[{"id":3677691,"web_url":"http://patchwork.ozlabs.org/comment/3677691/","msgid":"","list_archive_url":null,"date":"2026-04-15T14:10:21","subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Skip conntrack for EVPN remote\n VTEP traffic.","submitter":{"id":83634,"url":"http://patchwork.ozlabs.org/api/people/83634/","name":"Ales Musil","email":"amusil@redhat.com"},"content":"On Wed, Apr 15, 2026 at 12:27 PM Dumitru Ceara wrote:\n\n> When a logical switch has stateful ACLs (allow-related) or load\n> balancers configured, all IP traffic is sent to conntrack in the\n> PRE_ACL and PRE_LB pipeline stages. Traffic from/to remote VTEPs\n> has no conntrack zone assigned, so conntrack lookups return\n> ct_state=+trk+inv, causing the traffic to be dropped.\n>\n> Fix this by adding priority-110 flows that bypass conntrack for\n> EVPN remote VTEP traffic, identified by the from_evpn_vtep and\n> to_evpn_vtep predicates. These predicates check bit 31 of the\n> logical inport/outport registers, which is always set for EVPN\n> binding keys (OVN_MIN_EVPN_KEY = 1 << 31).\n>\n> The EVPN skip in PRE_ACL is only added when stateful ACLs are\n> present (matching the existing pattern for localnet/router/switch\n> ports). The EVPN skip in PRE_LB is unconditional, unlike localnet\n> ports which are gated on !has_lb_vip -- remote VTEPs have no\n> conntrack zones so conntrack would always fail regardless of LB\n> configuration.\n>\n> Fixes: 9081afcf8698 (\"controller: Create physical flows based on EVPN\n> structures.\")\n> Reported-at: https://redhat.atlassian.net/browse/FDP-3462\n> Suggested-by: Ales Musil \n> Assisted-by: Claude, with model: claude-opus-4-6\n> Signed-off-by: Dumitru Ceara \n> ---\n>\n\nHi Dumitru,\n\nthank you for the v2. The Fixes seems to have wrong hash.\n\n\n> V2:\n> - Addressed Ales' comments:\n> - Register inport/outport backing fields as \"__inport\"/\"__outport\"\n> instead of dynamically computing \"reg14\"/\"reg15\" names.\n> - Use bit-index predicates (__inport[31]/__outport[31]) instead of\n> mask-based predicates (reg14 == 0x80000000/0x80000000).\n> - Extract the EVPN key bit position into OVN_EVPN_KEY_FLAG (31) in\n> ovn-util.h; redefine OVN_MIN_EVPN_KEY in terms of it.\n> - Fix \"action parsing\" test: reg15 is no longer a registered symbol,\n> so \"reg15 = get_fdb(eth.dst)\" must expect a syntax error again.\n> - Restore \"registers\" test to its pre-patch expected output (no\n> reg14/reg15 entries since they are no longer registered as symbols).\n> ---\n> lib/logical-fields.c | 15 +++++++\n> lib/ovn-util.c | 2 +-\n> lib/ovn-util.h | 3 +-\n> northd/northd.c | 37 ++++++++++++++++++\n> tests/multinode.at | 30 ++++++++++++++\n> tests/ovn-northd.at | 93 ++++++++++++++++++++++++++++++++++++++++++++\n> tests/ovn.at | 8 ++++\n> 7 files changed, 186 insertions(+), 2 deletions(-)\n>\n> diff --git a/lib/logical-fields.c b/lib/logical-fields.c\n> index 9b04762a17..807bb4db48 100644\n> --- a/lib/logical-fields.c\n> +++ b/lib/logical-fields.c\n> @@ -16,6 +16,7 @@\n> #include \n>\n> #include \"openvswitch/shash.h\"\n> +#include \"ovn-util.h\"\n> #include \"ovn/expr.h\"\n> #include \"ovn/logical-fields.h\"\n> #include \"ovs-thread.h\"\n> @@ -72,6 +73,20 @@ ovn_init_symtab(struct shash *symtab)\n> expr_symtab_add_string(symtab, \"inport\", MFF_LOG_INPORT, NULL);\n> expr_symtab_add_string(symtab, \"outport\", MFF_LOG_OUTPORT, NULL);\n>\n> + /* Also register the inport/outport backing registers as numeric\n> fields\n> + * so that predicates can reference specific bits (e.g., the EVPN key\n> + * indicator at bit 