{"id":2231546,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2231546/?format=json","web_url":"http://patchwork.ozlabs.org/project/ovn/patch/20260430202314.228205-1-lucas.vdias@luizalabs.com/","project":{"id":68,"url":"http://patchwork.ozlabs.org/api/1.1/projects/68/?format=json","name":"Open Virtual Network development","link_name":"ovn","list_id":"ovs-dev.openvswitch.org","list_email":"ovs-dev@openvswitch.org","web_url":"http://openvswitch.org/","scm_url":"","webscm_url":""},"msgid":"<20260430202314.228205-1-lucas.vdias@luizalabs.com>","date":"2026-04-30T20:23:14","name":"[ovs-dev,v0] northd: Remove duplicate NAT flows from lr_in_ip_input.","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"1a5ea9fb9293b06c871beca865abeaa7669b0686","submitter":{"id":90169,"url":"http://patchwork.ozlabs.org/api/1.1/people/90169/?format=json","name":"Lucas Vargas Dias","email":"lucas.vdias@luizalabs.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/ovn/patch/20260430202314.228205-1-lucas.vdias@luizalabs.com/mbox/","series":[{"id":502376,"url":"http://patchwork.ozlabs.org/api/1.1/series/502376/?format=json","web_url":"http://patchwork.ozlabs.org/project/ovn/list/?series=502376","date":"2026-04-30T20:23:14","name":"[ovs-dev,v0] northd: Remove duplicate NAT flows from lr_in_ip_input.","version":0,"mbox":"http://patchwork.ozlabs.org/series/502376/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2231546/comments/","check":"fail","checks":"http://patchwork.ozlabs.org/api/patches/2231546/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=luizalabs.com header.i=@luizalabs.com\n header.a=rsa-sha256 header.s=google header.b=GKPdsNzW;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::137; helo=smtp4.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp4.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key,\n unprotected) header.d=luizalabs.com header.i=@luizalabs.com\n header.a=rsa-sha256 header.s=google header.b=GKPdsNzW","smtp1.osuosl.org; dmarc=pass (p=quarantine dis=none)\n header.from=luizalabs.com","smtp1.osuosl.org; dkim=pass (1024-bit key,\n unprotected) header.d=luizalabs.com header.i=@luizalabs.com\n header.a=rsa-sha256 header.s=google header.b=GKPdsNzW"],"Received":["from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g65GW0NrXz1yHZ\n\tfor ; Fri, 01 May 2026 06:23:29 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id DF71141D24;\n\tThu, 30 Apr 2026 20:23:26 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id faNEKwZw5Nu9; Thu, 30 Apr 2026 20:23:24 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp4.osuosl.org (Postfix) with ESMTPS id 8D07841D07;\n\tThu, 30 Apr 2026 20:23:24 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 71661C04E8;\n\tThu, 30 Apr 2026 20:23:24 +0000 (UTC)","from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 0411EC04E7\n for ; Thu, 30 Apr 2026 20:23:24 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id E3A78850BE\n for ; Thu, 30 Apr 2026 20:23:23 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id ebp4F4yRC6yH for ;\n Thu, 30 Apr 2026 20:23:22 +0000 (UTC)","from mail-dl1-x122b.google.com (mail-dl1-x122b.google.com\n [IPv6:2607:f8b0:4864:20::122b])\n by smtp1.osuosl.org (Postfix) with ESMTPS id 14BFA850BD\n for ; Thu, 30 Apr 2026 20:23:21 +0000 (UTC)","by mail-dl1-x122b.google.com with SMTP id\n a92af1059eb24-12c726f46baso2265081c88.1\n for ; Thu, 30 Apr 2026 13:23:21 -0700 (PDT)","from WNEC-73GS814.. ([186.237.124.211])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12df827a73fsm103000c88.1.2026.04.30.13.23.18\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Thu, 30 Apr 2026 13:23:19 -0700 (PDT)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections -\n client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp4.osuosl.org 8D07841D07","OpenDKIM Filter v2.11.0 smtp1.osuosl.org 14BFA850BD"],"Received-SPF":"Pass (mailfrom) identity=mailfrom;\n client-ip=2607:f8b0:4864:20::122b; helo=mail-dl1-x122b.google.com;\n envelope-from=lucas.vdias@luizalabs.com; receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp1.osuosl.org 14BFA850BD","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=luizalabs.com; s=google; t=1777580601; x=1778185401; darn=openvswitch.