From patchwork Thu Jul 22 18:08:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 1508829 X-Patchwork-Delegate: mmichels@redhat.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=DWHYTgO+; dkim-atps=neutral Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4GW0nh4F24z9sX5 for ; Fri, 23 Jul 2021 04:08:56 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id D503182C4D; Thu, 22 Jul 2021 18:08:53 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AI1vYzKPgi4U; Thu, 22 Jul 2021 18:08:52 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp1.osuosl.org (Postfix) with ESMTPS id F2BA0826C1; Thu, 22 Jul 2021 18:08:51 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id B1883C0010; Thu, 22 Jul 2021 18:08:51 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists.linuxfoundation.org (Postfix) with ESMTP id B8B1DC000E for ; Thu, 22 Jul 2021 18:08:50 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 92DB1600B5 for ; Thu, 22 Jul 2021 18:08:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Authentication-Results: smtp3.osuosl.org (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wJSAHFQPCiis for ; Thu, 22 Jul 2021 18:08:48 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by smtp3.osuosl.org (Postfix) with ESMTPS id 7F8C1600B4 for ; Thu, 22 Jul 2021 18:08:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1626977326; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BWxBHtMLe1hlc0DXenYu+3y5+LAT7Q5tYjfDRXeg8v4=; b=DWHYTgO+SzO0h6I37dwpr6WeQ3VH5OCl8CCAQYwJnJMvrQdW2A505gR/3glMOE2fC20n5l JA40g4MCBlDPrKti4A+/YSkg27BZZu2MVRgEgTkG1TTNwDLyiRDQmb0PpS0KrHCbmnP6K/ 2+TwduanrCVnY5V4X7PMsM78PysrgxE= Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-33-EboGfRKePOKvgFV30gLqxQ-1; Thu, 22 Jul 2021 14:08:45 -0400 X-MC-Unique: EboGfRKePOKvgFV30gLqxQ-1 Received: by mail-ed1-f72.google.com with SMTP id ee46-20020a056402292eb02903a1187e547cso3173284edb.0 for ; Thu, 22 Jul 2021 11:08:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=BWxBHtMLe1hlc0DXenYu+3y5+LAT7Q5tYjfDRXeg8v4=; b=tsNXxgn1/E/5+W6UlAmjiXqb2Bgz6l5qHM/mp8bO6sx+5bQpn1h9wVAo9GoeHD/rqc dsaQ8pQWENCIxZngH9yJHup/n4UJywFLB5li+rG4SnfQVnUmFmfntv5Ygkhni4a+UO7b As1N0xu4w4xHYeum1g4JtFuVBY5jYtlWU+MnDdbsiHmzqHZDe0YGp/8sMWWEnUryNyvn eKhPu5sOfgO+vrcyl/Yrkrzn0nxkQohXoVdLG28ZtmuQdW8aO0eRUlbuSiMDbZgEkngc aR1eDesMKIVA/JKd/AQqZnRzE/OBlJ7+Wue3crrRlpGp7KL89zo5k/H5z69iESvfHwne CQFg== X-Gm-Message-State: AOAM531wUtYTICf+B0xeqNHFW7sG0NChpZkmaLeR5QwcTdIKdX2hbUBm rHmf0d2aKasD+WBlTK9i+W8XmU4GBp2Uvl2qVeYBAyhBsWVhv3dI8wKKwSDRdh2ZnCv1yffcie4 pO/hHqEwU3UqFN0dPOpU9g5cX7lBG92dVIiBbewq42HQgZOATYnvP8ZvCuiDMkr8XMM6yuX959s 0= X-Received: by 2002:aa7:df12:: with SMTP id c18mr1061784edy.62.1626977322092; Thu, 22 Jul 2021 11:08:42 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzMKzxHuvJ+/b4bwkRbf7+3Xtb/l741Gao2Lv+lbJB6pIqwGR5xNDxPUu1Rh6IVnVeHVcipfw== X-Received: by 2002:aa7:df12:: with SMTP id c18mr1061760edy.62.1626977321801; Thu, 22 Jul 2021 11:08:41 -0700 (PDT) Received: from lore-desk.redhat.com (net-130-25-106-225.cust.vodafonedsl.it. [130.25.106.225]) by smtp.gmail.com with ESMTPSA id n26sm8237270eds.63.2021.07.22.11.08.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Jul 2021 11:08:41 -0700 (PDT) From: Lorenzo Bianconi To: dev@openvswitch.org Date: Thu, 22 Jul 2021 20:08:35 +0200 Message-Id: <2b20d506ad0bc5582f52a2ae1924456cbf201bec.1626976781.git.lorenzo.bianconi@redhat.