Thanks, Ales and Alin for the review and testing!
I can squash the following unit/system test update into the patch
when applying it if you guys agree. I'll wait for your confirmation
though.
Regards,
Dumitru
diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
index a5622e3fbe..d9682f78e4 100644
--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
@@ -5484,7 +5484,7 @@ AT_CLEANUP
])
OVN_FOR_EACH_NORTHD_NO_HV([
-AT_SETUP([LS load balancer logical flows])
+AT_SETUP([LS/LR load balancer logical flows])
ovn_start
lbg=$(ovn-nbctl create load_balancer_group name=lbg)
@@ -5494,15 +5494,16 @@ check ovn-nbctl \
lbg0=$(fetch_column nb:load_balancer _uuid name=lbg0)
check ovn-nbctl \
+ -- lr-add lr0 -- set logical_router lr0 options:chassis=hv1 \
+ -- lrp-add lr0 lr0-sw0 00:00:00:00:ff:01 10.0.0.1/24 \
-- ls-add sw0 \
+ -- lsp-add-router-port sw0 sw0-lr0 lr0-sw0 \
-- add logical_switch sw0 load_balancer_group $lbg \
-- ls-lb-add sw0 lb0 \
+ -- add logical_router lr0 load_balancer_group $lbg \
+ -- lr-lb-add lr0 lb0 \
-- add load_balancer_group $lbg load_balancer $lbg0
-check ovn-nbctl lr-add lr0
-check ovn-nbctl lrp-add lr0 lr0-sw0 00:00:00:00:ff:01 10.0.0.1/24
-check ovn-nbctl lsp-add-router-port sw0 sw0-lr0 lr0-sw0
-
check ovn-nbctl --wait=sb sync
check_stateful_flows() {
@@ -5530,6 +5531,14 @@ check_stateful_flows() {
table=??(ls_in_pre_stateful ), priority=120 , match=(reg0[[2]] == 1 &&
ip4.dst == 10.0.0.20 && tcp.dst == 80), action=(reg4 = 10.0.0.20; reg2[[0..15]]
= 80; ct_lb_mark;)
])
+ AT_CHECK([grep "ls_in_ct_extract" sw0flows | ovn_strip_lflows], [0], [dnl
+ table=??(ls_in_ct_extract ), priority=0 , match=(1), action=(next;)
+ table=??(ls_in_ct_extract ), priority=100 , match=(ct.new && ip &&
ip.is_frag), action=(reg1[[16..23]] = ct_proto(); reg1[[0..15]] = ct_tp_dst();
next;)
+ table=??(ls_in_ct_extract ), priority=100 , match=(ct.new && ip && sctp
&& !ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = sctp.dst;
next;)
+ table=??(ls_in_ct_extract ), priority=100 , match=(ct.new && ip && tcp &&
!ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = tcp.dst; next;)
+ table=??(ls_in_ct_extract ), priority=100 , match=(ct.new && ip && udp &&
!ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = udp.dst; next;)
+])
+
AT_CHECK([grep "ls_in_lb " sw0flows | ovn_strip_lflows], [0], [dnl
table=??(ls_in_lb ), priority=0 , match=(1), action=(next;)
table=??(ls_in_lb ), priority=110 , match=(ct.trk && ct.est &&
!ct.rpl && reg0[[19]] == 1 && ip4), action=(reg4 = ct_nw_dst(); reg2[[0..15]] =
ct_tp_dst(); next;)
@@ -5571,6 +5580,30 @@ check_stateful_flows() {
table=??(ls_out_stateful ), priority=110 , match=(reg0[[1]] == 1 &&
reg0[[13]] == 0 && reg8[[21]] == 1), action=(ct_commit { ct_mark.blocked = 0;
ct_mark.allow_established = reg0[[20]]; ct_label.acl_id = reg2[[16..31]];
ct_label.nf = 1; ct_label.nf_id = reg0[[22..29]]; }; next;)
table=??(ls_out_stateful ), priority=110 , match=(reg0[[1]] == 1 &&
