Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2223802/?format=api
{ "id": 2223802, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2223802/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ovn/patch/20260416085431.32604-1-arukomoinikova@k2.cloud/", "project": { "id": 68, "url": "http://patchwork.ozlabs.org/api/1.1/projects/68/?format=api", "name": "Open Virtual Network development", "link_name": "ovn", "list_id": "ovs-dev.openvswitch.org", "list_email": "ovs-dev@openvswitch.org", "web_url": "http://openvswitch.org/", "scm_url": "", "webscm_url": "" }, "msgid": "<20260416085431.32604-1-arukomoinikova@k2.cloud>", "date": "2026-04-16T08:54:30", "name": "[ovs-dev] controller: Exclude ICMP frag-needed from VTEP tunnels.", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "d89e8727f55c98ee5ce77bd77ebc235f6372a84a", "submitter": { "id": 89461, "url": "http://patchwork.ozlabs.org/api/1.1/people/89461/?format=api", "name": "Rukomoinikova Aleksandra", "email": "ARukomoinikova@k2.cloud" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ovn/patch/20260416085431.32604-1-arukomoinikova@k2.cloud/mbox/", "series": [ { "id": 500113, "url": "http://patchwork.ozlabs.org/api/1.1/series/500113/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ovn/list/?series=500113", "date": "2026-04-16T08:54:30", "name": "[ovs-dev] controller: Exclude ICMP frag-needed from VTEP tunnels.", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500113/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2223802/comments/", "check": "warning", "checks": "http://patchwork.ozlabs.org/api/patches/2223802/checks/", "tags": {}, "headers": { "Return-Path": "<ovs-dev-bounces@openvswitch.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "dev@openvswitch.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "ovs-dev@lists.linuxfoundation.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=k2.cloud header.i=@k2.cloud header.a=rsa-sha256\n header.s=cloudmail header.b=ZiPeJO8j;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=140.211.166.137; helo=smtp4.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)", "smtp4.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key,\n unprotected) header.d=k2.cloud header.i=@k2.cloud header.a=rsa-sha256\n header.s=cloudmail header.b=ZiPeJO8j", "smtp1.osuosl.org; dmarc=pass (p=quarantine dis=none)\n header.from=k2.cloud", "smtp1.osuosl.org; dkim=pass (1024-bit key,\n unprotected) header.d=k2.cloud header.i=@k2.cloud header.a=rsa-sha256\n header.s=cloudmail header.b=ZiPeJO8j" ], "Received": [ "from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxBfD30brz1yG9\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 16 Apr 2026 18:54:44 +1000 (AEST)", "from localhost (localhost [127.0.0.1])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id 4BE4D40839;\n\tThu, 16 Apr 2026 08:54:42 +0000 (UTC)", "from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id uReIziVGp4Bk; Thu, 16 Apr 2026 08:54:40 +0000 (UTC)", "from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp4.osuosl.org (Postfix) with ESMTPS id A4A7040830;\n\tThu, 16 Apr 2026 08:54:40 +0000 (UTC)", "from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 8F408C054A;\n\tThu, 16 Apr 2026 08:54:40 +0000 (UTC)", "from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 888E6C0549\n for <dev@openvswitch.org>; Thu, 16 Apr 2026 08:54:39 +0000 (UTC)", "from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id 6EE2C80BE6\n