| Message ID | 83230852f6430353c4ee1fd49f422d0e08a78f13.1706626208.git.lorenzo.bianconi@redhat.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [ovs-dev] northd: Add qos packet marking. | expand |
| Context | Check | Description |
|---|---|---|
| ovsrobot/apply-robot | warning | apply and check: warning |
| ovsrobot/github-robot-_Build_and_Test | fail | github build: failed |
| ovsrobot/github-robot-_ovn-kubernetes | success | github build: passed |
| ovsrobot/github-robot-_Build_and_Test | fail | github build: failed |
| ovsrobot/github-robot-_ovn-kubernetes | success | github build: passed |
Recheck-request: github-robot
On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < lorenzo.bianconi@redhat.com> wrote: > Add the capbility to mark (through pkt.mark) incoming/outgoing packets > in logical_switch datapath according to user configured QoS rule. > > Co-developed-by: Dumitru Ceara <dceara@redhat.com> > Reported-at: https://issues.redhat.com/browse/FDP-42 > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > --- > Hi Lorenzo and Dumitru, I have one question, would it be possible to use existing QOS_MARK by moving it after the lb/stateful stage in ingress/egress? Even if both dscp and mark are set at the same time the action could set both in one logical flow. That being said, we might even collapse all QoS stages into one that will be a combination of dscp/mark/set_meter WDYT? However, I might have missed something crucial why it isn't possible. > NEWS | 2 + > controller/lflow.h | 15 +- > lib/ovn-util.h | 2 +- > northd/northd.c | 55 +++-- > northd/ovn-northd.8.xml | 60 ++++-- > ovn-nb.ovsschema | 9 +- > ovn-nb.xml | 12 +- > tests/ovn-controller.at | 308 +++++++++++++-------------- > tests/ovn-nbctl.at | 8 +- > tests/ovn-northd.at | 103 ++++++--- > tests/ovn.at | 429 +++++++++++++++++++++++--------------- > tests/system-ovn.at | 12 +- > utilities/ovn-nbctl.8.xml | 3 + > utilities/ovn-nbctl.c | 27 ++- > 14 files changed, 627 insertions(+), 418 deletions(-) > > diff --git a/NEWS b/NEWS > index 6553bd078..7300345f1 100644 > --- a/NEWS > +++ b/NEWS > @@ -18,6 +18,8 @@ Post v23.09.0 > - Support selecting encapsulation IP based on the source/destination > VIF's > settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more > details. > + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets > + in the logical switch datapath according to user configured QoS rule. > > OVN v23.09.0 - 15 Sep 2023 > -------------------------- > diff --git a/controller/lflow.h b/controller/lflow.h > index 9b7ffa19c..f7f6c7950 100644 > --- a/controller/lflow.h > +++ b/controller/lflow.h > @@ -67,17 +67,20 @@ struct uuid; > > /* Start of LOG_PIPELINE_LEN tables. */ > #define OFTABLE_LOG_INGRESS_PIPELINE 8 > -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > -#define OFTABLE_REMOTE_OUTPUT 39 > -#define OFTABLE_LOCAL_OUTPUT 40 > -#define OFTABLE_CHECK_LOOPBACK 41 > +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > +#define OFTABLE_REMOTE_OUTPUT 44 > +#define OFTABLE_LOCAL_OUTPUT 45 > +#define OFTABLE_CHECK_LOOPBACK 46 > > /* Start of the OUTPUT section of the pipeline. */ > #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT > +BUILD_ASSERT_DECL( > + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT > +); > > /* Start of LOG_PIPELINE_LEN tables. */ > -#define OFTABLE_LOG_EGRESS_PIPELINE 42 > +#define OFTABLE_LOG_EGRESS_PIPELINE 47 > #define OFTABLE_SAVE_INPORT 64 > #define OFTABLE_LOG_TO_PHY 65 > #define OFTABLE_MAC_BINDING 66 > diff --git a/lib/ovn-util.h b/lib/ovn-util.h > index 2afff0d07..3e1d68cf9 100644 > --- a/lib/ovn-util.h > +++ b/lib/ovn-util.h > @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( > #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) > > /* The number of tables for the ingress and egress pipelines. */ > -#define LOG_PIPELINE_LEN 29 > +#define LOG_PIPELINE_LEN 30 > > static inline uint32_t > hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) > diff --git a/northd/northd.c b/northd/northd.c > index d2091d4bc..597d203ca 100644 > --- a/northd/northd.c > +++ b/northd/northd.c > @@ -134,22 +134,23 @@ enum ovn_stage { > PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") > \ > PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") > \ > PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") > \ > - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") > \ > - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") > \ > - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") > \ > - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ > + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") > \ > + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") > \ > + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") > \ > + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") > \ > + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ > "ls_in_acl_after_lb_eval") \ > - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ > + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ > "ls_in_acl_after_lb_action") \ > - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") > \ > - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") > \ > - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") > \ > - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") > \ > - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") > \ > - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") > \ > - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") > \ > - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") > \ > - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") > \ > + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") > \ > + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") > \ > + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") > \ > + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") > \ > + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") > \ > + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") > \ > + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") > \ > + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") > \ > + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") > \ > > \ > /* Logical switch egress stages. */ > \ > PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") > \ > @@ -161,8 +162,9 @@ enum ovn_stage { > PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") > \ > PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") > \ > PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") > \ > - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, > "ls_out_check_port_sec") \ > - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, > "ls_out_apply_port_sec") \ > + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") > \ > + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, > "ls_out_check_port_sec") \ > + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, > "ls_out_apply_port_sec") \ > \ > /* Logical router ingress stages. */ \ > PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") > \ > @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct > chassis_features *features, > ds_destroy(&actions); > } > > +#define QOS_MAX_DSCP 63 > + > static void > build_qos(struct ovn_datapath *od, struct hmap *lflows) { > struct ds action = DS_EMPTY_INITIALIZER; > @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap > *lflows) { > ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); > ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); > ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); > + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); > + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); > > for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { > struct nbrec_qos *qos = od->nbs->qos_rules[i]; > bool ingress = !strcmp(qos->direction, "from-lport") ? true > :false; > enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : > S_SWITCH_OUT_QOS_MARK; > + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); > int64_t rate = 0; > int64_t burst = 0; > > for (size_t j = 0; j < qos->n_action; j++) { > if (!strcmp(qos->key_action[j], "dscp")) { > + if (qos->value_action[j] > QOS_MAX_DSCP) { > + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " > + UUID_FMT, qos->value_action[j], > + UUID_ARGS(&qos->header_.uuid)); > + continue; > + } > + > ds_clear(&action); > ds_put_format(&action, "ip.dscp = %"PRId64"; next;", > qos->value_action[j]); > @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap > *lflows) { > qos->priority, > qos->match, ds_cstr(&action), > &qos->header_); > + } else if (!strcmp(qos->key_action[j], "mark")) { > + ds_clear(&action); > + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", > + qos->value_action[j]); > + ovn_lflow_add_with_hint(lflows, od, > + ingress ? S_SWITCH_IN_QOS_PKT_MARK > + : S_SWITCH_OUT_QOS_PKT_MARK, > + qos->priority, qos->match, ds_cstr(&action), > + &qos->header_); > } > } > > diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml > index 068d47e1a..c1cd19947 100644 > --- a/northd/ovn-northd.8.xml > +++ b/northd/ovn-northd.8.xml > @@ -1082,7 +1082,28 @@ > </li> > </ul> > > - <h3>Ingress Table 15: Pre-Hairpin</h3> > + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> > + > + <p> > + Logical flows in this table closely reproduce those in the > + <code>QoS</code> table with the <code>action</code> column set in > + the <code>OVN_Northbound</code> database for the > + <code>from-lport</code> direction. > + </p> > + > + <ul> > + <li> > + For every qos_rules entry in a logical switch with packet marking > + enabled, a flow will be added at the priority mentioned in the > + QoS table. > + </li> > + > + <li> > + A priority-0 flow that simply moves traffic to the next table. > + </li> > + </ul> > + > + <h3>Ingress Table 16: Pre-Hairpin</h3> > <ul> > <li> > If the logical switch has load balancer(s) configured, then a > @@ -1100,7 +1121,7 @@ > </li> > </ul> > > - <h3>Ingress Table 16: Nat-Hairpin</h3> > + <h3>Ingress Table 17: Nat-Hairpin</h3> > <ul> > <li> > If the logical switch has load balancer(s) configured, then a > @@ -1135,7 +1156,7 @@ > </li> > </ul> > > - <h3>Ingress Table 17: Hairpin</h3> > + <h3>Ingress Table 18: Hairpin</h3> > <ul> > <li> > <p> > @@ -1173,7 +1194,7 @@ > </li> > </ul> > > - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after > LB</h3> > + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after > LB</h3> > > <p> > Logical flows in this table closely reproduce those in the > @@ -1257,7 +1278,7 @@ > </li> > </ul> > > - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> > + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> > > <p> > Logical flows in this table decide how to proceed based on the > values of > @@ -1297,7 +1318,7 @@ > </li> > </ul> > > - <h3>Ingress Table 20: Stateful</h3> > + <h3>Ingress Table 21: Stateful</h3> > > <ul> > <li> > @@ -1320,7 +1341,7 @@ > </li> > </ul> > > - <h3>Ingress Table 21: ARP/ND responder</h3> > + <h3>Ingress Table 22: ARP/ND responder</h3> > > <p> > This table implements ARP/ND responder in a logical switch for known > @@ -1653,7 +1674,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 22: DHCP option processing</h3> > + <h3>Ingress Table 23: DHCP option processing</h3> > > <p> > This table adds the DHCPv4 options to a DHCPv4 packet from the > @@ -1714,7 +1735,7 @@ next; > </li> > </ul> > > - <h3>Ingress Table 23: DHCP responses</h3> > + <h3>Ingress Table 24: DHCP responses</h3> > > <p> > This table implements DHCP responder for the DHCP replies generated > by > @@ -1795,7 +1816,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 24 DNS Lookup</h3> > + <h3>Ingress Table 25 DNS Lookup</h3> > > <p> > This table looks up and resolves the DNS names to the corresponding > @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; > </li> > </ul> > > - <h3>Ingress Table 25 DNS Responses</h3> > + <h3>Ingress Table 26 DNS Responses</h3> > > <p> > This table implements DNS responder for the DNS replies generated by > @@ -1859,7 +1880,7 @@ output; > </li> > </ul> > > - <h3>Ingress table 26 External ports</h3> > + <h3>Ingress table 27 External ports</h3> > > <p> > Traffic from the <code>external</code> logical ports enter the > ingress > @@ -1902,7 +1923,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 27 Destination Lookup</h3> > + <h3>Ingress Table 28 Destination Lookup</h3> > > <p> > This table implements switching behavior. It contains these logical > @@ -2078,7 +2099,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 28 Destination unknown</h3> > + <h3>Ingress Table 29 Destination unknown</h3> > > <p> > This table handles the packets whose destination was not found or > @@ -2312,7 +2333,14 @@ output; > there are no rules added for load balancing new connections. > </p> > > - <h3>Egress Table 9: Egress Port Security - check</h3> > + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> > + > + <p> > + This is similar to ingress table <code>QoS marking</code> except > + they apply to <code>to-lport</code> QoS rules. > + </p> > + > + <h3>Egress Table 10: Egress Port Security - check</h3> > > <p> > This is similar to the port security logic in table > @@ -2341,7 +2369,7 @@ output; > </li> > </ul> > > - <h3>Egress Table 10: Egress Port Security - Apply</h3> > + <h3>Egress Table 11: Egress Port Security - Apply</h3> > > <p> > This is similar to the ingress port security logic in ingress table > diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema > index b2e0993e0..7bb8f36c0 100644 > --- a/ovn-nb.ovsschema > +++ b/ovn-nb.ovsschema > @@ -1,7 +1,7 @@ > { > "name": "OVN_Northbound", > - "version": "7.2.0", > - "cksum": "1069338687 34162", > + "version": "7.3.0", > + "cksum": "2786772995 34106", > "tables": { > "NB_Global": { > "columns": { > @@ -293,10 +293,9 @@ > "enum": ["set", > ["from-lport", "to-lport"]]}}}, > "match": {"type": "string"}, > "action": {"type": {"key": {"type": "string", > - "enum": ["set", ["dscp"]]}, > + "enum": ["set", ["dscp", > "mark"]]}, > "value": {"type": "integer", > - "minInteger": 0, > - "maxInteger": 63}, > + "minInteger": 0}, > "min": 0, "max": "unlimited"}}, > "bandwidth": {"type": {"key": {"type": "string", > "enum": ["set", ["rate", > diff --git a/ovn-nb.xml b/ovn-nb.xml > index 765ffcf2e..5b593f6a7 100644 > --- a/ovn-nb.xml > +++ b/ovn-nb.xml > @@ -2808,12 +2808,22 @@ or > </column> > > <column name="action"> > - <p>When specified, matching flows will have DSCP marking > applied.</p> > + <p> > + When <code>dscp</code> action is specified, matching flows will > have > + have DSCP marking applied. > + When <code>mark</code> action is specified, matching flows will > have > + packet marking applied. > + </p> > + > <ul> > <li> > <code>dscp</code>: The value of this action should be in the > range of 0 to 63 (inclusive). > </li> > + <li> > + <code>mark</code>: The value of this action should be a > positive > + integer. > + </li> > </ul> > </column> > > diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at > index b3d536471..5427d2d14 100644 > --- a/tests/ovn-controller.at > +++ b/tests/ovn-controller.at > @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) > port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) > check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 > > -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep > -q "reg15=0x${port},metadata=0x${meta}"]) > +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep > -q "reg15=0x${port},metadata=0x${meta}"]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -918,14 +918,14 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$i > ]) > done > > @@ -940,15 +940,15 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 9; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((10 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((10 - $i)) > ]) > fi > done > @@ -966,17 +966,17 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i * 2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i * 2)) > ]) > done > > @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > add address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], > [0], [1 > ]) > > reprocess_count_new=$(read_counter consider_logical_flow) > @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > remove address_set as1 addresses 10.0.0.9,10.0.0.8 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1091,24 +1091,24 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i + 4)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i + 4)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=conjunction,1/2) > @@ -1130,17 +1130,17 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((14 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((14 - $i)) > ]) > fi > done > @@ -1156,11 +1156,11 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=conjunction,1/2) > @@ -1172,7 +1172,7 @@ > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 > actions=conjun > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 > actions=conjunction,2/2) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i * 2 + 4)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i * 2 + 4)) > ]) > done > > @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > add address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], > [0], [1 > ]) > > reprocess_count_new=$(read_counter consider_logical_flow) > @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > remove address_set as1 addresses 10.0.0.9,10.0.0.8 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], > [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], > [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], > [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1288,22 +1288,22 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i*2 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i*2 + 1)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > actions=conjunction,1/2) > @@ -1327,15 +1327,15 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((21 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((21 - $i*2)) > ]) > fi > done > @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$i > ]) > done > > @@ -1382,16 +1382,16 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 9; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > elif test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > else > # 2 dst + (10 - i) src + 1 conj_id > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((10 - $i + 3)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((10 - $i + 3)) > ]) > fi > done > @@ -1445,27 +1445,27 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i*2)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > done > @@ -1483,9 +1483,9 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((20 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((20 - $i*2)) > ]) > fi > done > @@ -1541,30 +1541,30 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > elif test "$i" -lt 6; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i*2)) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((5 + $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((5 + $i)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > done > @@ -1582,12 +1582,12 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > elif test "$i" -lt 6; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((15 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((15 - $i)) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((10 - ($i - 5)*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((10 - ($i - 5)*2)) > ]) > fi > done > @@ -1639,22 +1639,22 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i*2 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i*2 + 1)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > actions=conjunction,1/2) > @@ -1676,15 +1676,15 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((21 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((21 - $i*2)) > ]) > fi > done > @@ -1700,11 +1700,11 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > actions=conjunction,1/2) > @@ -1719,7 +1719,7 @@ > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > actions=co > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > actions=conjunction,2/2) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$(($i * 4 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$(($i * 4 + 1)) > ]) > done > > @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync > reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > actions=conjunction,1/2) > @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - > $reprocess_count_old))], [0], [1 > # Delete 2 IPs > reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl --wait=hv remove address_set as1 addresses > 10.0.0.4,10.0.0.5 > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > actions=conjunction,1/2) > @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport > == "ls1-lp1" && ip4.src == $as > check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src > == $as2 && tcp && tcp.dst == {201, 202}' drop > > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > actions=conjunction,1/2) > @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > add address_set as2 addresses 10.0.0.24,10.0.0.33 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > actions=conjunction,1/2) > @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > remove address_set as2 addresses 10.0.0.24,10.0.0.33 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > actions=conjunction,1/2) > @@ -1943,14 +1943,14 @@ for i in $(seq 5); do > check ovn-nbctl add address_set as1 addresses > "aa\:aa\:aa\:aa\:aa\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$i > ]) > done > > @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter > consider_logical_flow) > for i in $(seq 5); do > check ovn-nbctl remove address_set as1 addresses > "aa\:aa\:aa\:aa\:aa\:0$i" > check ovn-nbctl --wait=hv sync > - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" > + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" > if test "$i" = 4; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 5; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((5 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((5 - $i)) > ]) > fi > done > @@ -2024,14 +2024,14 @@ for i in $(seq 5); do > check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$i > ]) > done > > @@ -2046,15 +2046,15 @@ for i in $(seq 5); do > check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 4; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 5; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [$((5 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [$((5 - $i)) > ]) > fi > done > @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg > ovn-nbctl create address_set name=as1 addresses=8.8.8.8 > check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src > == $as1' drop > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100"], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100"], [0], [1 > ]) > > # pause ovn-northd > @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause > # undefined. This test runs the scenario ten times to make sure different > # orders are covered and handled properly. > > -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c > "priority=1100") > +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c > "priority=1100") > for i in $(seq 10); do > # Delete and recreate the SB address set with same name and an extra > IP. > addrs_=$(fetch_column address_set addresses name=as1) > addrs=${addrs_// /,} > AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set > name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) > - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | > grep -c "priority=1100") = "$(($i + 1))"]) > + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | > grep -c "priority=1100") = "$(($i + 1))"]) > done > > OVN_CLEANUP([hv1]) > @@ -2698,7 +2698,7 @@ done > wait_for_ports_up > ovn-nbctl --wait=hv sync > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep > reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > [0],[dnl > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep > reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > [0],[dnl > 3 > ]) > > @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do > done > ovn-nbctl --wait=hv sync > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q > controller], [1]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q > controller], [1]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at > index 7f37d7716..b11e4ec6b 100644 > --- a/tests/ovn-nbctl.at > +++ b/tests/ovn-nbctl.at > @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp > dscp=0 rate=300 burst=3000]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 > burst=30000]) > +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) > +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) > > dnl Add duplicated qos > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 > burst=30002], [1], [], [stderr]) > @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 > from-lport 400 (tcp) rate=300 burst=3000 dscp=0 > to-lport 300 (tcp) dscp=48 > to-lport 200 (ip) rate=101 > + to-lport 102 (ip4) dscp=16 mark=17 > + to-lport 101 (ip4) mark=15 > to-lport 100 (ip4) rate=301 burst=30000 dscp=13 > ]) > > @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip > dscp=-1], [1], [], > ]) > > AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], > -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and > "burst=" > +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" > and "mark=" > ]) > > AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], > -[ovn-nbctl: Either "rate" and/or "dscp" must be specified > +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified > ])]) > > dnl --------------------------------------------------------------------- > diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > index 67e81ddba..6a27b7dcf 100644 > --- a/tests/ovn-northd.at > +++ b/tests/ovn-northd.at > @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ > -- ls-lb-add ls lb > > AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > ls_in_acl_after_lb_eval | sort], [0], [dnl > - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > action=(next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == > 1), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > action=(next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == > 1), action=(reg8[[16]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) > table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && > ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && > ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) > @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls > ovn-nbctl --wait=sb clear logical_switch ls load_balancer > > AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > ls_in_acl_after_lb_eval | sort], [0], [dnl > - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > action=(next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > action=(next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) > table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) > @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), > action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), > action=(outport = get_fdb(eth.dst); next;) > @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 > "00:00:00:00:00:01" > @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), > action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), > action=(outport = get_fdb(eth.dst); next;) > @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 > 1000::3" > @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), > action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), > action=(outport = get_fdb(eth.dst); next;) > @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > # Disable sw0p1 > @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), > action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), > action=(outport = get_fdb(eth.dst); next;) > @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "sw0p1"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 > @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=70 , match=(inport == > "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "sw0p1"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl set logical_switch_port sw0p1 enabled=true > @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && > icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && > icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) > table=??