From patchwork Fri Feb 14 10:42:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dumitru Ceara X-Patchwork-Id: 1237967 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.133; helo=hemlock.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=LufvHn31; dkim-atps=neutral Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 48JqhS30Hlz9sNg for ; Fri, 14 Feb 2020 21:42:31 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 50C4F87C3F; Fri, 14 Feb 2020 10:42:29 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XlGkvaL7XyJn; Fri, 14 Feb 2020 10:42:28 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by hemlock.osuosl.org (Postfix) with ESMTP id 2C82A85ACC; Fri, 14 Feb 2020 10:42:28 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 1AA9FC08A4; Fri, 14 Feb 2020 10:42:28 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id EF425C0177 for ; Fri, 14 Feb 2020 10:42:26 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id D84DE85B1C for ; Fri, 14 Feb 2020 10:42:26 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kf9f0mUcxVJa for ; Fri, 14 Feb 2020 10:42:25 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) by hemlock.osuosl.org (Postfix) with ESMTPS id AD18485ACC for ; Fri, 14 Feb 2020 10:42:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1581676944; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QfVRvN0y/6aXOGHymERNe3nj+k253DaSWAy9FOSuHdw=; b=LufvHn3162DGbC8BaQxkobgARRfT/dZhKsBFjFatoIqgibpIud1o3fTtxLoMbqpgI9M8Gm vPeQet9tyFHFP/XrFvohdOsnaFy1gqwZ19Pe1qhLdUp/6GLq93rAQg1eO3gyv1b5YqOaKs ahDhSQ0S2dj6hvjADprhr0UOPRfTr20= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-315-uVBl8jgDNkGw6ipeYue_bw-1; Fri, 14 Feb 2020 05:42:19 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 33F2B10CE7B0 for ; Fri, 14 Feb 2020 10:42:18 +0000 (UTC) Received: from dceara.remote.csb (ovpn-117-149.ams2.redhat.com [10.36.117.149]) by smtp.corp.redhat.com (Postfix) with ESMTP id AC89E9009E; Fri, 14 Feb 2020 10:42:16 +0000 (UTC) From: Dumitru Ceara To: dev@openvswitch.org Date: Fri, 14 Feb 2020 11:42:11 +0100 Message-Id: <1581676931-1957-1-git-send-email-dceara@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-MC-Unique: uVBl8jgDNkGw6ipeYue_bw-1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: lmartins@redhat.com Subject: [ovs-dev] [PATCH ovn] ovn-northd: Fix IP local multicast flooding. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" Skip IGMP and MLD entries learned for local multicast groups when generating logical flows. We still allow ovn-controller to learn them as it might be useful information for administrators to see that hosts register for the groups even though they are not expected to send JOIN messages for this range. Fixes: ddc64665b678 ("OVN: Add ovn-northd IGMP support") Reported-by: Lucas Alvares Gomes Reported-at: https://bugzilla.redhat.com/1803008 Signed-off-by: Dumitru Ceara Acked-by: Mark Michelson --- northd/ovn-northd.c | 15 +++++++ tests/ovn.at | 119 +++++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 109 insertions(+), 25 deletions(-) diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c index 46521b5..6d95ee2 100644 --- a/northd/ovn-northd.c +++ b/northd/ovn-northd.c @@ -6608,6 +6608,15 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, &igmp_group->datapath->mcast_info.sw; if (IN6_IS_ADDR_V4MAPPED(&igmp_group->address)) { + /* RFC 4541, section 2.1.2, item 2: Skip groups in the 224.0.0.X + * range. + */ + ovs_be32 group_address = + in6_addr_get_mapped_ipv4(&igmp_group->address); + if (ip_is_local_multicast(group_address)) { + continue; + } + if (mcast_sw_info->active_v4_flows >= mcast_sw_info->table_size) { continue; } @@ -6615,6 +6624,12 