Re: [ovs-dev] [PATCH ovn v2 2/2] northd: Allow related traffic through LB

Mark Michelson Tue, 15 Nov 2022 08:32:16 -0800

Hi Ales, be sure to address the checkpatch errors that 0-day robot reported.


Other than that, I have just a couple of comments down below.

On 11/4/22 04:18, Ales Musil wrote:

In order to allow realted traffic use the


s/realted/related/

new action ct_commit_nat, which ensures that
the traffic is commited and NATted. In combination
with match on ct.rel it allows the related traffic
to go through with correct NAT being applied.

Reported-at: https://bugzilla.redhat.com/2126083
Signed-off-by: Ales Musil <[email protected]>
---
v2: Add e2e test case.
---
  northd/northd.c         |  29 ++++--
  northd/ovn-northd.8.xml |  19 +++-
  tests/ovn-northd.at     | 208 +++++++++++++++++++++-------------------
  tests/ovn.at            |  10 +-
  tests/system-ovn.at     | 128 +++++++++++++++++++++++++
  5 files changed, 279 insertions(+), 115 deletions(-)

diff --git a/northd/northd.c b/northd/northd.c
index b7388afc5..e188e4f6a 100644
--- a/northd/northd.c
+++ b/northd/northd.c
@@ -6686,7 +6686,8 @@ build_acls(struct ovn_datapath *od, const struct 
chassis_features *features,
          /* Ingress and Egress ACL Table (Priority 65535).
           *
           * Allow traffic that is related to an existing conntrack entry that
-         * has not been marked for deletion (ct_mark.blocked).
+         * has not been marked for deletion (ct_mark.blocked). At the same
+         * time apply NAT on this traffic.
           *
           * This is enforced at a higher priority than ACLs can be defined.
           *
@@ -6699,9 +6700,9 @@ build_acls(struct ovn_datapath *od, const struct 
chassis_features *features,
                        use_ct_inv_match ? " && !ct.inv" : "",
                        ct_blocked_match);
          ovn_lflow_add(lflows, od, S_SWITCH_IN_ACL, UINT16_MAX - 3,
-                      ds_cstr(&match), "next;");
+                      ds_cstr(&match), "ct_commit_nat;");
          ovn_lflow_add(lflows, od, S_SWITCH_OUT_ACL, UINT16_MAX - 3,
-                      ds_cstr(&match), "next;");
+                      ds_cstr(&match), "ct_commit_nat;");

/* Ingress and Egress ACL Table (Priority 65532).

           *
@@ -10006,16 +10007,16 @@ build_lrouter_nat_flows_for_lb(struct ovn_lb_vip 
*lb_vip,
      int prio = 110;
      if (lb_vip->vip_port) {
          prio = 120;
-        new_match = xasprintf("ct.new && %s && %s && "
+        new_match = xasprintf("ct.new && !ct.rel && %s && %s && "
                                REG_ORIG_TP_DPORT_ROUTER" == %d",
                                ds_cstr(match), lb->proto, lb_vip->vip_port);
-        est_match = xasprintf("ct.est && %s && %s && "
+        est_match = xasprintf("ct.est && !ct.rel && %s && %s && "
                                REG_ORIG_TP_DPORT_ROUTER" == %d && %s == 1",
                                ds_cstr(match), lb->proto, lb_vip->vip_port,
                                ct_natted);
      } else {
-        new_match = xasprintf("ct.new && %s", ds_cstr(match));
-        est_match = xasprintf("ct.est && %s && %s == 1",
+        new_match = xasprintf("ct.new && !ct.rel && %s", ds_cstr(match));
+        est_match = xasprintf("ct.est && !ct.rel && %s && %s == 1",
                            ds_cstr(match), ct_natted);
      }

@@ -13664,6 +13665,20 @@ build_lrouter_nat_defrag_and_lb(struct ovn_datapath *od, struct hmap *lflows,

      ovn_lflow_add(lflows, od, S_ROUTER_OUT_EGR_LOOP, 0, "1", "next;");
      ovn_lflow_add(lflows, od, S_ROUTER_IN_ECMP_STATEFUL, 0, "1", "next;");

+ /* Ingress DNAT Table (Priority 50).