(ls_in_check_port_sec), priority=50 , match=(1), > action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_check_port_sec), priority=70 , match=(inport == > "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > next;) > - table=??(ls_in_check_port_sec), priority=70 , match=(inport == > "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) > + table=??(ls_in_check_port_sec), priority=70 , match=(inport == > "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) > table=??(ls_in_check_port_sec), priority=70 , match=(inport == > "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), > action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), > action=(output;) > table=??(ls_out_apply_port_sec), priority=100 , match=(outport == > "localnetport"), action=(set_queue(10); output;) > table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), > action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), > action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > action=(reg0[[15]] = 0; next;) > ]) > > AT_CLEANUP > @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options > logical_port=public |grep -q 'qos > AT_CLEANUP > ]) > > +OVN_FOR_EACH_NORTHD_NO_HV([ > +AT_SETUP([check OVN QoS mark/meter logical flows]) > +AT_KEYWORDS([OVN-QoS]) > +ovn_start > + > +check ovn-nbctl ls-add ls > +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > + > +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > +check ovn-nbctl --wait=sb sync > + > +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl > + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) > + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), > action=(ip.dscp = 16; next;) > + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), > action=(ip.dscp = 17; next;) > + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) > + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), > action=(set_meter(100, 1000); next;) > + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) > + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), > action=(pkt.mark = 15; next;) > + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), > action=(pkt.mark = 18; next;) > + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) > + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), > action=(ip.dscp = 16; next;) > + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), > action=(ip.dscp = 17; next;) > + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) > + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), > action=(set_meter(100, 1000); next;) > + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) > + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), > action=(pkt.mark = 15; next;) > + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), > action=(pkt.mark = 18; next;) > +]) > + > +AT_CLEANUP > +]) > + > AT_SETUP([Tiered ACL logical flows]) > AT_KEYWORDS([acl]) > > @@ -9978,10 +10017,10 @@ acl_test() { > } > > acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > ls_in_acl_after_lb_action 18 > +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > ls_in_acl_after_lb_action 19 > acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > ls_in_acl_after_lb_action 18 > +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > ls_in_acl_after_lb_action 19 > acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > > AT_CLEANUP > diff --git a/tests/ovn.at b/tests/ovn.at > index 28c6b6c34..9b158e79c 100644 > --- a/tests/ovn.at > +++ b/tests/ovn.at > @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > > next(pipeline=egress); > formats as next(pipeline=egress, table=11); > - encodes as resubmit(,53) > + encodes as resubmit(,58) > > next(pipeline=egress, table=5); > - encodes as resubmit(,47) > + encodes as resubmit(,52) > > next(table=10); > formats as next(10); > @@ -9719,18 +9719,18 @@ as hv1 > AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 > external_ids:iface-id=localvif1]) > > # On hv1, check that there are no flows outputting bcast to tunnel > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > | grep output | wc -l` -eq 0]) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > | grep output | wc -l` -eq 0]) > > # On hv2, check that no flow outputs bcast to tunnel to hv1. > as hv2 > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > | grep output | wc -l` -eq 0]) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > | grep output | wc -l` -eq 0]) > > # Now bind vif2 on hv2. > AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 > external_ids:iface-id=localvif2]) > > # At this point, the broadcast flow on vif2 should be deleted. > -# because, there is now a localnet vif bound (table=37 programming logic) > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > | grep output | wc -l` -eq 0]) > +# because, there is now a localnet vif bound (table=42 programming logic) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > | grep output | wc -l` -eq 0]) > > # Verify that the local net patch port exists on hv2. > OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port > patch-br-int-to-ln_port" | wc -l` -eq 1]) > @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns > ofport find Interface name=ov > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface > name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > ]) > > test_ip_packet() > @@ -11631,7 +11631,7 @@ AT_CHECK( > ]) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > ]) > > test_ip_packet gw2 gw1 0 > @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns > ofport find Interface name=ov > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface > name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > ]) > > test_ip_packet() > @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > ]) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > ]) > > test_ip_packet gw2 gw1 > @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > > AT_CHECK( > [# Check that redirect mapping is programmed only on hv2 > - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc > -l > + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc > -l > > # Check that hv1 sends chassisredirect port traffic to hv2 > - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > > # Check that arp reply on distributed gateway port is only programmed > on hv2 > grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int > in_port=hv1-vif1 $packet > sleep 2 > > AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > ]]) > > @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > echo $hv2_gw2_ofport > > echo "--- hv1 ---" > -as hv1 ovs-ofctl dump-flows br-int table=39 > +as hv1 ovs-ofctl dump-flows br-int table=44 > > echo "--- hv2 ---" > -as hv2 ovs-ofctl dump-flows br-int table=39 > +as hv2 ovs-ofctl dump-flows br-int table=44 > > gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [1 > ]) > @@ -13566,15 +13566,15 @@ sleep 10 > > as gw1 ovs-ofctl dump-flows br-int > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too > through ls_in_arp_rsp table > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > @@ -13598,12 +13598,12 @@ wait_for_ports_up > check ovn-nbctl --wait=hv sync > > # we make sure that the hypervisors noticed, and inverted the slave ports > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > | wc -l], [0], [1 > ]) > @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > Interface name=ovn-hv1-0],[0], > ]]) > > # make sure that flows for handling the outside router port reside on gw2 > now > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > bfd_dump > > # make sure that flows for handling the outside router port reside on gw1 > now > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside > ha_chassis_group=$hagrp1_uuid > wait_row_count HA_Chassis_Group 1 > wait_row_count HA_Chassis 2 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [0 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [0 > ]) > @@ -13777,26 +13777,26 @@ done > # Re-add gw2 > as gw2 ovn_attach n1 br-phys 192.168.0.1 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [1 > ]) > > # make sure that flows for handling the outside router port reside on gw1 > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group > ref_chassis > # Increase the priority of gw2 > ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > | wc -l], [0], [1 > ]) > @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > Interface name=ovn-hv1-0],[0], > ]]) > > # make sure that flows for handling the outside router port reside on gw2 > now > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > bfd_dump > > # make sure that flows for handling the outside router port reside on gw2 > now > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > AT_CAPTURE_FILE([sw0-flows]) > > AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed > 's/table=../table=??/' | sort], [0], [dnl > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > inport; next(pipeline=ingress,table=28); };) > ]) > > > @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst > $ipv6_src $ipv6_dst > # Get total number of ipv4 packets that received on ovs > > # sender side > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | > grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | > grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | > grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | > grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # Get total number of ipv6 packets that received on ovs > > # sender side > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | > grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | > grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | > grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | > grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > OVN_CLEANUP([hv1], [hv2]) > AT_CLEANUP > @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > 'ip4.src==10.0.0.1' allow > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the second less restrictive allow ACL should have been > installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > ]) > > # Remove the less restrictive allow ACL. > @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > 'ip4.src==10.0.0.1' > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > 'ip4.src==10.0.0.1' allow > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > ]) > > # Add another ACL that overlaps with the existing less restrictive ones. > @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > # with an additional conjunction action. > # > # New non-conjunctive flows should be added to match on 'udp'. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > - table=46, priority=1003,udp,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,udp6,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > actions=conjunction(),conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > actions=conjunction(),conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > actions=conjunction() > + table=51, priority=1003,udp,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,udp6,metadata=0x1 > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > ]) > > OVN_CLEANUP([hv1]) > @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 > 'outport == @pg1 && ip4.src == $as2' al > > wait_for_ports_up > check ovn-nbctl --wait=hv sync > -ovs-ofctl dump-flows br-int table=46 > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = > 2]) > +ovs-ofctl dump-flows br-int table=51 > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = > 2]) > > echo ------- > # Add another address in as1, so that the 1st ACL will now generate 2 > conjunctions. > ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > check ovn-nbctl --wait=hv sync > > -ovs-ofctl dump-flows br-int table=46 > +ovs-ofctl dump-flows br-int table=51 > # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd > ACL) > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = > 3]) > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = > 3]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined > # to router mac. > AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > grep -c "actions=drop"], [0], [1 > ]) > # Stop ovn-controllers on hv1 and hv3. > @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy > options:pkt_mark=100 > check ovn-nbctl --wait=hv sync > as hv2 > # add a flow in egress pipeline to check pkt marking > -ovs-ofctl --protocols=OpenFlow13 add-flow br-int > "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > actions=resubmit(,38)" > +ovs-ofctl --protocols=OpenFlow13 add-flow br-int > "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > actions=resubmit(,43)" > > dst_ip=$(ip_to_hex 172 16 2 10) > fip_ip=$(ip_to_hex 172 16 1 2) > @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip > $gw_router_ip) >> expected > send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > echo > "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" > >> expected > > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | > grep pkt_mark=0x64 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | > grep pkt_mark=0x64 | grep -c n_packets=1`]) > > OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > > @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key > external_ids:name=lr0)) > lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding > tunnel_key logical_port=lr0-public)) > > - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | > ofctl_strip_all | grep "priority=2000"], [0], [dnl > - table=46, priority=2000,ip,metadata=0x$sw0_dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | > ofctl_strip_all | grep "priority=2000"], [0], [dnl > + table=51, priority=2000,ip,metadata=0x$sw0_dp_key > actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > ]) > > AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | > ofctl_strip_all | \ > grep "priority=92" | grep 172.168.0.50], [0], [dnl > - table=11, > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > + table=11, > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > ]) > } > > check_virtual_offlows_not_present() { > hv=$1 > - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | > ofctl_strip_all | grep "priority=2000"], [1], [dnl > + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | > ofctl_strip_all | grep "priority=2000"], [1], [dnl > ]) > > AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | > ofctl_strip_all | \ > @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 > logical_port=sw0-vir virtual_parent=sw0-p1 > wait_for_ports_up sw0-vir > check ovn-nbctl --wait=hv sync > AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received > packet-in" | \ > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid > check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 > @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], > [vif-north.expected]) > > # Confirm that packets did not go out via tunnel port. > - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep > NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep > NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > ]]) > > # Confirm that packet went out via localnet port > @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > external_ids:ct-zone-sw0-p2 | sed 's/"//g') > AT_CHECK([test ! -z $p2_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) > -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw1_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw1_dpkey},\ > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw1_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw1_dpkey},\ > reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) > -eq 1]) > > ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > external_ids:ct-zone-sw0-p1 | sed 's/"//g') > @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up > sw0-p1) = xup]) > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > external_ids:ct-zone-sw0-p1 | sed 's/"//g') > AT_CHECK([test ! -z $p1_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) > -eq 1]) > > ovs-vsctl del-port hv1-vif2 > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > external_ids:ct-zone-sw0-p2 | sed 's/"//g') > @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > > ovn-nbctl lsp-del sw0-p1 > > -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > table=40,metadata=${sw0_dpkey},\ > +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > external_ids:ct-zone-sw0-p1 | sed 's/"//g') > @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) > check ovn-nbctl --wait=hv sync > > # Check OVS flows are installed properly. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > \ > grep "priority=2002" | grep conjunction | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > - table=46, > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > + table=51, > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > actions=conjunction() > ]) > > OVN_CLEANUP([hv1]) > @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface > lsp0-0 external_ids:iface-id=l > ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 > external_ids:iface-id=lsp0-1 > > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 22]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 22]) > > # Save the current lflow_run counter > lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller > coverage/read-counter lflow_run) > # 1. Remove half of the ports from pg1. The excepted conjunction flows > should be: > # 2 + 10 = 12 > check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j > in 0 1; do echo lsp${i}-${j}; done; done) > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 12]) > > # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because > the > # port group const set should have only one member (lsp0-1). And the > total > @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int > table=46 | grep conjunction | wc -l > # 10. > ovs-vsctl del-port br-int lsp0-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 0]) > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc > -l) == 10]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 0]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc > -l) == 10]) > > # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 > external_ids:iface-id=lsp0-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 12]) > > # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any > change. > ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 > external_ids:iface-id=lsp9-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 12]) > > # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a > different > # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 > external_ids:iface-id=lsp1-0 > ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 > external_ids:iface-id=lsp1-1 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > | wc -l) == 24]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > | wc -l) == 24]) > > # 6. Simulate a SB port-group "del and add" notification to > ovn-controller in the > # same IDL iteration. ovn-controller should still program the same > flows. In > @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > check ovn-nbctl --wait=hv sync > > # Finally check flow count is the same as before. > - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction | wc -l) == 24]) > + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction | wc -l) == 24]) > done > > # Make sure all the above was performed with I-P (no recompute) > @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > 'outport == "lp2" && ip4.src == 10.0. > > # The first ACL should be programmed, but the second one shouldn't. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], > [ignore]) > > # Now create the lport lp2. > check ovn-nbctl lsp-add lsw0 lp2 \ > @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > > check ovn-nbctl --wait=hv sync > # Now the second ACL should be programmed. > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], > [ignore]) > > # Remove the lport lp2 again, the OVS flow for the second ACL should be > # removed. > check ovn-nbctl --wait=hv lsp-del lp2 > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], > [ignore]) > > # Test similar scenario but when the referenced lport is not bound > locally. > > @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport > == "lp4" && ip4.dst == 10.0.0 > > # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], > [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], > [ignore]) > > # Now create the lport lp4. > check ovn-nbctl lsp-add lsw0 lp4 \ > @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > > # Now the ACL for lp4 should be programmed. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], > [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], > [ignore]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -33493,15 +33493,15 @@ done > check ovn-nbctl --wait=hv sync > > # hv0 should see flows for lsp1 but not lsp2 > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > [0], [ignore]) > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], > [1]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > [0], [ignore]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], > [1]) > # hv2 should see flows for lsp2 but not lsp1 > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], > [0], [ignore]) > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > [1]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], > [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > [1]) > > # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > [0], [ignore]) > > # Change it back, and trigger recompute to make sure extra flows are > removed > # from hv2 (recompute is needed because currently I-P adds local > datapaths but > @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int > table=29 | grep 10.0.1.2], [0], [ig > check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > as hv2 check ovn-appctl -t ovn-controller recompute > ovn-nbctl --wait=hv sync > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > [1]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > [1]) > > # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr > dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > [0], [ignore]) > > OVN_CLEANUP([hv1],[hv2]) > AT_CLEANUP > @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > # Use constants so that if tables or registers change, this test can > # be updated easily. > DNAT_TABLE=15 > -SNAT_TABLE=45 > +SNAT_TABLE=50 > DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > > @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > wait_for_ports_up > OVN_POPULATE_ARP > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c > controller], [0],[dnl > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c > controller], [0],[dnl > 9 > ]) > > @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > send_garp 1 1 $eth_src $eth_dst $spa $tpa > > OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl > received packet-in" | \ > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > sleep_controller hv1 > > @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT > \ > > OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > AT_CLEANUP > + > +OVN_FOR_EACH_NORTHD([ > +AT_SETUP([QoS packet marking]) > +AT_KEYWORDS([ovn-qos-pkt-marking]) > +AT_SKIP_IF([test $HAVE_SCAPY = no]) > +ovn_start > + > +check ovn-nbctl lr-add lr0 > +check ovn-nbctl ls-add ls0 > +check ovn-nbctl ls-add ls1 > + > +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > + set Logical_Switch_Port lrp-s0 type=router \ > + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > + set Logical_Switch_Port lrp-s1 type=router \ > + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > + > +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > + > +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > +check ovn-nbctl --wait=sb sync > + > +net_add n1 > +sim_add hv > + > +as hv > +check ovs-vsctl add-br br-phys > +ovn_attach n1 br-phys 192.168.0.1 > + > +check ovs-vsctl add-port br-int vif0 -- \ > + set Interface vif0 external-ids:iface-id=lp0 \ > + options:tx_pcap=hv/vif0-tx.pcap \ > + options:rxq_pcap=hv/vif0-rx.pcap \ > + ofport-request=1 > +check ovs-vsctl add-port br-int vif1 -- \ > + set Interface vif1 external-ids:iface-id=lp1 \ > + options:tx_pcap=hv/vif1-tx.pcap \ > + options:rxq_pcap=hv/vif1-rx.pcap \ > + ofport-request=2 > +check ovs-vsctl add-port br-int vif2 -- \ > + set Interface vif2 external-ids:iface-id=lp2 \ > + options:tx_pcap=hv/vif2-tx.pcap \ > + options:rxq_pcap=hv/vif2-rx.pcap \ > + ofport-request=3 > + > +# Create QoS rules for packet marking. > +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" > mark=48 > +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" > mark=49 > +check_row_count nb:QoS 2 > + > +# Create some flows to count pkt marking. > +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark > == 48" drop > +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > +wait_for_ports_up > +check ovn-nbctl --wait=hv sync > + > +send_udp_packet() { > + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ > + IP(src='${ipv4_src}', dst='${ipv4_dst}', > ttl=0x40)/ \ > + UDP(sport=4242, dport=4343)") > + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > +} > + > +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > external_ids:name=ls0)) > +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > external_ids:name=lr0)) > + > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > + > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > + > +OVN_CLEANUP([hv]) > +AT_CLEANUP > +]) > diff --git a/tests/system-ovn.at b/tests/system-ovn.at > index cb4124b70..1277f1057 100644 > --- a/tests/system-ovn.at > +++ b/tests/system-ovn.at > @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > grep 'nat(src=20.0.0.2)']) > > check ovs-appctl dpctl/flush-conntrack > @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > grep 'nat(src=20.0.0.2)']) > > rm -f wget*.log > @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > ]) > > OVS_WAIT_UNTIL([ > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > grep controller | grep tp_dst=84 -c) > test $n_pkt -eq 1 > ]) > @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > ]) > > OVS_WAIT_UNTIL([ > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > grep controller | grep tp_dst=84 -c) > test $n_pkt -eq 1 > ]) > @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > > wait_igmp_flows_installed() > { > - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > grep 'priority=90' | grep "nw_dst=$1"]) > } > > @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > 30.0.0.2:8000"'='"192.168.1.2:12345,192 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep > 'nat(src=20.0.0.2)']) > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep > 'nat(src=20.0.0.2)']) > > dnl Test load-balancing that includes L4 ports in NAT. > for i in `seq 1 20`; do > diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > index 6f74bd557..f838393a6 100644 > --- a/utilities/ovn-nbctl.8.xml > +++ b/utilities/ovn-nbctl.8.xml > @@ -482,6 +482,9 @@ > <code>burst=</code><var>burst</var> specifies the burst rate > limit in kilobits. <code>dscp</code> and/or <code>rate</code> > are required arguments. > + If <code>mark=</code><var>mark</var> is specified, then matching > + packets will be marked (through <code>pkt.mark</code>). > + <var>mark</var> must be a positive integer. > </p> > > <p> > diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > index 526369b68..0620d333a 100644 > --- a/utilities/ovn-nbctl.c > +++ b/utilities/ovn-nbctl.c > @@ -283,7 +283,7 @@ ACL commands:\n\ > print ACLs for SWITCH\n\ > \n\ > QoS commands:\n\ > - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > [dscp=DSCP]\n\ > + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > [dscp=DSCP] [mark=MARK]\n\ > add an QoS rule to SWITCH\n\ > qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > remove QoS rules from SWITCH\n\ > @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > if (!strcmp(qos_rule->key_action[j], "dscp")) { > ds_put_format(&ctx->output, " dscp=%"PRId64"", > qos_rule->value_action[j]); > + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > + ds_put_format(&ctx->output, " mark=%"PRId64"", > + qos_rule->value_action[j]); > } > } > ds_put_cstr(&ctx->output, "\n"); > @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > } > > static void > @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > const char *direction; > int64_t priority; > int64_t dscp = -1; > + int64_t mark = 0; > int64_t rate = 0; > int64_t burst = 0; > char *error; > @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > return; > } > } > + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < > 0) { > + ctl_error(ctx, "%s: mark must be a positive integer", > + ctx->argv[i] + 5); > + return; > + } > + } > else if (!strncmp(ctx->argv[i], "rate=", 5)) { > if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > || rate < 1 || rate > UINT32_MAX) { > @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > } > } else { > ctl_error(ctx, "%s: supported arguments are \"dscp=\", > \"rate=\", " > - "and \"burst=\"", ctx->argv[i]); > + "\"burst=\" and \"mark=\"", ctx->argv[i]); > return; > } > } > > /* Validate rate and dscp. */ > - if (-1 == dscp && !rate) { > - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be > specified"); > + if (-1 == dscp && !rate && !mark) { > + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be > " > + "specified"); > return; > } > > @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > nbrec_qos_set_priority(qos, priority); > nbrec_qos_set_direction(qos, direction); > nbrec_qos_set_match(qos, ctx->argv[4]); > + if (mark) { > + nbrec_qos_update_action_setkey(qos, "mark", mark); > + } > if (-1 != dscp) { > - const char *dscp_key = "dscp"; > - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > } > if (rate) { > const char *bandwidth_key[2] = {"rate", "burst"}; > -- > 2.43.0 > > _______________________________________________ > dev mailing list > dev@openvswitch.org > https://mail.openvswitch.org/mailman/listinfo/ovs-dev > > Thanks, Ales
On 1/31/24 13:10, Ales Musil wrote: > On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < > lorenzo.bianconi@redhat.com> wrote: > >> Add the capbility to mark (through pkt.mark) incoming/outgoing packets >> in logical_switch datapath according to user configured QoS rule. >> >> Co-developed-by: Dumitru Ceara <dceara@redhat.com> >> Reported-at: https://issues.redhat.com/browse/FDP-42 >> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> >> --- >> > > Hi Lorenzo and Dumitru, Hi Ales, > I have one question, would it be possible to use existing QOS_MARK by > moving it after the lb/stateful stage in ingress/egress? Even if both dscp > and mark are set at the same time the action could set both in one logical > flow. That being said, we might even collapse all QoS stages into one that > will be a combination of dscp/mark/set_meter WDYT? However, I might have > missed something crucial why it isn't possible. > That's a significant behavior change IMO (that I'd like to avoid for now). We might be breaking existing QoS (DSCP) marking rules if we move the ls_in_qos_mark stage after load balancing. The CMS has more knowledge about the network than OVN does and it can attach it's own "metadata" (pkt.mark) to relay that to upper layers (or later stages in the OVN pipeline). In this specific case ovn-kubernetes can determine whether the mark should be set _only after_ load balancing. That's the reason why we addded the new stage after the lb one. But I think we're definitely open to alternatives if you have ideas. > > >> NEWS | 2 + >> controller/lflow.h | 15 +- >> lib/ovn-util.h | 2 +- >> northd/northd.c | 55 +++-- >> northd/ovn-northd.8.xml | 60 ++++-- >> ovn-nb.ovsschema | 9 +- >> ovn-nb.xml | 12 +- >> tests/ovn-controller.at | 308 +++++++++++++-------------- >> tests/ovn-nbctl.at | 8 +- >> tests/ovn-northd.at | 103 ++++++--- >> tests/ovn.at | 429 +++++++++++++++++++++++--------------- >> tests/system-ovn.at | 12 +- >> utilities/ovn-nbctl.8.xml | 3 + >> utilities/ovn-nbctl.c | 27 ++- >> 14 files changed, 627 insertions(+), 418 deletions(-) >> >> diff --git a/NEWS b/NEWS >> index 6553bd078..7300345f1 100644 >> --- a/NEWS >> +++ b/NEWS >> @@ -18,6 +18,8 @@ Post v23.09.0 >> - Support selecting encapsulation IP based on the source/destination >> VIF's >> settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more >> details. >> + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets >> + in the logical switch datapath according to user configured QoS rule. >> >> OVN v23.09.0 - 15 Sep 2023 >> -------------------------- >> diff --git a/controller/lflow.h b/controller/lflow.h >> index 9b7ffa19c..f7f6c7950 100644 >> --- a/controller/lflow.h >> +++ b/controller/lflow.h >> @@ -67,17 +67,20 @@ struct uuid; >> >> /* Start of LOG_PIPELINE_LEN tables. */ >> #define OFTABLE_LOG_INGRESS_PIPELINE 8 >> -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 >> -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 >> -#define OFTABLE_REMOTE_OUTPUT 39 >> -#define OFTABLE_LOCAL_OUTPUT 40 >> -#define OFTABLE_CHECK_LOOPBACK 41 >> +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 >> +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 >> +#define OFTABLE_REMOTE_OUTPUT 44 >> +#define OFTABLE_LOCAL_OUTPUT 45 >> +#define OFTABLE_CHECK_LOOPBACK 46 >> >> /* Start of the OUTPUT section of the pipeline. */ >> #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT >> +BUILD_ASSERT_DECL( >> + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT >> +); >> >> /* Start of LOG_PIPELINE_LEN tables. */ >> -#define OFTABLE_LOG_EGRESS_PIPELINE 42 >> +#define OFTABLE_LOG_EGRESS_PIPELINE 47 >> #define OFTABLE_SAVE_INPORT 64 >> #define OFTABLE_LOG_TO_PHY 65 >> #define OFTABLE_MAC_BINDING 66 >> diff --git a/lib/ovn-util.h b/lib/ovn-util.h >> index 2afff0d07..3e1d68cf9 100644 >> --- a/lib/ovn-util.h >> +++ b/lib/ovn-util.h >> @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( >> #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) >> >> /* The number of tables for the ingress and egress pipelines. */ >> -#define LOG_PIPELINE_LEN 29 >> +#define LOG_PIPELINE_LEN 30 >> >> static inline uint32_t >> hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) >> diff --git a/northd/northd.c b/northd/northd.c >> index d2091d4bc..597d203ca 100644 >> --- a/northd/northd.c >> +++ b/northd/northd.c >> @@ -134,22 +134,23 @@ enum ovn_stage { >> PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") >> \ >> PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") >> \ >> PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") >> \ >> - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") >> \ >> - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") >> \ >> - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") >> \ >> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ >> + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") >> \ >> + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") >> \ >> + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") >> \ >> + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") >> \ >> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ >> "ls_in_acl_after_lb_eval") \ >> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ >> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ >> "ls_in_acl_after_lb_action") \ >> - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") >> \ >> - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") >> \ >> - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") >> \ >> - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") >> \ >> - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") >> \ >> - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") >> \ >> - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") >> \ >> - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") >> \ >> - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") >> \ >> + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") >> \ >> + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") >> \ >> + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") >> \ >> + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") >> \ >> + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") >> \ >> + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") >> \ >> + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") >> \ >> + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") >> \ >> + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") >> \ >> >> \ >> /* Logical switch egress stages. */ >> \ >> PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") >> \ >> @@ -161,8 +162,9 @@ enum ovn_stage { >> PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") >> \ >> PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") >> \ >> PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") >> \ >> - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, >> "ls_out_check_port_sec") \ >> - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, >> "ls_out_apply_port_sec") \ >> + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") >> \ >> + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, >> "ls_out_check_port_sec") \ >> + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, >> "ls_out_apply_port_sec") \ >> \ >> /* Logical router ingress stages. */ \ >> PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") >> \ >> @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct >> chassis_features *features, >> ds_destroy(&actions); >> } >> >> +#define QOS_MAX_DSCP 63 >> + >> static void >> build_qos(struct ovn_datapath *od, struct hmap *lflows) { >> struct ds action = DS_EMPTY_INITIALIZER; >> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap >> *lflows) { >> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); >> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); >> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); >> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); >> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); >> >> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { >> struct nbrec_qos *qos = od->nbs->qos_rules[i]; >> bool ingress = !strcmp(qos->direction, "from-lport") ? true >> :false; >> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : >> S_SWITCH_OUT_QOS_MARK; >> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); >> int64_t rate = 0; >> int64_t burst = 0; >> >> for (size_t j = 0; j < qos->n_action; j++) { >> if (!strcmp(qos->key_action[j], "dscp")) { >> + if (qos->value_action[j] > QOS_MAX_DSCP) { >> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " >> + UUID_FMT, qos->value_action[j], >> + UUID_ARGS(&qos->header_.uuid)); >> + continue; >> + } >> + >> ds_clear(&action); >> ds_put_format(&action, "ip.dscp = %"PRId64"; next;", >> qos->value_action[j]); >> @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap >> *lflows) { >> qos->priority, >> qos->match, ds_cstr(&action), >> &qos->header_); >> + } else if (!strcmp(qos->key_action[j], "mark")) { >> + ds_clear(&action); >> + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", >> + qos->value_action[j]); >> + ovn_lflow_add_with_hint(lflows, od, >> + ingress ? S_SWITCH_IN_QOS_PKT_MARK >> + : S_SWITCH_OUT_QOS_PKT_MARK, >> + qos->priority, qos->match, ds_cstr(&action), >> + &qos->header_); >> } >> } >> >> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml >> index 068d47e1a..c1cd19947 100644 >> --- a/northd/ovn-northd.8.xml >> +++ b/northd/ovn-northd.8.xml >> @@ -1082,7 +1082,28 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 15: Pre-Hairpin</h3> >> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> >> + >> + <p> >> + Logical flows in this table closely reproduce those in the >> + <code>QoS</code> table with the <code>action</code> column set in >> + the <code>OVN_Northbound</code> database for the >> + <code>from-lport</code> direction. >> + </p> >> + >> + <ul> >> + <li> >> + For every qos_rules entry in a logical switch with packet marking >> + enabled, a flow will be added at the priority mentioned in the >> + QoS table. >> + </li> >> + >> + <li> >> + A priority-0 flow that simply moves traffic to the next table. >> + </li> >> + </ul> >> + >> + <h3>Ingress Table 16: Pre-Hairpin</h3> >> <ul> >> <li> >> If the logical switch has load balancer(s) configured, then a >> @@ -1100,7 +1121,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 16: Nat-Hairpin</h3> >> + <h3>Ingress Table 17: Nat-Hairpin</h3> >> <ul> >> <li> >> If the logical switch has load balancer(s) configured, then a >> @@ -1135,7 +1156,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 17: Hairpin</h3> >> + <h3>Ingress Table 18: Hairpin</h3> >> <ul> >> <li> >> <p> >> @@ -1173,7 +1194,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after >> LB</h3> >> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after >> LB</h3> >> >> <p> >> Logical flows in this table closely reproduce those in the >> @@ -1257,7 +1278,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> >> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> >> >> <p> >> Logical flows in this table decide how to proceed based on the >> values of >> @@ -1297,7 +1318,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 20: Stateful</h3> >> + <h3>Ingress Table 21: Stateful</h3> >> >> <ul> >> <li> >> @@ -1320,7 +1341,7 @@ >> </li> >> </ul> >> >> - <h3>Ingress Table 21: ARP/ND responder</h3> >> + <h3>Ingress Table 22: ARP/ND responder</h3> >> >> <p> >> This table implements ARP/ND responder in a logical switch for known >> @@ -1653,7 +1674,7 @@ output; >> </li> >> </ul> >> >> - <h3>Ingress Table 22: DHCP option processing</h3> >> + <h3>Ingress Table 23: DHCP option processing</h3> >> >> <p> >> This table adds the DHCPv4 options to a DHCPv4 packet from the >> @@ -1714,7 +1735,7 @@ next; >> </li> >> </ul> >> >> - <h3>Ingress Table 23: DHCP responses</h3> >> + <h3>Ingress Table 24: DHCP responses</h3> >> >> <p> >> This table implements DHCP responder for the DHCP replies generated >> by >> @@ -1795,7 +1816,7 @@ output; >> </li> >> </ul> >> >> - <h3>Ingress Table 24 DNS Lookup</h3> >> + <h3>Ingress Table 25 DNS Lookup</h3> >> >> <p> >> This table looks up and resolves the DNS names to the corresponding >> @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; >> </li> >> </ul> >> >> - <h3>Ingress Table 25 DNS Responses</h3> >> + <h3>Ingress Table 26 DNS Responses</h3> >> >> <p> >> This table implements DNS responder for the DNS replies generated by >> @@ -1859,7 +1880,7 @@ output; >> </li> >> </ul> >> >> - <h3>Ingress table 26 External ports</h3> >> + <h3>Ingress table 27 External ports</h3> >> >> <p> >> Traffic from the <code>external</code> logical ports enter the >> ingress >> @@ -1902,7 +1923,7 @@ output; >> </li> >> </ul> >> >> - <h3>Ingress Table 27 Destination Lookup</h3> >> + <h3>Ingress Table 28 Destination Lookup</h3> >> >> <p> >> This table implements switching behavior. It contains these logical >> @@ -2078,7 +2099,7 @@ output; >> </li> >> </ul> >> >> - <h3>Ingress Table 28 Destination unknown</h3> >> + <h3>Ingress Table 29 Destination unknown</h3> >> >> <p> >> This table handles the packets whose destination was not found or >> @@ -2312,7 +2333,14 @@ output; >> there are no rules added for load balancing new connections. >> </p> >> >> - <h3>Egress Table 9: Egress Port Security - check</h3> >> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> >> + >> + <p> >> + This is similar to ingress table <code>QoS marking</code> except >> + they apply to <code>to-lport</code> QoS rules. >> + </p> >> + >> + <h3>Egress Table 10: Egress Port Security - check</h3> >> >> <p> >> This is similar to the port security logic in table >> @@ -2341,7 +2369,7 @@ output; >> </li> >> </ul> >> >> - <h3>Egress Table 10: Egress Port Security - Apply</h3> >> + <h3>Egress Table 11: Egress Port Security - Apply</h3> >> >> <p> >> This is similar to the ingress port security logic in ingress table >> diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema >> index b2e0993e0..7bb8f36c0 100644 >> --- a/ovn-nb.ovsschema >> +++ b/ovn-nb.ovsschema >> @@ -1,7 +1,7 @@ >> { >> "name": "OVN_Northbound", >> - "version": "7.2.0", >> - "cksum": "1069338687 34162", >> + "version": "7.3.0", >> + "cksum": "2786772995 34106", >> "tables": { >> "NB_Global": { >> "columns": { >> @@ -293,10 +293,9 @@ >> "enum": ["set", >> ["from-lport", "to-lport"]]}}}, >> "match": {"type": "string"}, >> "action": {"type": {"key": {"type": "string", >> - "enum": ["set", ["dscp"]]}, >> + "enum": ["set", ["dscp", >> "mark"]]}, >> "value": {"type": "integer", >> - "minInteger": 0, >> - "maxInteger": 63}, >> + "minInteger": 0}, >> "min": 0, "max": "unlimited"}}, >> "bandwidth": {"type": {"key": {"type": "string", >> "enum": ["set", ["rate", >> diff --git a/ovn-nb.xml b/ovn-nb.xml >> index 765ffcf2e..5b593f6a7 100644 >> --- a/ovn-nb.xml >> +++ b/ovn-nb.xml >> @@ -2808,12 +2808,22 @@ or >> </column> >> >> <column name="action"> >> - <p>When specified, matching flows will have DSCP marking >> applied.</p> >> + <p> >> + When <code>dscp</code> action is specified, matching flows will >> have >> + have DSCP marking applied. >> + When <code>mark</code> action is specified, matching flows will >> have >> + packet marking applied. >> + </p> >> + >> <ul> >> <li> >> <code>dscp</code>: The value of this action should be in the >> range of 0 to 63 (inclusive). >> </li> >> + <li> >> + <code>mark</code>: The value of this action should be a >> positive >> + integer. >> + </li> >> </ul> >> </column> >> >> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at >> index b3d536471..5427d2d14 100644 >> --- a/tests/ovn-controller.at >> +++ b/tests/ovn-controller.at >> @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) >> port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) >> check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 >> >> -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep >> -q "reg15=0x${port},metadata=0x${meta}"]) >> +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep >> -q "reg15=0x${port},metadata=0x${meta}"]) >> >> OVN_CLEANUP([hv1]) >> AT_CLEANUP >> @@ -918,14 +918,14 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$i >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$i >> ]) >> done >> >> @@ -940,15 +940,15 @@ for i in $(seq 10); do >> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 9; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}'], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((10 - $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((10 - $i)) >> ]) >> fi >> done >> @@ -966,17 +966,17 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i * 2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i * 2)) >> ]) >> done >> >> @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >> remove address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >> add address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], >> [0], [1 >> ]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ >> remove address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ >> remove address_set as1 addresses 10.0.0.9,10.0.0.8 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1091,24 +1091,24 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 1; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i + 4)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i + 4)) >> ]) >> fi >> >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >> [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1130,17 +1130,17 @@ for i in $(seq 10); do >> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> elif test "$i" = 9; then >> # no conjunction left >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((14 - $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((14 - $i)) >> ]) >> fi >> done >> @@ -1156,11 +1156,11 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >> [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1172,7 +1172,7 @@ >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 >> actions=conjun >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 >> actions=conjunction,2/2) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i * 2 + 4)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i * 2 + 4)) >> ]) >> done >> >> @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >> remove address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >> add address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], >> [0], [1 >> ]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ >> remove address_set as1 addresses 10.0.0.10 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ >> remove address_set as1 addresses 10.0.0.9,10.0.0.8 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], >> [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], >> [0], [1 >> ]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], >> [ignore]) >> >> reprocess_count_new=$(read_counter consider_logical_flow) >> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >> @@ -1288,22 +1288,22 @@ for i in $(seq 10); do >> add address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 1; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i*2 + 1)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i*2 + 1)) >> ]) >> fi >> >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >> [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >> actions=conjunction,1/2) >> @@ -1327,15 +1327,15 @@ for i in $(seq 10); do >> remove address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> elif test "$i" = 9; then >> # no conjunction left >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((21 - $i*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((21 - $i*2)) >> ]) >> fi >> done >> @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$i >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$i >> ]) >> done >> >> @@ -1382,16 +1382,16 @@ for i in $(seq 10); do >> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 9; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}'], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> elif test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> else >> # 2 dst + (10 - i) src + 1 conj_id >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((10 - $i + 3)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((10 - $i + 3)) >> ]) >> fi >> done >> @@ -1445,27 +1445,27 @@ for i in $(seq 10); do >> add address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 1; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i*2)) >> ]) >> fi >> >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> done >> @@ -1483,9 +1483,9 @@ for i in $(seq 10); do >> remove address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((20 - $i*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((20 - $i*2)) >> ]) >> fi >> done >> @@ -1541,30 +1541,30 @@ for i in $(seq 10); do >> add address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 1; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> elif test "$i" -lt 6; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i*2)) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((5 + $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((5 + $i)) >> ]) >> fi >> >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> done >> @@ -1582,12 +1582,12 @@ for i in $(seq 10); do >> remove address_set as2 addresses 10.0.0.