reg0[[13]] == 1 && reg8[[21]] == 1), action=(ct_commit { ct_mark.blocked = 0;
ct_mark.allow_established = reg0[[20]]; ct_mark.obs_stage = reg8[[19..20]];
ct_mark.obs_collector_id = reg8[[8..15]]; ct_label.obs_point_id = reg9;
ct_label.acl_id = reg2[[16..31]]; ct_label.nf = 1; ct_label.nf_id =
reg0[[22..29]]; }; next;)
])
+
+ ovn-sbctl dump-flows lr0 > lr0flows
+ AT_CAPTURE_FILE([lr0flows])
+
+ AT_CHECK([grep "lr_in_ct_extract" lr0flows | ovn_strip_lflows], [0], [dnl
+ table=??(lr_in_ct_extract ), priority=0 , match=(1), action=(next;)
+ table=??(lr_in_ct_extract ), priority=100 , match=(ct.new && ip &&
ip.is_frag), action=(reg1[[16..23]] = ct_proto(); reg1[[0..15]] = ct_tp_dst();
next;)
+ table=??(lr_in_ct_extract ), priority=100 , match=(ct.new && ip && sctp
&& !ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = sctp.dst;
next;)
+ table=??(lr_in_ct_extract ), priority=100 , match=(ct.new && ip && tcp &&
!ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = tcp.dst; next;)
+ table=??(lr_in_ct_extract ), priority=100 , match=(ct.new && ip && udp &&
!ip.is_frag), action=(reg1[[16..23]] = ip.proto; reg1[[0..15]] = udp.dst; next;)
+])
+
+ AT_CHECK([grep "lr_in_dnat" lr0flows | ovn_strip_lflows], [0], [dnl
+ table=??(lr_in_dnat ), priority=0 , match=(1), action=(next;)
+ table=??(lr_in_dnat ), priority=120 , match=(ct.new && !ct.rel &&
ip4 && ip4.dst == 10.0.0.10 && reg1[[16..23]] == 6 && reg1[[0..15]] == 80),
action=(ct_lb_mark(backends=10.0.0.4:8080);)
+ table=??(lr_in_dnat ), priority=120 , match=(ct.new && !ct.rel &&
ip4 && ip4.dst == 10.0.0.20 && reg1[[16..23]] == 6 && reg1[[0..15]] == 80),
action=(ct_lb_mark(backends=10.0.0.40:8080);)
+ table=??(lr_in_dnat ), priority=50 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted), action=(next;)
+ table=??(lr_in_dnat ), priority=50 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl), action=(ct_commit_nat;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted && ct_mark.force_snat == 1),
action=(flags.force_snat_for_lb = 1; next;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted && ct_mark.skip_snat == 1),
action=(flags.skip_snat_for_lb = 1; next;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl && ct_mark.force_snat == 1), action=(flags.force_snat_for_lb
= 1; ct_commit_nat;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl && ct_mark.skip_snat == 1), action=(flags.skip_snat_for_lb =
1; ct_commit_nat;)
+])
+
}
check_stateful_flows "flags.pkt_sampled = 0; ct_clear; next;"
@@ -5641,6 +5674,22 @@ AT_CHECK([grep "ls_out_stateful" sw0flows |
ovn_strip_lflows], [0], [dnl
table=??(ls_out_stateful ), priority=110 , match=(reg0[[1]] == 1 &&
reg0[[13]] == 1 && reg8[[21]] == 1), action=(ct_commit { ct_mark.blocked = 0;
ct_mark.allow_established = reg0[[20]]; ct_mark.obs_stage = reg8[[19..20]];
ct_mark.obs_collector_id = reg8[[8..15]]; ct_label.obs_point_id = reg9;
ct_label.acl_id = reg2[[16..31]]; ct_label.nf = 1; ct_label.nf_id =
