From patchwork Fri May 15 15:49:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 1291439 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.137; helo=fraxinus.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=M+HxEcrL; dkim-atps=neutral Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49NtCY15Zzz9sRR for ; Sat, 16 May 2020 01:50:17 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 4201487DB7; Fri, 15 May 2020 15:50:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K4ZvUEYGeSQJ; Fri, 15 May 2020 15:50:10 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id DA6F987D8A; Fri, 15 May 2020 15:50:10 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id A9589C0859; Fri, 15 May 2020 15:50:10 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id 2B6A2C016F for ; Fri, 15 May 2020 15:50:09 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 0FA6789A80 for ; Fri, 15 May 2020 15:50:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vemL3aCfsN15 for ; Fri, 15 May 2020 15:50:04 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) by hemlock.osuosl.org (Postfix) with ESMTPS id 95AD889A82 for ; Fri, 15 May 2020 15:50:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1589557803; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N/1v7iKYiLsgY3bOWP/mpq4w4gJhSxIaS5utJBDDYFY=; b=M+HxEcrL5ECpoFVeQtCRba/9dOuAixDZiNmuWV4WOKRiGkjCoDFUCc1KymOoayw5cCo1yi Z5fEyZYQ8Kl64LxDdLjVFNYP+nwjNHrb92YDgQ0QzxkiYpXjxH8zv5H462Ft3HuGLmEOaN Z5XxwhNUDAj9r3CBpunGjCB2mFXw7e0= Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-200--fQLNgGqMHyR3KtuiP6Lgw-1; Fri, 15 May 2020 11:50:01 -0400 X-MC-Unique: -fQLNgGqMHyR3KtuiP6Lgw-1 Received: by mail-wm1-f72.google.com with SMTP id o8so629191wmd.0 for ; Fri, 15 May 2020 08:50:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=N/1v7iKYiLsgY3bOWP/mpq4w4gJhSxIaS5utJBDDYFY=; b=fXgzH/E7PHXECQ6knfvOCxeLJKKwPcbbgQUbAQsEWrtboTLJQRxnSXtWAj3w+jVNRp 2/jkXw0I+0PIPXdKBHH2LAgJDb2Tvb737Zg3XNGUHvKaC30gjYOlwxpmaRwdC90AW9K7 gtN6PF9e4qEdG32PzwgdvRICx+7PLUhzHegZjop79xYDjH+Vq4UYerpjTwZhLQ29++U+ GHpVfKePDuC49N0HcVAoeC7rAg97PnSyGQF5den1h2ypeaAbfTjEYiREMemEPbH1/n7I ulPqpxeB1TMsg8XePLORl4ipltxhGJRGNmYBxpUbHfdxxXNGvukrz7e4CIisHMeZxtZx Z24A== X-Gm-Message-State: AOAM532azg1ppID+WA0UMGRU3p7Ede5OHsqW1XYiNjSsdbfLcQIOwHo8 NJjnVxURw9AjUV8V4fOO5uMk3q/Y5uTiNa2U5FmvLaH36RUMf7SoDF83kTEsmlv6nnA2RRk782V aDtJT+Zn461VzHAsRYg== X-Received: by 2002:adf:cc81:: with SMTP id p1mr4717053wrj.192.1589557799649; Fri, 15 May 2020 08:49:59 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxePVn2YwRak6JMYAn5YW0pMHFYqvHXgbPouzhGGpfnuDkirOd5Gc7zdRHinnAIqAsRPOjGlQ== X-Received: by 2002:adf:cc81:: with SMTP id p1mr4717011wrj.192.1589557799109; Fri, 15 May 2020 08:49:59 -0700 (PDT) Received: from localhost.localdomain.com ([151.48.155.206]) by smtp.gmail.com with ESMTPSA id d6sm4835694wra.63.2020.05.15.08.49.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2020 08:49:58 -0700 (PDT) From: Lorenzo Bianconi To: ovs-dev@openvswitch.org Date: Fri, 15 May 2020 17:49:49 +0200 Message-Id: X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: hzhou@ovn.org, jlibosva@redhat.com Subject: [ovs-dev] [RFC ovn] ovn: introduce IP_SRC_POLICY stage in ingress router pipeline X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" In order to fix the issues introduced by commit c0bf32d72f8b ("Manage ARP process locally in a DVR scenario "), restore previous configuration of table 9 in ingress router pipeline and introduce a new stage called 'ip_src_policy' used to set the src address info in order to not distribute FIP traffic if DVR is enabled Fixes: c0bf32d72f8b ("Manage ARP process locally in a DVR scenario ") Signed-off-by: Lorenzo Bianconi --- northd/ovn-northd.8.xml | 65 ++++++++++++++++++++--------------------- northd/ovn-northd.c | 38 ++++++++++-------------- tests/ovn.at | 28 +++++------------- 3 files changed, 54 insertions(+), 77 deletions(-) diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml index 8f224b07f..09dbb52b4 100644 --- a/northd/ovn-northd.8.xml +++ b/northd/ovn-northd.8.xml @@ -2484,37 +2484,6 @@ output;