$j >> check ovn-nbctl --wait=hv sync >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> elif test "$i" -lt 6; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((15 - $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((15 - $i)) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((10 - ($i - 5)*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((10 - ($i - 5)*2)) >> ]) >> fi >> done >> @@ -1639,22 +1639,22 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 1; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i*2 + 1)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i*2 + 1)) >> ]) >> fi >> >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >> [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1676,15 +1676,15 @@ for i in $(seq 10); do >> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 10; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> elif test "$i" = 9; then >> # no conjunction left >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((21 - $i*2)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((21 - $i*2)) >> ]) >> fi >> done >> @@ -1700,11 +1700,11 @@ for i in $(seq 10); do >> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >> [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1719,7 +1719,7 @@ >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >> actions=co >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >> actions=conjunction,2/2) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$(($i * 4 + 1)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$(($i * 4 + 1)) >> ]) >> done >> >> @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync >> reprocess_count_old=$(read_counter consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >> | \ >> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >> | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - >> $reprocess_count_old))], [0], [1 >> # Delete 2 IPs >> reprocess_count_old=$(read_counter consider_logical_flow) >> check ovn-nbctl --wait=hv remove address_set as1 addresses >> 10.0.0.4,10.0.0.5 >> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >> | \ >> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >> | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.*,/conjunction,/' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >> actions=conjunction,1/2) >> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >> actions=conjunction,1/2) >> @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport >> == "ls1-lp1" && ip4.src == $as >> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src >> == $as2 && tcp && tcp.dst == {201, 202}' drop >> >> check ovn-nbctl --wait=hv sync >> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >> | \ >> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >> | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >> actions=conjunction,1/2) >> @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ >> add address_set as2 addresses 10.0.0.24,10.0.0.33 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >> | \ >> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >> | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >> actions=conjunction,1/2) >> @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ >> remove address_set as2 addresses 10.0.0.24,10.0.0.33 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >> | \ >> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >> | \ >> grep -v reply | awk '{print $7, $8}' | \ >> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,conj_id=,metadata=0x$dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >> actions=conjunction,1/2) >> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >> actions=conjunction,1/2) >> @@ -1943,14 +1943,14 @@ for i in $(seq 5); do >> check ovn-nbctl add address_set as1 addresses >> "aa\:aa\:aa\:aa\:aa\:0$i" >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$i >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$i >> ]) >> done >> >> @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter >> consider_logical_flow) >> for i in $(seq 5); do >> check ovn-nbctl remove address_set as1 addresses >> "aa\:aa\:aa\:aa\:aa\:0$i" >> check ovn-nbctl --wait=hv sync >> - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" >> + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" >> if test "$i" = 4; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}'], [0], [dnl >> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> if test "$i" = 5; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((5 - $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((5 - $i)) >> ]) >> fi >> done >> @@ -2024,14 +2024,14 @@ for i in $(seq 5); do >> check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" >> check ovn-nbctl --wait=hv sync >> if test "$i" = 3; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$i >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$i >> ]) >> done >> >> @@ -2046,15 +2046,15 @@ for i in $(seq 5); do >> check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" >> check ovn-nbctl --wait=hv sync >> if test "$i" = 4; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=46,reg15=0x$port_key | \ >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >> table=51,reg15=0x$port_key | \ >> grep -v reply | awk '{print $7, $8}'], [0], [dnl >> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 >> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >> ]) >> fi >> if test "$i" = 5; then >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >> "priority=1100"], [1], [ignore]) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >> "priority=1100"], [1], [ignore]) >> else >> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [$((5 - $i)) >> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [$((5 - $i)) >> ]) >> fi >> done >> @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg >> ovn-nbctl create address_set name=as1 addresses=8.8.8.8 >> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src >> == $as1' drop >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100"], [0], [1 >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100"], [0], [1 >> ]) >> >> # pause ovn-northd >> @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause >> # undefined. This test runs the scenario ten times to make sure different >> # orders are covered and handled properly. >> >> -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c >> "priority=1100") >> +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c >> "priority=1100") >> for i in $(seq 10); do >> # Delete and recreate the SB address set with same name and an extra >> IP. >> addrs_=$(fetch_column address_set addresses name=as1) >> addrs=${addrs_// /,} >> AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set >> name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) >> - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | >> grep -c "priority=1100") = "$(($i + 1))"]) >> + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | >> grep -c "priority=1100") = "$(($i + 1))"]) >> done >> >> OVN_CLEANUP([hv1]) >> @@ -2698,7 +2698,7 @@ done >> wait_for_ports_up >> ovn-nbctl --wait=hv sync >> >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep >> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], >> [0],[dnl >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep >> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], >> [0],[dnl >> 3 >> ]) >> >> @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do >> done >> ovn-nbctl --wait=hv sync >> >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q >> controller], [1]) >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q >> controller], [1]) >> >> OVN_CLEANUP([hv1]) >> AT_CLEANUP >> diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at >> index 7f37d7716..b11e4ec6b 100644 >> --- a/tests/ovn-nbctl.at >> +++ b/tests/ovn-nbctl.at >> @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp >> dscp=0 rate=300 burst=3000]) >> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) >> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) >> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 >> burst=30000]) >> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) >> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) >> >> dnl Add duplicated qos >> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 >> burst=30002], [1], [], [stderr]) >> @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 >> from-lport 400 (tcp) rate=300 burst=3000 dscp=0 >> to-lport 300 (tcp) dscp=48 >> to-lport 200 (ip) rate=101 >> + to-lport 102 (ip4) dscp=16 mark=17 >> + to-lport 101 (ip4) mark=15 >> to-lport 100 (ip4) rate=301 burst=30000 dscp=13 >> ]) >> >> @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip >> dscp=-1], [1], [], >> ]) >> >> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], >> -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and >> "burst=" >> +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" >> and "mark=" >> ]) >> >> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], >> -[ovn-nbctl: Either "rate" and/or "dscp" must be specified >> +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified >> ])]) >> >> dnl --------------------------------------------------------------------- >> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at >> index 67e81ddba..6a27b7dcf 100644 >> --- a/tests/ovn-northd.at >> +++ b/tests/ovn-northd.at >> @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ >> -- ls-lb-add ls lb >> >> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e >> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e >> ls_in_acl_after_lb_eval | sort], [0], [dnl >> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), >> action=(next;) >> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == >> 1), action=(reg8[[16]] = 1; next;) >> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), >> action=(next;) >> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == >> 1), action=(reg8[[16]] = 1; next;) >> table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) >> table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && >> ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) >> table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && >> ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) >> @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls >> ovn-nbctl --wait=sb clear logical_switch ls load_balancer >> >> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e >> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e >> ls_in_acl_after_lb_eval | sort], [0], [dnl >> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), >> action=(next;) >> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), >> action=(next;) >> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) >> table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) >> @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >> action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >> @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >> @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >> action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >> @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >> action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >> action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >> action=(reg8[[16]] = 1; next;) >> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >> @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >> | sed 's/table=../table=??/ >> table=??(ls_out_acl_action ), priority=0 , match=(1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >> action=(next;) >> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >> @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=50 , match=(1), >> action=(reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >> action=(outport = get_fdb(eth.dst); next;) >> @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >> action=(outport = "_MC_flood"; output;) >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 >> "00:00:00:00:00:01" >> @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=50 , match=(1), >> action=(reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >> action=(outport = get_fdb(eth.dst); next;) >> @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >> action=(outport = "_MC_flood"; output;) >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 >> 1000::3" >> @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=50 , match=(1), >> action=(reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >> action=(outport = get_fdb(eth.dst); next;) >> @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >> action=(outport = "_MC_flood"; output;) >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> # Disable sw0p1 >> @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=50 , match=(1), >> action=(reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >> action=(outport = get_fdb(eth.dst); next;) >> @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "sw0p1"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 >> @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == >> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) >> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "sw0p1"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> check ovn-nbctl set logical_switch_port sw0p1 enabled=true >> @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && >> icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && >> icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) >> table=??(ls_in_check_port_sec), priority=50 , match=(1), >> action=(reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >> "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); >> next;) >> - table=??(ls_in_check_port_sec), priority=70 , match=(inport == >> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) >> + table=??(ls_in_check_port_sec), priority=70 , match=(inport == >> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) >> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) >> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >> action=(next;) >> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >> 1), action=(drop;) >> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >> action=(output;) >> table=??(ls_out_apply_port_sec), priority=100 , match=(outport == >> "localnetport"), action=(set_queue(10); output;) >> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == >> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) >> @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >> action=(outport = "_MC_flood"; output;) >> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >> action=(output;) >> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >> "none"), action=(drop;) >> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >> action=(reg0[[15]] = check_out_port_sec(); next;) >> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >> action=(reg0[[15]] = 0; next;) >> ]) >> >> AT_CLEANUP >> @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options >> logical_port=public |grep -q 'qos >> AT_CLEANUP >> ]) >> >> +OVN_FOR_EACH_NORTHD_NO_HV([ >> +AT_SETUP([check OVN QoS mark/meter logical flows]) >> +AT_KEYWORDS([OVN-QoS]) >> +ovn_start >> + >> +check ovn-nbctl ls-add ls >> +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 >> +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 >> +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 >> +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 >> + >> +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 >> +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 >> +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 >> +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 >> +check ovn-nbctl --wait=sb sync >> + >> +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl >> + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) >> + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), >> action=(ip.dscp = 16; next;) >> + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), >> action=(ip.dscp = 17; next;) >> + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) >> + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), >> action=(set_meter(100, 1000); next;) >> + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) >> + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), >> action=(pkt.mark = 15; next;) >> + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), >> action=(pkt.mark = 18; next;) >> + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) >> + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), >> action=(ip.dscp = 16; next;) >> + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), >> action=(ip.dscp = 17; next;) >> + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) >> + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), >> action=(set_meter(100, 1000); next;) >> + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) >> + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), >> action=(pkt.mark = 15; next;) >> + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), >> action=(pkt.mark = 18; next;) >> +]) >> + >> +AT_CLEANUP >> +]) >> + >> AT_SETUP([Tiered ACL logical flows]) >> AT_KEYWORDS([acl]) >> >> @@ -9978,10 +10017,10 @@ acl_test() { >> } >> >> acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 >> -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval >> ls_in_acl_after_lb_action 18 >> +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval >> ls_in_acl_after_lb_action 19 >> acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 >> acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 >> -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval >> ls_in_acl_after_lb_action 18 >> +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval >> ls_in_acl_after_lb_action 19 >> acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 >> >> AT_CLEANUP >> diff --git a/tests/ovn.at b/tests/ovn.at >> index 28c6b6c34..9b158e79c 100644 >> --- a/tests/ovn.at >> +++ b/tests/ovn.at >> @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); >> >> next(pipeline=egress); >> formats as next(pipeline=egress, table=11); >> - encodes as resubmit(,53) >> + encodes as resubmit(,58) >> >> next(pipeline=egress, table=5); >> - encodes as resubmit(,47) >> + encodes as resubmit(,52) >> >> next(table=10); >> formats as next(10); >> @@ -9719,18 +9719,18 @@ as hv1 >> AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 >> external_ids:iface-id=localvif1]) >> >> # On hv1, check that there are no flows outputting bcast to tunnel >> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> >> # On hv2, check that no flow outputs bcast to tunnel to hv1. >> as hv2 >> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> >> # Now bind vif2 on hv2. >> AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 >> external_ids:iface-id=localvif2]) >> >> # At this point, the broadcast flow on vif2 should be deleted. >> -# because, there is now a localnet vif bound (table=37 programming logic) >> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> +# because, there is now a localnet vif bound (table=42 programming logic) >> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >> | grep output | wc -l` -eq 0]) >> >> # Verify that the local net patch port exists on hv2. >> OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port >> patch-br-int-to-ln_port" | wc -l` -eq 1]) >> @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns >> ofport find Interface name=ov >> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface >> name=ovn-gw2-0) >> >> OVS_WAIT_UNTIL([ >> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >> ]) >> >> test_ip_packet() >> @@ -11631,7 +11631,7 @@ AT_CHECK( >> ]) >> >> OVS_WAIT_UNTIL([ >> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >> ]) >> >> test_ip_packet gw2 gw1 0 >> @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns >> ofport find Interface name=ov >> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface >> name=ovn-gw2-0) >> >> OVS_WAIT_UNTIL([ >> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >> ]) >> >> test_ip_packet() >> @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ >> ]) >> >> OVS_WAIT_UNTIL([ >> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >> ]) >> >> test_ip_packet gw2 gw1 >> @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) >> >> AT_CHECK( >> [# Check that redirect mapping is programmed only on hv2 >> - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l >> - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc >> -l >> + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l >> + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc >> -l >> >> # Check that hv1 sends chassisredirect port traffic to hv2 >> - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l >> - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l >> + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l >> + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l >> >> # Check that arp reply on distributed gateway port is only programmed >> on hv2 >> grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l >> @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int >> in_port=hv1-vif1 $packet >> sleep 2 >> >> AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ >> | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 >> ]]) >> >> @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport >> echo $hv2_gw2_ofport >> >> echo "--- hv1 ---" >> -as hv1 ovs-ofctl dump-flows br-int table=39 >> +as hv1 ovs-ofctl dump-flows br-int table=44 >> >> echo "--- hv2 ---" >> -as hv2 ovs-ofctl dump-flows br-int table=39 >> +as hv2 ovs-ofctl dump-flows br-int table=44 >> >> gw1_chassis=$(fetch_column Chassis _uuid name=gw1) >> gw2_chassis=$(fetch_column Chassis _uuid name=gw2) >> >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >> | wc -l], [0], [1 >> ]) >> >> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >> | wc -l], [0], [1 >> ]) >> @@ -13566,15 +13566,15 @@ sleep 10 >> >> as gw1 ovs-ofctl dump-flows br-int >> >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> # make sure ARP responder flows for outside router port reside on gw1 too >> through ls_in_arp_rsp table >> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ >> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ >> grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) >> >> # check that the chassis redirect port has been claimed by the gw1 chassis >> @@ -13598,12 +13598,12 @@ wait_for_ports_up >> check ovn-nbctl --wait=hv sync >> >> # we make sure that the hypervisors noticed, and inverted the slave ports >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ >> | wc -l], [0], [1 >> ]) >> >> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ >> | wc -l], [0], [1 >> ]) >> @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find >> Interface name=ovn-hv1-0],[0], >> ]]) >> >> # make sure that flows for handling the outside router port reside on gw2 >> now >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port >> bfd_dump >> >> # make sure that flows for handling the outside router port reside on gw1 >> now >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside >> ha_chassis_group=$hagrp1_uuid >> wait_row_count HA_Chassis_Group 1 >> wait_row_count HA_Chassis 2 >> >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >> | wc -l], [0], [0 >> ]) >> >> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >> | wc -l], [0], [0 >> ]) >> @@ -13777,26 +13777,26 @@ done >> # Re-add gw2 >> as gw2 ovn_attach n1 br-phys 192.168.0.1 >> >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >> | wc -l], [0], [1 >> ]) >> >> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >> | wc -l], [0], [1 >> ]) >> >> # make sure that flows for handling the outside router port reside on gw1 >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> # make sure ARP responder flows for outside router port reside on gw1 too >> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ >> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ >> grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) >> >> # check that the chassis redirect port has been claimed by the gw1 chassis >> @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group >> ref_chassis >> # Increase the priority of gw2 >> ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 >> >> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ >> | wc -l], [0], [1 >> ]) >> >> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ >> | wc -l], [0], [1 >> ]) >> @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find >> Interface name=ovn-hv1-0],[0], >> ]]) >> >> # make sure that flows for handling the outside router port reside on gw2 >> now >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port >> bfd_dump >> >> # make sure that flows for handling the outside router port reside on gw2 >> now >> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >> ]]) >> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >> ]]) >> >> @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows >> AT_CAPTURE_FILE([sw0-flows]) >> >> AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed >> 's/table=../table=??