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=vBwETaeedhA0+6YgfGHT4+Mmwk3VsgZMAPFuY8WE2GA=;\n b=GKPdsNzWA40pvi6xGkjzxj3E/pK8+iJURlYCKvl1gQvWZPKrWdCUPt+JWhK+mYCpR/\n WdmKbu7CT6LcmDNJ6Xp38S2S+2hmgfU+Y5dV1usHuKHXjuJ1wrPwxfPBBtBrKhodA5ho\n aHKtZcCZW53Q6odkeSDyLsKkN7ZXJ0eaQ8vTk=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777580601; x=1778185401;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=vBwETaeedhA0+6YgfGHT4+Mmwk3VsgZMAPFuY8WE2GA=;\n b=FJdYN+QL9drzjA1EHst6LtTfh4J4cq+ppXKjl7MNyBSsvCmu/w82gadNNoDa8W14IR\n vOSB1TSi7EgTjrvj4Y5yPCmaRbKp/2nSO9QA+71UcNJfnRuxcODZ6ytSEWh2hAk7CbL8\n IlAxuFNrYeI18ryUrovwXFbOZKU27jqGjUSF6XQvLGV+lqzN0diA36IwCxIWc4Bl2Q6w\n ubHXEYh6ttCBsPFlf2x5mKV8R1uJuQedaM+0ogqo04o9AYA2eW2mASCKXfMEotuFtX4R\n ek5jyXhDavRplArt9WiG/Y92DbszjI9U0Tr1BZAps1pGck+RCVlPOOTMvZkEHucngwHF\n /9ug==","X-Gm-Message-State":"AOJu0Yz+pFu5aTu52X75z9mNh69zE4Y+3DkxG9xDWE089MzxpbOenBTN\n MceEuMdSqSRrgID+rKEgM0I7uIWY3sV6s+upYif47lht8Q1o38nOsOAcFCn6KfYCaBuNpgXpLK4\n SfZKgFlK7MZZX4B4NqvjZp2DVp3ITFZoXNo31L9GPJPIvpLDJJR//9fOszLAt","X-Gm-Gg":"AeBDiev4eLaAp7PMokz2sNzRlN/o48+OjXEDW5lqRB/DWCWCOfFbpVuf/uyHFJg5D5y\n dwug0PodNmnejP+YVHAD72doYza6BGvL3V98UjJST9bhpmoDEyS3jwBNfxfJcmJgTZKJ6P/IQ+A\n uw/u7jO8zI3EXId7WALppzfBb9891wF4wMhhEh0SxJyc69ODzE4j6sKYG0GiMRlR36Z42FvHjit\n 5jjqGghGv24sQhuzXI4kmqzop7kYDTnC+aR9oe1D6TF/do4H9x9mr2CjoVAxE7f0ZxAVLXchKa1\n ksX03k27+TS+cEBdNjolmWV1N9231Qu7fultZ6mcA2DIBKzfMgNkc2XR0nFeps19BrpjQq6B1+8\n HNu0OP+RpVMed6ZLltnv7AjXMt69TtXWGO+DqO/JzGrW4prHtE/7cu/4oc/Oh3xCQrqKVKcAT+D\n JkJ9b4LSJu21+cgQxS7oPFXL0b2DeUqybzLQj1RNKeqbf46Uw=","X-Received":"by 2002:a05:7022:1003:b0:12d:b2e9:b20f with SMTP id\n a92af1059eb24-12df82648a5mr41844c88.21.1777580599765;\n Thu, 30 Apr 2026 13:23:19 -0700 (PDT)","To":"dev@openvswitch.org","Date":"Thu, 30 Apr 2026 17:23:14 -0300","Message-ID":"<20260430202314.228205-1-lucas.vdias@luizalabs.com>","X-Mailer":"git-send-email 2.43.0","MIME-Version":"1.0","Subject":"[ovs-dev] [PATCH ovn v0] northd: Remove duplicate NAT flows from\n lr_in_ip_input.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Lucas Vargas Dias via dev ","Reply-To":"Lucas Vargas Dias ","Content-Type":"text/plain; charset=\"iso-8859-1\"","Content-Transfer-Encoding":"quoted-printable","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "},"content":"Optimize logical flow generation for NAT with distributed gateway ports by removing duplicate\npriority 90/91 flows and consolidating ARP/ND flow creation in build_lrouter_nat_arp_nd_flow().\nAdd chassis residency filtering for l3dgw ports so ARP/ND responses are generated only on the\ncorrect gateway chassis, reducing flow count while preserving behavior.