for <dev@openvswitch.org>; Thu, 16 Apr 2026 08:54:39 +0000 (UTC)", "from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id jYPcqcNWV_AK for <dev@openvswitch.org>;\n Thu, 16 Apr 2026 08:54:38 +0000 (UTC)", "from mail3.k2.cloud (mail3.k2.cloud [109.73.14.254])\n by smtp1.osuosl.org (Postfix) with ESMTPS id 8996980BE2\n for <dev@openvswitch.org>; Thu, 16 Apr 2026 08:54:37 +0000 (UTC)" ], "X-Virus-Scanned": [ "amavis at osuosl.org", "amavis at osuosl.org" ], "X-Comment": "SPF check N/A for local connections -\n client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=<UNKNOWN> ", "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 smtp4.osuosl.org A4A7040830", "OpenDKIM Filter v2.11.0 smtp1.osuosl.org 8996980BE2" ], "Received-SPF": "Pass (mailfrom) identity=mailfrom; client-ip=109.73.14.254;\n helo=mail3.k2.cloud; envelope-from=arukomoinikova@k2.cloud;\n receiver=<UNKNOWN>", "DMARC-Filter": "OpenDMARC Filter v1.4.2 smtp1.osuosl.org 8996980BE2", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=k2.cloud;\n s=cloudmail; t=1776329672;\n bh=qf7D1XqlgxE3Fu5HphrpqkUrswIXZ1b83sWtrOx4448=;\n h=From:To:Cc:Subject:Date;\n b=ZiPeJO8jFlhnYRFcezG/VU0VR6B94mCgS3aOfXFxlBEEaPSpyVEpyfMfXUBUjk1aT\n UhFtY6F/9lNBc3tdwINFdsbMH0yoP7vh0j1iyfRj3OVZ9HHpTZq7DzX1uuRnEMYcUW\n VR1nVQ5+CgrxakNCvPIWE2ynI0Zhc/W+34qld9+0=", "To": "dev@openvswitch.org", "Cc": "Alexandra Rukomoinikova <arukomoinikova@k2.cloud>", "Date": "Thu, 16 Apr 2026 11:54:30 +0300", "Message-Id": "<20260416085431.32604-1-arukomoinikova@k2.cloud>", "MIME-Version": "1.0", "Subject": "[ovs-dev] [PATCH ovn] controller: Exclude ICMP frag-needed from\n VTEP tunnels.", "X-BeenThere": "ovs-dev@openvswitch.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "<ovs-dev.openvswitch.org>", "List-Unsubscribe": "<https://mail.openvswitch.org/mailman/options/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=unsubscribe>", "List-Archive": "<http://mail.openvswitch.org/pipermail/ovs-dev/>", "List-Post": "<mailto:ovs-dev@openvswitch.org>", "List-Help": "<mailto:ovs-dev-request@openvswitch.org?subject=help>", "List-Subscribe": "<https://mail.openvswitch.org/mailman/listinfo/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=subscribe>", "From": "Alexandra Rukomoinikova via dev <ovs-dev@openvswitch.org>", "Reply-To": "Alexandra Rukomoinikova <arukomoinikova@k2.cloud>", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "ovs-dev-bounces@openvswitch.org", "Sender": "\"dev\" <ovs-dev-bounces@openvswitch.org>" }, "content": "Commit [1] added handling for E/W ICMPv4/v6 \"fragmentation needed\"\npackets generated for overlay tunneled traffic. This was required\nbecause the GENEVE kernel module generates ICMP \"need frag\" packets\nwhen a tunneled packet exceeds the path MTU, and such packets were\npreviously dropped due to metadata needing to be swapped.\n\nHowever, it did not cover the case where similar ICMP packets\narrive from VTEP tunnels. Such packets are not subject to the same\nmetadata handling constraints, since they are VXLAN-encapsulated and\nare already delivered directly to the destination VIF MAC address.\n\nAs a result, they do not match the added for such packets rules and are\ndropped. Exclude packets coming from VTEP tunnels from this special handling.\n\nFixes: ff54ab6cdced (\"controller: Exclude ICMP frag-needed from VTEP tunnels.