/' | sort], [0], [dnl >> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=27); };) >> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >> inport; next(pipeline=ingress,table=28); };) >> ]) >> >> >> @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst >> $ipv6_src $ipv6_dst >> # Get total number of ipv4 packets that received on ovs >> >> # sender side >> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | >> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | >> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >> >> # receiver side >> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | >> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | >> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >> >> # Get total number of ipv6 packets that received on ovs >> >> # sender side >> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | >> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | >> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >> >> # receiver side >> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | >> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | >> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >> >> OVN_CLEANUP([hv1], [hv2]) >> AT_CLEANUP >> @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 >> 'ip4.src==10.0.0.1' allow >> check ovn-nbctl --wait=hv sync >> >> # Check OVS flows, the less restrictive flows should have been installed. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> grep "priority=1003" | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> ]) >> >> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. >> @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 >> 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' >> check ovn-nbctl --wait=hv sync >> >> # Check OVS flows, the second less restrictive allow ACL should have been >> installed. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> \ >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> \ >> grep "priority=1003" | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> ]) >> >> # Remove the less restrictive allow ACL. >> @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 >> 'ip4.src==10.0.0.1' >> check ovn-nbctl --wait=hv sync >> >> # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> \ >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> \ >> grep "priority=1003" | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> ]) >> >> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. >> @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 >> 'ip4.src==10.0.0.1' allow >> check ovn-nbctl --wait=hv sync >> >> # Check OVS flows, the less restrictive flows should have been installed. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> \ >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> \ >> grep "priority=1003" | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> ]) >> >> # Add another ACL that overlaps with the existing less restrictive ones. >> @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync >> # with an additional conjunction action. >> # >> # New non-conjunctive flows should be added to match on 'udp'. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> \ >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> \ >> grep "priority=1003" | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction(),conjunction() >> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> - table=46, priority=1003,udp,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> - table=46, priority=1003,udp6,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >> actions=conjunction(),conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >> actions=conjunction(),conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >> actions=conjunction(),conjunction() >> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >> actions=conjunction() >> + table=51, priority=1003,udp,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> + table=51, priority=1003,udp6,metadata=0x1 >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> ]) >> >> OVN_CLEANUP([hv1]) >> @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 >> 'outport == @pg1 && ip4.src == $as2' al >> >> wait_for_ports_up >> check ovn-nbctl --wait=hv sync >> -ovs-ofctl dump-flows br-int table=46 >> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = >> 2]) >> +ovs-ofctl dump-flows br-int table=51 >> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = >> 2]) >> >> echo ------- >> # Add another address in as1, so that the 1st ACL will now generate 2 >> conjunctions. >> ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" >> check ovn-nbctl --wait=hv sync >> >> -ovs-ofctl dump-flows br-int table=46 >> +ovs-ofctl dump-flows br-int table=51 >> # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd >> ACL) >> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = >> 3]) >> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = >> 3]) >> >> OVN_CLEANUP([hv1]) >> AT_CLEANUP >> @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 >> # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined >> # to router mac. >> AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ >> -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ >> +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ >> grep -c "actions=drop"], [0], [1 >> ]) >> # Stop ovn-controllers on hv1 and hv3. >> @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy >> options:pkt_mark=100 >> check ovn-nbctl --wait=hv sync >> as hv2 >> # add a flow in egress pipeline to check pkt marking >> -ovs-ofctl --protocols=OpenFlow13 add-flow br-int >> "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 >> actions=resubmit(,38)" >> +ovs-ofctl --protocols=OpenFlow13 add-flow br-int >> "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 >> actions=resubmit(,43)" >> >> dst_ip=$(ip_to_hex 172 16 2 10) >> fip_ip=$(ip_to_hex 172 16 1 2) >> @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip >> $gw_router_ip) >> expected >> send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip >> echo >> "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" >>>> expected >> >> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | >> grep pkt_mark=0x64 | grep -c n_packets=1`]) >> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | >> grep pkt_mark=0x64 | grep -c n_packets=1`]) >> >> OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) >> >> @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { >> lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key >> external_ids:name=lr0)) >> lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding >> tunnel_key logical_port=lr0-public)) >> >> - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | >> ofctl_strip_all | grep "priority=2000"], [0], [dnl >> - table=46, priority=2000,ip,metadata=0x$sw0_dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >> + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | >> ofctl_strip_all | grep "priority=2000"], [0], [dnl >> + table=51, priority=2000,ip,metadata=0x$sw0_dp_key >> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >> ]) >> >> AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | >> ofctl_strip_all | \ >> grep "priority=92" | grep 172.168.0.50], [0], [dnl >> - table=11, >> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 >> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) >> + table=11, >> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 >> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) >> ]) >> } >> >> check_virtual_offlows_not_present() { >> hv=$1 >> - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | >> ofctl_strip_all | grep "priority=2000"], [1], [dnl >> + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | >> ofctl_strip_all | grep "priority=2000"], [1], [dnl >> ]) >> >> AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | >> ofctl_strip_all | \ >> @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 >> logical_port=sw0-vir virtual_parent=sw0-p1 >> wait_for_ports_up sw0-vir >> check ovn-nbctl --wait=hv sync >> AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received >> packet-in" | \ >> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) >> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) >> >> wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid >> check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 >> @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], >> OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], >> [vif-north.expected]) >> >> # Confirm that packets did not go out via tunnel port. >> - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep >> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 >> + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep >> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 >> ]]) >> >> # Confirm that packet went out via localnet port >> @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) >> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int >> external_ids:ct-zone-sw0-p2 | sed 's/"//g') >> AT_CHECK([test ! -z $p2_zoneid]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) >> -eq 1]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw1_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw1_dpkey},\ >> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw1_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw1_dpkey},\ >> reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) >> -eq 1]) >> >> ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo >> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) >> >> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >> @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up >> sw0-p1) = xup]) >> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >> AT_CHECK([test ! -z $p1_zoneid]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) >> -eq 1]) >> >> ovs-vsctl del-port hv1-vif2 >> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) >> >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) >> >> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int >> external_ids:ct-zone-sw0-p2 | sed 's/"//g') >> @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) >> >> ovn-nbctl lsp-del sw0-p1 >> >> -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int >> table=40,metadata=${sw0_dpkey},\ >> +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int >> table=45,metadata=${sw0_dpkey},\ >> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) >> >> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >> @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) >> check ovn-nbctl --wait=hv sync >> >> # Check OVS flows are installed properly. >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >> \ >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >> \ >> grep "priority=2002" | grep conjunction | \ >> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >> sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> - table=46, >> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> + table=51, >> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >> actions=conjunction() >> ]) >> >> OVN_CLEANUP([hv1]) >> @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface >> lsp0-0 external_ids:iface-id=l >> ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 >> external_ids:iface-id=lsp0-1 >> >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 22]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 22]) >> >> # Save the current lflow_run counter >> lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) >> @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller >> coverage/read-counter lflow_run) >> # 1. Remove half of the ports from pg1. The excepted conjunction flows >> should be: >> # 2 + 10 = 12 >> check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j >> in 0 1; do echo lsp${i}-${j}; done; done) >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 12]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 12]) >> >> # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because >> the >> # port group const set should have only one member (lsp0-1). And the >> total >> @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int >> table=46 | grep conjunction | wc -l >> # 10. >> ovs-vsctl del-port br-int lsp0-0 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 0]) >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc >> -l) == 10]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 0]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc >> -l) == 10]) >> >> # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. >> ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 >> external_ids:iface-id=lsp0-0 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 12]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 12]) >> >> # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any >> change. >> ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 >> external_ids:iface-id=lsp9-0 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 12]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 12]) >> >> # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a >> different >> # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) >> ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 >> external_ids:iface-id=lsp1-0 >> ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 >> external_ids:iface-id=lsp1-1 >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >> | wc -l) == 24]) >> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >> | wc -l) == 24]) >> >> # 6. Simulate a SB port-group "del and add" notification to >> ovn-controller in the >> # same IDL iteration. ovn-controller should still program the same >> flows. In >> @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do >> check ovn-nbctl --wait=hv sync >> >> # Finally check flow count is the same as before. >> - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep >> conjunction | wc -l) == 24]) >> + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep >> conjunction | wc -l) == 24]) >> done >> >> # Make sure all the above was performed with I-P (no recompute) >> @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 >> 'outport == "lp2" && ip4.src == 10.0. >> >> # The first ACL should be programmed, but the second one shouldn't. >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], >> [ignore]) >> >> # Now create the lport lp2. >> check ovn-nbctl lsp-add lsw0 lp2 \ >> @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ >> >> check ovn-nbctl --wait=hv sync >> # Now the second ACL should be programmed. >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], >> [ignore]) >> >> # Remove the lport lp2 again, the OVS flow for the second ACL should be >> # removed. >> check ovn-nbctl --wait=hv lsp-del lp2 >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], >> [ignore]) >> >> # Test similar scenario but when the referenced lport is not bound >> locally. >> >> @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport >> == "lp4" && ip4.dst == 10.0.0 >> >> # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], >> [ignore]) >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], >> [ignore]) >> >> # Now create the lport lp4. >> check ovn-nbctl lsp-add lsw0 lp4 \ >> @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ >> >> # Now the ACL for lp4 should be programmed. >> check ovn-nbctl --wait=hv sync >> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], >> [ignore]) >> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], >> [ignore]) >> >> OVN_CLEANUP([hv1]) >> AT_CLEANUP >> @@ -33493,15 +33493,15 @@ done >> check ovn-nbctl --wait=hv sync >> >> # hv0 should see flows for lsp1 but not lsp2 >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >> [0], [ignore]) >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], >> [1]) >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >> [0], [ignore]) >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], >> [1]) >> # hv2 should see flows for lsp2 but not lsp1 >> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], >> [0], [ignore]) >> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >> [1]) >> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], >> [0], [ignore]) >> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >> [1]) >> >> # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 >> check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 >> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >> [0], [ignore]) >> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >> [0], [ignore]) >> >> # Change it back, and trigger recompute to make sure extra flows are >> removed >> # from hv2 (recompute is needed because currently I-P adds local >> datapaths but >> @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int >> table=29 | grep 10.0.1.2], [0], [ig >> check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 >> as hv2 check ovn-appctl -t ovn-controller recompute >> ovn-nbctl --wait=hv sync >> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >> [1]) >> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >> [1]) >> >> # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. >> AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr >> dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) >> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >> [0], [ignore]) >> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >> [0], [ignore]) >> >> OVN_CLEANUP([hv1],[hv2]) >> AT_CLEANUP >> @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync >> # Use constants so that if tables or registers change, this test can >> # be updated easily. >> DNAT_TABLE=15 >> -SNAT_TABLE=45 >> +SNAT_TABLE=50 >> DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" >> SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" >> >> @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync >> wait_for_ports_up >> OVN_POPULATE_ARP >> >> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c >> controller], [0],[dnl >> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c >> controller], [0],[dnl >> 9 >> ]) >> >> @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) >> send_garp 1 1 $eth_src $eth_dst $spa $tpa >> >> OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl >> received packet-in" | \ >> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) >> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) >> >> sleep_controller hv1 >> >> @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT >> \ >> >> OVS_APP_EXIT_AND_WAIT([ovsdb-server]) >> AT_CLEANUP >> + >> +OVN_FOR_EACH_NORTHD([ >> +AT_SETUP([QoS packet marking]) >> +AT_KEYWORDS([ovn-qos-pkt-marking]) >> +AT_SKIP_IF([test $HAVE_SCAPY = no]) >> +ovn_start >> + >> +check ovn-nbctl lr-add lr0 >> +check ovn-nbctl ls-add ls0 >> +check ovn-nbctl ls-add ls1 >> + >> +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 >> +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ >> + set Logical_Switch_Port lrp-s0 type=router \ >> + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' >> +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 >> +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ >> + set Logical_Switch_Port lrp-s1 type=router \ >> + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' >> + >> +check ovn-nbctl --wait=sb lsp-add ls0 lp0 >> +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 >> +check ovn-nbctl --wait=sb lsp-add ls0 lp1 >> +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 >> + >> +check ovn-nbctl --wait=sb lsp-add ls1 lp2 >> +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 >> +check ovn-nbctl --wait=sb sync >> + >> +net_add n1 >> +sim_add hv >> + >> +as hv >> +check ovs-vsctl add-br br-phys >> +ovn_attach n1 br-phys 192.168.0.1 >> + >> +check ovs-vsctl add-port br-int vif0 -- \ >> + set Interface vif0 external-ids:iface-id=lp0 \ >> + options:tx_pcap=hv/vif0-tx.pcap \ >> + options:rxq_pcap=hv/vif0-rx.pcap \ >> + ofport-request=1 >> +check ovs-vsctl add-port br-int vif1 -- \ >> + set Interface vif1 external-ids:iface-id=lp1 \ >> + options:tx_pcap=hv/vif1-tx.pcap \ >> + options:rxq_pcap=hv/vif1-rx.pcap \ >> + ofport-request=2 >> +check ovs-vsctl add-port br-int vif2 -- \ >> + set Interface vif2 external-ids:iface-id=lp2 \ >> + options:tx_pcap=hv/vif2-tx.pcap \ >> + options:rxq_pcap=hv/vif2-rx.pcap \ >> + ofport-request=3 >> + >> +# Create QoS rules for packet marking. >> +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" >> mark=48 >> +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" >> mark=49 >> +check_row_count nb:QoS 2 >> + >> +# Create some flows to count pkt marking. >> +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark >> == 48" drop >> +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop >> +wait_for_ports_up >> +check ovn-nbctl --wait=hv sync >> + >> +send_udp_packet() { >> + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 >> + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ >> + IP(src='${ipv4_src}', dst='${ipv4_dst}', >> ttl=0x40)/ \ >> + UDP(sport=4242, dport=4343)") >> + as hv ovs-appctl netdev-dummy/receive vif$inport $packet >> +} >> + >> +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key >> external_ids:name=ls0)) >> +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key >> external_ids:name=lr0)) >> + >> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 >> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E >> "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) >> + >> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 >> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E >> "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) >> + >> +OVN_CLEANUP([hv]) >> +AT_CLEANUP >> +]) >> diff --git a/tests/system-ovn.at b/tests/system-ovn.at >> index cb4124b70..1277f1057 100644 >> --- a/tests/system-ovn.at >> +++ b/tests/system-ovn.at >> @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 >> >> ovn-nbctl list load_balancer >> ovn-sbctl dump-flows R2 >> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ >> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ >> grep 'nat(src=20.0.0.2)']) >> >> check ovs-appctl dpctl/flush-conntrack >> @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 >> >> ovn-nbctl list load_balancer >> ovn-sbctl dump-flows R2 >> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ >> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ >> grep 'nat(src=20.0.0.2)']) >> >> rm -f wget*.log >> @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ >> ]) >> >> OVS_WAIT_UNTIL([ >> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ >> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ >> grep controller | grep tp_dst=84 -c) >> test $n_pkt -eq 1 >> ]) >> @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ >> ]) >> >> OVS_WAIT_UNTIL([ >> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ >> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ >> grep controller | grep tp_dst=84 -c) >> test $n_pkt -eq 1 >> ]) >> @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast >> >> wait_igmp_flows_installed() >> { >> - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ >> + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ >> grep 'priority=90' | grep "nw_dst=$1"]) >> } >> >> @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >> 30.0.0.2:8000"'='"192.168.1.2:12345,192 >> >> ovn-nbctl list load_balancer >> ovn-sbctl dump-flows R2 >> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep >> 'nat(src=20.0.0.2)']) >> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep >> 'nat(src=20.0.0.2)']) >> >> dnl Test load-balancing that includes L4 ports in NAT. >> for i in `seq 1 20`; do >> diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml >> index 6f74bd557..f838393a6 100644 >> --- a/utilities/ovn-nbctl.8.xml >> +++ b/utilities/ovn-nbctl.8.xml >> @@ -482,6 +482,9 @@ >> <code>burst=</code><var>burst</var> specifies the burst rate >> limit in kilobits. <code>dscp</code> and/or <code>rate</code> >> are required arguments. >> + If <code>mark=</code><var>mark</var> is specified, then matching >> + packets will be marked (through <code>pkt.mark</code>). >> + <var>mark</var> must be a positive integer. >> </p> >> >> <p> >> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c >> index 526369b68..0620d333a 100644 >> --- a/utilities/ovn-nbctl.c >> +++ b/utilities/ovn-nbctl.c >> @@ -283,7 +283,7 @@ ACL commands:\n\ >> print ACLs for SWITCH\n\ >> \n\ >> QoS commands:\n\ >> - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] >> [dscp=DSCP]\n\ >> + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] >> [dscp=DSCP] [mark=MARK]\n\ >> add an QoS rule to SWITCH\n\ >> qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ >> remove QoS rules from SWITCH\n\ >> @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) >> if (!strcmp(qos_rule->key_action[j], "dscp")) { >> ds_put_format(&ctx->output, " dscp=%"PRId64"", >> qos_rule->value_action[j]); >> + } else if (!strcmp(qos_rule->key_action[j], "mark")) { >> + ds_put_format(&ctx->output, " mark=%"PRId64"", >> + qos_rule->value_action[j]); >> } >> } >> ds_put_cstr(&ctx->output, "\n"); >> @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) >> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); >> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); >> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); >> + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); >> } >> >> static void >> @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) >> const char *direction; >> int64_t priority; >> int64_t dscp = -1; >> + int64_t mark = 0; >> int64_t rate = 0; >> int64_t burst = 0; >> char *error; >> @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) >> return; >> } >> } >> + else if (!strncmp(ctx->argv[i], "mark=", 5)) { >> + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < >> 0) { >> + ctl_error(ctx, "%s: mark must be a positive integer", >> + ctx->argv[i] + 5); >> + return; >> + } >> + } >> else if (!strncmp(ctx->argv[i], "rate=", 5)) { >> if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) >> || rate < 1 || rate > UINT32_MAX) { >> @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) >> } >> } else { >> ctl_error(ctx, "%s: supported arguments are \"dscp=\", >> \"rate=\", " >> - "and \"burst=\"", ctx->argv[i]); >> + "\"burst=\" and \"mark=\"", ctx->argv[i]); >> return; >> } >> } >> >> /* Validate rate and dscp. */ >> - if (-1 == dscp && !rate) { >> - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be >> specified"); >> + if (-1 == dscp && !rate && !mark) { >> + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be >> " >> + "specified"); >> return; >> } >> >> @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) >> nbrec_qos_set_priority(qos, priority); >> nbrec_qos_set_direction(qos, direction); >> nbrec_qos_set_match(qos, ctx->argv[4]); >> + if (mark) { >> + nbrec_qos_update_action_setkey(qos, "mark", mark); >> + } >> if (-1 != dscp) { >> - const char *dscp_key = "dscp"; >> - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); >> + nbrec_qos_update_action_setkey(qos, "dscp", dscp); >> } >> if (rate) { >> const char *bandwidth_key[2] = {"rate", "burst"}; >> -- >> 2.43.0 >> >> _______________________________________________ >> dev mailing list >> dev@openvswitch.org >> https://mail.openvswitch.org/mailman/listinfo/ovs-dev >> >> > Thanks, > Ales > Thanks, Dumitru