\n\nSigned-off-by: Lucas Vargas Dias \n---\n northd/northd.c | 36 +++++++++++++----------\n tests/ovn-northd.at | 70 +++++++--------------------------------------\n 2 files changed, 31 insertions(+), 75 deletions(-)","diff":"diff --git a/northd/northd.c b/northd/northd.c\nindex 0b52db6cf..20546af6c 100644\n--- a/northd/northd.c\n+++ b/northd/northd.c\n@@ -14026,6 +14026,7 @@ build_lrouter_nd_flow(const struct ovn_datapath *od, struct ovn_port *op,\n \n static void\n build_lrouter_nat_arp_nd_flow(const struct ovn_datapath *od,\n+ struct ovn_port *op,\n struct ovn_nat *nat_entry,\n struct lflow_table *lflows,\n const struct shash *meter_groups,\n@@ -14033,16 +14034,20 @@ build_lrouter_nat_arp_nd_flow(const struct ovn_datapath *od,\n {\n struct lport_addresses *ext_addrs = &nat_entry->ext_addrs;\n const struct nbrec_nat *nat = nat_entry->nb;\n+ if (op && lrp_is_l3dgw(op) && (!op->peer || !op->peer->cr_port)) {\n+ return;\n+ }\n \n+ op = NULL;\n if (nat_entry_is_v6(nat_entry)) {\n- build_lrouter_nd_flow(od, NULL, \"nd_na\",\n+ build_lrouter_nd_flow(od, op, \"nd_na\",\n ext_addrs->ipv6_addrs[0].addr_s,\n ext_addrs->ipv6_addrs[0].sn_addr_s,\n REG_INPORT_ETH_ADDR, NULL, false, 90,\n &nat->header_, lflows, meter_groups,\n lflow_ref);\n } else {\n- build_lrouter_arp_flow(od, NULL,\n+ build_lrouter_arp_flow(od, op,\n ext_addrs->ipv4_addrs[0].addr_s,\n REG_INPORT_ETH_ADDR, NULL, false, 90,\n &nat->header_, lflows,\n@@ -14113,23 +14118,12 @@ build_lrouter_port_nat_arp_nd_flow(struct ovn_port *op,\n mac_s, &match, false, 92,\n &nat->header_, lflows, meter_groups,\n lflow_ref);\n- build_lrouter_nd_flow(op->od, op, \"nd_na\",\n- ext_addrs->ipv6_addrs[0].addr_s,\n- ext_addrs->ipv6_addrs[0].sn_addr_s,\n- mac_s, NULL, true, 91,\n- &nat->header_, lflows, meter_groups,\n- lflow_ref);\n } else {\n build_lrouter_arp_flow(op->od, op,\n ext_addrs->ipv4_addrs[0].addr_s,\n mac_s, &match, false, 92,\n &nat->header_, lflows,\n lflow_ref);\n- build_lrouter_arp_flow(op->od, op,\n- ext_addrs->ipv4_addrs[0].addr_s,\n- mac_s, NULL, true, 91,\n- &nat->header_, lflows,\n- lflow_ref);\n }\n \n ds_destroy(&match);\n@@ -16846,6 +16840,8 @@ build_lrouter_ipv4_default_ttl_expired_flows(\n ds_clear(&ip_ds);\n if (lrp_is_l3dgw(op)) {\n ds_put_cstr(&ip_ds, \"ip4.dst <-> ip4.src\");\n+ ds_put_format(match, \"is_chassis_resident(%s) && \",\n+ op->cr_port->json_key);\n } else {\n ds_put_format(&ip_ds, \"ip4.dst = ip4.src; ip4.src = %s\",\n op->lrp_networks.ipv4_addrs[i].addr_s);\n@@ -16922,6 +16918,8 @@ build_lrouter_ipv6_default_ttl_expired_flows(\n ds_clear(&ip_ds);\n if (lrp_is_l3dgw(op)) {\n ds_put_cstr(&ip_ds, \"ip6.dst <-> ip6.src\");\n+ ds_put_format(match, \"is_chassis_resident(%s) && \",\n+ op->cr_port->json_key);\n } else {\n ds_put_format(&ip_ds, \"ip6.dst = ip6.src; ip6.src = %s\",\n op->lrp_networks.ipv6_addrs[i].addr_s);\n@@ -17141,7 +17139,11 @@ build_lrouter_arp_nd_for_datapath(const struct ovn_datapath *od,\n if (nat_entry->type == SNAT) {\n continue;\n }\n- build_lrouter_nat_arp_nd_flow(od, nat_entry, lflows, meter_groups,\n+ struct ovn_port *op = NULL;\n+ if (nat_entry->l3dgw_port) {\n+ op = nat_entry->l3dgw_port;\n+ }\n+ build_lrouter_nat_arp_nd_flow(od, op, nat_entry, lflows, meter_groups,\n lflow_ref);\n }\n \n@@ -17157,7 +17159,11 @@ build_lrouter_arp_nd_for_datapath(const struct ovn_datapath *od,\n struct ovn_nat *nat_entry =\n CONTAINER_OF(ovs_list_front(&snat_ip->snat_entries),\n struct ovn_nat, ext_addr_list_node);\n- build_lrouter_nat_arp_nd_flow(od, nat_entry, lflows, meter_groups,\n+ struct ovn_port *op = NULL;\n+ if (nat_entry->l3dgw_port) {\n+ op = nat_entry->l3dgw_port;\n+ }\n+ build_lrouter_nat_arp_nd_flow(od, op, nat_entry, lflows, meter_groups,\n lflow_ref);\n }\n }\ndiff --git a/tests/ovn-northd.at b/tests/ovn-northd.at\nindex 1d7bd6c28..f065dda35 100644\n--- a/tests/ovn-northd.at\n+++ b/tests/ovn-northd.at\n@@ -2185,18 +2185,6 @@ action=(xreg0[[0..47]] = 00:00:00:00:01:00; next;)\n # Priority 90 flows (per router).\n AT_CHECK_UNQUOTED([ovn-sbctl lflow-list | grep -E \"lr_in_ip_input.*priority=90\" | grep \"arp\\|nd\" | ovn_strip_lflows], [0], [dnl\n table=??