reg0[[22..29]]; }; next;)
])
+# Remove load balancers from lr0
+check ovn-nbctl lr-lb-del lr0 lb0
+check ovn-nbctl clear logical_router lr0 load_balancer_group
+check ovn-nbctl --wait=sb sync
+
+ovn-sbctl dump-flows lr0 > lr0flows
+AT_CAPTURE_FILE([lr0flows])
+
+AT_CHECK([grep "lr_in_ct_extract" lr0flows | ovn_strip_lflows], [0], [dnl
+ table=??(lr_in_ct_extract ), priority=0 , match=(1), action=(next;)
+])
+
+AT_CHECK([grep "lr_in_dnat" lr0flows | ovn_strip_lflows], [0], [dnl
+ table=??(lr_in_dnat ), priority=0 , match=(1), action=(next;)
+])
+
# LB with event=false and reject=false
AT_CHECK([ovn-nbctl create load_balancer name=lb1 options:reject=false
options:event=false vips:\"10.0.0.20\"=\"\" protocol=tcp], [0], [ignore])
check ovn-nbctl --wait=sb ls-lb-add sw0 lb1
@@ -5652,6 +5701,18 @@ AT_CHECK([ovn-sbctl dump-flows sw0 | grep "ls_in_lb " |
ovn_strip_lflows ], [0],
table=??(ls_in_lb ), priority=110 , match=(ct.trk && ct.est &&
!ct.rpl && reg0[[19]] == 1 && ip6), action=(xxreg1 = ct_ip6_dst();
reg2[[0..15]] = ct_tp_dst(); next;)
])
+check ovn-nbctl --wait=sb lr-lb-add lr0 lb1
+AT_CHECK([ovn-sbctl dump-flows lr0 | grep "lr_in_dnat " | ovn_strip_lflows ],
[0], [dnl
+ table=??(lr_in_dnat ), priority=0 , match=(1), action=(next;)
+ table=??(lr_in_dnat ), priority=110 , match=(ct.new && !ct.rel &&
ip4 && ip4.dst == 10.0.0.20), action=(drop;)
+ table=??(lr_in_dnat ), priority=50 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted), action=(next;)
+ table=??(lr_in_dnat ), priority=50 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl), action=(ct_commit_nat;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted && ct_mark.force_snat == 1),
action=(flags.force_snat_for_lb = 1; next;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.est && !ct.rel &&
!ct.new && !ct.rpl && ct_mark.natted && ct_mark.skip_snat == 1),
action=(flags.skip_snat_for_lb = 1; next;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl && ct_mark.force_snat == 1), action=(flags.force_snat_for_lb
= 1; ct_commit_nat;)
+ table=??(lr_in_dnat ), priority=70 , match=(ct.rel && !ct.est &&
!ct.new && !ct.rpl && ct_mark.skip_snat == 1), action=(flags.skip_snat_for_lb =
1; ct_commit_nat;)
+])
+
OVN_CLEANUP_NORTHD
AT_CLEANUP
])
diff --git a/tests/system-ovn.at b/tests/system-ovn.at
index cd2c11cad8..3cb4b858a8 100644
--- a/tests/system-ovn.at
+++ b/tests/system-ovn.at
@@ -24034,15 +24034,17 @@ start_daemon ovn-controller
check ovn-nbctl \
-- lr-add lr0 \
-- lrp-add lr0 lrp aa:bb:cc:dd:ee:03 10.0.0.3/24 \
+ -- set logical_router lr0 options:chassis=hv1 \
-- ls-add ls0 \
-- lsp-add ls0 lsp0 \
-- lsp-set-addresses lsp0 "aa:bb:cc:dd:ee:01 10.0.0.1" \
-- lsp-add ls0 lsp1 \
-- lsp-set-addresses lsp1 "aa:bb:cc:dd:ee:02 10.0.0.2" \
- -- lsp-add-router-port ls0 ls0-lr0 lrp
-
-check ovn-nbctl lb-add lb0 10.0.1.100:5000 10.0.0.2:6000 udp
-check ovn-nbctl ls-lb-add ls0 lb0
+ -- lsp-add-router-port ls0 ls0-lr0 lrp \