On 1/31/24 13:22, Dumitru Ceara wrote: > On 1/31/24 13:10, Ales Musil wrote: >> On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < >> lorenzo.bianconi@redhat.com> wrote: >> >>> Add the capbility to mark (through pkt.mark) incoming/outgoing packets >>> in logical_switch datapath according to user configured QoS rule. >>> >>> Co-developed-by: Dumitru Ceara <dceara@redhat.com> >>> Reported-at: https://issues.redhat.com/browse/FDP-42 >>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> >>> --- >>> >> >> Hi Lorenzo and Dumitru, > > Hi Ales, > >> I have one question, would it be possible to use existing QOS_MARK by >> moving it after the lb/stateful stage in ingress/egress? Even if both dscp >> and mark are set at the same time the action could set both in one logical >> flow. That being said, we might even collapse all QoS stages into one that >> will be a combination of dscp/mark/set_meter WDYT? However, I might have >> missed something crucial why it isn't possible. >> > > That's a significant behavior change IMO (that I'd like to avoid for > now). We might be breaking existing QoS (DSCP) marking rules if we move > the ls_in_qos_mark stage after load balancing. > > The CMS has more knowledge about the network than OVN does and it can > attach it's own "metadata" (pkt.mark) to relay that to upper layers (or > later stages in the OVN pipeline). In this specific case ovn-kubernetes > can determine whether the mark should be set _only after_ load > balancing. That's the reason why we addded the new stage after the lb one. > > But I think we're definitely open to alternatives if you have ideas. > I had another look and because we send all traffic to conntrack in stage pre_stateful if load balancers are enabled it's probably fine to move the pkt marking stage (the new one) next to the qos stages. I wouldn't merge QoS stages them in this patch though given that we're late in the dev cycle. It's probably fine to merge them as a follow up for 24.09. Lorenzo, what do you think? Regards, Dumitru >> >> >>> NEWS | 2 + >>> controller/lflow.h | 15 +- >>> lib/ovn-util.h | 2 +- >>> northd/northd.c | 55 +++-- >>> northd/ovn-northd.8.xml | 60 ++++-- >>> ovn-nb.ovsschema | 9 +- >>> ovn-nb.xml | 12 +- >>> tests/ovn-controller.at | 308 +++++++++++++-------------- >>> tests/ovn-nbctl.at | 8 +- >>> tests/ovn-northd.at | 103 ++++++--- >>> tests/ovn.at | 429 +++++++++++++++++++++++--------------- >>> tests/system-ovn.at | 12 +- >>> utilities/ovn-nbctl.8.xml | 3 + >>> utilities/ovn-nbctl.c | 27 ++- >>> 14 files changed, 627 insertions(+), 418 deletions(-) >>> >>> diff --git a/NEWS b/NEWS >>> index 6553bd078..7300345f1 100644 >>> --- a/NEWS >>> +++ b/NEWS >>> @@ -18,6 +18,8 @@ Post v23.09.0 >>> - Support selecting encapsulation IP based on the source/destination >>> VIF's >>> settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more >>> details. >>> + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets >>> + in the logical switch datapath according to user configured QoS rule. >>> >>> OVN v23.09.0 - 15 Sep 2023 >>> -------------------------- >>> diff --git a/controller/lflow.h b/controller/lflow.h >>> index 9b7ffa19c..f7f6c7950 100644 >>> --- a/controller/lflow.h >>> +++ b/controller/lflow.h >>> @@ -67,17 +67,20 @@ struct uuid; >>> >>> /* Start of LOG_PIPELINE_LEN tables. */ >>> #define OFTABLE_LOG_INGRESS_PIPELINE 8 >>> -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 >>> -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 >>> -#define OFTABLE_REMOTE_OUTPUT 39 >>> -#define OFTABLE_LOCAL_OUTPUT 40 >>> -#define OFTABLE_CHECK_LOOPBACK 41 >>> +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 >>> +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 >>> +#define OFTABLE_REMOTE_OUTPUT 44 >>> +#define OFTABLE_LOCAL_OUTPUT 45 >>> +#define OFTABLE_CHECK_LOOPBACK 46 >>> >>> /* Start of the OUTPUT section of the pipeline. */ >>> #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT >>> +BUILD_ASSERT_DECL( >>> + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT >>> +); >>> >>> /* Start of LOG_PIPELINE_LEN tables. */ >>> -#define OFTABLE_LOG_EGRESS_PIPELINE 42 >>> +#define OFTABLE_LOG_EGRESS_PIPELINE 47 >>> #define OFTABLE_SAVE_INPORT 64 >>> #define OFTABLE_LOG_TO_PHY 65 >>> #define OFTABLE_MAC_BINDING 66 >>> diff --git a/lib/ovn-util.h b/lib/ovn-util.h >>> index 2afff0d07..3e1d68cf9 100644 >>> --- a/lib/ovn-util.h >>> +++ b/lib/ovn-util.h >>> @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( >>> #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) >>> >>> /* The number of tables for the ingress and egress pipelines. */ >>> -#define LOG_PIPELINE_LEN 29 >>> +#define LOG_PIPELINE_LEN 30 >>> >>> static inline uint32_t >>> hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) >>> diff --git a/northd/northd.c b/northd/northd.c >>> index d2091d4bc..597d203ca 100644 >>> --- a/northd/northd.c >>> +++ b/northd/northd.c >>> @@ -134,22 +134,23 @@ enum ovn_stage { >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") >>> \ >>> PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") >>> \ >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ >>> + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ >>> "ls_in_acl_after_lb_eval") \ >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ >>> "ls_in_acl_after_lb_action") \ >>> - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") >>> \ >>> - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") >>> \ >>> + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") >>> \ >>> >>> \ >>> /* Logical switch egress stages. */ >>> \ >>> PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") >>> \ >>> @@ -161,8 +162,9 @@ enum ovn_stage { >>> PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") >>> \ >>> PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") >>> \ >>> PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") >>> \ >>> - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, >>> "ls_out_check_port_sec") \ >>> - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, >>> "ls_out_apply_port_sec") \ >>> + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") >>> \ >>> + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, >>> "ls_out_check_port_sec") \ >>> + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, >>> "ls_out_apply_port_sec") \ >>> \ >>> /* Logical router ingress stages. */ \ >>> PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") >>> \ >>> @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct >>> chassis_features *features, >>> ds_destroy(&actions); >>> } >>> >>> +#define QOS_MAX_DSCP 63 >>> + >>> static void >>> build_qos(struct ovn_datapath *od, struct hmap *lflows) { >>> struct ds action = DS_EMPTY_INITIALIZER; >>> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap >>> *lflows) { >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); >>> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); >>> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); >>> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); >>> >>> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { >>> struct nbrec_qos *qos = od->nbs->qos_rules[i]; >>> bool ingress = !strcmp(qos->direction, "from-lport") ? true >>> :false; >>> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : >>> S_SWITCH_OUT_QOS_MARK; >>> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); >>> int64_t rate = 0; >>> int64_t burst = 0; >>> >>> for (size_t j = 0; j < qos->n_action; j++) { >>> if (!strcmp(qos->key_action[j], "dscp")) { >>> + if (qos->value_action[j] > QOS_MAX_DSCP) { >>> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " >>> + UUID_FMT, qos->value_action[j], >>> + UUID_ARGS(&qos->header_.uuid)); >>> + continue; >>> + } >>> + >>> ds_clear(&action); >>> ds_put_format(&action, "ip.dscp = %"PRId64"; next;", >>> qos->value_action[j]); >>> @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap >>> *lflows) { >>> qos->priority, >>> qos->match, ds_cstr(&action), >>> &qos->header_); >>> + } else if (!strcmp(qos->key_action[j], "mark")) { >>> + ds_clear(&action); >>> + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", >>> + qos->value_action[j]); >>> + ovn_lflow_add_with_hint(lflows, od, >>> + ingress ? S_SWITCH_IN_QOS_PKT_MARK >>> + : S_SWITCH_OUT_QOS_PKT_MARK, >>> + qos->priority, qos->match, ds_cstr(&action), >>> + &qos->header_); >>> } >>> } >>> >>> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml >>> index 068d47e1a..c1cd19947 100644 >>> --- a/northd/ovn-northd.8.xml >>> +++ b/northd/ovn-northd.8.xml >>> @@ -1082,7 +1082,28 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 15: Pre-Hairpin</h3> >>> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> >>> + >>> + <p> >>> + Logical flows in this table closely reproduce those in the >>> + <code>QoS</code> table with the <code>action</code> column set in >>> + the <code>OVN_Northbound</code> database for the >>> + <code>from-lport</code> direction. >>> + </p> >>> + >>> + <ul> >>> + <li> >>> + For every qos_rules entry in a logical switch with packet marking >>> + enabled, a flow will be added at the priority mentioned in the >>> + QoS table. >>> + </li> >>> + >>> + <li> >>> + A priority-0 flow that simply moves traffic to the next table. >>> + </li> >>> + </ul> >>> + >>> + <h3>Ingress Table 16: Pre-Hairpin</h3> >>> <ul> >>> <li> >>> If the logical switch has load balancer(s) configured, then a >>> @@ -1100,7 +1121,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 16: Nat-Hairpin</h3> >>> + <h3>Ingress Table 17: Nat-Hairpin</h3> >>> <ul> >>> <li> >>> If the logical switch has load balancer(s) configured, then a >>> @@ -1135,7 +1156,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 17: Hairpin</h3> >>> + <h3>Ingress Table 18: Hairpin</h3> >>> <ul> >>> <li> >>> <p> >>> @@ -1173,7 +1194,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after >>> LB</h3> >>> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after >>> LB</h3> >>> >>> <p> >>> Logical flows in this table closely reproduce those in the >>> @@ -1257,7 +1278,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> >>> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> >>> >>> <p> >>> Logical flows in this table decide how to proceed based on the >>> values of >>> @@ -1297,7 +1318,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 20: Stateful</h3> >>> + <h3>Ingress Table 21: Stateful</h3> >>> >>> <ul> >>> <li> >>> @@ -1320,7 +1341,7 @@ >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 21: ARP/ND responder</h3> >>> + <h3>Ingress Table 22: ARP/ND responder</h3> >>> >>> <p> >>> This table implements ARP/ND responder in a logical switch for known >>> @@ -1653,7 +1674,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 22: DHCP option processing</h3> >>> + <h3>Ingress Table 23: DHCP option processing</h3> >>> >>> <p> >>> This table adds the DHCPv4 options to a DHCPv4 packet from the >>> @@ -1714,7 +1735,7 @@ next; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 23: DHCP responses</h3> >>> + <h3>Ingress Table 24: DHCP responses</h3> >>> >>> <p> >>> This table implements DHCP responder for the DHCP replies generated >>> by >>> @@ -1795,7 +1816,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 24 DNS Lookup</h3> >>> + <h3>Ingress Table 25 DNS Lookup</h3> >>> >>> <p> >>> This table looks up and resolves the DNS names to the corresponding >>> @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 25 DNS Responses</h3> >>> + <h3>Ingress Table 26 DNS Responses</h3> >>> >>> <p> >>> This table implements DNS responder for the DNS replies generated by >>> @@ -1859,7 +1880,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Ingress table 26 External ports</h3> >>> + <h3>Ingress table 27 External ports</h3> >>> >>> <p> >>> Traffic from the <code>external</code> logical ports enter the >>> ingress >>> @@ -1902,7 +1923,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 27 Destination Lookup</h3> >>> + <h3>Ingress Table 28 Destination Lookup</h3> >>> >>> <p> >>> This table implements switching behavior. It contains these logical >>> @@ -2078,7 +2099,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Ingress Table 28 Destination unknown</h3> >>> + <h3>Ingress Table 29 Destination unknown</h3> >>> >>> <p> >>> This table handles the packets whose destination was not found or >>> @@ -2312,7 +2333,14 @@ output; >>> there are no rules added for load balancing new connections. >>> </p> >>> >>> - <h3>Egress Table 9: Egress Port Security - check</h3> >>> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> >>> + >>> + <p> >>> + This is similar to ingress table <code>QoS marking</code> except >>> + they apply to <code>to-lport</code> QoS rules. >>> + </p> >>> + >>> + <h3>Egress Table 10: Egress Port Security - check</h3> >>> >>> <p> >>> This is similar to the port security logic in table >>> @@ -2341,7 +2369,7 @@ output; >>> </li> >>> </ul> >>> >>> - <h3>Egress Table 10: Egress Port Security - Apply</h3> >>> + <h3>Egress Table 11: Egress Port Security - Apply</h3> >>> >>> <p> >>> This is similar to the ingress port security logic in ingress table >>> diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema >>> index b2e0993e0..7bb8f36c0 100644 >>> --- a/ovn-nb.ovsschema >>> +++ b/ovn-nb.ovsschema >>> @@ -1,7 +1,7 @@ >>> { >>> "name": "OVN_Northbound", >>> - "version": "7.2.0", >>> - "cksum": "1069338687 34162", >>> + "version": "7.3.0", >>> + "cksum": "2786772995 34106", >>> "tables": { >>> "NB_Global": { >>> "columns": { >>> @@ -293,10 +293,9 @@ >>> "enum": ["set", >>> ["from-lport", "to-lport"]]}}}, >>> "match": {"type": "string"}, >>> "action": {"type": {"key": {"type": "string", >>> - "enum": ["set", ["dscp"]]}, >>> + "enum": ["set", ["dscp", >>> "mark"]]}, >>> "value": {"type": "integer", >>> - "minInteger": 0, >>> - "maxInteger": 63}, >>> + "minInteger": 0}, >>> "min": 0, "max": "unlimited"}}, >>> "bandwidth": {"type": {"key": {"type": "string", >>> "enum": ["set", ["rate", >>> diff --git a/ovn-nb.xml b/ovn-nb.xml >>> index 765ffcf2e..5b593f6a7 100644 >>> --- a/ovn-nb.xml >>> +++ b/ovn-nb.xml >>> @@ -2808,12 +2808,22 @@ or >>> </column> >>> >>> <column name="action"> >>> - <p>When specified, matching flows will have DSCP marking >>> applied.</p> >>> + <p> >>> + When <code>dscp</code> action is specified, matching flows will >>> have >>> + have DSCP marking applied. >>> + When <code>mark</code> action is specified, matching flows will >>> have >>> + packet marking applied. >>> + </p> >>> + >>> <ul> >>> <li> >>> <code>dscp</code>: The value of this action should be in the >>> range of 0 to 63 (inclusive). >>> </li> >>> + <li> >>> + <code>mark</code>: The value of this action should be a >>> positive >>> + integer. >>> + </li> >>> </ul> >>> </column> >>> >>> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at >>> index b3d536471..5427d2d14 100644 >>> --- a/tests/ovn-controller.at >>> +++ b/tests/ovn-controller.at >>> @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) >>> port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) >>> check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 >>> >>> -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep >>> -q "reg15=0x${port},metadata=0x${meta}"]) >>> +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep >>> -q "reg15=0x${port},metadata=0x${meta}"]) >>> >>> OVN_CLEANUP([hv1]) >>> AT_CLEANUP >>> @@ -918,14 +918,14 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$i >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$i >>> ]) >>> done >>> >>> @@ -940,15 +940,15 @@ for i in $(seq 10); do >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 9; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((10 - $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((10 - $i)) >>> ]) >>> fi >>> done >>> @@ -966,17 +966,17 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i * 2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i * 2)) >>> ]) >>> done >>> >>> @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >>> remove address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >>> add address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], >>> [0], [1 >>> ]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ >>> remove address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1091,24 +1091,24 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 1; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i + 4)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i + 4)) >>> ]) >>> fi >>> >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >>> [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1130,17 +1130,17 @@ for i in $(seq 10); do >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> elif test "$i" = 9; then >>> # no conjunction left >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((14 - $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((14 - $i)) >>> ]) >>> fi >>> done >>> @@ -1156,11 +1156,11 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >>> [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1172,7 +1172,7 @@ >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 >>> actions=conjun >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 >>> actions=conjunction,2/2) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i * 2 + 4)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i * 2 + 4)) >>> ]) >>> done >>> >>> @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >>> remove address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ >>> add address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], >>> [0], [1 >>> ]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ >>> remove address_set as1 addresses 10.0.0.10 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], >>> [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], >>> [0], [1 >>> ]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], >>> [ignore]) >>> >>> reprocess_count_new=$(read_counter consider_logical_flow) >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 >>> @@ -1288,22 +1288,22 @@ for i in $(seq 10); do >>> add address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 1; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i*2 + 1)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i*2 + 1)) >>> ]) >>> fi >>> >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >>> [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >>> actions=conjunction,1/2) >>> @@ -1327,15 +1327,15 @@ for i in $(seq 10); do >>> remove address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> elif test "$i" = 9; then >>> # no conjunction left >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((21 - $i*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((21 - $i*2)) >>> ]) >>> fi >>> done >>> @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$i >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$i >>> ]) >>> done >>> >>> @@ -1382,16 +1382,16 @@ for i in $(seq 10); do >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 9; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> elif test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> else >>> # 2 dst + (10 - i) src + 1 conj_id >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((10 - $i + 3)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((10 - $i + 3)) >>> ]) >>> fi >>> done >>> @@ -1445,27 +1445,27 @@ for i in $(seq 10); do >>> add address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 1; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i*2)) >>> ]) >>> fi >>> >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> done >>> @@ -1483,9 +1483,9 @@ for i in $(seq 10); do >>> remove address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((20 - $i*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((20 - $i*2)) >>> ]) >>> fi >>> done >>> @@ -1541,30 +1541,30 @@ for i in $(seq 10); do >>> add address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 1; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> elif test "$i" -lt 6; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i*2)) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((5 + $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((5 + $i)) >>> ]) >>> fi >>> >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> done >>> @@ -1582,12 +1582,12 @@ for i in $(seq 10); do >>> remove address_set as2 addresses 10.0.0.$j >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> elif test "$i" -lt 6; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((15 - $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((15 - $i)) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) >>> ]) >>> fi >>> done >>> @@ -1639,22 +1639,22 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 1; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i*2 + 1)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i*2 + 1)) >>> ]) >>> fi >>> >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >>> [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1676,15 +1676,15 @@ for i in $(seq 10); do >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 10; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> elif test "$i" = 9; then >>> # no conjunction left >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((21 - $i*2)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((21 - $i*2)) >>> ]) >>> fi >>> done >>> @@ -1700,11 +1700,11 @@ for i in $(seq 10); do >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], >>> [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1719,7 +1719,7 @@ >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 >>> actions=co >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 >>> actions=conjunction,2/2) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$(($i * 4 + 1)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$(($i * 4 + 1)) >>> ]) >>> done >>> >>> @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync >>> reprocess_count_old=$(read_counter consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >>> | \ >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >>> | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - >>> $reprocess_count_old))], [0], [1 >>> # Delete 2 IPs >>> reprocess_count_old=$(read_counter consider_logical_flow) >>> check ovn-nbctl --wait=hv remove address_set as1 addresses >>> 10.0.0.4,10.0.0.5 >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >>> | \ >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >>> | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.