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, ds_put_format(&match, "eth.mcast && ip4 && ip4.dst == %s ", igmp_group->mcgroup.name); } else { + /* RFC 4291, section 2.7.1: Skip groups that correspond to all + * hosts. + */ + if (ipv6_is_all_hosts(&igmp_group->address)) { + continue; + } if (mcast_sw_info->active_v6_flows >= mcast_sw_info->table_size) { continue; } diff --git a/tests/ovn.at b/tests/ovn.at index ff9a732..d2f1101 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -15434,7 +15434,7 @@ ovn-nbctl set Logical_Switch sw1 \ other_config:mcast_snoop="true" # No IGMP query should be generated by sw1 (mcast_querier="false"). -truncate -s 0 expected +> expected OVN_CHECK_PACKETS([hv1/vif1-tx.pcap], [expected]) OVN_CHECK_PACKETS([hv1/vif2-tx.pcap], [expected]) OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) @@ -15454,14 +15454,14 @@ send_igmp_v3_report hv2-vif1 hv2 000000000002 $(ip_to_hex 10 0 0 2) f9f9 \ # Check that the IGMP Group is learned on both hv. OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "2" ]) # Send traffic and make sure it gets forwarded only on the two ports that # joined. -truncate -s 0 expected -truncate -s 0 expected_empty +> expected +> expected_empty send_ip_multicast_pkt hv1-vif2 hv1 \ 000000000001 01005e000144 \ $(ip_to_hex 10 0 0 42) $(ip_to_hex 239 0 1 68) 1e 20 ca70 11 \ @@ -15486,15 +15486,15 @@ send_igmp_v3_report hv1-vif1 hv1 \ # Check IGMP_Group table on both HV. OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "1" ]) # Send traffic and make sure it gets forwarded only on the port that joined. as hv1 reset_pcap_file hv1-vif1 hv1/vif1 as hv2 reset_pcap_file hv2-vif1 hv2/vif1 -truncate -s 0 expected -truncate -s 0 expected_empty +> expected +> expected_empty send_ip_multicast_pkt hv1-vif2 hv1 \ 000000000001 01005e000144 \ $(ip_to_hex 10 0 0 42) $(ip_to_hex 239 0 1 68) 1e 20 ca70 11 \ @@ -15514,10 +15514,43 @@ OVN_CHECK_PACKETS([hv2/vif3-tx.pcap], [expected_empty]) # Flush IGMP groups. ovn-sbctl ip-multicast-flush sw1 OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "0" ]) +# Check that traffic for 224.0.0.X is flooded even if some hosts register for +# it. +# Inject IGMP Join for 224.0.0.42 on sw1-p11. +send_igmp_v3_report hv1-vif1 hv1 \ + 000000000001 $(ip_to_hex 10 0 0 1) f9f8 \ + $(ip_to_hex 224 0 0 42) 04 f9d3 \ + /dev/null + +# Check that the IGMP Group is learned. +OVS_WAIT_UNTIL([ + total_entries=`ovn-sbctl find IGMP_Group | grep "224.0.0.42" -c` + test "${total_entries}" = "1" +]) + +# Send traffic and make sure it gets flooded to all ports. +as hv1 reset_pcap_file hv1-vif1 hv1/vif1 +as hv1 reset_pcap_file hv1-vif2 hv1/vif2 +as hv2 reset_pcap_file hv2-vif1 hv2/vif1 +as hv2 reset_pcap_file hv2-vif2 hv2/vif2 +> expected +send_ip_multicast_pkt hv1-vif2 hv1 \ + 000000000001 01005e000144 \ + $(ip_to_hex 10 0 0 42) $(ip_to_hex 224 0 0 42) 1e 01 f989 11 \ + e518e518000a4b540000 +store_ip_multicast_pkt \ + 000000000001 01005e000144 \ + $(ip_to_hex 10 0 0 42) $(ip_to_hex 224 0 0 42) 1e 01 f989 11 \ + e518e518000a4b540000 expected + +OVN_CHECK_PACKETS([hv1/vif1-tx.pcap], [expected]) +OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) +OVN_CHECK_PACKETS([hv2/vif2-tx.pcap], [expected]) + # Enable IGMP snooping and querier on sw2 and set query interval to minimum. ovn-nbctl set Logical_Switch sw2 \ other_config:mcast_snoop="true" \ @@ -15527,7 +15560,7 @@ ovn-nbctl set Logical_Switch sw2 \ other_config:mcast_ip4_src="20.0.0.254" # Wait for 1 query interval (1 sec) and check that two queries are generated. -truncate -s 0 expected +> expected store_igmp_v3_query 0000000002fe $(ip_to_hex 20 0 0 254) 84dd expected store_igmp_v3_query 0000000002fe $(ip_to_hex 20 0 0 254) 84dd