+ -- lb-add lb0 10.0.1.100:5000 10.0.0.2:6000 udp \
+ -- ls-lb-add ls0 lb0 \
+ -- lb-add lb1 10.0.1.101:5001 10.0.0.2:6001 udp \
+ -- lr-lb-add lr0 lb1
ADD_NAMESPACES(lsp0, lsp1)
ADD_VETH(lsp0, lsp0, br-int, "10.0.0.1/24", "aa:bb:cc:dd:ee:01", "10.0.0.3")
@@ -24079,13 +24081,22 @@ AT_CHECK([grep 'dst=4791' dpflows | grep -q
'ct_tuple4'], [1])
dnl --- UDP to VIP is DNAT'd correctly ---
dnl
-NETNS_DAEMONIZE([lsp1], [ncat -u -l 10.0.0.2 6000], [lsp1_udp.pid])
-NETNS_START_TCPDUMP([lsp1], [-nn -c 1 -i lsp1 'udp and dst port 6000 and dst
host 10.0.0.2'], [lb-dnat])
+NETNS_DAEMONIZE([lsp1], [ncat -u -l 10.0.0.2 6000], [lsp1_udp1.pid])
+NETNS_START_TCPDUMP([lsp1], [-nn -c 1 -i lsp1 'udp and dst port 6000 and dst
host 10.0.0.2'], [lb-dnat1])
+NETNS_DAEMONIZE([lsp1], [ncat -u -l 10.0.0.2 6001], [lsp1_udp2.pid])
+NETNS_START_TCPDUMP([lsp1], [-nn -c 1 -i lsp1 'udp and dst port 6001 and dst
host 10.0.0.2'], [lb-dnat2])
NS_CHECK_EXEC([lsp0], [echo test | ncat -u 10.0.1.100 5000], [ignore],
[ignore], [ignore])
OVS_WAIT_UNTIL([
- total_pkts=$(cat lb-dnat.tcpdump | wc -l)
+ total_pkts=$(cat lb-dnat1.tcpdump | wc -l)
+ test "${total_pkts}" -ge 1
+])
+
+NS_CHECK_EXEC([lsp0], [echo test | ncat -u 10.0.1.101 5001], [ignore],
[ignore], [ignore])
+
+OVS_WAIT_UNTIL([
+ total_pkts=$(cat lb-dnat2.tcpdump | wc -l)
test "${total_pkts}" -ge 1
])
On 10/15/26 1:23 PM, Alin Serdean wrote:
> Forgot to mention that I tested this and it looks good from the
> offloading perspective, there are a still issues but those are on our end.
>
> Just one small nit instead of testing this just from a logical switch
> perspective,
> maybe it’s worth to also add a test from the router lflow point of view.
>
> Acked-by: Alin Serdean <[email protected]>
>
> *From: *Ales Musil <[email protected]>
> *Date: *Thursday, 15 October 2026 at 13:14
> *To: *Dumitru Ceara <[email protected]>
> *Cc: *[email protected] <[email protected]>; [email protected]
> <[email protected]>; Tim Rozet <[email protected]>; [email protected]
> <[email protected]>; Alin Serdean <[email protected]>
> *Subject: *Re: [PATCH ovn] northd: Avoid ct_tuple matches for non-fragments.
>
> *External email: Use caution opening links or attachments*
>
>
>
>
> On Tue, Oct 13, 2026 at 12:15 PM Dumitru Ceara <[email protected]
> <mailto:[email protected]>> wrote:
>
> Megaflows matching on these are not offloadable on specific hardware
> NICs. These were originally introduced by 20a96b9d2c3d ("northd: Allow
> fragmented traffic through LB.") in order to address the fact that with
> the userspace datapath fragmented IP packets miss L4 headers in later
> fragments, breaking load balancing. A follow up commit, 8e6f9a8355e2
> ("northd: Fix HW offload problem related to ct_tuple."), tried to
> address the offload issue but missed to add a check to only send the
> first packet of a session (ct_state=+new) to the CT EXTRACT side table
> if and only if it is a fragmented IP packet.