31). */\n> + expr_symtab_add_field(symtab, \"__inport\", MFF_LOG_INPORT, NULL,\n> false);\n> + expr_symtab_add_field(symtab, \"__outport\", MFF_LOG_OUTPORT, NULL,\n> false);\n> +\n> + /* Define predicates to identify traffic from/to remote VTEPs so that\n> + * northd can skip conntrack without hard-coding register indices. */\n> + char vtep_pred[16];\n> + snprintf(vtep_pred, sizeof vtep_pred, \"__inport[%d]\",\n> OVN_EVPN_KEY_FLAG);\n> + expr_symtab_add_predicate(symtab, \"from_evpn_vtep\", vtep_pred);\n> + snprintf(vtep_pred, sizeof vtep_pred, \"__outport[%d]\",\n> OVN_EVPN_KEY_FLAG);\n> + expr_symtab_add_predicate(symtab, \"to_evpn_vtep\", vtep_pred);\n> +\n> /* The port isn't reserved along the pipeline it's just defined as\n> symbol\n> * to support matching on string and moving between string registers.\n> */\n> expr_symtab_add_string(symtab, \"remote_outport\",\n> diff --git a/lib/ovn-util.c b/lib/ovn-util.c\n> index 65fdb3a59c..fb02825ac4 100644\n> --- a/lib/ovn-util.c\n> +++ b/lib/ovn-util.c\n> @@ -1027,7 +1027,7 @@ ip_address_and_port_from_lb_key(const char *key,\n> char **ip_address,\n> * NOTE: If OVN_NORTHD_PIPELINE_CSUM is updated make sure to double check\n> * whether an update of OVN_INTERNAL_MINOR_VER is required. */\n> #define OVN_NORTHD_PIPELINE_CSUM \"3760014456 11249\"\n> -#define OVN_INTERNAL_MINOR_VER 13\n> +#define OVN_INTERNAL_MINOR_VER 14\n>\n> /* Returns the OVN version. The caller must free the returned value. */\n> char *\n> diff --git a/lib/ovn-util.h b/lib/ovn-util.h\n> index 4ccf6dc2db..bcb344de44 100644\n> --- a/lib/ovn-util.h\n> +++ b/lib/ovn-util.h\n> @@ -183,7 +183,8 @@ struct ovsdb_idl_txn *run_idl_loop(struct\n> ovsdb_idl_loop *idl_loop,\n> #define OVN_MIN_DP_VXLAN_KEY_GLOBAL (OVN_MAX_DP_VXLAN_KEY_LOCAL + 1)\n> #define OVN_MAX_DP_VXLAN_KEY_GLOBAL ((1u << 12) - 1)\n>\n> -#define OVN_MIN_EVPN_KEY (1u << 31)\n> +#define OVN_EVPN_KEY_FLAG 31\n> +#define OVN_MIN_EVPN_KEY (1u << OVN_EVPN_KEY_FLAG)\n> #define OVN_MAX_EVPN_KEY (OVN_MAX_DP_GLOBAL_NUM | OVN_MIN_EVPN_KEY)\n>\n> struct hmap;\n> diff --git a/northd/northd.c b/northd/northd.c\n> index bc817073e2..0b52db6cf6 100644\n> --- a/northd/northd.c\n> +++ b/northd/northd.c\n> @@ -6418,6 +6418,31 @@ skip_port_from_conntrack(const struct ovn_datapath\n> *od, struct ovn_port *op,\n> free(egress_match);\n> }\n>\n> +/* Skip conntrack for traffic from/to EVPN remote VTEPs.\n> + * Remote VTEPs do not have conntrack zones assigned, so\n> + * conntrack lookups would return +trk+inv and cause drops. */\n> +static void\n> +skip_evpn_from_conntrack(const struct ovn_datapath *od,\n> + bool has_stateful_acl,\n> + const struct ovn_stage *in_stage,\n> + const struct ovn_stage *out_stage, uint16_t\n> priority,\n> + struct lflow_table *lflows,\n> + struct lflow_ref *lflow_ref)\n> +{\n> + if (!od->has_evpn_vni) {\n> + return;\n> + }\n> +\n> + const char *egress_action = has_stateful_acl\n> + ? \"next;\"\n> + : \"flags.pkt_sampled = 0; ct_clear;\n> next;\";\n> +\n> + ovn_lflow_add(lflows, od, in_stage, priority,\n> + \"from_evpn_vtep\", \"next;\", lflow_ref);\n> + ovn_lflow_add(lflows, od, out_stage, priority,\n> + \"to_evpn_vtep\", egress_action, lflow_ref);\n> +}\n> +\n> static void\n> build_stateless_filter(const struct ovn_datapath *od,\n> const struct nbrec_acl *acl,\n> @@ -6520,6 +6545,10 @@ build_ls_stateful_rec_pre_acls(\n> lflow_ref);\n> }\n>\n> + skip_evpn_from_conntrack(od, true,\n> + S_SWITCH_IN_PRE_ACL,\n> S_SWITCH_OUT_PRE_ACL,\n> + 110, lflows, lflow_ref);\n> +\n> /* stateless filters always take precedence over stateful