\")\nSigned-off-by: Alexandra Rukomoinikova <arukomoinikova@k2.cloud>\n---\n controller/encaps.c | 29 +++++++++++-----\n controller/local_data.c | 2 ++\n controller/local_data.h | 1 +\n controller/physical.c | 66 ++++++++++++++++++++++++------------\n tests/ovn-controller-vtep.at | 4 +++\n 5 files changed, 71 insertions(+), 31 deletions(-)", "diff": "diff --git a/controller/encaps.c b/controller/encaps.c\nindex 61f41bf3a..0f3dd5aed 100644\n--- a/controller/encaps.c\n+++ b/controller/encaps.c\n@@ -44,6 +44,7 @@ encaps_register_ovs_idl(struct ovsdb_idl *ovs_idl)\n ovsdb_idl_track_add_column(ovs_idl, &ovsrec_interface_col_name);\n ovsdb_idl_track_add_column(ovs_idl, &ovsrec_interface_col_type);\n ovsdb_idl_track_add_column(ovs_idl, &ovsrec_interface_col_options);\n+ ovsdb_idl_track_add_column(ovs_idl, &ovsrec_interface_col_other_config);\n }\n \n /* Enough context to create a new tunnel, using tunnel_add(). */\n@@ -201,12 +202,14 @@ out:\n }\n \n static void\n-tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n- const char *new_chassis_id, const struct sbrec_encap *encap,\n- const char *local_ip,\n+tunnel_add(struct tunnel_ctx *tc,\n+ const struct sbrec_sb_global *sbg,\n+ const struct sbrec_chassis *chassis_rec,\n+ const struct sbrec_encap *encap, const char *local_ip,\n const struct ovsrec_open_vswitch_table *ovs_table)\n {\n struct smap options = SMAP_INITIALIZER(&options);\n+ struct smap other_config = SMAP_INITIALIZER(&other_config);\n smap_add(&options, \"remote_ip\", encap->ip);\n smap_add(&options, \"local_ip\", local_ip);\n smap_add(&options, \"key\", \"flow\");\n@@ -214,6 +217,8 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n const char *csum = smap_get(&encap->options, \"csum\");\n char *tunnel_entry_id = NULL;\n char *tunnel_entry_id_old = NULL;\n+ bool is_vtep_tunnel = smap_get_bool(&chassis_rec->other_config,\n+ \"is-vtep\", false);\n \n /*\n * Since a chassis may have multiple encap-ip, we can't just add the\n@@ -221,9 +226,9 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n * combination of the chassis_name and the remote and local encap-ips to\n * identify a specific tunnel to the remote chassis.\n */\n- tunnel_entry_id = encaps_tunnel_id_create(new_chassis_id, encap->ip,\n+ tunnel_entry_id = encaps_tunnel_id_create(chassis_rec->name, encap->ip,\n local_ip);\n- tunnel_entry_id_old = encaps_tunnel_id_create_legacy(new_chassis_id,\n+ tunnel_entry_id_old = encaps_tunnel_id_create_legacy(chassis_rec->name,\n encap->ip);\n if (csum && (!strcmp(csum, \"true\") || !strcmp(csum, \"false\"))) {\n smap_add(&options, \"csum\", csum);\n@@ -258,7 +263,7 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n \n /* Add auth info if ipsec is enabled. */\n if (sbg->ipsec) {\n- smap_add(&options, \"remote_name\", new_chassis_id);\n+ smap_add(&options, \"remote_name\", chassis_rec->name);\n \n /* Force NAT-T traversal via configuration */\n /* Two ipsec backends are supported: libreswan and strongswan */\n@@ -276,6 +281,10 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n }\n }\n \n+ if (is_vtep_tunnel) {\n+ smap_add(&other_config, \"is-vtep\", \"true\");\n+ }\n+\n /* If there's an existing tunnel record that does not need any change,\n * keep it. Otherwise, create a new record (if there was an existing\n * record, the new record will supplant it and encaps_run() will delete\n@@ -312,10 +321,10 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n * its name, otherwise generate a new, unique name. */\n char *port_name = (tunnel\n ? xstrdup(tunnel->port->name)\n- : tunnel_create_name(tc, new_chassis_id));\n+ : tunnel_create_name(tc, chassis_rec->name));\n if (!port_name) {\n VLOG_WARN(\"Unable to allocate unique name for '%s' tunnel\",\n- new_chassis_id);\n+ chassis_rec->name);\n goto exit;\n }\n \n@@ -323,6 +332,7 @@ tunnel_add(struct tunnel_ctx *tc, const struct sbrec_sb_global *sbg,\n ovsrec_interface_set_name(iface, port_name);\n ovsrec_interface_set_type(iface, encap->type);\n ovsrec_interface_set_options(iface, &options);\n+ ovsrec_interface_set_other_config(iface, &other_config);\n \n struct ovsrec_port *port = ovsrec_port_insert(tc->ovs_txn);\n ovsrec_port_set_name(port, port_name);\n@@ -338,6 +348,7 @@ exit:\n free(tunnel_entry_id);\n free(tunnel_entry_id_old);\n smap_destroy(&options);\n+ smap_destroy(&other_config);\n }\n \n static bool\n@@ -403,7 +414,7 @@ chassis_tunnel_add(const struct sbrec_chassis *chassis_rec,\n }\n VLOG_DBG(\"tunnel_add: '%s', local ip: %s\", chassis_rec->name,\n this_chassis->encaps[j]->ip);\n- tunnel_add(tc, sbg, chassis_rec->name, chassis_rec->encaps[i],\n+ tunnel_add(tc, sbg, chassis_rec, chassis_rec->encaps[i],\n this_chassis->encaps[j]->ip, ovs_table);\n tuncnt++;\n }\ndiff --git a/controller/local_data.c b/controller/local_data.c\nindex dda746d73..5f1a52771 100644\n--- a/controller/local_data.c\n+++ b/controller/local_data.c\n@@ -532,6 +532,8 @@ local_nonvif_data_run(const struct ovsrec_bridge *br_int,\n tun->ofport = u16_to_ofp(ofport);\n tun->type = tunnel_type;\n tun->is_ipv6 = ip ? addr_is_ipv6(ip) : false;\n+ tun->is_vtep_tunnel = smap_get_bool(&iface_rec->other_config,\n+ \"is-vtep\", false);\n \n free(hash_id);\n free(ip);\ndiff --git a/controller/local_data.h b/controller/local_data.h\nindex 948c1a935..fdb81288c 100644\n--- a/controller/local_data.h\n+++ b/controller/local_data.h\n@@ -146,6 +146,7 @@ struct chassis_tunnel {\n ofp_port_t ofport;\n enum chassis_tunnel_type type;\n bool is_ipv6;\n+ bool is_vtep_tunnel;\n };\n \n /* Flow-based tunnel that consolidates multiple endpoints into a single\ndiff --git a/controller/physical.c b/controller/physical.c\nindex 228f3d171..c1401074e 100644\n--- a/controller/physical.c\n+++ b/controller/physical.c\n@@ -351,31 +351,34 @@ put_flow_based_remote_port_redirect_overlay(\n }\n }\n \n+/* Add handling for E/W ICMPv4/v6 packets when tunneled packets exceed\n+ * path MTU.\n+ * If packet needs to be tunneled to another node and the physical\n+ * interface used for tunneling has a lower MTU than the packet size,\n+ * or if there is a route exception with a smaller MTU, kernel\n+ * generates an ICMP \"Fragmentation Needed\" message, but the package\n+ * metadata didn't change. Such packets might have been dropped due\n+ * to required metadata modifications for returned packet.\n+ *\n+ * Mark these packets with MLF_RX_FROM_TUNNEL_BIT for further\n+ * processing. Packets received from a VTEP tunnel should be passed\n+ * through, and errors handled via the normal processing path, since\n+ * port metadata is not carried in VTEP packets in VNI.