+     *
+     * Allow traffic that is related to an existing conntrack entry.
+     * At the same time apply NAT for this traffic.
+     *
+     * NOTE: This does not support related data sessions (eg,
+     * a dynamically negotiated FTP data channel), but will allow
+     * related traffic such as an ICMP Port Unreachable through
+     * that's generated from a non-listening UDP port.  */
+    if (od->has_lb_vip) {
+        ovn_lflow_add(lflows, od, S_ROUTER_IN_DNAT, 50,
+                      "ct.rel && !ct.est && !ct.new", "ct_commit_nat;");
+    }
+
      /* If the router has load balancer or DNAT rules, re-circulate every 
packet
       * through the DNAT zone so that packets that need to be unDNATed in the
       * reverse direction get unDNATed.
diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml
index a70f2e678..175db6130 100644
--- a/northd/ovn-northd.8.xml
+++ b/northd/ovn-northd.8.xml
@@ -766,6 +766,8 @@
          related to a committed flow in the connection tracker (e.g., an
          ICMP Port Unreachable from a non-listening UDP port), as long
          as the committed flow does not have <code>ct_mark.blocked</code> set.
+        This flow also applies NAT to the related traffic so that ICMP headers
+        and the inner packet have correct addresses.
          If ACL logging and logging of related packets is enabled, then a
          companion priority-65533 flow will be installed that accomplishes the
          same thing but also logs the traffic.
@@ -3206,7 +3208,7 @@ icmp6 {
            Router with gateway port in <code>OVN_Northbound</code> database 
that
            includes a L4 port <var>PORT</var> of protocol <var>P</var> and IPv4
            or IPv6 address <var>VIP</var>, a priority-120 flow that matches on
-          <code>ct.new &amp;&amp; ip &amp;&amp; reg0 == <var>VIP</var>
+          <code>ct.new &amp;&amp; !ct.rel &amp;&amp; ip &amp;&amp; reg0 == 
<var>VIP</var>
            &amp;&amp; <var>P</var> &amp;&amp; reg9[16..31] == </code>
            <code><var>PORT</var></code> (<code>xxreg0 == <var>VIP</var></code>
            in the IPv6 case) with an action of
@@ -3238,7 +3240,7 @@ icmp6 {
            <code>OVN_Northbound</code> database that includes a L4 port
            <var>PORT</var> of protocol <var>P</var> and IPv4 or IPv6 address
            <var>VIP</var>, a priority-120 flow that matches on
-          <code>ct.est &amp;&amp; ip4 &amp;&amp; reg0 == <var>VIP</var>
+          <code>ct.est &amp;&amp; !ct.rel &amp;&amp; ip4 &amp;&amp; reg0 == 
<var>VIP</var>
            &amp;&amp; <var>P</var> &amp;&amp; reg9[16..31] == </code>
            <code><var>PORT</var></code> (<code>ip6</code> and
            <code>xxreg0 == <var>VIP</var></code> in the IPv6 case) with an
@@ -3263,7 +3265,7 @@ icmp6 {
            For all the configured load balancing rules for a router in
            <code>OVN_Northbound</code> database that includes just an IP 
address
            <var>VIP</var> to match on, a priority-110 flow that matches on
-          <code>ct.new &amp;&amp; ip4 &amp;&amp; reg0 ==
+          <code>ct.new &amp;&amp; !ct.rel &amp;&amp; ip4 &amp;&amp; reg0 ==
            <var>VIP</var></code> (<code>ip6</code> and <code>xxreg0 ==
            <var>VIP</var></code> in the IPv6 case) with an action of
            <code>ct_lb_mark(<var>args</var>)</code>, where <var>args</var> 
contains
@@ -3290,7 +3292,7 @@ icmp6 {
            For all the configured load balancing rules for a router in
            <code>OVN_Northbound</code> database that includes just an IP 
address
            <var>VIP</var> to match on, a priority-110 flow that matches on
-          <code>ct.est &amp;&amp; ip4 &amp;&amp; reg0 ==
+          <code>ct.est &amp;&amp; !ct.rel &amp;&amp; ip4 &amp;&amp; reg0 ==
            <var>VIP</var></code> (or <code>ip6</code> and
            <code>xxreg0 == <var>VIP</var></code>) with an action of
            <code>next;</code>. If the router is configured to force SNAT any
@@ -3317,6 +3319,15 @@ icmp6 {
          Please note using <code>--reject</code> option will disable
          empty_lb SB controller event for this load balancer.
        </li>
+
+      <li>
+        <p>
+            For the related traffic, a priority 50 flow that matches
+            <code>ct.rel &amp;&amp; !ct.est &amp;&amp; !ct.new </code>
+            with an action of <code>ct_commit_nat;</code>, if the router
+            has load balancer assigned to it.
+        </p>
+      </li>
      </ul>