>
> That means that ct_tuple matches would always be present for
> megaflows forwarding unidirectional UDP traffic, even if the IP packets
> are not fragmented. Some hardware NICs may be capable of offloading
> such traffic (see the first Reported-at link) but only if their
> megaflows don't match on ct_tuple fields.
>
> A previous patch attempted to fix a similar issue by limiting switch
> conntrack tuple fields extraction only to traffic destined to load
> balancers that are configured with L4 ports. That approach has some
> downsides and requires an additional logical flow for each load balancer
> VIP.
>
> This patch attempts fixing the issue in a different, a bit more generic
> way: it turns out we don't need to send all ct_state=+new traffic to
> the CT EXTRACT table, we should instead do that only for fragments.
>
> Reported-at: https://mail.openvswitch.org/pipermail/ovs-
> discuss/2026-October/054041.html <https://mail.openvswitch.org/
> pipermail/ovs-discuss/2026-October/054041.html>
> Reported-at: https://patchwork.ozlabs.org/project/ovn/
> patch/[email protected]/ <https://
> patchwork.ozlabs.org/project/ovn/patch/20260814142432.2098055-1-
> [email protected]/>
> Reported-at: https://redhat.atlassian.net/browse/FDP-4458 <https://
> redhat.atlassian.net/browse/FDP-4458>
> Fixes: 20a96b9d2c3d ("northd: Allow fragmented traffic through LB.")
> Fixes: 8e6f9a8355e2 ("northd: Fix HW offload problem related to
> ct_tuple.")
> Assisted-by: Claude Opus 4.6, OpenCode
> Signed-off-by: Dumitru Ceara <[email protected]
> <mailto:[email protected]>>
> ---
> northd/northd.c | 34 ++++++++++++++++-
> tests/ovn-northd.at <http://ovn-northd.at/> | 62 ++++++++++++++++++
> +++++++++---
> tests/system-ovn.at <http://system-ovn.at/> | 92 ++++++++++++++++++
> +++++++++++++++++++++++++++
> 3 files changed, 180 insertions(+), 8 deletions(-)
>
> diff --git a/northd/northd.c b/northd/northd.c
> index 7c4cb5a62f..84e830428c 100644
> --- a/northd/northd.c
> +++ b/northd/northd.c
> @@ -18413,10 +18413,25 @@ build_lrouter_in_ct_extract_flows(struct
> lflow_table *lflows,
> /* Ingress CT_EXTRACT table: Extract connection tracking fields
> for new
> * connections. */
> ovn_lflow_add(lflows, od, S_ROUTER_IN_CT_EXTRACT, 100,
> - "ct.new <http://ct.new/> && ip",
> + "ct.new <http://ct.new/> && ip && ip.is_frag",
> REG_CT_PROTO " = ct_proto(); "
> REG_CT_TP_DST " = ct_tp_dst(); next;",
> lflow_ref);
> + ovn_lflow_add(lflows, od, S_ROUTER_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && tcp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = tcp.dst; next;",
> + lflow_ref);
> + ovn_lflow_add(lflows, od, S_ROUTER_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && udp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = udp.dst; next;",
> + lflow_ref);
> + ovn_lflow_add(lflows, od, S_ROUTER_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && sctp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = sctp.dst; next;",
> + lflow_ref);
> }
>
> static void
> @@ -19699,10 +19714,25 @@ build_ls_stateful_flows(const struct
> ls_stateful_record *ls_stateful_rec,
> * balancers. */
> if (ls_stateful_rec->has_lb_vip) {
> ovn_lflow_add(lflows, od, S_SWITCH_IN_CT_EXTRACT, 100,
> - "ct.new <http://ct.new/> && ip",
> + "ct.new <http://ct.new/> && ip && ip.is_frag",
> REG_CT_PROTO " = ct_proto(); "
> REG_CT_TP_DST " = ct_tp_dst(); next;",
> ls_stateful_rec->lflow_ref);
> + ovn_lflow_add(lflows, od, S_SWITCH_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && tcp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = tcp.dst; next;",
> + ls_stateful_rec->lflow_ref);
> + ovn_lflow_add(lflows, od, S_SWITCH_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && udp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = udp.dst; next;",
> + ls_stateful_rec->lflow_ref);
> + ovn_lflow_add(lflows, od, S_SWITCH_IN_CT_EXTRACT, 100,
> + "ct.new <http://ct.new/> && ip && sctp && !