ACLs. */\n> build_stateless_filters(od, ls_port_groups, lflows, lflow_ref);\n>\n> @@ -6751,6 +6780,14 @@ build_ls_stateful_rec_pre_lb(const struct\n> ls_stateful_record *ls_stateful_rec,\n> }\n> }\n>\n> + /* EVPN remote VTEPs do not have conntrack zones, so their traffic\n> + * must always skip conntrack regardless of whether LB VIPs are\n> + * configured. This differs from localnet ports which DO have\n> + * conntrack zones and can participate in load balancing. */\n> + skip_evpn_from_conntrack(od, ls_stateful_rec->has_stateful_acl,\n> + S_SWITCH_IN_PRE_LB, S_SWITCH_OUT_PRE_LB,\n> + 110, lflows, lflow_ref);\n> +\n> /* 'REGBIT_CONNTRACK_NAT' is set to let the pre-stateful table send\n> * packet to conntrack for defragmentation and possibly for unNATting.\n> *\n> diff --git a/tests/multinode.at b/tests/multinode.at\n> index c2587b68ae..d07660797c 100644\n> --- a/tests/multinode.at\n> +++ b/tests/multinode.at\n> @@ -3829,6 +3829,36 @@ OVS_WAIT_UNTIL([m_as ovn-gw-1 ip netns exec\n> fabric_workload ping -6 -W 1 -c 1 10\n> OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -W 1\n> -c 1 10.0.0.12])\n> OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -6 -W 1\n> -c 1 10::12])\n>\n> +AS_BOX([Check EVPN traffic with stateful ACLs])\n> +dnl Adding a stateful ACL should not break traffic from/to remote VTEPs.\n> +dnl Without the conntrack skip flows (from_evpn_vtep / to_evpn_vtep),\n> +dnl conntrack would return +trk+inv for VXLAN traffic and drop it.\n> +check multinode_nbctl --wait=hv \\\n> + -- acl-add ls from-lport 100 \"ip\" allow-related \\\n> + -- acl-add ls to-lport 100 \"ip\" allow-related\n> +\n> +dnl Verify fabric-to-workload pings still work with stateful ACL.\n> +OVS_WAIT_UNTIL([m_as ovn-gw-1 ip netns exec fabric_workload ping -W 1\n> -c 1 10.0.0.11])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-1 ip netns exec fabric_workload ping -6 -W 1\n> -c 1 10::11])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -W 1\n> -c 1 10.0.0.12])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -6 -W 1\n> -c 1 10::12])\n> +\n> +dnl Also add a load balancer and verify pings still work.\n> +check multinode_nbctl --wait=hv \\\n> + -- lb-add lb1 10.0.0.100:80 10.0.0.11:80 \\\n> + -- ls-lb-add ls lb1\n> +\n> +OVS_WAIT_UNTIL([m_as ovn-gw-1 ip netns exec fabric_workload ping -W 1\n> -c 1 10.0.0.11])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-1 ip netns exec fabric_workload ping -6 -W 1\n> -c 1 10::11])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -W 1\n> -c 1 10.0.0.12])\n> +OVS_WAIT_UNTIL([m_as ovn-gw-2 ip netns exec fabric_workload ping -6 -W 1\n> -c 1 10::12])\n> +\n> +dnl Cleanup ACL and LB.\n> +check multinode_nbctl --wait=hv \\\n> + -- acl-del ls \\\n> + -- ls-lb-del ls lb1 \\\n> + -- lb-del lb1\n> +\n> AS_BOX([Check type-2 MAC+IP EVPN route advertisements])\n> # Ping from the frr-ns to the fabric workload so that its IP is learned on\n> # the fabric EVPN peer (and advertised to OVN).\n> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at\n> index 796c30daf7..1d7bd6c288 100644\n> --- a/tests/ovn-northd.at\n> +++ b/tests/ovn-northd.at\n> @@ -19026,6 +19026,99 @@ OVN_CLEANUP_NORTHD\n> AT_CLEANUP\n> ])\n>\n> +OVN_FOR_EACH_NORTHD_NO_HV([\n> +AT_SETUP([LS EVPN conntrack skip with stateful ACLs and LBs])\n> +AT_KEYWORDS([dynamic-routing])\n> +ovn_start\n> +\n> +AS_BOX([EVPN switch, no ACLs or LBs])\n> +check ovn-nbctl --wait=sb \\\n> + -- ls-add ls-evpn \\\n> + -- set logical_switch ls-evpn other_config:dynamic-routing-vni=10 \\\n> + -- lsp-add ls-evpn lsp0 \\\n> + -- lsp-set-addresses lsp0 \"00:00:00:00:00:01 10.0.0.1\"\n> +\n> +ovn-sbctl dump-flows ls-evpn > lflows\n> +\n> +dnl No stateful ACL, so no EVPN skip flows in pre_acl.