From patchwork Wed Aug 19 07:41:00 2020
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Numan Siddique
X-Patchwork-Id: 1347591
Return-Path:
X-Original-To: incoming@patchwork.ozlabs.org
Delivered-To: patchwork-incoming@bilbo.ozlabs.org
Authentication-Results: ozlabs.org;
spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org
(client-ip=140.211.166.137; helo=fraxinus.osuosl.org;
envelope-from=ovs-dev-bounces@openvswitch.org; receiver=)
Authentication-Results: ozlabs.org;
dmarc=none (p=none dis=none) header.from=ovn.org
Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by ozlabs.org (Postfix) with ESMTPS id 4BWfq36cxLz9sTY
for ; Wed, 19 Aug 2020 17:41:19 +1000 (AEST)
Received: from localhost (localhost [127.0.0.1])
by fraxinus.osuosl.org (Postfix) with ESMTP id C918185D7D;
Wed, 19 Aug 2020 07:41:17 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
Received: from fraxinus.osuosl.org ([127.0.0.1])
by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 7-cpI8PwbmR2; Wed, 19 Aug 2020 07:41:16 +0000 (UTC)
Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56])
by fraxinus.osuosl.org (Postfix) with ESMTP id BC41A85C11;
Wed, 19 Aug 2020 07:41:16 +0000 (UTC)
Received: from lf-lists.osuosl.org (localhost [127.0.0.1])
by lists.linuxfoundation.org (Postfix) with ESMTP id 9BCF4C0889;
Wed, 19 Aug 2020 07:41:16 +0000 (UTC)
X-Original-To: dev@openvswitch.org
Delivered-To: ovs-dev@lists.linuxfoundation.org
Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])
by lists.linuxfoundation.org (Postfix) with ESMTP id D0365C0051
for ; Wed, 19 Aug 2020 07:41:14 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by silver.osuosl.org (Postfix) with ESMTP id 9C26B20017
for ; Wed, 19 Aug 2020 07:41:14 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
Received: from silver.osuosl.org ([127.0.0.1])
by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id nJ-vjtsZ0p-O for ;
Wed, 19 Aug 2020 07:41:13 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net
[217.70.183.197])
by silver.osuosl.org (Postfix) with ESMTPS id CF7212000B
for ; Wed, 19 Aug 2020 07:41:12 +0000 (UTC)
X-Originating-IP: 27.7.101.229
Received: from nusiddiq.home.org.com (unknown [27.7.101.229])
(Authenticated sender: numans@ovn.org)
by relay5-d.mail.gandi.net (Postfix) with ESMTPSA id 65AAF1C000C;
Wed, 19 Aug 2020 07:41:07 +0000 (UTC)
From: numans@ovn.org
To: dev@openvswitch.org
Date: Wed, 19 Aug 2020 13:11:00 +0530
Message-Id: <20200819074100.2682036-1-numans@ovn.org>
X-Mailer: git-send-email 2.26.2
MIME-Version: 1.0
Subject: [ovs-dev] [PATCH ovn v3] northd: Fix the routing for external
logical ports of bridged logical switches.
X-BeenThere: ovs-dev@openvswitch.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id:
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
Errors-To: ovs-dev-bounces@openvswitch.org
Sender: "dev"
From: Numan Siddique
Routing for external logical ports is broken if these ports belonged
to bridged logical switches (with localnet port) and 'ovn-chassis-mac-mappings'
is configured. External logical ports are those which are external to OVN,
but there is a logical port for it and it is claimed by one of the HA chassis.
The claimed chassis provides routing and other native OVN serices like dhcp and dns.
When the external port sends ARP request for the router IP, the claimed chassis
replies for the ARP request, but the arp.sha is set to the actual router mac instead
of the chassis mac. This causes the traffic from external port VM/container to be handled
incorrectly. A ping to the router ip, is replied by all the chassis which can see this
packet instead of just the claimed HA chassis.
This patch fixes this issue by adding a logical flow to drop any packet from the external
ports destined to the router port mac on all the chassis except the claimed chassis.
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1829762
Reported-by: Daniel Alvarez
Suggested-by: Dumitru Ceara
Signed-off-by: Numan Siddique
Acked-by: Dumitru Ceara
---
northd/ovn-northd.8.xml | 11 +++++++++++
northd/ovn-northd.c | 13 +++++++++++++
tests/ovn.at | 7 +++++++
3 files changed, 31 insertions(+)
diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml
index ee21c825d..989e3643b 100644
--- a/northd/ovn-northd.8.xml
+++ b/northd/ovn-northd.8.xml
@@ -1161,6 +1161,17 @@ output;
which has claimed these external ports. All the other chassis,
drops these packets.
+
+
+ A priority-100 flow is added for each external
logical
+ port which doesn't reside on a chassis to drop any packet destined
+ to the router mac - with the match
+ inport == external &&
+ eth.src == E && eth.dst == R
+ && !is_chassis_resident("external")
+ where E is the external port mac and R is the
+ router port mac.
+
diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
index dc4592980..212de2f1f 100644
--- a/northd/ovn-northd.c
+++ b/northd/ovn-northd.c
@@ -6577,6 +6577,19 @@ build_drop_arp_nd_flows_for_unbound_router_ports(struct ovn_port *op,
ds_cstr(&match), "drop;",
&op->nbsp->header_);
}
+
+ ds_clear(&match);
+ ds_put_format(
+ &match, "inport == %s && eth.src == %s"
+ " && eth.dst == %s"
+ " && !is_chassis_resident(%s)",
+ port->json_key,
+ op->lsp_addrs[i].ea_s, rp->lsp_addrs[k].ea_s,
+ op->json_key);
+ ovn_lflow_add_with_hint(lflows, op->od,
+ S_SWITCH_IN_EXTERNAL_PORT,
+ 100, ds_cstr(&match), "drop;",
+ &op->nbsp->header_);
}
}
}
diff --git a/tests/ovn.at b/tests/ovn.at
index 9b250b02f..8aabdf307 100644
--- a/tests/ovn.at
+++ b/tests/ovn.at
@@ -14870,6 +14870,13 @@ OVS_WAIT_UNTIL(
logical_port=ls1-lp_ext1`
test "$chassis" = "$hv1_uuid"])
+# There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined
+# to router mac.
+AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \
+table=26,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \
+grep -c "actions=drop"], [0], [1
+])
+
# Stop ovn-controllers on hv1 and hv3.
as hv1 ovn-appctl -t ovn-controller exit
as hv3 ovn-appctl -t ovn-controller exit