<p>Ingress Table 6: DNAT on Gateway Routers</p>

diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
index 4f399eccb..654e55984 100644
--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
@@ -2348,7 +2348,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e 
ls_in_acl_hint -e ls_out_acl_hint -e
    table=3 (ls_out_acl_hint    ), priority=7    , match=(ct.new && !ct.est), 
action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)
    table=4 (ls_out_acl         ), priority=1    , match=(ip && !ct.est), 
action=(reg0[[1]] = 1; next;)
    table=4 (ls_out_acl         ), priority=1    , match=(ip && ct.est && 
ct_mark.blocked == 1), action=(reg0[[1]] = 1; next;)
-  table=4 (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=4 (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=4 (ls_out_acl         ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(next;)
    table=4 (ls_out_acl         ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=7 (ls_in_acl_hint     ), priority=1    , match=(ct.est && 
ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;)
@@ -2360,7 +2360,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e 
ls_in_acl_hint -e ls_out_acl_hint -e
    table=7 (ls_in_acl_hint     ), priority=7    , match=(ct.new && !ct.est), 
action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)
    table=8 (ls_in_acl          ), priority=1    , match=(ip && !ct.est), 
action=(reg0[[1]] = 1; next;)
    table=8 (ls_in_acl          ), priority=1    , match=(ip && ct.est && 
ct_mark.blocked == 1), action=(reg0[[1]] = 1; next;)
-  table=8 (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=8 (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=8 (ls_in_acl          ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; next;)
    table=8 (ls_in_acl          ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
  ])
@@ -2388,7 +2388,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e 
ls_in_acl_hint -e ls_out_acl_hint -e
    table=4 (ls_out_acl         ), priority=1001 , match=(reg0[[7]] == 1 && 
(ip)), action=(reg0[[1]] = 1; next;)
    table=4 (ls_out_acl         ), priority=1001 , match=(reg0[[8]] == 1 && 
(ip)), action=(next;)
    table=4 (ls_out_acl         ), priority=34000, match=(eth.src == 
$svc_monitor_mac), action=(next;)
-  table=4 (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=4 (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=4 (ls_out_acl         ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(next;)
    table=4 (ls_out_acl         ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=4 (ls_out_acl         ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
@@ -2406,7 +2406,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e 
ls_in_acl_hint -e ls_out_acl_hint -e
    table=8 (ls_in_acl          ), priority=1001 , match=(reg0[[7]] == 1 && 
(ip)), action=(reg0[[1]] = 1; next;)
    table=8 (ls_in_acl          ), priority=1001 , match=(reg0[[8]] == 1 && 
(ip)), action=(next;)
    table=8 (ls_in_acl          ), priority=34000, match=(eth.dst == 
$svc_monitor_mac), action=(next;)
-  table=8 (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=8 (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=8 (ls_in_acl          ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; next;)
    table=8 (ls_in_acl          ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=8 (ls_in_acl          ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
@@ -3660,10 +3660,11 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], 
[dnl

AT_CHECK([grep "lr_in_dnat" lr0flows | sort], [0], [dnl

    table=6 (lr_in_dnat         ), priority=0    , match=(1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.10 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.100 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80), action=(ct_lb_mark(backends=10.0.0.4:8080);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80), action=(ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.10 && tcp && reg9[[16..31]] == 80), action=(ct_lb_mark(backends=10.0.0.4:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.100 && tcp && reg9[[16..31]] == 80), action=(ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=50   , match=(ct.rel && !ct.est && 
!ct.new), action=(ct_commit_nat;)
  ])

