Logical router policies' priorities are translated directly into logical flow priorities, and in turn OpenFlow priorities.
en-lflow installs a default logical flow at priority 0 that matches all traffic and sends the traffic to the next table. This means that a user could install a logical router policy with priority 0 that matches all traffic and drops it all. This creates ambiguity since we have flows at the same priority that say to either allow or drop all traffic. This commit changes the minimum priority for logical router policies from 0 to 1. This way, all user-defined router policies are guaranteed to be at a higher priority than the default allow that en-lflow installs at priority 0. Signed-off-by: Mark Michelson <[email protected]> --- NEWS | 3 +++ ovn-nb.ovsschema | 4 ++-- tests/ovn-nbctl.at | 18 ++++++++++++++++++ utilities/ovn-nbctl.c | 6 ++++++ 4 files changed, 29 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index f48fdd68d..3724e0b15 100644 --- a/NEWS +++ b/NEWS @@ -1,5 +1,8 @@ Post v26.09.0 -------------- + - Logical_Router_Policy priorities now have a minimum value of 1 instead of + 0. This is to prevent a potentially ambiguity with default flows + installed by OVN. - ovn-nbctl lr-policy-del will now return non-zero and emit an error message if a priority, match, or chain is provided as the input, but no router policies are actually deleted. This message is suppressed diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema index a29245115..484301c43 100644 --- a/ovn-nb.ovsschema +++ b/ovn-nb.ovsschema @@ -1,7 +1,7 @@ { "name": "OVN_Northbound", "version": "7.19.0", - "cksum": "2631744256 45474", + "cksum": "4103471446 45474", "tables": { "NB_Global": { "columns": { @@ -644,7 +644,7 @@ "Logical_Router_Policy": { "columns": { "priority": {"type": {"key": {"type": "integer", - "minInteger": 0, + "minInteger": 1, "maxInteger": 32767}}}, "chain": {"type": {"key": "string", "min": 0, "max": 1}}, "match": {"type": "string"}, diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at index 3741d2126..89cfe4c03 100644 --- a/tests/ovn-nbctl.at +++ b/tests/ovn-nbctl.at @@ -3801,3 +3801,21 @@ check ovn-nbctl --if-exists lr-policy-del lr0 10 check ovn-nbctl lr-policy-del lr0 100 check ovn-nbctl lr-policy-del lr0 200 ]) + +OVN_NBCTL_TEST([route_policy_addition_zero_priority], [Router policy addition: 0-priority], [ +check ovn-nbctl lr-add lr0 + +# We should be barred from adding a policy with priority 0. +AT_CHECK([ovn-nbctl lr-policy-add lr0 0 "1" drop], [1], [], +[ovn-nbctl: Priority 0 is not allowed for logical router policies +]) + +# Add a legitimate policy. +check ovn-nbctl lr-policy-add lr0 100 "1" allow +# Deleting a policy using priority 0 should succeed, essentially treating +# priority 0 as "unspecified" +check ovn-nbctl lr-policy-del lr0 0 "1" + +# Make sure that it was actually deleted. +wait_row_count nb:Logical_Router_Policy 0 +]) diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c index 2f78b47ca..77fdbbba5 100644 --- a/utilities/ovn-nbctl.c +++ b/utilities/ovn-nbctl.c @@ -4663,6 +4663,12 @@ nbctl_lr_policy_add(struct ctl_context *ctx) ctx->error = error; return; } + + if (priority == 0) { + ctl_error(ctx, "Priority 0 is not allowed for logical router " + "policies"); + return; + } const char *action = ctx->argv[4]; struct vector nexthops = VECTOR_EMPTY_INITIALIZER(char *); const struct nbrec_bfd **bfd_sessions = NULL; -- 2.55.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