> ip.is_frag",
> + REG_CT_PROTO " = ip.proto; "
> + REG_CT_TP_DST " = sctp.dst; next;",
> + ls_stateful_rec->lflow_ref);
> }
>
> build_lb_hairpin(ls_stateful_rec, od, lflows, ls_stateful_rec-
> >lflow_ref);
> diff --git a/tests/ovn-northd.at <http://ovn-northd.at/> b/tests/
> ovn-northd.at <http://ovn-northd.at/>
> index 7a0a400c4a..a5622e3fbe 100644
> --- a/tests/ovn-northd.at <http://ovn-northd.at/>
> +++ b/tests/ovn-northd.at <http://ovn-northd.at/>
> @@ -4335,8 +4335,6 @@ flow="inport == \"lsp1\" && ${flow_eth} &&
> ${flow_ip} && ${flow_tcp}"
> ovn_trace --ct new --ct new ls "${flow}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> - reg1[[16..23]] = 6;
> - reg1[[0..15]] = 80;
> ct_lb_mark {
> reg0[[6]] = 0;
> reg0[[12]] = 0;
> @@ -4350,6 +4348,20 @@ ct_lb_mark {
> # UDP packets should go to conntrack.
> flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} && ${flow_udp}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> +ct_lb_mark {
> + ct_lb_mark {
> + reg0[[6]] = 0;
> + reg0[[12]] = 0;
> + ct_lb_mark /* default (use --ct to customize) */ {
> + output("lsp2");
> + };
> + };
> +};
> +])
> +
> +# Fragmented UDP packets should go to conntrack.
> +flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} &&
> ${flow_udp} && ip.is_frag"
> +AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> reg1[[16..23]] = 17;
> reg1[[0..15]] = 80;
> @@ -4378,6 +4390,20 @@ output("lsp2");
> # UDP packets still go to conntrack.
> flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} && ${flow_udp}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> +ct_lb_mark {
> + ct_lb_mark {
> + reg0[[6]] = 0;
> + reg0[[12]] = 0;
> + ct_lb_mark /* default (use --ct to customize) */ {
> + output("lsp2");
> + };
> + };
> +};
> +])
> +
> +# Fragmented UDP packets still go to conntrack.
> +flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} &&
> ${flow_udp} && ip.is_frag"
> +AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> reg1[[16..23]] = 17;
> reg1[[0..15]] = 80;
> @@ -4478,8 +4504,6 @@ check ovn-nbctl --wait=sb sync
> flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} && ${flow_tcp}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> - reg1[[16..23]] = 6;
> - reg1[[0..15]] = 80;
> ct_lb_mark {
> reg0[[6]] = 0;
> reg0[[12]] = 0;
> @@ -4493,6 +4517,20 @@ ct_lb_mark {
> # UDP packets should go to conntrack.
> flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} && ${flow_udp}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> +ct_lb_mark {
> + ct_lb_mark {
> + reg0[[6]] = 0;
> + reg0[[12]] = 0;
> + ct_lb_mark /* default (use --ct to customize) */ {
> + output("lsp2");
> + };
> + };
> +};
> +])
> +
> +# Fragmented UDP packets should go to conntrack.