AT_CHECK([grep "lr_out_undnat" lr0flows | sed 's/table=./table=?/' | sort], [0], [dnl

@@ -3696,10 +3697,11 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], 
[dnl

AT_CHECK([grep "lr_in_dnat" lr0flows | sort], [0], [dnl

    table=6 (lr_in_dnat         ), priority=0    , match=(1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.10 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.100 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.10 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.100 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=50   , match=(ct.rel && !ct.est && 
!ct.new), action=(ct_commit_nat;)
  ])

AT_CHECK([grep "lr_out_snat" lr0flows | sed 's/table=./table=?/' | sort], [0], [dnl

@@ -3742,10 +3744,11 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], 
[dnl

AT_CHECK([grep "lr_in_dnat" lr0flows | sort], [0], [dnl

    table=6 (lr_in_dnat         ), priority=0    , match=(1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.10 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.100 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.10 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.100 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=50   , match=(ct.rel && !ct.est && 
!ct.new), action=(ct_commit_nat;)
  ])

AT_CHECK([grep "lr_out_snat" lr0flows | sed 's/table=./table=?/' | sort], [0], [dnl

@@ -3802,10 +3805,11 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], 
[dnl

AT_CHECK([grep "lr_in_dnat" lr0flows | sort], [0], [dnl

    table=6 (lr_in_dnat         ), priority=0    , match=(1), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.10 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.100 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.10 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.100 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.force_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.10 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.4:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.100 && tcp && reg9[[16..31]] == 80), action=(flags.force_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=50   , match=(ct.rel && !ct.est && 
!ct.new), action=(ct_commit_nat;)
  ])

AT_CHECK([grep "lr_out_snat" lr0flows | sed 's/table=./table=?/' | sort], [0], [dnl

@@ -3848,8 +3852,8 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], [dnl
  ])

AT_CHECK([grep "lr_in_dnat" lr0flows | grep skip_snat_for_lb | sort], [0], [dnl

-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.20 && 
tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.skip_snat_for_lb = 1; next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.20 
&& tcp && reg9[[16..31]] == 80), action=(flags.skip_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.20 
&& tcp && reg9[[16..31]] == 80 && ct_mark.natted == 1), action=(flags.skip_snat_for_lb = 1; next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 
10.0.0.20 && tcp && reg9[[16..31]] == 80), action=(flags.skip_snat_for_lb = 1; 
ct_lb_mark(backends=10.0.0.40:8080);)
  ])

AT_CHECK([grep "lr_out_snat" lr0flows | grep skip_snat_for_lb | sed 's/table=./table=?/' | sort], [0], [dnl

@@ -4224,14 +4228,14 @@ ovn-sbctl dump-flows sw0 > sw0flows
  AT_CAPTURE_FILE([sw0flows])

AT_CHECK([grep -w "ls_in_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_in_acl          ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; next;)
    table=? (ls_in_acl          ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_in_acl          ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
  ])

AT_CHECK([grep -w "ls_out_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_out_acl         ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(next;)
    table=? (ls_out_acl         ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_out_acl         ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
@@ -4244,14 +4248,14 @@ ovn-sbctl dump-flows sw0 > sw0flows
  AT_CAPTURE_FILE([sw0flows])

AT_CHECK([grep -w "ls_in_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& ct_mark.blocked == 0), action=(next;)
+  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_in_acl          ), priority=65532, match=((ct.est && ct.rpl && 
ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_in_acl          ), priority=65532, match=(ct.est && !ct.rel && !ct.new 
&& ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; next;)
    table=? (ls_in_acl          ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
  ])

AT_CHECK([grep -w "ls_out_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& ct_mark.blocked == 0), action=(next;)
+  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_out_acl         ), priority=65532, match=((ct.est && ct.rpl && 
ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_out_acl         ), priority=65532, match=(ct.est && !ct.rel && !ct.new 
&& ct.rpl && ct_mark.blocked == 0), action=(next;)
    table=? (ls_out_acl         ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
@@ -4268,14 +4272,14 @@ ovn-sbctl dump-flows sw0 > sw0flows
  AT_CAPTURE_FILE([sw0flows])