\n+ */\n static void\n-add_tunnel_ingress_flows(const struct chassis_tunnel *tun,\n- enum mf_field_id mff_ovn_geneve,\n- struct ovn_desired_flow_table *flow_table,\n- struct ofpbuf *ofpacts)\n+add_tunnel_ingress_icmp_need_frag_flows(const struct chassis_tunnel *tun,\n+ struct ofpbuf *ofpacts,\n+ struct ovn_desired_flow_table *table)\n {\n- /* Main ingress flow (priority 100) */\n- struct match match = MATCH_CATCHALL_INITIALIZER;\n- match_set_in_port(&match, tun->ofport);\n-\n- ofpbuf_clear(ofpacts);\n- put_decapsulation(mff_ovn_geneve, tun, ofpacts);\n- put_resubmit(OFTABLE_LOCAL_OUTPUT, ofpacts);\n+ if (tun->is_vtep_tunnel) {\n+ return;\n+ }\n \n- ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG, 100, 0, &match,\n- ofpacts, hc_uuid);\n+ struct match match = MATCH_CATCHALL_INITIALIZER;\n \n- /* Set allow rx from tunnel bit */\n put_load(1, MFF_LOG_FLAGS, MLF_RX_FROM_TUNNEL_BIT, 1, ofpacts);\n put_resubmit(OFTABLE_CT_ZONE_LOOKUP, ofpacts);\n \n- /* Add specific flows for E/W ICMPv{4,6} packets if tunnelled packets\n- * do not fit path MTU. */\n-\n- /* IPv4 ICMP flow (priority 120) */\n match_init_catchall(&match);\n match_set_in_port(&match, tun->ofport);\n match_set_dl_type(&match, htons(ETH_TYPE_IP));\n@@ -383,10 +386,9 @@ add_tunnel_ingress_flows(const struct chassis_tunnel *tun,\n match_set_icmp_type(&match, 3);\n match_set_icmp_code(&match, 4);\n \n- ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG, 120, 0, &match,\n+ ofctrl_add_flow(table, OFTABLE_PHY_TO_LOG, 120, 0, &match,\n ofpacts, hc_uuid);\n \n- /* IPv6 ICMP flow (priority 120) */\n match_init_catchall(&match);\n match_set_in_port(&match, tun->ofport);\n match_set_dl_type(&match, htons(ETH_TYPE_IPV6));\n@@ -394,10 +396,30 @@ add_tunnel_ingress_flows(const struct chassis_tunnel *tun,\n match_set_icmp_type(&match, 2);\n match_set_icmp_code(&match, 0);\n \n- ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG, 120, 0, &match,\n+ ofctrl_add_flow(table, OFTABLE_PHY_TO_LOG, 120, 0, &match,\n ofpacts, hc_uuid);\n }\n \n+static void\n+add_tunnel_ingress_flows(const struct chassis_tunnel *tun,\n+ enum mf_field_id mff_ovn_geneve,\n+ struct ovn_desired_flow_table *flow_table,\n+ struct ofpbuf *ofpacts)\n+{\n+ /* Main ingress flow (priority 100) */\n+ struct match match = MATCH_CATCHALL_INITIALIZER;\n+ match_set_in_port(&match, tun->ofport);\n+\n+ ofpbuf_clear(ofpacts);\n+ put_decapsulation(mff_ovn_geneve, tun, ofpacts);\n+ put_resubmit(OFTABLE_LOCAL_OUTPUT, ofpacts);\n+\n+ ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG, 100, 0, &match,\n+ ofpacts, hc_uuid);\n+\n+ add_tunnel_ingress_icmp_need_frag_flows(tun, ofpacts, flow_table);\n+}\n+\n static void\n put_stack(enum mf_field_id field, struct ofpact_stack *stack)\n {\n@@ -3943,7 +3965,7 @@ physical_run(struct physical_ctx *p_ctx,\n struct chassis_tunnel *tun;\n HMAP_FOR_EACH (tun, hmap_node, p_ctx->chassis_tunnels) {\n add_tunnel_ingress_flows(tun, p_ctx->mff_ovn_geneve, flow_table,\n- &ofpacts);\n+ &ofpacts);\n }\n \n /* Process packets that arrive from flow-based tunnels. */\ndiff --git a/tests/ovn-controller-vtep.at b/tests/ovn-controller-vtep.at\nindex 961324bd2..caf53e291 100644\n--- a/tests/ovn-controller-vtep.at\n+++ b/tests/ovn-controller-vtep.at\n@@ -775,6 +775,10 @@ AT_CHECK([ovs-ofctl dump-flows br-int table=OFTABLE_PHY_TO_LOG | grep 'priority=\n priority=110,tun_id=0x<>,in_port=<> actions=move:NXM_NX_TUN_ID[[0..23]]->OXM_OF_METADATA[[0..23]],load:0x<>->NXM_NX_REG14[[0..14]],load:0x<>->NXM_NX_REG10[[1]],resubmit(,OFTABLE_LOG_INGRESS_PIPELINE)\n ])\n \n+# Skip processing ICMP \"packet too big\" errors in this table if the packet came from a VTEP tunnel.\n+AT_CHECK([ovs-ofctl dump-flows br-int table=OFTABLE_PHY_TO_LOG | \\\n+ grep -E 'icmp_type=3,icmp_code=4|icmp_type=2,icmp_code=0'], [1], [])\n+\n OVN_CONTROLLER_VTEP_STOP([], vtep1)\n OVN_CLEANUP([hv1])\n AT_CLEANUP\n", "prefixes": [ "ovs-dev" ] }