> +flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} &&
> ${flow_udp} && ip.is_frag"
> +AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> reg1[[16..23]] = 17;
> reg1[[0..15]] = 80;
> @@ -4521,6 +4559,20 @@ output("lsp2");
> # UDP packets still go to conntrack.
> flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} && ${flow_udp}"
> AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> +ct_lb_mark {
> + ct_lb_mark {
> + reg0[[6]] = 0;
> + reg0[[12]] = 0;
> + ct_lb_mark /* default (use --ct to customize) */ {
> + output("lsp2");
> + };
> + };
> +};
> +])
> +
> +# Fragmented UDP packets still go to conntrack.
> +flow="inport == \"lsp1\" && ${flow_eth} && ${flow_ip} &&
> ${flow_udp} && ip.is_frag"
> +AT_CHECK_UNQUOTED([ovn_trace --ct new --ct new --minimal ls
> "${flow}"], [0], [dnl
> ct_lb_mark {
> reg1[[16..23]] = 17;
> reg1[[0..15]] = 80;
> @@ -8580,8 +8632,6 @@ flow="eth.dst == 00:00:00:00:01:00 && inport
> == \"rtr-ls\" && ip4.src == 42.42.4
> ovn_trace --ct new "${flow}" --lb-dst 42.42.42.42:4242
> <http://42.42.42.42:4242/>
> AT_CHECK_UNQUOTED([ovn_trace --ct new --minimal "${flow}" --lb-dst
> 42.42.42.42:4242 <http://42.42.42.42:4242/>], [0], [dnl
> ct_dnat /* assuming no un-dnat entry, so no change */ {
> - reg1[[16..23]] = 6;
> - reg1[[0..15]] = 4343;
> ct_lb_mark /* default (use --ct to customize) */ {
> ip.ttl--;
> eth.src = 00:00:00:00:01:00;
> diff --git a/tests/system-ovn.at <http://system-ovn.at/> b/tests/
> system-ovn.at <http://system-ovn.at/>
> index 13e62bf9ba..3239d709b4 100644
> --- a/tests/system-ovn.at <http://system-ovn.at/>
> +++ b/tests/system-ovn.at <http://system-ovn.at/>
> @@ -23978,3 +23978,95 @@ OVS_TRAFFIC_VSWITCHD_STOP(["/failed to
> query port patch-.*/d
>
> AT_CLEANUP
> ])
> +
> +OVN_FOR_EACH_NORTHD([
> +AT_SETUP([CT extraction limited to LB VIPs])
> +AT_KEYWORDS([ovnlb ct_extract])
> +AT_SKIP_IF([test $HAVE_NCAT = no])
> +AT_SKIP_IF([test $HAVE_TCPDUMP = no])
> +
> +dnl Test that the CT_EXTRACT pipeline stage currently matches doesn't
> +dnl generate ct_tuple4 megaflow matches for non fragments.
> +
> +ovn_start
> +
> +OVS_TRAFFIC_VSWITCHD_START()
> +ADD_BR([br-int])
> +
> +check ovs-vsctl
> \
> + -- set Open_vSwitch . external-ids:system-id=hv1
> \
> + -- set Open_vSwitch . external-ids:ovn-remote=unix:
> $ovs_base/ovn-sb/ovn-sb.sock \
> + -- set Open_vSwitch . external-ids:ovn-encap-type=geneve
> \
> + -- set Open_vSwitch . external-ids:ovn-encap-ip=169.0.0.1
> \
> + -- set bridge br-int fail-mode=secure other-config:disable-
> in-band=true
> +
> +start_daemon ovn-controller
> +
> +check ovn-nbctl \
> + -- lr-add lr0 \
> + -- lrp-add lr0 lrp aa:bb:cc:dd:ee:03 10.0.0.3/24
> <http://10.0.0.3/24> \
> + -- ls-add ls0 \
> + -- lsp-add ls0 lsp0 \
> + -- lsp-set-addresses lsp0 "aa:bb:cc:dd:ee:01 10.0.0.1" \
> + -- lsp-add ls0 lsp1 \
> + -- lsp-set-addresses lsp1 "aa:bb:cc:dd:ee:02 10.0.0.2" \
> + -- lsp-add-router-port ls0 ls0-lr0 lrp
> +
> +check ovn-nbctl lb-add lb0 10.0.1.100:5000 <http://10.0.1.100:5000/
> > 10.0.0.2:6000 <http://10.0.0.2:6000/> udp
> +check ovn-nbctl ls-lb-add ls0 lb0
> +
> +ADD_NAMESPACES(lsp0, lsp1)
> +ADD_VETH(lsp0, lsp0, br-int, "10.0.0.1/24 <http://10.0.0.1/24>",
> "aa:bb:cc:dd:ee:01", "10.0.0.3")
> +ADD_VETH(lsp1, lsp1, br-int, "10.0.0.2/24 <http://10.0.0.2/24>",
> "aa:bb:cc:dd:ee:02", "10.0.0.3")
> +
> +wait_for_ports_up lsp0 lsp1
> +check ovn-nbctl --wait=hv sync
> +
> +dnl Verify basic connectivity before testing megaflows.