(lr_in_ip_input ), priority=90 , dnl\n-match=(arp.op == 1 && arp.tpa == 43.43.43.150), dnl\n-action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , dnl\n-match=(arp.op == 1 && arp.tpa == 43.43.43.2), dnl\n-action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , dnl\n-match=(arp.op == 1 && arp.tpa == 43.43.43.3), dnl\n-action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , dnl\n-match=(arp.op == 1 && arp.tpa == 43.43.43.4), dnl\n-action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , dnl\n match=(inport == \"lrp\" && arp.op == 1 && arp.tpa == \\$${lb_as_v4}), dnl\n action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=90 , dnl\n@@ -2225,19 +2213,10 @@ match=(inport == \"lrp-public\" && nd_ns && nd.target == \\$${lb_as_v6} && is_chass\n action=(nd_na { eth.src = xreg0[[0..47]]; ip6.src = nd.target; nd.tll = xreg0[[0..47]]; outport = inport; flags.loopback = 1; output; };)\n ])\n \n-# Priority 91 drop flows (per distributed gw port), if port is not resident.\n-AT_CHECK([ovn-sbctl lflow-list | grep -E \"lr_in_ip_input.*priority=91\" | grep \"arp\\|nd\" | ovn_strip_lflows], [0], [dnl\n- table=??(lr_in_ip_input ), priority=91 , dnl\n-match=(inport == \"lrp-public\" && arp.op == 1 && arp.tpa == 43.43.43.150), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , dnl\n-match=(inport == \"lrp-public\" && arp.op == 1 && arp.tpa == 43.43.43.2), dnl\n-action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , dnl\n-match=(inport == \"lrp-public\" && arp.op == 1 && arp.tpa == 43.43.43.3), dnl\n-action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , dnl\n-match=(inport == \"lrp-public\" && arp.op == 1 && arp.tpa == 43.43.43.4), dnl\n-action=(drop;)\n+# Priority 85 drop using the default drop from table lr_in_ip_input.\n+AT_CHECK([ovn-sbctl lflow-list | grep -E \"lr_in_ip_input.*priority=85\" | grep \"arp\\|nd\" | ovn_strip_lflows], [0], [dnl\n+ table=??(lr_in_ip_input ), priority=85 , dnl\n+match=(arp || nd), action=(drop;)\n ])\n \n # Priority 92 ARP/NS responders (per distributed gw port), if port is resident.\n@@ -8762,13 +8741,8 @@ check ovn-nbctl --wait=sb sync\n ovn-sbctl dump-flows DR > lrflows\n AT_CAPTURE_FILE([lrflows])\n \n-AT_CHECK([grep lr_in_ip_input lrflows | grep arp | grep -e 172.16.1.10 -e 10.0.0.10 -e 192.168.0.10 | ovn_strip_lflows], [0], [dnl\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 10.0.0.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.16.1.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 192.168.0.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 192.168.0.10), action=(drop;)\n+AT_CHECK([grep lr_in_ip_input lrflows | grep arp | grep -e 172.16.1.10 -e 10.0.0.10 -e 192.168.0.10 -e drop| ovn_strip_lflows], [0], [dnl\n+ table=??(lr_in_ip_input ), priority=85 , match=(arp || nd), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10 && is_chassis_resident(\"cr-DR-S1\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10 && is_chassis_resident(\"cr-DR-S2\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 192.168.0.10 && is_chassis_resident(\"cr-DR-S3\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n@@ -8810,12 +8784,8 @@ check ovn-nbctl --wait=sb sync\n ovn-sbctl dump-flows DR > lrflows\n AT_CAPTURE_FILE([lrflows])\n \n-AT_CHECK([grep lr_in_ip_input lrflows | grep arp | grep -e 172.16.1.10 -e 10.0.0.10 | ovn_strip_lflows], [0], [dnl\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 10.0.0.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.16.1.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 172.16.1.10), action=(drop;)\n+AT_CHECK([grep lr_in_ip_input lrflows | grep arp | grep -e 172.16.1.10 -e 10.0.0.10 -e drop| ovn_strip_lflows], [0], [dnl\n+ table=??