[ovs-dev] [PATCH v2 ovn 3/3] northd: introduce logical flow for localnet egress shaping
Dumitru Ceara
dceara at redhat.com
Wed Sep 25 11:42:04 UTC 2019
On Tue, Sep 24, 2019 at 6:40 PM Lorenzo Bianconi
<lorenzo.bianconi at redhat.com> wrote:
>
> Add set_queue() action for qos capable localnet port in
> S_SWITCH_OUT_PORT_SEC_L2 stage of logical swith pipeline
> Introduce build_lswitch_{input,outpur}_port_sec and refactor
> lswitch_port_security code in order to remove duplicated code
>
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
Looks good to me. Thanks!
Acked-by: Dumitru Ceara <dceara at redhat.com>
> ---
> northd/ovn-northd.8.xml | 7 +-
> northd/ovn-northd.c | 231 ++++++++++++++++++++++++----------------
> 2 files changed, 143 insertions(+), 95 deletions(-)
>
> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml
> index 0f4f1c112..093b55438 100644
> --- a/northd/ovn-northd.8.xml
> +++ b/northd/ovn-northd.8.xml
> @@ -1150,10 +1150,15 @@ output;
> <code>eth.dst</code> are always accepted instead of being subject to the
> port security rules; this is implemented through a priority-100 flow that
> matches on <code>eth.mcast</code> with action <code>output;</code>.
> - Finally, to ensure that even broadcast and multicast packets are not
> + Moreover, to ensure that even broadcast and multicast packets are not
> delivered to disabled logical ports, a priority-150 flow for each
> disabled logical <code>outport</code> overrides the priority-100 flow
> with a <code>drop;</code> action.
> + Finally if egress qos has been enabled on a localnet port, the outgoing
> + queue id is set through <code>set_queue</code> action. Please remember to
> + mark the corresponding physical interface with
> + <code>ovn-egress-iface</code> set to true in <ref column="external_ids"
> + table="Interface" db="Open_vSwitch"/>
> </p>
>
> <h2>Logical Router Datapaths</h2>
> diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
> index 633fb502b..b1ece2d29 100644
> --- a/northd/ovn-northd.c
> +++ b/northd/ovn-northd.c
> @@ -3903,6 +3903,140 @@ has_stateful_acl(struct ovn_datapath *od)
> return false;
> }
>
> +static void
> +build_lswitch_input_port_sec(struct hmap *ports, struct hmap *datapaths,
> + struct hmap *lflows)
> +{
> + /* Logical switch ingress table 0: Ingress port security - L2
> + * (priority 50).
> + * Ingress table 1: Ingress port security - IP (priority 90 and 80)
> + * Ingress table 2: Ingress port security - ND (priority 90 and 80)
> + */
> + struct ds actions = DS_EMPTY_INITIALIZER;
> + struct ds match = DS_EMPTY_INITIALIZER;
> + struct ovn_port *op;
> +
> + HMAP_FOR_EACH (op, key_node, ports) {
> + if (!op->nbsp) {
> + continue;
> + }
> +
> + if (!lsp_is_enabled(op->nbsp)) {
> + /* Drop packets from disabled logical ports (since logical flow
> + * tables are default-drop). */
> + continue;
> + }
> +
> + if (lsp_is_external(op->nbsp)) {
> + continue;
> + }
> +
> + ds_clear(&match);
> + ds_clear(&actions);
> + ds_put_format(&match, "inport == %s", op->json_key);
> + build_port_security_l2("eth.src", op->ps_addrs, op->n_ps_addrs,
> + &match);
> +
> + const char *queue_id = smap_get(&op->sb->options, "qdisc_queue_id");
> + if (queue_id) {
> + ds_put_format(&actions, "set_queue(%s); ", queue_id);
> + }
> + ds_put_cstr(&actions, "next;");
> + ovn_lflow_add(lflows, op->od, S_SWITCH_IN_PORT_SEC_L2, 50,
> + ds_cstr(&match), ds_cstr(&actions));
> +
> + if (op->nbsp->n_port_security) {
> + build_port_security_ip(P_IN, op, lflows);
> + build_port_security_nd(op, lflows);
> + }
> + }
> +
> + /* Ingress table 1 and 2: Port security - IP and ND, by default
> + * goto next. (priority 0)
> + */
> + struct ovn_datapath *od;
> + HMAP_FOR_EACH (od, key_node, datapaths) {
> + if (!od->nbs) {
> + continue;
> + }
> +
> + ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_ND, 0, "1", "next;");
> + ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_IP, 0, "1", "next;");
> + }
> +
> + ds_destroy(&match);
> + ds_destroy(&actions);
> +}
> +
> +static void
> +build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,
> + struct hmap *lflows)
> +{
> + struct ds actions = DS_EMPTY_INITIALIZER;
> + struct ds match = DS_EMPTY_INITIALIZER;
> + struct ovn_port *op;
> +
> + /* Egress table 8: Egress port security - IP (priorities 90 and 80)
> + * if port security enabled.
> + *
> + * Egress table 9: Egress port security - L2 (priorities 50 and 150).
> + *
> + * Priority 50 rules implement port security for enabled logical port.
> + *
> + * Priority 150 rules drop packets to disabled logical ports, so that
> + * they don't even receive multicast or broadcast packets.