> +NS_CHECK_EXEC([lsp0], [ping -q -c 3 -i 0.3 -w 2 10.0.0.2 |
> FORMAT_PING], \
> +[0], [dnl
> +3 packets transmitted, 3 received, 0% packet loss, time 0ms
> +])
> +
> +check ovs-appctl revalidator/pause
> +on_exit 'ovs-appctl revalidator/resume'
> +
> +dnl --- Unfragmented unidirectional UDP to non-VIP must not have
> ct_tuple4 ---
> +dnl
> +dnl Start a UDP listener on lsp1 to absorb traffic. Start a continuous
> +dnl unidirectional UDP sender on lsp0 to port 4791 (a non-VIP port).
> +dnl The listener does not send replies, so every packet stays
> ct.new <http://ct.new/>.
> +dnl There should be no ct_tuple4 matches in the megaflows for this
> traffic.
> +NETNS_DAEMONIZE([lsp1], [ncat -u -l 4791 > /dev/null], [udp-
> listener.pid])
> +NETNS_DAEMONIZE([lsp0], [bash -c 'while true; do echo test; sleep
> 0.2; done | ncat -u 10.0.0.2 4791'], [udp-sender.pid])
> +
> +dnl Wait until the datapath has a cached flow for the UDP traffic
> we sent.
> +OVS_WAIT_UNTIL([ovs-appctl dpctl/dump-flows | grep -q 'dst=4791'])
> +
> +ovs-appctl dpctl/dump-flows > dpflows
> +AT_CAPTURE_FILE([dpflows])
> +
> +AT_CHECK([grep 'dst=4791' dpflows | grep -q 'ct_tuple4'], [1])
> +
> +dnl --- UDP to VIP is DNAT'd correctly ---
> +dnl
> +NETNS_DAEMONIZE([lsp1], [ncat -u -l 10.0.0.2 6000], [lsp1_udp.pid])
> +NETNS_START_TCPDUMP([lsp1], [-nn -c 1 -i lsp1 'udp and dst port
> 6000 and dst host 10.0.0.2'], [lb-dnat])
> +
> +NS_CHECK_EXEC([lsp0], [echo test | ncat -u 10.0.1.100 5000],
> [ignore], [ignore], [ignore])
> +
> +OVS_WAIT_UNTIL([
> + total_pkts=$(cat lb-dnat.tcpdump | wc -l)
> + test "${total_pkts}" -ge 1
> +])
> +
> +check ovs-appctl revalidator/resume
> +
> +OVN_CLEANUP_CONTROLLER([hv1])
> +OVN_CLEANUP_NORTHD
> +
> +as
> +OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d
> +/connection dropped.*/d"])
> +AT_CLEANUP
> +])
> --
> 2.55.0
>
>
> Looks good to me, thanks.
> Acked-by: Ales Musil <[email protected] <mailto:[email protected]>>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