\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'from_evpn_vtep'], [1])\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'to_evpn_vtep'], [1])\n> +\n> +dnl pre_lb EVPN skip flows are always present for EVPN switches.\n> +AT_CHECK([grep 'pre_lb' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_lb ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_lb ), priority=110 , match=(to_evpn_vtep),\n> action=(flags.pkt_sampled = 0; ct_clear; next;)\n> +])\n> +\n> +AS_BOX([EVPN switch + stateful ACL])\n> +check ovn-nbctl --wait=sb acl-add ls-evpn from-lport 100 \"ip\"\n> allow-related\n> +\n> +ovn-sbctl dump-flows ls-evpn > lflows\n> +\n> +dnl Stateful ACL present, so EVPN skip flows appear in pre_acl.\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_acl ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_acl ), priority=110 , match=(to_evpn_vtep),\n> action=(next;)\n> +])\n> +\n> +dnl pre_lb EVPN skip flows with next; action (has_stateful_acl is true).\n> +AT_CHECK([grep 'pre_lb' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_lb ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_lb ), priority=110 , match=(to_evpn_vtep),\n> action=(next;)\n> +])\n> +\n> +AS_BOX([EVPN switch + LB only])\n> +check ovn-nbctl --wait=sb \\\n> + -- acl-del ls-evpn \\\n> + -- lb-add lb1 10.0.0.100:80 10.0.0.1:80 \\\n> + -- ls-lb-add ls-evpn lb1\n> +\n> +ovn-sbctl dump-flows ls-evpn > lflows\n> +\n> +dnl No stateful ACL, so no EVPN skip flows in pre_acl.\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'from_evpn_vtep'], [1])\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'to_evpn_vtep'], [1])\n> +\n> +dnl pre_lb EVPN skip flows with ct_clear egress (no stateful ACL).\n> +AT_CHECK([grep 'pre_lb' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_lb ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_lb ), priority=110 , match=(to_evpn_vtep),\n> action=(flags.pkt_sampled = 0; ct_clear; next;)\n> +])\n> +\n> +AS_BOX([EVPN switch + ACL + LB])\n> +check ovn-nbctl --wait=sb acl-add ls-evpn from-lport 100 \"ip\"\n> allow-related\n> +\n> +ovn-sbctl dump-flows ls-evpn > lflows\n> +\n> +dnl Stateful ACL present again, so EVPN skip flows appear in pre_acl.\n> +AT_CHECK([grep 'pre_acl' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_acl ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_acl ), priority=110 , match=(to_evpn_vtep),\n> action=(next;)\n> +])\n> +\n> +dnl pre_lb egress action is next; because has_stateful_acl is true.\n> +AT_CHECK([grep 'pre_lb' lflows | grep 'from_evpn_vtep\\|to_evpn_vtep' |\n> ovn_strip_lflows], [0], [dnl\n> + table=??(ls_in_pre_lb ), priority=110 , match=(from_evpn_vtep),\n> action=(next;)\n> + table=??(ls_out_pre_lb ), priority=110 , match=(to_evpn_vtep),\n> action=(next;)\n> +])\n> +\n> +AS_BOX([Non-EVPN switch + ACL])\n> +check ovn-nbctl --wait=sb \\\n> + -- ls-add ls-plain \\\n> + -- lsp-add ls-plain lsp1 \\\n> + -- lsp-set-addresses lsp1 \"00:00:00:00:00:02 10.0.0.2\" \\\n> + -- acl-add ls-plain from-lport 100 \"ip\" allow-related\n> +\n> +ovn-sbctl dump-flows ls-plain > lflows\n> +\n> +dnl Non-EVPN switch must not have any EVPN skip flows.\n> +AT_CHECK([grep 'from_evpn_vtep' lflows], [1])\n> +AT_CHECK([grep 'to_evpn_vtep' lflows], [1])\n> +\n> +OVN_CLEANUP_NORTHD\n> +AT_CLEANUP\n> +])\n> +\n> OVN_FOR_EACH_NORTHD_NO_HV([\n> AT_SETUP([Check network function])\n> ovn_start\n> diff --git a/tests/ovn.at b/tests/ovn.at\n> index cec3bb9a73..0d8c223cc8 100644\n> --- a/tests/ovn.at\n> +++ b/tests/ovn.at\n> @@ -128,6 +128,14 @@ xxreg1 = NXM_NX_XXREG1\n> ]])\n> AT_CLEANUP\n>\n> +dnl Check EVPN VTEP predicate definitions.