(lr_in_ip_input ), priority=85 , match=(arp || nd), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10 && is_chassis_resident(\"cr-DR-S1\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10 && is_chassis_resident(\"cr-DR-S2\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 172.16.1.10 && is_chassis_resident(\"cr-DR-S3\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n@@ -8849,12 +8819,6 @@ ovn-sbctl dump-flows DR > lrflows\n AT_CAPTURE_FILE([lrflows])\n \n AT_CHECK([grep lr_in_ip_input lrflows | grep arp | grep -e 172.16.1.10 -e 10.0.0.10 -e 192.168.0.10 | ovn_strip_lflows], [0], [dnl\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 10.0.0.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.16.1.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 192.168.0.10), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 192.168.0.10), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S1\" && arp.op == 1 && arp.tpa == 172.16.1.10 && is_chassis_resident(\"cr-DR-S1\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S2\" && arp.op == 1 && arp.tpa == 10.0.0.10 && is_chassis_resident(\"cr-DR-S2\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"DR-S3\" && arp.op == 1 && arp.tpa == 192.168.0.10 && is_chassis_resident(\"cr-DR-S3\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n@@ -14245,9 +14209,9 @@ AT_CHECK([grep \"lr_in_ip_input\" lr0flows | ovn_strip_lflows], [0], [dnl\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw0\" && ip6 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp6 {eth.dst <-> eth.src; ip6.dst = ip6.src; ip6.src = fe80::200:ff:fe00:ff01; ip.ttl = 254; icmp6.type = 3; /* Time exceeded */ icmp6.code = 0; /* TTL exceeded in transit */ outport = \"lr0-sw0\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw1\" && ip4 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 20.0.0.1; ip.ttl = 254; outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw1\" && ip6 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp6 {eth.dst <-> eth.src; ip6.dst = ip6.src; ip6.src = fe80::200:ff:fe00:ff03; ip.ttl = 254; icmp6.type = 3; /* Time exceeded */ icmp6.code = 0; /* TTL exceeded in transit */ outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n- table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-public\" && ip4 && ip4.src == 172.168.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst <-> ip4.src ; ip.ttl = 254; outport = \"lr0-public\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-sw0\" && ip4 && ip4.src == 10.0.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 10.0.0.1 ; ip.ttl = 254; outport = \"lr0-sw0\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-sw1\" && ip4 && ip4.src == 20.0.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 20.0.0.1 ; ip.ttl = 254; outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n+ table=??(lr_in_ip_input ), priority=31 , match=(is_chassis_resident(\"cr-lr0-public\") && inport == \"lr0-public\" && ip4 && ip4.src == 172.168.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst <-> ip4.src ; ip.ttl = 254; outport = \"lr0-public\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=32 , match=(ip.ttl == {0, 1} && !ip.later_frag && (ip4.mcast || ip6.mcast)), action=(drop;)\n table=??(lr_in_ip_input ), priority=50 , match=(eth.bcast), action=(drop;)\n table=??(lr_in_ip_input ), priority=60 , match=(ip4.dst == {10.0.0.1}), action=(drop;)\n@@ -14260,9 +14224,6 @@ AT_CHECK([grep \"lr_in_ip_input\" lr0flows | ovn_strip_lflows], [0], [dnl\n table=??(lr_in_ip_input ), priority=83 , match=(ip6.mcast_rsvd), action=(drop;)\n table=??(lr_in_ip_input ), priority=84 , match=(nd_rs || nd_ra), action=(next;)\n table=??