expected @@ -15545,7 +15578,7 @@ ovn-nbctl set Logical_Switch sw3 \ other_config:mcast_snoop="true" # Send traffic from sw3 and make sure rtr doesn't relay it. -truncate -s 0 expected_empty +> expected_empty as hv1 reset_pcap_file hv1-vif1 hv1/vif1 as hv1 reset_pcap_file hv1-vif2 hv1/vif2 @@ -15589,15 +15622,15 @@ send_igmp_v3_report hv2-vif3 hv2 \ # Check that the IGMP Group is learned by all switches. OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "2" ]) # Send traffic from sw3 and make sure it is relayed by rtr. # to ports that joined. -truncate -s 0 expected_routed_sw1 -truncate -s 0 expected_routed_sw2 -truncate -s 0 expected_empty +> expected_routed_sw1 +> expected_routed_sw2 +> expected_empty as hv1 reset_pcap_file hv1-vif1 hv1/vif1 as hv1 reset_pcap_file hv1-vif2 hv1/vif2 @@ -15638,16 +15671,16 @@ send_igmp_v3_report hv1-vif4 hv1 \ # Check that the IGMP Group is learned by all switches. OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "3" ]) # Send traffic from sw3 and make sure it is relayed by rtr # to ports that joined. -truncate -s 0 expected_routed_sw1 -truncate -s 0 expected_routed_sw2 -truncate -s 0 expected_switched -truncate -s 0 expected_empty +> expected_routed_sw1 +> expected_routed_sw2 +> expected_switched +> expected_empty as hv1 reset_pcap_file hv1-vif1 hv1/vif1 as hv1 reset_pcap_file hv1-vif2 hv1/vif2 @@ -15689,7 +15722,7 @@ ovn-sbctl ip-multicast-flush sw1 ovn-sbctl ip-multicast-flush sw2 ovn-sbctl ip-multicast-flush sw3 OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "0" ]) @@ -15702,10 +15735,10 @@ as hv2 reset_pcap_file hv2-vif2 hv2/vif2 as hv2 reset_pcap_file hv2-vif3 hv2/vif3 as hv2 reset_pcap_file hv2-vif4 hv2/vif4 -truncate -s 0 expected_empty -truncate -s 0 expected_switched -truncate -s 0 expected_routed -truncate -s 0 expected_reports +> expected_empty +> expected_switched +> expected_routed +> expected_reports # Enable mcast_flood on sw1-p11 ovn-nbctl set Logical_Switch_Port sw1-p11 options:mcast_flood='true' @@ -15727,7 +15760,7 @@ send_igmp_v3_report hv1-vif2 hv1 \ # Check that the IGMP Group is learned. OVS_WAIT_UNTIL([ - total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" | wc -l` + total_entries=`ovn-sbctl find IGMP_Group | grep "239.0.1.68" -c` test "${total_entries}" = "1" ]) @@ -16077,6 +16110,42 @@ OVS_WAIT_UNTIL([ test "${total_entries}" = "0" ]) +# Check that traffic for "all-hosts" is flooded even if some hosts register +# for it. +# Inject MLD Join for ff02::1 on sw1-p11. +send_mld_v2_report hv1-vif1 hv1 \ + 000000000001 10000000000000000000000000000001 \ + ff020000000000000000000000000001 04 5e8a \ + /dev/null + +# Check that the Multicast Group is learned. +OVS_WAIT_UNTIL([ + total_entries=`ovn-sbctl find IGMP_Group | grep "ff02::1" -c` + test "${total_entries}" = "1" +]) + +# Send traffic and make sure it gets flooded to all ports. +as hv1 reset_pcap_file hv1-vif1 hv1/vif1 +as hv1 reset_pcap_file hv1-vif2 hv1/vif2 +as hv2 reset_pcap_file hv2-vif1 hv2/vif1 +as hv2 reset_pcap_file hv2-vif2 hv2/vif2 +> expected +send_ip_multicast_pkt hv1-vif2 hv1 \ + 000000000001 333300000001 \ + 10000000000000000000000000000042 ff020000000000000000000000000001 \ + 000e 01 11 \ + 93407a69000eb90361736461640a +store_ip_multicast_pkt \ + 000000000001 333300000001 \ + 10000000000000000000000000000042 ff020000000000000000000000000001 \ + 000e 01 11 \ + 93407a69000eb90361736461640a \ + expected + +OVN_CHECK_PACKETS([hv1/vif1-tx.pcap], [expected]) +OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) +OVN_CHECK_PACKETS([hv2/vif2-tx.pcap], [expected]) + # Enable multicast snooping and querier on sw2 and set query interval to # minimum. ovn-nbctl set Logical_Switch sw2 \