\n> +AT_SETUP([EVPN VTEP fields])\n> +AT_CHECK([ovstest test-ovn dump-symtab | grep evpn_vtep | sort], [0],\n> +[[from_evpn_vtep = __inport[31]\n> +to_evpn_vtep = __outport[31]\n> +]])\n> +AT_CLEANUP\n> +\n> dnl Check that the OVN conntrack field definitions are correct.\n> AT_SETUP([conntrack fields])\n> AT_CHECK([ovstest test-ovn dump-symtab | grep ^ct | sort], [0],\n> --\n> 2.53.0\n>\n>\nI took care of the Fixes tag and applied it to main and 26.03.\nI skipped 25.09 as there was a bunch of test conflicts and\nin 25.09 EVPN was still experimental.\n\nRegards,\nAles","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ovs-dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=MFuTvBZM;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::133; helo=smtp2.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp2.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key)\n header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=MFuTvBZM","smtp4.osuosl.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","smtp4.osuosl.org;\n dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com\n header.a=rsa-sha256 header.s=mimecast20190719 header.b=MFuTvBZM"],"Received":["from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwjjX3f2Wz1yHc\n\tfor ; Thu, 16 Apr 2026 00:10:56 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp2.osuosl.org (Postfix) with ESMTP id B9ED54088E;\n\tWed, 15 Apr 2026 14:10:49 +0000 (UTC)","from smtp2.osuosl.org ([127.0.0.1])\n by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id eaOqPVgwJ0nE; Wed, 15 Apr 2026 14:10:48 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp2.osuosl.org (Postfix) with ESMTPS id 4DFED421EB;\n\tWed, 15 Apr 2026 14:10:48 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 2B361C0902;\n\tWed, 15 Apr 2026 14:10:48 +0000 (UTC)","from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])\n by lists.linuxfoundation.org (Postfix) with ESMTP id A96ABC0549\n for ; Wed, 15 Apr 2026 14:10:47 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp4.osuosl.org (Postfix) with ESMTP id 2E8B04AC55\n for ; Wed, 15 Apr 2026 14:10:42 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id psEa3R8Y3KHq for ;\n Wed, 15 Apr 2026 14:10:40 +0000 (UTC)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by smtp4.osuosl.org (Postfix) with ESMTPS id C1BFD4AC93\n for ; Wed, 15 Apr 2026 14:10:39 +0000 (UTC)","from mail-yw1-f199.google.com (mail-yw1-f199.google.com\n [209.85.128.199]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-297-x7MrSkTqNciK_7zOlcRVag-1; Wed, 15 Apr 2026 10:10:35 -0400","by mail-yw1-f199.google.com with SMTP id\n 00721157ae682-79a670a5fe9so175454617b3.1\n for ; Wed, 15 Apr 2026 07:10:35 -0700 (PDT)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections -\n client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp2.osuosl.org 4DFED421EB","OpenDKIM Filter v2.11.0 smtp4.osuosl.org C1BFD4AC93"],"Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=170.10.129.124;\n helo=us-smtp-delivery-124.mimecast.com; envelope-from=amusil@redhat.