> + */
> + HMAP_FOR_EACH (op, key_node, ports) {
> + if (!op->nbsp || lsp_is_external(op->nbsp)) {
> + continue;
> + }
> +
> + ds_clear(&actions);
> + ds_clear(&match);
> +
> + ds_put_format(&match, "outport == %s", op->json_key);
> + if (lsp_is_enabled(op->nbsp)) {
> + build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,
> + &match);
> +
> + if (!strcmp(op->nbsp->type, "localnet")) {
> + const char *queue_id = smap_get(&op->sb->options,
> + "qdisc_queue_id");
> + if (queue_id) {
> + ds_put_format(&actions, "set_queue(%s); ", queue_id);
> + }
> + }
> + ds_put_cstr(&actions, "output;");
> + ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 50,
> + ds_cstr(&match), ds_cstr(&actions));
> + } else {
> + ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 150,
> + ds_cstr(&match), "drop;");
> + }
> +
> + if (op->nbsp->n_port_security) {
> + build_port_security_ip(P_OUT, op, lflows);
> + }
> + }
> +
> + /* Egress tables 8: Egress port security - IP (priority 0)
> + * Egress table 9: Egress port security L2 - multicast/broadcast
> + * (priority 100). */
> + struct ovn_datapath *od;
> + HMAP_FOR_EACH (od, key_node, datapaths) {
> + if (!od->nbs) {
> + continue;
> + }
> +
> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");
> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",
> + "output;");
> + }
> +
> + ds_destroy(&match);
> + ds_destroy(&actions);
> +}
> +
> static void
> build_pre_acls(struct ovn_datapath *od, struct hmap *lflows)
> {
> @@ -4974,61 +5108,12 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
> * to the next table if packet source is acceptable. */
> }
>
> - /* Logical switch ingress table 0: Ingress port security - L2
> - * (priority 50).
> - * Ingress table 1: Ingress port security - IP (priority 90 and 80)
> - * Ingress table 2: Ingress port security - ND (priority 90 and 80)
> - */
> - struct ovn_port *op;
> - HMAP_FOR_EACH (op, key_node, ports) {
> - if (!op->nbsp) {
> - continue;
> - }
> -
> - if (!lsp_is_enabled(op->nbsp)) {
> - /* Drop packets from disabled logical ports (since logical flow
> - * tables are default-drop). */
> - continue;
> - }
> -
> - if (lsp_is_external(op->nbsp)) {
> - continue;
> - }
> -
> - ds_clear(&match);
> - ds_clear(&actions);
> - ds_put_format(&match, "inport == %s", op->json_key);
> - build_port_security_l2("eth.src", op->ps_addrs, op->n_ps_addrs,
> - &match);
> -
> - const char *queue_id = smap_get(&op->sb->options, "qdisc_queue_id");
> - if (queue_id) {
> - ds_put_format(&actions, "set_queue(%s); ", queue_id);
> - }
> - ds_put_cstr(&actions, "next;");
> - ovn_lflow_add(lflows, op->od, S_SWITCH_IN_PORT_SEC_L2, 50,
> - ds_cstr(&match), ds_cstr(&actions));
> -
> - if (op->nbsp->n_port_security) {
> - build_port_security_ip(P_IN, op, lflows);
> - build_port_security_nd(op, lflows);
> - }
> - }
> -
> - /* Ingress table 1 and 2: Port security - IP and ND, by default goto next.
> - * (priority 0)*/
> - HMAP_FOR_EACH (od, key_node, datapaths) {
> - if (!od->nbs) {
> - continue;
> - }
> -
> - ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_ND, 0, "1", "next;");
> - ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_IP, 0, "1", "next;");
> - }
> + build_lswitch_input_port_sec(ports, datapaths, lflows);
>
> /* Ingress table 11: ARP/ND responder, skip requests coming from localnet
> * and vtep ports. (priority 100); see ovn-northd.8.xml for the
> * rationale. */
> + struct ovn_port *op;
> HMAP_FOR_EACH (op, key_node, ports) {
> if (!op->nbsp) {
> continue;
> @@ -5651,49 +5736,7 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
> }
> }
>
> - /* Egress tables 8: Egress port security - IP (priority 0)
> - * Egress table 9: Egress port security L2 - multicast/broadcast
> - * (priority 100). */
> - HMAP_FOR_EACH (od, key_node, datapaths) {
> - if (!od->nbs) {
> - continue;
> - }
> -
> - ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");
> - ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",
> - "output;");
> - }
> -
> - /* Egress table 8: Egress port security - IP (priorities 90 and 80)
> - * if port security enabled.
> - *
> - * Egress table 9: Egress port security - L2 (priorities 50 and 150).
> - *
> - * Priority 50 rules implement port security for enabled logical port.
> - *
> - * Priority 150 rules drop packets to disabled logical ports, so that they
> - * don't even receive multicast or broadcast packets. */
> - HMAP_FOR_EACH (op, key_node, ports) {
> - if (!op->nbsp || lsp_is_external(op->nbsp)) {
> - continue;
> - }
> -
> - ds_clear(&match);
> - ds_put_format(&match, "outport == %s", op->json_key);
> - if (lsp_is_enabled(op->nbsp)) {
> - build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,
> - &match);
> - ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 50,
> - ds_cstr(&match), "output;");
> - } else {
> - ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 150,
> - ds_cstr(&match), "drop;");
> - }
> -
> - if (op->nbsp->n_port_security) {
> - build_port_security_ip(P_OUT, op, lflows);
> - }
> - }
> + build_lswitch_output_port_sec(ports, datapaths, lflows);
>
> ds_destroy(&match);
> ds_destroy(&actions);
> --
> 2.21.0
>
More information about the dev
mailing list