-
  • -

    - For distributed logical routers where one of the logical router ports - specifies a redirect-chassis, a priority-400 logical - flow for each dnat_and_snat NAT rules configured. - These flows will allow to properly forward traffic to the external - connections if available and avoid sending it through the tunnel. - Assuming the following NAT rule has been configured: -

    - - 
    -external_ip = A;
-external_mac = B;
-logical_ip = C;
-
    - -

    - the following action will be applied: -

    - - 
    -ip.ttl--;
-reg0 = ip.dst;
-reg1 = A;
-eth.src = B;
-outport = router-port;
-next;
-
    - -
    • -

  • IPv4 routing table. For each route to IPv4 network N with @@ -2660,7 +2629,35 @@ outport = P;

    • -

    Ingress Table 12: ARP/ND Resolution

    +

    Ingress Table 12: IP Source Policy

    + +

    + This table contains for distributed logical routers where one of + the logical router ports specifies a redirect-chassis, + a priority-100 logical flow for each dnat_and_snat + NAT rules configured. + These flows will allow to properly forward traffic to the external + connections if available and avoid sending it through the tunnel. + Assuming the following NAT rule has been configured: +

    + + 
    +external_ip = A;
+external_mac = B;
+logical_ip = C;
+
    + +

    + the following action will be applied: +

    + + 
    +reg1 = A;
+eth.src = B;
+next;
+
    + +

    Ingress Table 13: ARP/ND Resolution

    Any packet that reaches this table is an IP packet whose next-hop @@ -2819,7 +2816,7 @@ outport = P; -

    Ingress Table 13: Check packet length

    +

    Ingress Table 14: Check packet length

    For distributed logical routers with distributed gateway port configured @@ -2849,7 +2846,7 @@ REGBIT_PKT_LARGER = check_pkt_larger(L); next; and advances to the next table.