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp4.osuosl.org C1BFD4AC93","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776262238;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n in-reply-to:in-reply-to:references:references;\n bh=nGrsH9klI1wsabU/o7YcwgOM5wIdVnugbCkIVUC96vw=;\n b=MFuTvBZMIEZvCv08iCV/7Me5UMYqVZVg4OmdZB4nD8H1I3kDwf5YEs91JnMgLCesPAFwbs\n rgm/xXp/Re6TSXmiuV0uOzy13VwlByO74rwrV7ggX49DUhlGIDt8jGw/RPATwJXRhtgOfd\n Jb/T5J9oFksdvZ8Kmd/kAaFtVUYK6RA=","X-MC-Unique":"x7MrSkTqNciK_7zOlcRVag-1","X-Mimecast-MFC-AGG-ID":"x7MrSkTqNciK_7zOlcRVag_1776262235","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776262235; x=1776867035;\n h=cc:to:subject:message-id:date:from:in-reply-to:references\n :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=nGrsH9klI1wsabU/o7YcwgOM5wIdVnugbCkIVUC96vw=;\n b=a/y6eCAy8Wcgeiy5/8qJbzA07PNOHt0gVOHeTt+X13BLDalDRBCAnwVYMvRl9th85g\n 56LlYFpVaUR/BQACWNKYvw2KkcNH+ECK8bK05yoFfrqPM2FRXbpUScDODl7MjfGebGFP\n GSNM9W9T1rR7emqOMcCPZzR9sWOAZkzm+9dqrpzgUiCfP+4z3TmrjsbsHQKAMcq60963\n 3UNTaXaIxpgPZgpAE3PgwzzWjytA9FgLMeUev3e4V52bDo0eDAddLHv8sEqnGZU33qnt\n baKnSBzTJkVm0nSdW5gbtQWidSyvjOM4tyeYHPCq+qkah9AunK/4FnAaVWfiMFsqPDiJ\n a/4Q==","X-Gm-Message-State":"AOJu0YxafsibEGB0WSHhc+lqbVfrBMXfc2u9QvRL/tlZl8hOlgbiPJOx\n WhmBW5MpnyANihNB1Hyy3wqeZTl1KPddePezKFaYP7amYzNMRANWAOSUlztelYMopXMrs17qf8E\n GTzfZ3IIzPaMgIvIFw73k0Mwt7SOMQ9XIHmDjmoKJuVKoh+v0XF4w6D+gTtFqh3mYUtBlBWh08L\n oe9UCeqfK58qIEdJc1/CUXZV+LOkZp+XWA54IPuThCcQ==","X-Gm-Gg":"AeBDiesMVRo2MbaOoNXMS8SVnEqgRPWkm9H2ZEu4X9lgbEcT83pwfXyEUiqGmKcMdn4\n 3vAKxx2sMunWDy84WFxw/D7o4w4xDTevhf5ZgdNQcdsy5FESp8omgCsdSiWe+zxY5wrE9C3FH1A\n 7blQb80XoSEm+4JgQdbYTPN0J9/4FPEloPtRnKxm6gbn1v2YgKBuGoJmDkAMZ5c7xeaI7ytjLlV\n 9HAej7GqPP1dbQ52Km8elQ4ucgc2btIhBYk2q3uQueV08QRDN0caOycfEzJQhL+JZ4w4V4ZXwlN\n gAAcEfC63tjTbVCovngV5YNaaHkchGQ+Z0X3lmomXTG1YMUr10gzRbJ0NtZT6rGzVGgmpvHHmd2\n Codwv+buO+UVwWs/gtsfDyrISBg+Fk5/VzSaBBx/Im2FYS1/c0nsujG/9aQ==","X-Received":["by 2002:a05:690c:85:b0:79a:c630:c40b with SMTP id\n 00721157ae682-7af7233cd10mr237067267b3.48.1776262234448;\n Wed, 15 Apr 2026 07:10:34 -0700 (PDT)","by 2002:a05:690c:85:b0:79a:c630:c40b with SMTP id\n 00721157ae682-7af7233cd10mr237066527b3.48.1776262233705; Wed, 15 Apr 2026\n 07:10:33 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260415102733.1044923-1-dceara@redhat.com>","In-Reply-To":"<20260415102733.1044923-1-dceara@redhat.com>","Date":"Wed, 15 Apr 2026 16:10:21 +0200","X-Gm-Features":"AQROBzBDFV89SJoBzQp08jZX4MPTL0BpTaefCXlb0iiW6ku6sMvX2AgjwasryQI","Message-ID":"\n ","To":"Dumitru Ceara ","Cc":"ovs-dev@openvswitch.org","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"0JBdSv42ldAEK-ky6PcNzM6i8_WBrBsG6GXN04bv81Y_1776262235","X-Mimecast-Originator":"redhat.com","X-Content-Filtered-By":"Mailman/MimeDel 2.1.30","Subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Skip conntrack for EVPN remote\n VTEP traffic.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Ales Musil via dev ","Reply-To":"Ales Musil ","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "}},{"id":3677693,"web_url":"http://patchwork.ozlabs.org/comment/3677693/","msgid":"<13cdcb3c-04df-41c8-a535-d041014ba859@redhat.com>","list_archive_url":null,"date":"2026-04-15T14:12:20","subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Skip conntrack for EVPN remote\n VTEP traffic.","submitter":{"id":76591,"url":"http://patchwork.ozlabs.org/api/people/76591/","name":"Dumitru Ceara","email":"dceara@redhat.com"},"content":"On 4/15/26 4:10 PM, Ales Musil wrote:\n> On Wed, Apr 15, 2026 at 12:27 PM Dumitru Ceara wrote:\n> \n>> When a logical switch has stateful ACLs (allow-related) or load\n>> balancers configured, all IP traffic is sent to conntrack in the\n>> PRE_ACL and PRE_LB pipeline stages. Traffic from/to remote VTEPs\n>> has no conntrack zone assigned, so conntrack lookups return\n>> ct_state=+trk+inv, causing the traffic to be dropped.