AT_CHECK([grep -w "ls_in_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=? (ls_in_acl          ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_in_acl          ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; next;)
    table=? (ls_in_acl          ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_in_acl          ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
  ])

AT_CHECK([grep -w "ls_out_acl" sw0flows | grep 6553 | sort | sed 's/table=./table=?/'], [0], [dnl

-  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(next;)
+  table=? (ls_out_acl         ), priority=65532, match=(!ct.est && ct.rel && !ct.new 
&& !ct.inv && ct_mark.blocked == 0), action=(ct_commit_nat;)
    table=? (ls_out_acl         ), priority=65532, match=(ct.est && !ct.rel && !ct.new && 
!ct.inv && ct.rpl && ct_mark.blocked == 0), action=(next;)
    table=? (ls_out_acl         ), priority=65532, match=(ct.inv || (ct.est && ct.rpl 
&& ct_mark.blocked == 1)), action=(drop;)
    table=? (ls_out_acl         ), priority=65532, match=(nd || nd_ra || nd_rs 
|| mldv1 || mldv2), action=(next;)
@@ -5103,14 +5107,15 @@ AT_CHECK([grep "lr_in_defrag" lr0flows | sort], [0], 
[dnl
  AT_CHECK([grep "lr_in_dnat" lr0flows | sort], [0], [dnl
    table=6 (lr_in_dnat         ), priority=0    , match=(1), action=(next;)
    table=6 (lr_in_dnat         ), priority=100  , match=(ip && ip4.dst == 172.168.0.20 && inport == 
"lr0-public" && is_chassis_resident("cr-lr0-public")), action=(ct_dnat_in_czone(10.0.0.3);)
-  table=6 (lr_in_dnat         ), priority=110  , match=(ct.est && ip4 && reg0 == 172.168.0.200 
&& ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
-  table=6 (lr_in_dnat         ), priority=110  , match=(ct.new && ip4 && reg0 == 172.168.0.200 
&& is_chassis_resident("cr-lr0-public")), action=(ct_lb_mark(backends=10.0.0.80,10.0.0.81);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 10.0.0.10 && tcp && 
reg9[[16..31]] == 80 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 172.168.0.100 && tcp && 
reg9[[16..31]] == 8082 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && ip4 && reg0 == 172.168.0.210 && udp && 
reg9[[16..31]] == 60 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 10.0.0.10 && tcp 
&& reg9[[16..31]] == 80 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.4:8080);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 172.168.0.100 && tcp 
&& reg9[[16..31]] == 8082 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.50:82,10.0.0.60:82);)
-  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && ip4 && reg0 == 172.168.0.210 && udp 
&& reg9[[16..31]] == 60 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.50:6062,10.0.0.60:6062);)
+  table=6 (lr_in_dnat         ), priority=110  , match=(ct.est && !ct.rel && ip4 && reg0 == 
172.168.0.200 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
+  table=6 (lr_in_dnat         ), priority=110  , match=(ct.new && !ct.rel && ip4 && reg0 == 
172.168.0.200 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.80,10.0.0.81);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 10.0.0.10 && tcp 
&& reg9[[16..31]] == 80 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 172.168.0.100 && tcp 
&& reg9[[16..31]] == 8082 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 172.168.0.210 && udp 
&& reg9[[16..31]] == 60 && ct_mark.natted == 1 && is_chassis_resident("cr-lr0-public")), action=(next;)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 10.0.0.10 && 
tcp && reg9[[16..31]] == 80 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.4:8080);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 172.168.0.100 
&& tcp && reg9[[16..31]] == 8082 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.50:82,10.0.0.60:82);)
+  table=6 (lr_in_dnat         ), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 172.168.0.210 
&& udp && reg9[[16..31]] == 60 && is_chassis_resident("cr-lr0-public")), 
action=(ct_lb_mark(backends=10.0.0.50:6062,10.0.0.60:6062);)
+  table=6 (lr_in_dnat         ), priority=50   , match=(ct.rel && !ct.est && 
!ct.new), action=(ct_commit_nat;)
  ])