    -

    Ingress Table 14: Handle larger packets

    +

    Ingress Table 15: Handle larger packets

    For distributed logical routers with distributed gateway port configured diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c index 3c0070ea7..d5f3997a9 100644 --- a/northd/ovn-northd.c +++ b/northd/ovn-northd.c @@ -175,11 +175,12 @@ enum ovn_stage { PIPELINE_STAGE(ROUTER, IN, IP_ROUTING, 9, "lr_in_ip_routing") \ PIPELINE_STAGE(ROUTER, IN, IP_ROUTING_ECMP, 10, "lr_in_ip_routing_ecmp") \ PIPELINE_STAGE(ROUTER, IN, POLICY, 11, "lr_in_policy") \ - PIPELINE_STAGE(ROUTER, IN, ARP_RESOLVE, 12, "lr_in_arp_resolve") \ - PIPELINE_STAGE(ROUTER, IN, CHK_PKT_LEN , 13, "lr_in_chk_pkt_len") \ - PIPELINE_STAGE(ROUTER, IN, LARGER_PKTS, 14,"lr_in_larger_pkts") \ - PIPELINE_STAGE(ROUTER, IN, GW_REDIRECT, 15, "lr_in_gw_redirect") \ - PIPELINE_STAGE(ROUTER, IN, ARP_REQUEST, 16, "lr_in_arp_request") \ + PIPELINE_STAGE(ROUTER, IN, IP_SRC_POLICY, 12, "lr_in_ip_src_policy") \ + PIPELINE_STAGE(ROUTER, IN, ARP_RESOLVE, 13, "lr_in_arp_resolve") \ + PIPELINE_STAGE(ROUTER, IN, CHK_PKT_LEN , 14, "lr_in_chk_pkt_len") \ + PIPELINE_STAGE(ROUTER, IN, LARGER_PKTS, 15,"lr_in_larger_pkts") \ + PIPELINE_STAGE(ROUTER, IN, GW_REDIRECT, 16, "lr_in_gw_redirect") \ + PIPELINE_STAGE(ROUTER, IN, ARP_REQUEST, 17, "lr_in_arp_request") \ \ /* Logical router egress stages. */ \ PIPELINE_STAGE(ROUTER, OUT, UNDNAT, 0, "lr_out_undnat") \ @@ -7103,8 +7104,6 @@ build_routing_policy_flow(struct hmap *lflows, struct ovn_datapath *od, ds_destroy(&actions); } -/* default logical flow prioriry for distributed routes */ -#define DROUTE_PRIO 400 struct parsed_route { struct ovs_list list_node; struct v46_ip prefix; @@ -7493,7 +7492,7 @@ build_ecmp_route_flow(struct hmap *lflows, struct ovn_datapath *od, } static void -add_distributed_routes(struct hmap *lflows, struct ovn_datapath *od) +add_ip_src_policy_flows(struct hmap *lflows, struct ovn_datapath *od) { struct ds actions = DS_EMPTY_INITIALIZER; struct ds match = DS_EMPTY_INITIALIZER; @@ -7511,12 +7510,9 @@ add_distributed_routes(struct hmap *lflows, struct ovn_datapath *od) is_ipv4 ? "4" : "6", nat->logical_ip, nat->logical_port); char *prefix = is_ipv4 ? "" : "xx"; - ds_put_format(&actions, "outport = %s; eth.src = %s; " - "%sreg0 = ip%s.dst; %sreg1 = %s; next;", - od->l3dgw_port->json_key, nat->external_mac, - prefix, is_ipv4 ? "4" : "6", - prefix, nat->external_ip); - ovn_lflow_add(lflows, od, S_ROUTER_IN_IP_ROUTING, DROUTE_PRIO, + ds_put_format(&actions, "eth.src = %s; %sreg1 = %s; next;", + nat->external_mac, prefix, nat->external_ip); + ovn_lflow_add(lflows, od, S_ROUTER_IN_IP_SRC_POLICY, 100, ds_cstr(&match), ds_cstr(&actions)); ds_clear(&match); ds_clear(&actions); @@ -7547,12 +7543,6 @@ add_route(struct hmap *lflows, const struct ovn_port *op, } build_route_match(op_inport, network_s, plen, is_src_route, is_ipv4, &match, &priority); - /* traffic for internal IPs of logical switch ports must be sent to - * the gw controller through the overlay tunnels - */ - if (op->nbrp && !op->nbrp->n_gateway_chassis) { - priority += DROUTE_PRIO; - } struct ds actions = DS_EMPTY_INITIALIZER; ds_put_format(&actions, "ip.ttl--; "REG_ECMP_GROUP_ID" = 0; %sreg0 = ", @@ -9519,9 +9509,13 @@ build_lrouter_flows(struct hmap *datapaths, struct hmap *ports, * logical router */ HMAP_FOR_EACH (od, key_node, datapaths) { - if (od->nbr && od->l3dgw_port) { - add_distributed_routes(lflows, od); + if (!od->nbr) { + continue; + } + if (od->l3dgw_port) { + add_ip_src_policy_flows(lflows, od); } + ovn_lflow_add(lflows, od, S_ROUTER_IN_IP_SRC_POLICY, 0, "1", "next;"); } /* Logical