\n>>\n>> Fix this by adding priority-110 flows that bypass conntrack for\n>> EVPN remote VTEP traffic, identified by the from_evpn_vtep and\n>> to_evpn_vtep predicates. These predicates check bit 31 of the\n>> logical inport/outport registers, which is always set for EVPN\n>> binding keys (OVN_MIN_EVPN_KEY = 1 << 31).\n>>\n>> The EVPN skip in PRE_ACL is only added when stateful ACLs are\n>> present (matching the existing pattern for localnet/router/switch\n>> ports). The EVPN skip in PRE_LB is unconditional, unlike localnet\n>> ports which are gated on !has_lb_vip -- remote VTEPs have no\n>> conntrack zones so conntrack would always fail regardless of LB\n>> configuration.\n>>\n>> Fixes: 9081afcf8698 (\"controller: Create physical flows based on EVPN\n>> structures.\")\n>> Reported-at: https://redhat.atlassian.net/browse/FDP-3462\n>> Suggested-by: Ales Musil \n>> Assisted-by: Claude, with model: claude-opus-4-6\n>> Signed-off-by: Dumitru Ceara \n>> ---\n>>\n> \n> Hi Dumitru,\n> \n> thank you for the v2. The Fixes seems to have wrong hash.\n> \n\nHi Ales,\n\nSorry, my bad, I had used the has from a relatively random branch in my\nfork by accident.\n\n>>\n> I took care of the Fixes tag and applied it to main and 26.03.\n> I skipped 25.09 as there was a bunch of test conflicts and\n> in 25.09 EVPN was still experimental.\n>\n\nThanks a lot!\n\n\n> Regards,\n> Ales\n> \n\nRegards,\nDumitru","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ovs-dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Ku0myZ4o;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::133; helo=smtp2.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp2.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key)\n header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Ku0myZ4o","smtp3.osuosl.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","smtp3.osuosl.org;\n dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com\n header.a=rsa-sha256 header.s=mimecast20190719 header.b=Ku0myZ4o"],"Received":["from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwjlN69GRz1yHc\n\tfor ; Thu, 16 Apr 2026 00:12:32 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp2.osuosl.org (Postfix) with ESMTP id 38FC440793;\n\tWed, 15 Apr 2026 14:12:31 +0000 (UTC)","from smtp2.osuosl.org ([127.0.0.1])\n by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id HwSL5PGxpPSu; Wed, 15 Apr 2026 14:12:30 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56])\n\tby smtp2.osuosl.org (Postfix) with ESMTPS id 6471840615;\n\tWed, 15 Apr 2026 14:12:30 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 13C8CC054A;\n\tWed, 15 Apr 2026 14:12:30 +0000 (UTC)","from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 53964C0549\n for ; Wed, 15 Apr 2026 14:12:28 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp3.osuosl.org (Postfix) with ESMTP id 451926F66D\n for ; Wed, 15 Apr 2026 14:12:28 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id rNhrpF7cB3Gh for ;\n Wed, 15 Apr 2026 14:12:27 +0000 (UTC)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by smtp3.osuosl.org (Postfix) with ESMTPS id 32A0B6F663\n for ; Wed, 15 Apr 2026 14:12:26 +0000 (UTC)","from mail-wm1-f71.google.com (mail-wm1-f71.google.com\n [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-477-Xpb6UDfnOF6TYGZ7zGIotA-1; Wed, 15 Apr 2026 10:12:24 -0400","by mail-wm1-f71.google.com with SMTP id\n 5b1f17b1804b1-488dcaf2f2fso30387115e9.0\n for ; Wed, 15 Apr 2026 07:12:24 -0700 (PDT)","from ?IPV6:2001:1c05:1417:d800:d1ef:9817:2a26:625d?\n (2001-1c05-1417-d800-d1ef-9817-2a26-625d.cable.dynamic.v6.ziggo.nl.