[ovs-dev] [PATCH ovn] physical: do not forward traffic from localport to a localnet one

Numan Siddique numans at ovn.org
Thu May 20 23:49:12 UTC 2021


On Thu, May 20, 2021 at 5:05 PM Mark Michelson <mmichels at redhat.com> wrote:
>
> Acked-by: Mark Michelson
>
> I have a small nit below, but since it's strictly with a comment, it's
> easy for whoever merges this to correct the comment when they do it.
> There's no reason to spin up a new version of this.
>
> On 5/4/21 1:59 PM, Lorenzo Bianconi wrote:
> > Since the localnet port is available on each hv, do not forward traffic
> > to the localnet port if it is present in order to avoid switch fdb
> > misconfiguration.
> > Related bz: https://bugzilla.redhat.com/show_bug.cgi?id=1942877
> >
> > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
> > ---
> >   controller/physical.c        | 23 +++++++++++++++++++++++
> >   include/ovn/logical-fields.h |  4 ++++
> >   tests/ovn.at                 | 17 +++++++++++++++++
> >   3 files changed, 44 insertions(+)
> >
> > diff --git a/controller/physical.c b/controller/physical.c
> > index 96c959d18..258842634 100644
> > --- a/controller/physical.c
> > +++ b/controller/physical.c
> > @@ -1193,6 +1193,11 @@ consider_port_binding(struct ovsdb_idl_index *sbrec_port_binding_by_name,
> >
> >           load_logical_ingress_metadata(binding, &zone_ids, ofpacts_p);
> >
> > +        if (!strcmp(binding->type, "localport")) {
> > +            /* mark the packet as incoming from a localport */
> > +            put_load(1, MFF_LOG_FLAGS, MLF_LOCALPORT_BIT, 1, ofpacts_p);
> > +        }
> > +
> >           /* Resubmit to first logical ingress pipeline table. */
> >           put_resubmit(OFTABLE_LOG_INGRESS_PIPELINE, ofpacts_p);
> >           ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG,
> > @@ -1251,6 +1256,24 @@ consider_port_binding(struct ovsdb_idl_index *sbrec_port_binding_by_name,
> >                                                 ofport, flow_table);
> >           }
> >
> > +        /* Table 34, priority 160.
>
> Nit: Table 34 is incorrect here. OFTABLE_CHECK_LOOPBACK is table 39 now.
> I think the issue here is that when the tables shifted, nobody updated
> the comments in this file, and so it's wrong here and several other
> places in physical.c
>

I corrected the comment and applied the patch to the main branch.

Numan

> > +         * =======================
> > +         *
> > +         * Do not forward local traffic from a localport to a localnet port.
> > +         */
> > +        if (!strcmp(binding->type, "localnet")) {
> > +            /* do not forward traffic from localport to localnet port */
> > +            match_init_catchall(&match);
> > +            ofpbuf_clear(ofpacts_p);
> > +            match_set_metadata(&match, htonll(dp_key));
> > +            match_set_reg(&match, MFF_LOG_OUTPORT - MFF_REG0, port_key);
> > +            match_set_reg_masked(&match, MFF_LOG_FLAGS - MFF_REG0,
> > +                                 MLF_LOCALPORT, MLF_LOCALPORT);
> > +            ofctrl_add_flow(flow_table, OFTABLE_CHECK_LOOPBACK, 160,
> > +                            binding->header_.uuid.parts[0], &match,
> > +                            ofpacts_p, &binding->header_.uuid);
> > +        }
> > +
> >       } else if (!tun && !is_ha_remote) {
> >           /* Remote port connected by localnet port */
> >           /* Table 33, priority 100.
> > diff --git a/include/ovn/logical-fields.h b/include/ovn/logical-fields.h
> > index d44b30b30..ef97117b9 100644
> > --- a/include/ovn/logical-fields.h
> > +++ b/include/ovn/logical-fields.h
> > @@ -67,6 +67,7 @@ enum mff_log_flags_bits {
> >       MLF_LOOKUP_LB_HAIRPIN_BIT = 7,
> >       MLF_LOOKUP_FDB_BIT = 8,
> >       MLF_SKIP_SNAT_FOR_LB_BIT = 9,
> > +    MLF_LOCALPORT_BIT = 10,
> >   };
> >
> >   /* MFF_LOG_FLAGS_REG flag assignments */
> > @@ -107,6 +108,9 @@ enum mff_log_flags {
> >       /* Indicate that a packet must not SNAT in the gateway router when
> >        * load-balancing has taken place. */
> >       MLF_SKIP_SNAT_FOR_LB = (1 << MLF_SKIP_SNAT_FOR_LB_BIT),
> > +
> > +    /* Indicate the packet has been received from a localport */
> > +    MLF_LOCALPORT = (1 << MLF_LOCALPORT_BIT),
> >   };
> >
> >   /* OVN logical fields
> > diff --git a/tests/ovn.at b/tests/ovn.at
> > index fe6a7c85b..99764b24b 100644
> > --- a/tests/ovn.at
> > +++ b/tests/ovn.at
> > @@ -11823,10 +11823,17 @@ OVN_FOR_EACH_NORTHD([
> >   AT_SETUP([ovn -- localport suppress gARP])
> >   ovn_start
> >
> > +send_garp() {
> > +    local inport=$1 eth_src=$2 eth_dst=$3 spa=$4 tpa=$5
> > +    local request=${eth_dst}${eth_src}08060001080006040001${eth_src}${spa}${eth_dst}${tpa}
> > +    as hv1 ovs-appctl netdev-dummy/receive vif$inport $request
> > +}
> > +
> >   net_add n1
> >   sim_add hv1
> >   as hv1
> >   check ovs-vsctl add-br br-phys
> > +ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys:br-phys
> >   ovn_attach n1 br-phys 192.168.0.1
> >
> >   check ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys:br-phys
> > @@ -11837,6 +11844,7 @@ check ovn-nbctl ls-add ls \
> >       -- lsp-set-addresses lp "00:00:00:00:00:01 10.0.0.1" \
> >       -- lsp-add ls ln \
> >       -- lsp-set-type ln localnet \
> > +    -- lsp-set-addresses ln unknown \
> >       -- lsp-set-options ln network_name=phys \
> >       -- lsp-add ls lsp \
> >       -- lsp-set-addresses lsp "00:00:00:00:00:02 10.0.0.2"
> > @@ -11870,6 +11878,15 @@ AT_CHECK([
> >       test 0 -eq $pkts
> >   ])
> >
> > +spa=$(ip_to_hex 10 0 0 1)
> > +tpa=$(ip_to_hex 10 0 0 100)
> > +send_garp 1 000000000001 ffffffffffff $spa $tpa
> > +
> > +dnl traffic from localport should not be sent to localnet
> > +AT_CHECK([tcpdump -r hv1/br-phys_n1-tx.pcap arp[[24:4]]=0x0a000064 | wc -l],[0],[dnl
> > +0
> > +],[ignore])
> > +
> >   OVN_CLEANUP([hv1])
> >   AT_CLEANUP
> >   ])
> >
>
> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
>


More information about the dev mailing list