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lorenzo.bianconi@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: dceara@redhat.com Subject: [ovs-dev] [PATCH v3 ovn] northd: do not centralized traffic for unclaimed virtual ports X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" Add a rule to drop traffic from a distributed NAT if the virtual port has not claimed yet becaused otherwise the traffic will be centralized misconfiguring the TOR switch. https://bugzilla.redhat.com/show_bug.cgi?id=1952961 Acked-by: Dumitru Ceara Co-authored-by: Numan Siddique Signed-off-by: Numan Siddique Signed-off-by: Lorenzo Bianconi Acked-by: Mark Michelson --- Changes since v2: - rebase on top of ovn master Changes since v1: - add northd documentation - add DDlog support (numan) --- northd/ovn-northd.8.xml | 7 +++++++ northd/ovn-northd.c | 22 +++++++++++++++++----- northd/ovn_northd.dl | 15 +++++++++++++++ tests/ovn.at | 26 ++++++++++++++++++++++++++ 4 files changed, 65 insertions(+), 5 deletions(-) diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml index 6599ba194..99a19f853 100644 --- a/northd/ovn-northd.8.xml +++ b/northd/ovn-northd.8.xml @@ -3784,6 +3784,13 @@ icmp6 { external ip and D is NAT external mac. +
  • + For each NAT rule in the OVN Northbound database that can + be handled in a distributed manner, a priority-80 logical flow + with drop action if the NAT logical port is a virtual port not + claimed by any chassis yet. +
    • +
  • A priority-50 logical flow with match outport == GW has actions diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c index af3e0bf87..1058c1c26 100644 --- a/northd/ovn-northd.c +++ b/northd/ovn-northd.c @@ -12045,7 +12045,8 @@ lrouter_check_nat_entry(struct ovn_datapath *od, const struct nbrec_nat *nat, /* NAT, Defrag and load balancing. */ static void build_lrouter_nat_defrag_and_lb(struct ovn_datapath *od, struct hmap *lflows, - struct ds *match, struct ds *actions) + struct hmap *ports, struct ds *match, + struct ds *actions) { if (!od->nbr) { return; @@ -12168,10 +12169,21 @@ build_lrouter_nat_defrag_and_lb(struct ovn_datapath *od, struct hmap *lflows, ds_clear(match); ds_clear(actions); ds_put_format(match, - "ip%s.src == %s && outport == %s && " - "is_chassis_resident(\"%s\")", + "ip%s.src == %s && outport == %s", is_v6 ? "6" : "4", nat->logical_ip, - od->l3dgw_port->json_key, nat->logical_port); + od->l3dgw_port->json_key); + /* Add a rule to drop traffic from a distributed NAT if + * the virtual port has not claimed yet becaused otherwise + * the traffic will be centralized misconfiguring the TOR switch. + */ + struct ovn_port *op = ovn_port_find(ports, nat->logical_port); + if (op && op->nbsp && !strcmp(op->nbsp->type, "virtual")) { + ovn_lflow_add_with_hint(lflows, od, S_ROUTER_IN_GW_REDIRECT, + 80, ds_cstr(match), "drop;", + &nat->header_); + } + ds_put_format(match, " && is_chassis_resident(\"%s\")", + nat->logical_port); ds_put_format(actions, "eth.src = %s; %s = %s; next;", nat->external_mac, is_v6 ? REG_SRC_IPV6 : REG_SRC_IPV4, @@ -12309,7 +12321,7 @@ build_lswitch_and_lrouter_iterate_by_od(struct ovn_datapath *od, &lsi->actions); build_misc_local_traffic_drop_flows_for_lrouter(od, lsi->lflows); build_lrouter_arp_nd_for_datapath(od, lsi->lflows); - build_lrouter_nat_defrag_and_lb(od, lsi->lflows, &lsi->match, + build_lrouter_nat_defrag_and_lb(od, lsi->lflows, lsi->ports, &lsi->match, &lsi->actions); } diff --git a/northd/ovn_northd.dl b/northd/ovn_northd.dl index bae34a6a1..ab33a139e 100644 --- a/northd/ovn_northd.dl +++ b/northd/ovn_northd.dl @@ -5807,6 +5807,10 @@ for (rp in &RouterPort(.router = &Router{._uuid = lr_uuid, .options = lr_options } } +relation VirtualLogicalPort(logical_port: Option) +VirtualLogicalPort(Some{logical_port}) :- + lsp in &nb::Logical_Switch_Port(.name = logical_port, .__type = "virtual"). + /* NAT rules are only valid on Gateway routers and routers with * l3dgw_port (router has a port with "redirect-chassis" * specified). */ @@ -6151,6 +6155,17 @@ for (r in &Router(._uuid = lr_uuid, .actions = actions, .external_ids = stage_hint(nat.nat._uuid)); + for (VirtualLogicalPort(nat.nat.logical_port)) { + Some{var gwport} = l3dgw_port in + Flow(.logical_datapath = lr_uuid, + .stage = s_ROUTER_IN_GW_REDIRECT(), + .priority = 80, + .__match = "${ipX}.src == ${nat.nat.logical_ip} && " + "outport == ${json_string_escape(gwport.name)}", + .actions = "drop;", + .external_ids = stage_hint(nat.nat._uuid)) + }; + /* Egress Loopback table: For NAT on a distributed router. * If packets in the egress pipeline on the distributed * gateway port have ip.dst matching a NAT external IP, then diff --git a/tests/ovn.at b/tests/ovn.at index 777409144..eaf344be9 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -17397,6 +17397,16 @@ send_arp_reply() { as hv$hv ovs-appctl netdev-dummy/receive hv${hv}-vif$inport $request } +send_icmp_packet() { + local inport=$1 hv=$2 eth_src=$3 eth_dst=$4 ipv4_src=$5 ipv4_dst=$6 ip_chksum=$7 data=$8 + shift 8 + + local ip_ttl=ff + local ip_len=001c + local packet=${eth_dst}${eth_src}08004500${ip_len}00004000${ip_ttl}01${ip_chksum}${ipv4_src}${ipv4_dst}${data} + as hv$hv ovs-appctl netdev-dummy/receive hv${hv}-vif$inport $packet +} + net_add n1 sim_add hv1 @@ -17611,6 +17621,22 @@ logical_port=sw0-vir) = x]) wait_row_count nb:Logical_Switch_Port 1 up=false name=sw0-vir check ovn-nbctl --wait=hv sync + +# verify the traffic from virtual port is discarded if the port is not claimed +AT_CHECK([grep lr_in_gw_redirect lr0-flows2 | grep "ip4.src == 10.0.0.10"], [0], [dnl + table=17(lr_in_gw_redirect ), priority=100 , match=(ip4.src == 10.0.0.10 && outport == "lr0-public" && is_chassis_resident("sw0-vir")), action=(eth.src = 10:54:00:00:00:10; reg1 = 172.168.0.50; next;) + table=17(lr_in_gw_redirect ), priority=80 , match=(ip4.src == 10.0.0.10 && outport == "lr0-public"), action=(drop;) +]) + +eth_src=505400000003 +eth_dst=00000000ff01 +ip_src=$(ip_to_hex 10 0 0 10) +ip_dst=$(ip_to_hex 172 168 0 101) +send_icmp_packet 1 1 $eth_src $eth_dst $ip_src $ip_dst c4c9 0000000000000000000000 +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | awk '/table=25, n_packets=1, n_bytes=45/{print $7" "$8}'],[0],[dnl +priority=80,ip,reg15=0x3,metadata=0x3,nw_src=10.0.0.10 actions=drop +]) + # hv1 should remove the flow for the ACL with is_chassis_redirect check for sw0-vir. check_virtual_offlows_not_present hv1