\n [2001:1c05:1417:d800:d1ef:9817:2a26:625d])\n by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-488f4352900sm597235e9.1.2026.04.15.07.12.21\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Wed, 15 Apr 2026 07:12:21 -0700 (PDT)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.9.56;\n helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp2.osuosl.org 6471840615","OpenDKIM Filter v2.11.0 smtp3.osuosl.org 32A0B6F663"],"Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=170.10.129.124;\n helo=us-smtp-delivery-124.mimecast.com; envelope-from=dceara@redhat.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp3.osuosl.org 32A0B6F663","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776262346;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=YbfFnJeYrA2pC5b+/Vzs2nfxbo6EOxB320hpcYCdT3I=;\n b=Ku0myZ4oc3R7OSgJML1igQiPfMHrItDO0Ewpqu/ZLFsqVye1Nip6vO3HZaU78jmvGW+40/\n jOH8WhRjmaQ3ewlhcrGFTFM8rlhy73QomFOqgs1FCPgd58pIYkp9BHuiZSMnS94Z6nh3sL\n MFBSsoALQjGkY1S0AZNy+8ZCTqyMaGQ=","X-MC-Unique":"Xpb6UDfnOF6TYGZ7zGIotA-1","X-Mimecast-MFC-AGG-ID":"Xpb6UDfnOF6TYGZ7zGIotA_1776262343","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776262342; x=1776867142;\n h=content-transfer-encoding:in-reply-to:content-language:from\n :references:cc:to:subject:user-agent:mime-version:date:message-id\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=YbfFnJeYrA2pC5b+/Vzs2nfxbo6EOxB320hpcYCdT3I=;\n b=r+3bdXTlLqVBw59lLw5gsbJ5O4V5R/fVNPYmOfpU9LSdHTpoUiuxkvkv/VEMtXgjiR\n 9j4PcxUr25aa4fu36DmGI8GXZ+mb1OCaVDBIGmDul/FnokxYdMNua2K2EpbruZNPyCB+\n gYb7EA7MU+mLByTuQY+Fp/f0vZ6jn9v0YQXHpuA5ZORmviUmamRf7ucTM3W/9lyMonK6\n uT+DhN89XtIec8q9aH4F6NLlsrEFM7v1gGGXbCesKLWiC3XEyNVYSVr7jWSbRXJmjEOG\n QBs49a9Og+Aw0hDfbynxtxrz2vKnJJcob7dV4dWD2UDrjweO0AdXJTtJp1EHdTp99wxb\n wX6w==","X-Gm-Message-State":"AOJu0YySZeh5Rh/UXInEdRH6ud8iQVkhBgdmisDa3TDJLlt3DT/9Nzr5\n U3PXlNzBA7SdQ/g4pYB+OLvtqNN8cTi12kGiuK7wa99aVIODeYLkf0ssgI64myY9ooI9Ok31zzE\n 5ClESZ22fwjk3Im5b+bwTCen5yTl/UOSGQiCtoOL5/XHMQ5qEMsaGcheuagizsYD2yTo=","X-Gm-Gg":"AeBDieu+BL/p7orBEvcliOI5Djt4P25PQXgvTk109HiEXK+7exyyvqcPlWS8khj5IHX\n 3FxYvjGHZTakv8xUoMgYESn1cZKOfXufhbZRUi9A1fTANCz09uQI110MAXK/KBRNwkXLA9j/Wbw\n bul1nc9AGrl33grrslvXi6VZi7vjYvX8PJJNB9gSB7PgI3qqb4rZOJAgPuTuyFGMasnC2Gb/RGv\n CWM4MKZN0xQmu/3lrFMFE74bsYLb+o2iofwA4bhPRhWbSheayZ+4RuektV4KLc/plK3+XrO19dg\n V6aTmqAafhy5MHuJvOLDoBJXDsGTc/uBLRdMPTr3tD3oC0ODM+MqgBQclcmjy/pR+YIChmb96zH\n nI5PnXMOho9JNAYwEpadenk/4svzTIfSsXYnJIRXbB9ghcI1OFEz1e3njVJTxx8FKGKvfoFevts\n Q1bI651C6LfrNEhtUmZlvObNu4enWHBKgmdb1OfH098FWaffWpb6uzTel0PnkDI8XzeYmx7OePF\n JUi5yMSpY4=","X-Received":["by 2002:a05:600c:64c4:b0:485:30d4:6b9e with SMTP id\n 5b1f17b1804b1-488d686c04fmr272268525e9.21.1776262342299;\n Wed, 15 Apr 2026 07:12:22 -0700 (PDT)","by 2002:a05:600c:64c4:b0:485:30d4:6b9e with SMTP id\n 5b1f17b1804b1-488d686c04fmr272267975e9.21.1776262341840;\n Wed, 15 Apr 2026 07:12:21 -0700 (PDT)"],"Message-ID":"<13cdcb3c-04df-41c8-a535-d041014ba859@redhat.com>","Date":"Wed, 15 Apr 2026 16:12:20 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","To":"Ales Musil ","Cc":"ovs-dev@openvswitch.org","References":"<20260415102733.1044923-1-dceara@redhat.com>\n ","In-Reply-To":"\n ","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"Ed6FBMtpDe9uGEn6BftLwtwGQqOBpylkO2MuFdruoeU_1776262343","X-Mimecast-Originator":"redhat.com","Content-Language":"en-US","Subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Skip conntrack for EVPN remote\n VTEP traffic.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Dumitru Ceara via dev ","Reply-To":"Dumitru Ceara ","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "}}]