router ingress table IP_ROUTING & IP_ROUTING_ECMP: IP Routing. diff --git a/tests/ovn.at b/tests/ovn.at index f39fda2e4..fcc34fd5d 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -9637,20 +9637,6 @@ AT_CHECK([as hv3 ovs-vsctl set Open_vSwitch . external-ids:ovn-bridge-mappings=p OVS_WAIT_UNTIL([test 1 = `as hv3 ovs-vsctl show | \ grep "Port patch-br-int-to-ln_port" | wc -l`]) -AT_CHECK([test 1 = `ovn-sbctl dump-flows lr0 | grep lr_in_ip_routing | \ -grep "ip4.src == 10.0.0.3 && is_chassis_resident(\"foo1\")" -c`]) -AT_CHECK([test 1 = `ovn-sbctl dump-flows lr0 | grep lr_in_ip_routing | \ -grep "ip4.src == 10.0.0.4 && is_chassis_resident(\"foo2\")" -c`]) - -key=`ovn-sbctl --bare --columns tunnel_key list datapath_Binding lr0` -# Check that the OVS flows appear for the dnat_and_snat entries in -# lr_in_ip_routing table. -OVS_WAIT_UNTIL([test 1 = `as hv3 ovs-ofctl dump-flows br-int table=17 | \ -grep "priority=400,ip,metadata=0x$key,nw_src=10.0.0.3" -c`]) - -OVS_WAIT_UNTIL([test 1 = `as hv3 ovs-ofctl dump-flows br-int table=17 | \ -grep "priority=400,ip,metadata=0x$key,nw_src=10.0.0.4" -c`]) - # Re-add nat-addresses option ovn-nbctl lsp-set-options lrp0-rp router-port=lrp0 nat-addresses="router" @@ -15141,7 +15127,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ # Since the sw0-vir is not claimed by any chassis, eth.dst should be set to # zero if the ip4.dst is the virtual ip in the router pipeline. AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 00:00:00:00:00:00; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 00:00:00:00:00:00; next;) ]) ip_to_hex() { @@ -15192,7 +15178,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ # There should be an arp resolve flow to resolve the virtual_ip with the # sw0-p1's MAC. AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:03; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:03; next;) ]) # Forcibly clear virtual_parent. ovn-controller should release the binding @@ -15233,7 +15219,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ # There should be an arp resolve flow to resolve the virtual_ip with the # sw0-p2's MAC. AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:05; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:05; next;) ]) # send the garp from sw0-p2 (in hv2). hv2 should claim sw0-vir @@ -15256,7 +15242,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ # There should be an arp resolve flow to resolve the virtual_ip with the # sw0-p3's MAC. AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:04; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:04; next;) ]) # Now send arp reply from sw0-p1. hv1 should claim sw0-vir @@ -15277,7 +15263,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ > lflows.txt AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:03; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:03; next;) ]) # Delete hv1-vif1 port. hv1 should release sw0-vir @@ -15295,7 +15281,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ > lflows.txt AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 00:00:00:00:00:00; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 00:00:00:00:00:00; next;) ]) # Now send arp reply from sw0-p2. hv2 should claim sw0-vir @@ -15316,7 +15302,7 @@ ovn-sbctl dump-flows lr0 | grep lr_in_arp_resolve | grep "reg0 == 10.0.0.10" \ > lflows.txt AT_CHECK([cat lflows.txt], [0], [dnl - table=12(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:04; next;) + table=13(lr_in_arp_resolve ), priority=100 , match=(outport == "lr0-sw0" && reg0 == 10.0.0.10), action=(eth.dst = 50:54:00:00:00:04; next;) ]) # Delete sw0-p2 logical port