On a logical switch with stateful ACLs, a sampled from-lport drop ACL can drop packets arriving from a router port without sampling them. These packets are untracked, while the generated sampling flow requires ct.new. Denied established packets can also be missed or attributed to the ACL that previously allowed the connection.
Patch 1 clears observation data written by a pass ACL in the current stage when advancing to the next tier. This prevents an unsampled ACL in the next tier from inheriting that data, while preserving observation data from other stages. Patch 2 samples drop/reject verdicts using the denying ACL's sample_new regardless of conntrack state. It relies on patch 1 to avoid using stale pass ACL data. Denied established packets are reported with the denying ACL's observation point in the acl-new domain. Full make check passed with patch 1 alone and with both patches. Both monitor_all variants of the new deny system test passed twice on Linux arm64 with the userspace datapath. Both failed at the denied established-traffic check with unpatched northd (7d16edb88). The eight selected ACL sampling system tests passed on rerun. Kernel datapath tests and the full system test suite were not run. Best regards, Chanyeol Yoon KT Cloud Chanyeol Yoon (2): northd: Clear pass ACL observation data on tier advance. northd: Sample all traffic denied by stateful ACLs. NEWS | 8 ++ northd/northd.c | 83 +++++++++++++++ ovn-nb.xml | 28 +++++- tests/ovn-northd.at | 238 ++++++++++++++++++++++++++++++++++++++++++++ tests/system-ovn.at | 222 +++++++++++++++++++++++++++++++++++++++++ 5 files changed, 578 insertions(+), 1 deletion(-) -- 2.55.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
