[ovs-discuss] OVS 2.9.0 native firewall drops empty payload TCP packets continued

Gregory Rose gvrose8192 at gmail.com
Fri May 3 19:29:48 UTC 2019


On 5/2/2019 6:03 PM, Zhang, Jing C. (Nokia - CA/Ottawa) wrote:
> We (our VNFs) continue to observe the same empty payload TCP (ACK) 
> packet drop with native firewall (see original post below) after 
> upgrading to Centos 7.6. This packet drop results in unacceptable TCP 
> performance, by that native firewall still can not be enabled in product.
> _https://mail.openvswitch.org/pipermail/ovs-discuss/2018-August/047263.html_ 
> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fpipermail%2Fovs-discuss%2F2018-August%2F047263.html&data=02%7C01%7Croseg%40vmware.com%7C99e374a533314ae804e308d6cf1e77bc%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C636924127135278159&sdata=CJwM1qEQ2vlVQh1Ko2wXQOtQpCLc2cVBkuSC5kB1H9k%3D&reserved=0>
> $ uname -a
> Linux overcloud-sriovperformancecompute-0 3.10.0-957.10.1.el7.x86_64 
> #1 SMP Mon Mar 18 15:06:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
> $ ovs-vswitchd --version
> ovs-vswitchd (Open vSwitch) 2.9.0
> DPDK 17.11.0
> The scenario: OVS provider VLAN network is used
>
>  1. in physical interface of ovs compute zero length tcp payload
>     packet arrives as padded to 64 bytes (and vlan tag is included in
>     ethernet header)
>  2. same packet does not appear anymore in the tcpdump taken from
>     tap-xyz interface (once vlan tag is removed and packet is cut by 4
>     bytes to 60 bytes)
>
> Tcpdump on physical port:
> 00:25:24.468423 fa:16:3e:d7:bb:2c > fa:16:3e:ff:dd:29, ethertype 
> 802.1Q (0x8100), length 2674: vlan 3837, p 0, ethertype IPv4, (tos 
> 0x0, ttl 64, id 6893, offset 0, flags [DF], proto TCP (6), length 2656)
>     192.168.10.52.80 > 192.168.10.60.57576: Flags [P.], cksum 0xa013 
> (incorrect -> 0x772d), seq 8961:11577, ack 78, win 210, length 2616: HTTP
> 00:25:24.468593 fa:16:3e:ff:dd:29 > fa:16:3e:d7:bb:2c, ethertype 
> 802.1Q (0x8100), length 60: vlan 3837, p 0, ethertype IPv4, (tos 0x0, 
> ttl 64, id 56318, offset 0, flags [DF], proto TCP (6), length 40)
>     192.168.10.60.57576 > 192.168.10.52.80: Flags [.], cksum 0x1d34 
> (correct), seq 78, ack 11577, win 391, length 0
> 00:25:24.475848 fa:16:3e:ff:dd:29 > fa:16:3e:d7:bb:2c, ethertype 
> 802.1Q (0x8100), length 60: vlan 3837, p 0, ethertype IPv4, (tos 0x0, 
> ttl 64, id 56319, offset 0, flags [DF], proto TCP (6), length 40)
>     192.168.10.60.57576 > 192.168.10.52.80: Flags [F.], cksum 0x1d33 
> (correct), seq 78, ack 11577, win 391, length 0
> 00:25:24.480337 fa:16:3e:d7:bb:2c > fa:16:3e:ff:dd:29, ethertype 
> 802.1Q (0x8100), length 2674: vlan 3837, p 0, ethertype IPv4, (tos 
> 0x0, ttl 64, id 6894, offset 0, flags [DF], proto TCP (6), length 2656)
>     192.168.10.52.80 > 192.168.10.60.57576: Flags [P.], cksum 0xa013 
> (incorrect -> 0x772d), seq 8961:11577, ack 78, win 210, length 2616: HTTP
> Tcpdump on vm tap interface:
> 00:25:24.468419 fa:16:3e:d7:bb:2c > fa:16:3e:ff:dd:29, ethertype IPv4 
> (0x0800), length 2670: (tos 0x0, ttl 64, id 6893, offset 0, flags 
> [DF], proto TCP (6), length 2656)
>     192.168.10.52.80 > 192.168.10.60.57576: Flags [P.], cksum 0xa013 
> (incorrect -> 0x772d), seq 8961:11577, ack 78, win 210, length 2616: HTTP
> 00:25:24.480331 fa:16:3e:d7:bb:2c > fa:16:3e:ff:dd:29, ethertype IPv4 
> (0x0800), length 2670: (tos 0x0, ttl 64, id 6894, offset 0, flags 
> [DF], proto TCP (6), length 2656)
>     192.168.10.52.80 > 192.168.10.60.57576: Flags [P.], cksum 0xa013 
> (incorrect -> 0x772d), seq 8961:11577, ack 78, win 210, length 2616: HTTP
> Very straightforward to see the issue:
>
>  1. Configure neutron OVS agent to use native firewall
>  2. Create a pair of VMs on separate computes on provider vLAN
>  3. Disable TCP timestamp inside the VMs
>  4. Exchange TCP traffic between the VMs, e.g. http download.
>  5. Tcpdump on the physical and vm port, and compare.
>
> I wonder why such obvious issue is not widely discussed?

I wonder that myself.  I would indicate to me that there is some rare or 
unique circumstance to  your setup or
configuration.

In any case, we'll just focus on why you're seeing the issue and try to 
determine the root cause.  I'll probably want
to set up a remote debugging situation so I can interactively view and 
troubleshoot the problem.  Unfortunately,
that will probably not be doable until I return to work after May 27 
because the next week and a half before I go
on PTO is pretty booked up for me.

Thanks,

- Greg

> Jing
>
> _______________________________________________
> discuss mailing list
> discuss at openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-discuss

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-discuss/attachments/20190503/5f0bb3f5/attachment.html>


More information about the discuss mailing list