(lr_in_ip_input ), priority=85 , match=(arp || nd), action=(drop;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.100), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.110), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.120), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=90 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.10 && arp.spa == 172.168.0.0/24 && is_chassis_resident(\"cr-lr0-public\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=90 , match=(inport == \"lr0-public\" && ip6.dst == {fe80::200:ff:fe00:ff02, ff02::1:ff00:ff02} && nd_ns && nd.target == fe80::200:ff:fe00:ff02 && is_chassis_resident(\"cr-lr0-public\")), action=(nd_na_router { eth.src = xreg0[[0..47]]; ip6.src = nd.target; nd.tll = xreg0[[0..47]]; outport = inport; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=90 , match=(inport == \"lr0-sw0\" && arp.op == 1 && arp.tpa == 10.0.0.1 && arp.spa == 10.0.0.0/24), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n@@ -14275,9 +14236,6 @@ AT_CHECK([grep \"lr_in_ip_input\" lr0flows | ovn_strip_lflows], [0], [dnl\n table=??(lr_in_ip_input ), priority=90 , match=(ip6.dst == fe80::200:ff:fe00:ff01 && icmp6.type == 128 && icmp6.code == 0), action=(ip6.dst <-> ip6.src; ip.ttl = 255; icmp6.type = 129; flags.loopback = 1; next; )\n table=??(lr_in_ip_input ), priority=90 , match=(ip6.dst == fe80::200:ff:fe00:ff02 && icmp6.type == 128 && icmp6.code == 0), action=(ip6.dst <-> ip6.src; ip.ttl = 255; icmp6.type = 129; flags.loopback = 1; next; )\n table=??(lr_in_ip_input ), priority=90 , match=(ip6.dst == fe80::200:ff:fe00:ff03 && icmp6.type == 128 && icmp6.code == 0), action=(ip6.dst <-> ip6.src; ip.ttl = 255; icmp6.type = 129; flags.loopback = 1; next; )\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.100), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.100 && is_chassis_resident(\"cr-lr0-public\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110 && is_chassis_resident(\"sw0-port1\")), action=(eth.dst = eth.src; eth.src = 30:54:00:00:00:03; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = 30:54:00:00:00:03; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120 && is_chassis_resident(\"cr-lr0-public\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n@@ -14372,10 +14330,6 @@ AT_CHECK([grep -Fe \"172.168.0.110\" -e \"172.168.0.120\" -e \"10.0.0.3\" -e \"20.0.0.3\n table=??(lr_in_dnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.110 && inport == \"lr0-public\"), action=(ct_dnat(10.0.0.3);)\n table=??(lr_in_dnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.120 && inport == \"lr0-public\" && is_chassis_resident(\"cr-lr0-public\")), action=(ct_dnat(20.0.0.3);)\n table=??(lr_in_gw_redirect ), priority=100 , match=(ip4.src == 10.0.0.3 && outport == \"lr0-public\" && is_chassis_resident(\"sw0-port1\")), action=(eth.src = 30:54:00:00:00:03; reg5 = 172.168.0.110; next;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.110), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.120), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110 && is_chassis_resident(\"sw0-port1\")), action=(eth.dst = eth.src; eth.src = 30:54:00:00:00:03; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = 30:54:00:00:00:03; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120 && is_chassis_resident(\"cr-lr0-public\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_unsnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.110 && inport == \"lr0-public\"), action=(ct_snat;)\n@@ -14431,9 +14385,9 @@ AT_CHECK([grep \"lr_in_ip_input\" lr0flows | ovn_strip_lflows], [0], [dnl\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw0\" && ip6 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp6 {eth.dst <-> eth.src; ip6.dst = ip6.src; ip6.src = fe80::200:ff:fe00:ff01; ip.ttl = 254; icmp6.type = 3; /* Time exceeded */ icmp6.code = 0; /* TTL exceeded in transit */ outport = \"lr0-sw0\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw1\" && ip4 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 20.0.0.1; ip.ttl = 254; outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=30 , match=(inport == \"lr0-sw1\" && ip6 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp6 {eth.dst <-> eth.src; ip6.dst = ip6.src; ip6.src = fe80::200:ff:fe00:ff03; ip.ttl = 254; icmp6.type = 3; /* Time exceeded */ icmp6.code = 0; /* TTL exceeded in transit */ outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n- table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-public\" && ip4 && ip4.src == 172.168.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst <-> ip4.src ; ip.ttl = 254; outport = \"lr0-public\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-sw0\" && ip4 && ip4.src == 10.0.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 10.0.0.1 ; ip.ttl = 254; outport = \"lr0-sw0\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=31 , match=(inport == \"lr0-sw1\" && ip4 && ip4.src == 20.0.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst = ip4.src; ip4.src = 20.0.0.1 ; ip.ttl = 254; outport = \"lr0-sw1\"; flags.loopback = 1; output; };)\n+ table=??(lr_in_ip_input ), priority=31 , match=(is_chassis_resident(\"cr-lr0-public\") && inport == \"lr0-public\" && ip4 && ip4.src == 172.168.0.0/24 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded */ icmp4.code = 0; /* TTL exceeded in transit */ ip4.dst <-> ip4.src ; ip.ttl = 254; outport = \"lr0-public\"; flags.loopback = 1; output; };)\n table=??(lr_in_ip_input ), priority=32 , match=(ip.ttl == {0, 1} && !ip.later_frag && (ip4.mcast || ip6.mcast)), action=(drop;)\n table=??(lr_in_ip_input ), priority=50 , match=(eth.bcast), action=(drop;)\n table=??(lr_in_ip_input ), priority=60 , match=(ip4.dst == {10.0.0.1}), action=(drop;)\n@@ -14618,10 +14572,6 @@ AT_CHECK([grep -Fe \"172.168.0.110\" -e \"172.168.0.120\" -e \"10.0.0.3\" -e \"20.0.0.3\n table=??(lr_in_dnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.110 && inport == \"lr0-public\"), action=(ct_dnat(10.0.0.3);)\n table=??(lr_in_dnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.120 && inport == \"lr0-public\" && is_chassis_resident(\"cr-lr0-public\")), action=(ct_dnat(20.0.0.3);)\n table=??(lr_in_gw_redirect ), priority=100 , match=(ip4.src == 10.0.0.3 && outport == \"lr0-public\" && is_chassis_resident(\"sw0-port1\")), action=(eth.src = 30:54:00:00:00:03; reg5 = 172.168.0.110; next;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.110), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 172.168.0.120), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110), action=(drop;)\n- table=??(lr_in_ip_input ), priority=91 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120), action=(drop;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.110 && is_chassis_resident(\"sw0-port1\")), action=(eth.dst = eth.src; eth.src = 30:54:00:00:00:03; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = 30:54:00:00:00:03; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_ip_input ), priority=92 , match=(inport == \"lr0-public\" && arp.op == 1 && arp.tpa == 172.168.0.120 && is_chassis_resident(\"cr-lr0-public\")), action=(eth.dst = eth.src; eth.src = xreg0[[0..47]]; arp.op = 2; /* ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[[0..47]]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)\n table=??(lr_in_unsnat ), priority=100 , match=(ip && ip4.dst == 172.168.0.110 && inport == \"lr0-public\"), action=(ct_snat;)\n","prefixes":["ovs-dev","v0"]}