*,/conjunction,/' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 >>> actions=conjunction,1/2) >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 >>> actions=conjunction,1/2) >>> @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport >>> == "ls1-lp1" && ip4.src == $as >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src >>> == $as2 && tcp && tcp.dst == {201, 202}' drop >>> >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >>> | \ >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >>> | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >>> actions=conjunction,1/2) >>> @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ >>> add address_set as2 addresses 10.0.0.24,10.0.0.33 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >>> | \ >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >>> | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >>> actions=conjunction,1/2) >>> @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ >>> remove address_set as2 addresses 10.0.0.24,10.0.0.33 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key >>> | \ >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key >>> | \ >>> grep -v reply | awk '{print $7, $8}' | \ >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,conj_id=,metadata=0x$dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 >>> actions=conjunction,1/2) >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 >>> actions=conjunction,1/2) >>> @@ -1943,14 +1943,14 @@ for i in $(seq 5); do >>> check ovn-nbctl add address_set as1 addresses >>> "aa\:aa\:aa\:aa\:aa\:0$i" >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$i >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$i >>> ]) >>> done >>> >>> @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter >>> consider_logical_flow) >>> for i in $(seq 5); do >>> check ovn-nbctl remove address_set as1 addresses >>> "aa\:aa\:aa\:aa\:aa\:0$i" >>> check ovn-nbctl --wait=hv sync >>> - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" >>> + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" >>> if test "$i" = 4; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> if test "$i" = 5; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((5 - $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((5 - $i)) >>> ]) >>> fi >>> done >>> @@ -2024,14 +2024,14 @@ for i in $(seq 5); do >>> check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 3; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$i >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$i >>> ]) >>> done >>> >>> @@ -2046,15 +2046,15 @@ for i in $(seq 5); do >>> check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" >>> check ovn-nbctl --wait=hv sync >>> if test "$i" = 4; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=46,reg15=0x$port_key | \ >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int >>> table=51,reg15=0x$port_key | \ >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) >>> ]) >>> fi >>> if test "$i" = 5; then >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep >>> "priority=1100"], [1], [ignore]) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep >>> "priority=1100"], [1], [ignore]) >>> else >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [$((5 - $i)) >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [$((5 - $i)) >>> ]) >>> fi >>> done >>> @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg >>> ovn-nbctl create address_set name=as1 addresses=8.8.8.8 >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src >>> == $as1' drop >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100"], [0], [1 >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100"], [0], [1 >>> ]) >>> >>> # pause ovn-northd >>> @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause >>> # undefined. This test runs the scenario ten times to make sure different >>> # orders are covered and handled properly. >>> >>> -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c >>> "priority=1100") >>> +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c >>> "priority=1100") >>> for i in $(seq 10); do >>> # Delete and recreate the SB address set with same name and an extra >>> IP. >>> addrs_=$(fetch_column address_set addresses name=as1) >>> addrs=${addrs_// /,} >>> AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set >>> name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) >>> - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | >>> grep -c "priority=1100") = "$(($i + 1))"]) >>> + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | >>> grep -c "priority=1100") = "$(($i + 1))"]) >>> done >>> >>> OVN_CLEANUP([hv1]) >>> @@ -2698,7 +2698,7 @@ done >>> wait_for_ports_up >>> ovn-nbctl --wait=hv sync >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], >>> [0],[dnl >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], >>> [0],[dnl >>> 3 >>> ]) >>> >>> @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do >>> done >>> ovn-nbctl --wait=hv sync >>> >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q >>> controller], [1]) >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q >>> controller], [1]) >>> >>> OVN_CLEANUP([hv1]) >>> AT_CLEANUP >>> diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at >>> index 7f37d7716..b11e4ec6b 100644 >>> --- a/tests/ovn-nbctl.at >>> +++ b/tests/ovn-nbctl.at >>> @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp >>> dscp=0 rate=300 burst=3000]) >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 >>> burst=30000]) >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) >>> >>> dnl Add duplicated qos >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 >>> burst=30002], [1], [], [stderr]) >>> @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 >>> from-lport 400 (tcp) rate=300 burst=3000 dscp=0 >>> to-lport 300 (tcp) dscp=48 >>> to-lport 200 (ip) rate=101 >>> + to-lport 102 (ip4) dscp=16 mark=17 >>> + to-lport 101 (ip4) mark=15 >>> to-lport 100 (ip4) rate=301 burst=30000 dscp=13 >>> ]) >>> >>> @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip >>> dscp=-1], [1], [], >>> ]) >>> >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], >>> -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and >>> "burst=" >>> +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" >>> and "mark=" >>> ]) >>> >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], >>> -[ovn-nbctl: Either "rate" and/or "dscp" must be specified >>> +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified >>> ])]) >>> >>> dnl --------------------------------------------------------------------- >>> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at >>> index 67e81ddba..6a27b7dcf 100644 >>> --- a/tests/ovn-northd.at >>> +++ b/tests/ovn-northd.at >>> @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ >>> -- ls-lb-add ls lb >>> >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e >>> ls_in_acl_after_lb_eval | sort], [0], [dnl >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), >>> action=(next;) >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == >>> 1), action=(reg8[[16]] = 1; next;) >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), >>> action=(next;) >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == >>> 1), action=(reg8[[16]] = 1; next;) >>> table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) >>> table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && >>> ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) >>> table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && >>> ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) >>> @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls >>> ovn-nbctl --wait=sb clear logical_switch ls load_balancer >>> >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e >>> ls_in_acl_after_lb_eval | sort], [0], [dnl >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), >>> action=(next;) >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), >>> action=(next;) >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) >>> table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) >>> @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >>> action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >>> @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) >>> @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >>> action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >>> @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >>> action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >>> action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), >>> action=(reg8[[16]] = 1; next;) >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) >>> @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" >>> | sed 's/table=../table=??/ >>> table=??(ls_out_acl_action ), priority=0 , match=(1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), >>> action=(next;) >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) >>> @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), >>> action=(reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >>> action=(outport = get_fdb(eth.dst); next;) >>> @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >>> action=(outport = "_MC_flood"; output;) >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 >>> "00:00:00:00:00:01" >>> @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), >>> action=(reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >>> action=(outport = get_fdb(eth.dst); next;) >>> @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >>> action=(outport = "_MC_flood"; output;) >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 >>> 1000::3" >>> @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), >>> action=(reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >>> action=(outport = get_fdb(eth.dst); next;) >>> @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >>> action=(outport = "_MC_flood"; output;) >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> # Disable sw0p1 >>> @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), >>> action=(reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), >>> action=(outport = get_fdb(eth.dst); next;) >>> @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "sw0p1"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 >>> @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "sw0p1"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> check ovn-nbctl set logical_switch_port sw0p1 enabled=true >>> @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && >>> icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && >>> icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), >>> action=(reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >>> "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); >>> next;) >>> - table=??(ls_in_check_port_sec), priority=70 , match=(inport == >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) >>> + table=??(ls_in_check_port_sec), priority=70 , match=(inport == >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), >>> action=(next;) >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == >>> 1), action=(drop;) >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_out_apply_port_sec), priority=100 , match=(outport == >>> "localnetport"), action=(set_queue(10); output;) >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) >>> @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), >>> action=(outport = "_MC_flood"; output;) >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), >>> action=(output;) >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == >>> "none"), action=(drop;) >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), >>> action=(reg0[[15]] = check_out_port_sec(); next;) >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), >>> action=(reg0[[15]] = 0; next;) >>> ]) >>> >>> AT_CLEANUP >>> @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options >>> logical_port=public |grep -q 'qos >>> AT_CLEANUP >>> ]) >>> >>> +OVN_FOR_EACH_NORTHD_NO_HV([ >>> +AT_SETUP([check OVN QoS mark/meter logical flows]) >>> +AT_KEYWORDS([OVN-QoS]) >>> +ovn_start >>> + >>> +check ovn-nbctl ls-add ls >>> +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 >>> +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 >>> +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 >>> +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 >>> + >>> +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 >>> +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 >>> +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 >>> +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 >>> +check ovn-nbctl --wait=sb sync >>> + >>> +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl >>> + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) >>> + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), >>> action=(ip.dscp = 16; next;) >>> + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), >>> action=(ip.dscp = 17; next;) >>> + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) >>> + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), >>> action=(set_meter(100, 1000); next;) >>> + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) >>> + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), >>> action=(pkt.mark = 15; next;) >>> + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), >>> action=(pkt.mark = 18; next;) >>> + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) >>> + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), >>> action=(ip.dscp = 16; next;) >>> + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), >>> action=(ip.dscp = 17; next;) >>> + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) >>> + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), >>> action=(set_meter(100, 1000); next;) >>> + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) >>> + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), >>> action=(pkt.mark = 15; next;) >>> + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), >>> action=(pkt.mark = 18; next;) >>> +]) >>> + >>> +AT_CLEANUP >>> +]) >>> + >>> AT_SETUP([Tiered ACL logical flows]) >>> AT_KEYWORDS([acl]) >>> >>> @@ -9978,10 +10017,10 @@ acl_test() { >>> } >>> >>> acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 >>> -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval >>> ls_in_acl_after_lb_action 18 >>> +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval >>> ls_in_acl_after_lb_action 19 >>> acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 >>> acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 >>> -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval >>> ls_in_acl_after_lb_action 18 >>> +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval >>> ls_in_acl_after_lb_action 19 >>> acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 >>> >>> AT_CLEANUP >>> diff --git a/tests/ovn.at b/tests/ovn.at >>> index 28c6b6c34..9b158e79c 100644 >>> --- a/tests/ovn.at >>> +++ b/tests/ovn.at >>> @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); >>> >>> next(pipeline=egress); >>> formats as next(pipeline=egress, table=11); >>> - encodes as resubmit(,53) >>> + encodes as resubmit(,58) >>> >>> next(pipeline=egress, table=5); >>> - encodes as resubmit(,47) >>> + encodes as resubmit(,52) >>> >>> next(table=10); >>> formats as next(10); >>> @@ -9719,18 +9719,18 @@ as hv1 >>> AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 >>> external_ids:iface-id=localvif1]) >>> >>> # On hv1, check that there are no flows outputting bcast to tunnel >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> >>> # On hv2, check that no flow outputs bcast to tunnel to hv1. >>> as hv2 >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> >>> # Now bind vif2 on hv2. >>> AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 >>> external_ids:iface-id=localvif2]) >>> >>> # At this point, the broadcast flow on vif2 should be deleted. >>> -# because, there is now a localnet vif bound (table=37 programming logic) >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> +# because, there is now a localnet vif bound (table=42 programming logic) >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip >>> | grep output | wc -l` -eq 0]) >>> >>> # Verify that the local net patch port exists on hv2. >>> OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port >>> patch-br-int-to-ln_port" | wc -l` -eq 1]) >>> @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns >>> ofport find Interface name=ov >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface >>> name=ovn-gw2-0) >>> >>> OVS_WAIT_UNTIL([ >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >>> ]) >>> >>> test_ip_packet() >>> @@ -11631,7 +11631,7 @@ AT_CHECK( >>> ]) >>> >>> OVS_WAIT_UNTIL([ >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >>> ]) >>> >>> test_ip_packet gw2 gw1 0 >>> @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns >>> ofport find Interface name=ov >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface >>> name=ovn-gw2-0) >>> >>> OVS_WAIT_UNTIL([ >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") >>> ]) >>> >>> test_ip_packet() >>> @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ >>> ]) >>> >>> OVS_WAIT_UNTIL([ >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") >>> ]) >>> >>> test_ip_packet gw2 gw1 >>> @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) >>> >>> AT_CHECK( >>> [# Check that redirect mapping is programmed only on hv2 >>> - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l >>> - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc >>> -l >>> + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l >>> + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc >>> -l >>> >>> # Check that hv1 sends chassisredirect port traffic to hv2 >>> - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l >>> - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l >>> + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l >>> + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l >>> >>> # Check that arp reply on distributed gateway port is only programmed >>> on hv2 >>> grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l >>> @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int >>> in_port=hv1-vif1 $packet >>> sleep 2 >>> >>> AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ >>> | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 >>> ]]) >>> >>> @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport >>> echo $hv2_gw2_ofport >>> >>> echo "--- hv1 ---" >>> -as hv1 ovs-ofctl dump-flows br-int table=39 >>> +as hv1 ovs-ofctl dump-flows br-int table=44 >>> >>> echo "--- hv2 ---" >>> -as hv2 ovs-ofctl dump-flows br-int table=39 >>> +as hv2 ovs-ofctl dump-flows br-int table=44 >>> >>> gw1_chassis=$(fetch_column Chassis _uuid name=gw1) >>> gw2_chassis=$(fetch_column Chassis _uuid name=gw2) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> @@ -13566,15 +13566,15 @@ sleep 10 >>> >>> as gw1 ovs-ofctl dump-flows br-int >>> >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> # make sure ARP responder flows for outside router port reside on gw1 too >>> through ls_in_arp_rsp table >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) >>> >>> # check that the chassis redirect port has been claimed by the gw1 chassis >>> @@ -13598,12 +13598,12 @@ wait_for_ports_up >>> check ovn-nbctl --wait=hv sync >>> >>> # we make sure that the hypervisors noticed, and inverted the slave ports >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find >>> Interface name=ovn-hv1-0],[0], >>> ]]) >>> >>> # make sure that flows for handling the outside router port reside on gw2 >>> now >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port >>> bfd_dump >>> >>> # make sure that flows for handling the outside router port reside on gw1 >>> now >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside >>> ha_chassis_group=$hagrp1_uuid >>> wait_row_count HA_Chassis_Group 1 >>> wait_row_count HA_Chassis 2 >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >>> | wc -l], [0], [0 >>> ]) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >>> | wc -l], [0], [0 >>> ]) >>> @@ -13777,26 +13777,26 @@ done >>> # Re-add gw2 >>> as gw2 ovn_attach n1 br-phys 192.168.0.1 >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> >>> # make sure that flows for handling the outside router port reside on gw1 >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> # make sure ARP responder flows for outside router port reside on gw1 too >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) >>> >>> # check that the chassis redirect port has been claimed by the gw1 chassis >>> @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group >>> ref_chassis >>> # Increase the priority of gw2 >>> ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ >>> | wc -l], [0], [1 >>> ]) >>> @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find >>> Interface name=ovn-hv1-0],[0], >>> ]]) >>> >>> # make sure that flows for handling the outside router port reside on gw2 >>> now >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port >>> bfd_dump >>> >>> # make sure that flows for handling the outside router port reside on gw2 >>> now >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 >>> ]]) >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 >>> ]]) >>> >>> @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows >>> AT_CAPTURE_FILE([sw0-flows]) >>> >>> AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed >>> 's/table=../table=??/' | sort], [0], [dnl >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=27); };) >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> >>> inport; next(pipeline=ingress,table=28); };) >>> ]) >>> >>> >>> @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst >>> $ipv6_src $ipv6_dst >>> # Get total number of ipv4 packets that received on ovs >>> >>> # sender side >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >>> >>> # receiver side >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) >>> >>> # Get total number of ipv6 packets that received on ovs >>> >>> # sender side >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >>> >>> # receiver side >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) >>> >>> OVN_CLEANUP([hv1], [hv2]) >>> AT_CLEANUP >>> @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 >>> 'ip4.src==10.0.0.1' allow >>> check ovn-nbctl --wait=hv sync >>> >>> # Check OVS flows, the less restrictive flows should have been installed. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> grep "priority=1003" | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> ]) >>> >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. >>> @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 >>> 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' >>> check ovn-nbctl --wait=hv sync >>> >>> # Check OVS flows, the second less restrictive allow ACL should have been >>> installed. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> \ >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> \ >>> grep "priority=1003" | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> ]) >>> >>> # Remove the less restrictive allow ACL. >>> @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 >>> 'ip4.src==10.0.0.1' >>> check ovn-nbctl --wait=hv sync >>> >>> # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> \ >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> \ >>> grep "priority=1003" | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> ]) >>> >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. >>> @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 >>> 'ip4.src==10.0.0.1' allow >>> check ovn-nbctl --wait=hv sync >>> >>> # Check OVS flows, the less restrictive flows should have been installed. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> \ >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> \ >>> grep "priority=1003" | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> ]) >>> >>> # Add another ACL that overlaps with the existing less restrictive ones. >>> @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync >>> # with an additional conjunction action. >>> # >>> # New non-conjunctive flows should be added to match on 'udp'. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> \ >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> \ >>> grep "priority=1003" | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction(),conjunction() >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> - table=46, priority=1003,udp,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> - table=46, priority=1003,udp6,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 >>> actions=conjunction(),conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 >>> actions=conjunction(),conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 >>> actions=conjunction(),conjunction() >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 >>> actions=conjunction() >>> + table=51, priority=1003,udp,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> + table=51, priority=1003,udp6,metadata=0x1 >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> ]) >>> >>> OVN_CLEANUP([hv1]) >>> @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 >>> 'outport == @pg1 && ip4.src == $as2' al >>> >>> wait_for_ports_up >>> check ovn-nbctl --wait=hv sync >>> -ovs-ofctl dump-flows br-int table=46 >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = >>> 2]) >>> +ovs-ofctl dump-flows br-int table=51 >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = >>> 2]) >>> >>> echo ------- >>> # Add another address in as1, so that the 1st ACL will now generate 2 >>> conjunctions. >>> ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" >>> check ovn-nbctl --wait=hv sync >>> >>> -ovs-ofctl dump-flows br-int table=46 >>> +ovs-ofctl dump-flows br-int table=51 >>> # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd >>> ACL) >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = >>> 3]) >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = >>> 3]) >>> >>> OVN_CLEANUP([hv1]) >>> AT_CLEANUP >>> @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 >>> # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined >>> # to router mac. >>> AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ >>> -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ >>> +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ >>> grep -c "actions=drop"], [0], [1 >>> ]) >>> # Stop ovn-controllers on hv1 and hv3. >>> @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy >>> options:pkt_mark=100 >>> check ovn-nbctl --wait=hv sync >>> as hv2 >>> # add a flow in egress pipeline to check pkt marking >>> -ovs-ofctl --protocols=OpenFlow13 add-flow br-int >>> "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 >>> actions=resubmit(,38)" >>> +ovs-ofctl --protocols=OpenFlow13 add-flow br-int >>> "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 >>> actions=resubmit(,43)" >>> >>> dst_ip=$(ip_to_hex 172 16 2 10) >>> fip_ip=$(ip_to_hex 172 16 1 2) >>> @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip >>> $gw_router_ip) >> expected >>> send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip >>> echo >>> "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" >>>>> expected >>> >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) >>> >>> OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) >>> >>> @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { >>> lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key >>> external_ids:name=lr0)) >>> lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding >>> tunnel_key logical_port=lr0-public)) >>> >>> - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl >>> - table=46, priority=2000,ip,metadata=0x$sw0_dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) >>> + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl >>> + table=51, priority=2000,ip,metadata=0x$sw0_dp_key >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) >>> ]) >>> >>> AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | >>> ofctl_strip_all | \ >>> grep "priority=92" | grep 172.168.0.50], [0], [dnl >>> - table=11, >>> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 >>> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) >>> + table=11, >>> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 >>> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) >>> ]) >>> } >>> >>> check_virtual_offlows_not_present() { >>> hv=$1 >>> - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl >>> + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl >>> ]) >>> >>> AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | >>> ofctl_strip_all | \ >>> @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 >>> logical_port=sw0-vir virtual_parent=sw0-p1 >>> wait_for_ports_up sw0-vir >>> check ovn-nbctl --wait=hv sync >>> AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received >>> packet-in" | \ >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) >>> >>> wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid >>> check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 >>> @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], >>> OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], >>> [vif-north.expected]) >>> >>> # Confirm that packets did not go out via tunnel port. >>> - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 >>> + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 >>> ]]) >>> >>> # Confirm that packet went out via localnet port >>> @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') >>> AT_CHECK([test ! -z $p2_zoneid]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) >>> -eq 1]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw1_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw1_dpkey},\ >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw1_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw1_dpkey},\ >>> reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) >>> -eq 1]) >>> >>> ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) >>> >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >>> @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up >>> sw0-p1) = xup]) >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >>> AT_CHECK([test ! -z $p1_zoneid]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) >>> -eq 1]) >>> >>> ovs-vsctl del-port hv1-vif2 >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) >>> >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) >>> >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') >>> @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) >>> >>> ovn-nbctl lsp-del sw0-p1 >>> >>> -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int >>> table=40,metadata=${sw0_dpkey},\ >>> +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int >>> table=45,metadata=${sw0_dpkey},\ >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) >>> >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') >>> @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) >>> check ovn-nbctl --wait=hv sync >>> >>> # Check OVS flows are installed properly. >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | >>> \ >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | >>> \ >>> grep "priority=2002" | grep conjunction | \ >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ >>> sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> - table=46, >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> + table=51, >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 >>> actions=conjunction() >>> ]) >>> >>> OVN_CLEANUP([hv1]) >>> @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface >>> lsp0-0 external_ids:iface-id=l >>> ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 >>> external_ids:iface-id=lsp0-1 >>> >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 22]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 22]) >>> >>> # Save the current lflow_run counter >>> lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) >>> @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller >>> coverage/read-counter lflow_run) >>> # 1. Remove half of the ports from pg1. The excepted conjunction flows >>> should be: >>> # 2 + 10 = 12 >>> check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j >>> in 0 1; do echo lsp${i}-${j}; done; done) >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 12]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 12]) >>> >>> # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because >>> the >>> # port group const set should have only one member (lsp0-1). And the >>> total >>> @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int >>> table=46 | grep conjunction | wc -l >>> # 10. >>> ovs-vsctl del-port br-int lsp0-0 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 0]) >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc >>> -l) == 10]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 0]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc >>> -l) == 10]) >>> >>> # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. >>> ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 >>> external_ids:iface-id=lsp0-0 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 12]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 12]) >>> >>> # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any >>> change. >>> ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 >>> external_ids:iface-id=lsp9-0 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 12]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 12]) >>> >>> # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a >>> different >>> # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) >>> ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 >>> external_ids:iface-id=lsp1-0 >>> ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 >>> external_ids:iface-id=lsp1-1 >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction >>> | wc -l) == 24]) >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction >>> | wc -l) == 24]) >>> >>> # 6. Simulate a SB port-group "del and add" notification to >>> ovn-controller in the >>> # same IDL iteration. ovn-controller should still program the same >>> flows. In >>> @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do >>> check ovn-nbctl --wait=hv sync >>> >>> # Finally check flow count is the same as before. >>> - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep >>> conjunction | wc -l) == 24]) >>> + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep >>> conjunction | wc -l) == 24]) >>> done >>> >>> # Make sure all the above was performed with I-P (no recompute) >>> @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 >>> 'outport == "lp2" && ip4.src == 10.0. >>> >>> # The first ACL should be programmed, but the second one shouldn't. >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], >>> [ignore]) >>> >>> # Now create the lport lp2. >>> check ovn-nbctl lsp-add lsw0 lp2 \ >>> @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ >>> >>> check ovn-nbctl --wait=hv sync >>> # Now the second ACL should be programmed. >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], >>> [ignore]) >>> >>> # Remove the lport lp2 again, the OVS flow for the second ACL should be >>> # removed. >>> check ovn-nbctl --wait=hv lsp-del lp2 >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], >>> [ignore]) >>> >>> # Test similar scenario but when the referenced lport is not bound >>> locally. >>> >>> @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport >>> == "lp4" && ip4.dst == 10.0.0 >>> >>> # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], >>> [ignore]) >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], >>> [ignore]) >>> >>> # Now create the lport lp4. >>> check ovn-nbctl lsp-add lsw0 lp4 \ >>> @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ >>> >>> # Now the ACL for lp4 should be programmed. >>> check ovn-nbctl --wait=hv sync >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], >>> [ignore]) >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], >>> [ignore]) >>> >>> OVN_CLEANUP([hv1]) >>> AT_CLEANUP >>> @@ -33493,15 +33493,15 @@ done >>> check ovn-nbctl --wait=hv sync >>> >>> # hv0 should see flows for lsp1 but not lsp2 >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >>> [0], [ignore]) >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], >>> [1]) >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >>> [0], [ignore]) >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], >>> [1]) >>> # hv2 should see flows for lsp2 but not lsp1 >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], >>> [0], [ignore]) >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >>> [1]) >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], >>> [0], [ignore]) >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >>> [1]) >>> >>> # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 >>> check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >>> [0], [ignore]) >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >>> [0], [ignore]) >>> >>> # Change it back, and trigger recompute to make sure extra flows are >>> removed >>> # from hv2 (recompute is needed because currently I-P adds local >>> datapaths but >>> @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int >>> table=29 | grep 10.0.1.2], [0], [ig >>> check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 >>> as hv2 check ovn-appctl -t ovn-controller recompute >>> ovn-nbctl --wait=hv sync >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >>> [1]) >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >>> [1]) >>> >>> # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. >>> AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr >>> dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], >>> [0], [ignore]) >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], >>> [0], [ignore]) >>> >>> OVN_CLEANUP([hv1],[hv2]) >>> AT_CLEANUP >>> @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync >>> # Use constants so that if tables or registers change, this test can >>> # be updated easily. >>> DNAT_TABLE=15 >>> -SNAT_TABLE=45 >>> +SNAT_TABLE=50 >>> DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" >>> SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" >>> >>> @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync >>> wait_for_ports_up >>> OVN_POPULATE_ARP >>> >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c >>> controller], [0],[dnl >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c >>> controller], [0],[dnl >>> 9 >>> ]) >>> >>> @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) >>> send_garp 1 1 $eth_src $eth_dst $spa $tpa >>> >>> OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl >>> received packet-in" | \ >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) >>> >>> sleep_controller hv1 >>> >>> @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT >>> \ >>> >>> OVS_APP_EXIT_AND_WAIT([ovsdb-server]) >>> AT_CLEANUP >>> + >>> +OVN_FOR_EACH_NORTHD([ >>> +AT_SETUP([QoS packet marking]) >>> +AT_KEYWORDS([ovn-qos-pkt-marking]) >>> +AT_SKIP_IF([test $HAVE_SCAPY = no]) >>> +ovn_start >>> + >>> +check ovn-nbctl lr-add lr0 >>> +check ovn-nbctl ls-add ls0 >>> +check ovn-nbctl ls-add ls1 >>> + >>> +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 >>> +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ >>> + set Logical_Switch_Port lrp-s0 type=router \ >>> + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' >>> +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 >>> +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ >>> + set Logical_Switch_Port lrp-s1 type=router \ >>> + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' >>> + >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp0 >>> +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp1 >>> +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 >>> + >>> +check ovn-nbctl --wait=sb lsp-add ls1 lp2 >>> +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 >>> +check ovn-nbctl --wait=sb sync >>> + >>> +net_add n1 >>> +sim_add hv >>> + >>> +as hv >>> +check ovs-vsctl add-br br-phys >>> +ovn_attach n1 br-phys 192.168.0.1 >>> + >>> +check ovs-vsctl add-port br-int vif0 -- \ >>> + set Interface vif0 external-ids:iface-id=lp0 \ >>> + options:tx_pcap=hv/vif0-tx.pcap \ >>> + options:rxq_pcap=hv/vif0-rx.pcap \ >>> + ofport-request=1 >>> +check ovs-vsctl add-port br-int vif1 -- \ >>> + set Interface vif1 external-ids:iface-id=lp1 \ >>> + options:tx_pcap=hv/vif1-tx.pcap \ >>> + options:rxq_pcap=hv/vif1-rx.pcap \ >>> + ofport-request=2 >>> +check ovs-vsctl add-port br-int vif2 -- \ >>> + set Interface vif2 external-ids:iface-id=lp2 \ >>> + options:tx_pcap=hv/vif2-tx.pcap \ >>> + options:rxq_pcap=hv/vif2-rx.pcap \ >>> + ofport-request=3 >>> + >>> +# Create QoS rules for packet marking. >>> +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" >>> mark=48 >>> +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" >>> mark=49 >>> +check_row_count nb:QoS 2 >>> + >>> +# Create some flows to count pkt marking. >>> +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark >>> == 48" drop >>> +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop >>> +wait_for_ports_up >>> +check ovn-nbctl --wait=hv sync >>> + >>> +send_udp_packet() { >>> + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 >>> + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ >>> + IP(src='${ipv4_src}', dst='${ipv4_dst}', >>> ttl=0x40)/ \ >>> + UDP(sport=4242, dport=4343)") >>> + as hv ovs-appctl netdev-dummy/receive vif$inport $packet >>> +} >>> + >>> +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key >>> external_ids:name=ls0)) >>> +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key >>> external_ids:name=lr0)) >>> + >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E >>> "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) >>> + >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E >>> "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) >>> + >>> +OVN_CLEANUP([hv]) >>> +AT_CLEANUP >>> +]) >>> diff --git a/tests/system-ovn.at b/tests/system-ovn.at >>> index cb4124b70..1277f1057 100644 >>> --- a/tests/system-ovn.at >>> +++ b/tests/system-ovn.at >>> @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 >>> >>> ovn-nbctl list load_balancer >>> ovn-sbctl dump-flows R2 >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ >>> grep 'nat(src=20.0.0.2)']) >>> >>> check ovs-appctl dpctl/flush-conntrack >>> @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 >>> >>> ovn-nbctl list load_balancer >>> ovn-sbctl dump-flows R2 >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ >>> grep 'nat(src=20.0.0.2)']) >>> >>> rm -f wget*.log >>> @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ >>> ]) >>> >>> OVS_WAIT_UNTIL([ >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ >>> grep controller | grep tp_dst=84 -c) >>> test $n_pkt -eq 1 >>> ]) >>> @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ >>> ]) >>> >>> OVS_WAIT_UNTIL([ >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ >>> grep controller | grep tp_dst=84 -c) >>> test $n_pkt -eq 1 >>> ]) >>> @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast >>> >>> wait_igmp_flows_installed() >>> { >>> - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ >>> + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ >>> grep 'priority=90' | grep "nw_dst=$1"]) >>> } >>> >>> @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" >>> 30.0.0.2:8000"'='"192.168.1.2:12345,192 >>> >>> ovn-nbctl list load_balancer >>> ovn-sbctl dump-flows R2 >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep >>> 'nat(src=20.0.0.2)']) >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep >>> 'nat(src=20.0.0.2)']) >>> >>> dnl Test load-balancing that includes L4 ports in NAT. >>> for i in `seq 1 20`; do >>> diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml >>> index 6f74bd557..f838393a6 100644 >>> --- a/utilities/ovn-nbctl.8.xml >>> +++ b/utilities/ovn-nbctl.8.xml >>> @@ -482,6 +482,9 @@ >>> <code>burst=</code><var>burst</var> specifies the burst rate >>> limit in kilobits. <code>dscp</code> and/or <code>rate</code> >>> are required arguments. >>> + If <code>mark=</code><var>mark</var> is specified, then matching >>> + packets will be marked (through <code>pkt.mark</code>). >>> + <var>mark</var> must be a positive integer. >>> </p> >>> >>> <p> >>> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c >>> index 526369b68..0620d333a 100644 >>> --- a/utilities/ovn-nbctl.c >>> +++ b/utilities/ovn-nbctl.c >>> @@ -283,7 +283,7 @@ ACL commands:\n\ >>> print ACLs for SWITCH\n\ >>> \n\ >>> QoS commands:\n\ >>> - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] >>> [dscp=DSCP]\n\ >>> + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] >>> [dscp=DSCP] [mark=MARK]\n\ >>> add an QoS rule to SWITCH\n\ >>> qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ >>> remove QoS rules from SWITCH\n\ >>> @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) >>> if (!strcmp(qos_rule->key_action[j], "dscp")) { >>> ds_put_format(&ctx->output, " dscp=%"PRId64"", >>> qos_rule->value_action[j]); >>> + } else if (!strcmp(qos_rule->key_action[j], "mark")) { >>> + ds_put_format(&ctx->output, " mark=%"PRId64"", >>> + qos_rule->value_action[j]); >>> } >>> } >>> ds_put_cstr(&ctx->output, "\n"); >>> @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); >>> + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); >>> } >>> >>> static void >>> @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) >>> const char *direction; >>> int64_t priority; >>> int64_t dscp = -1; >>> + int64_t mark = 0; >>> int64_t rate = 0; >>> int64_t burst = 0; >>> char *error; >>> @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) >>> return; >>> } >>> } >>> + else if (!strncmp(ctx->argv[i], "mark=", 5)) { >>> + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < >>> 0) { >>> + ctl_error(ctx, "%s: mark must be a positive integer", >>> + ctx->argv[i] + 5); >>> + return; >>> + } >>> + } >>> else if (!strncmp(ctx->argv[i], "rate=", 5)) { >>> if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) >>> || rate < 1 || rate > UINT32_MAX) { >>> @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) >>> } >>> } else { >>> ctl_error(ctx, "%s: supported arguments are \"dscp=\", >>> \"rate=\", " >>> - "and \"burst=\"", ctx->argv[i]); >>> + "\"burst=\" and \"mark=\"", ctx->argv[i]); >>> return; >>> } >>> } >>> >>> /* Validate rate and dscp. */ >>> - if (-1 == dscp && !rate) { >>> - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be >>> specified"); >>> + if (-1 == dscp && !rate && !mark) { >>> + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be >>> " >>> + "specified"); >>> return; >>> } >>> >>> @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) >>> nbrec_qos_set_priority(qos, priority); >>> nbrec_qos_set_direction(qos, direction); >>> nbrec_qos_set_match(qos, ctx->argv[4]); >>> + if (mark) { >>> + nbrec_qos_update_action_setkey(qos, "mark", mark); >>> + } >>> if (-1 != dscp) { >>> - const char *dscp_key = "dscp"; >>> - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); >>> + nbrec_qos_update_action_setkey(qos, "dscp", dscp); >>> } >>> if (rate) { >>> const char *bandwidth_key[2] = {"rate", "burst"}; >>> -- >>> 2.43.0 >>> >>> _______________________________________________ >>> dev mailing list >>> dev@openvswitch.org >>> https://mail.openvswitch.org/mailman/listinfo/ovs-dev >>> >>> >> Thanks, >> Ales >> > > Thanks, > Dumitru > >
On Wed, Jan 31, 2024 at 1:37 PM Dumitru Ceara <dceara@redhat.com> wrote: > On 1/31/24 13:22, Dumitru Ceara wrote: > > On 1/31/24 13:10, Ales Musil wrote: > >> On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < > >> lorenzo.bianconi@redhat.com> wrote: > >> > >>> Add the capbility to mark (through pkt.mark) incoming/outgoing packets > >>> in logical_switch datapath according to user configured QoS rule. > >>> > >>> Co-developed-by: Dumitru Ceara <dceara@redhat.com> > >>> Reported-at: https://issues.redhat.com/browse/FDP-42 > >>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > >>> --- > >>> > >> > >> Hi Lorenzo and Dumitru, > > > > Hi Ales, > > > >> I have one question, would it be possible to use existing QOS_MARK by > >> moving it after the lb/stateful stage in ingress/egress? Even if both > dscp > >> and mark are set at the same time the action could set both in one > logical > >> flow. That being said, we might even collapse all QoS stages into one > that > >> will be a combination of dscp/mark/set_meter WDYT? However, I might have > >> missed something crucial why it isn't possible. > >> > > > > That's a significant behavior change IMO (that I'd like to avoid for > > now). We might be breaking existing QoS (DSCP) marking rules if we move > > the ls_in_qos_mark stage after load balancing. > > > > The CMS has more knowledge about the network than OVN does and it can > > attach it's own "metadata" (pkt.mark) to relay that to upper layers (or > > later stages in the OVN pipeline). In this specific case ovn-kubernetes > > can determine whether the mark should be set _only after_ load > > balancing. That's the reason why we addded the new stage after the lb > one. > > > > But I think we're definitely open to alternatives if you have ideas. > > > > I had another look and because we send all traffic to conntrack in stage > pre_stateful if load balancers are enabled it's probably fine to move > the pkt marking stage (the new one) next to the qos stages. > That would be more consistent from a CMS perspective IMO. > > I wouldn't merge QoS stages them in this patch though given that we're > late in the dev cycle. It's probably fine to merge them as a follow up > for 24.09. > Sure that's fine. Lorenzo, would you mind splitting this into two patches? One that makes the space for an additional stage by shifting the table numbers and second that will add the packet mark? > > Lorenzo, what do you think? > > Regards, > Dumitru > > >> > >> > >>> NEWS | 2 + > >>> controller/lflow.h | 15 +- > >>> lib/ovn-util.h | 2 +- > >>> northd/northd.c | 55 +++-- > >>> northd/ovn-northd.8.xml | 60 ++++-- > >>> ovn-nb.ovsschema | 9 +- > >>> ovn-nb.xml | 12 +- > >>> tests/ovn-controller.at | 308 +++++++++++++-------------- > >>> tests/ovn-nbctl.at | 8 +- > >>> tests/ovn-northd.at | 103 ++++++--- > >>> tests/ovn.at | 429 > +++++++++++++++++++++++--------------- > >>> tests/system-ovn.at | 12 +- > >>> utilities/ovn-nbctl.8.xml | 3 + > >>> utilities/ovn-nbctl.c | 27 ++- > >>> 14 files changed, 627 insertions(+), 418 deletions(-) > >>> > >>> diff --git a/NEWS b/NEWS > >>> index 6553bd078..7300345f1 100644 > >>> --- a/NEWS > >>> +++ b/NEWS > >>> @@ -18,6 +18,8 @@ Post v23.09.0 > >>> - Support selecting encapsulation IP based on the source/destination > >>> VIF's > >>> settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for > more > >>> details. > >>> + - Add the capbility to mark (through pkt.mark) incoming/outgoing > packets > >>> + in the logical switch datapath according to user configured QoS > rule. > >>> > >>> OVN v23.09.0 - 15 Sep 2023 > >>> -------------------------- > >>> diff --git a/controller/lflow.h b/controller/lflow.h > >>> index 9b7ffa19c..f7f6c7950 100644 > >>> --- a/controller/lflow.h > >>> +++ b/controller/lflow.h > >>> @@ -67,17 +67,20 @@ struct uuid; > >>> > >>> /* Start of LOG_PIPELINE_LEN tables. */ > >>> #define OFTABLE_LOG_INGRESS_PIPELINE 8 > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > >>> -#define OFTABLE_REMOTE_OUTPUT 39 > >>> -#define OFTABLE_LOCAL_OUTPUT 40 > >>> -#define OFTABLE_CHECK_LOOPBACK 41 > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > >>> +#define OFTABLE_REMOTE_OUTPUT 44 > >>> +#define OFTABLE_LOCAL_OUTPUT 45 > >>> +#define OFTABLE_CHECK_LOOPBACK 46 > >>> > >>> /* Start of the OUTPUT section of the pipeline. */ > >>> #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT > >>> +BUILD_ASSERT_DECL( > >>> + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < > OFTABLE_OUTPUT_INIT > >>> +); > >>> > >>> /* Start of LOG_PIPELINE_LEN tables. */ > >>> -#define OFTABLE_LOG_EGRESS_PIPELINE 42 > >>> +#define OFTABLE_LOG_EGRESS_PIPELINE 47 > >>> #define OFTABLE_SAVE_INPORT 64 > >>> #define OFTABLE_LOG_TO_PHY 65 > >>> #define OFTABLE_MAC_BINDING 66 > >>> diff --git a/lib/ovn-util.h b/lib/ovn-util.h > >>> index 2afff0d07..3e1d68cf9 100644 > >>> --- a/lib/ovn-util.h > >>> +++ b/lib/ovn-util.h > >>> @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( > >>> #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) > >>> > >>> /* The number of tables for the ingress and egress pipelines. */ > >>> -#define LOG_PIPELINE_LEN 29 > >>> +#define LOG_PIPELINE_LEN 30 > >>> > >>> static inline uint32_t > >>> hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) > >>> diff --git a/northd/northd.c b/northd/northd.c > >>> index d2091d4bc..597d203ca 100644 > >>> --- a/northd/northd.c > >>> +++ b/northd/northd.c > >>> @@ -134,22 +134,23 @@ enum ovn_stage { > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, > "ls_in_lb_aff_check") > >>> \ > >>> PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") > >>> \ > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, > "ls_in_lb_aff_learn") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, > "ls_in_pre_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, > "ls_in_nat_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ > >>> + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, > "ls_in_qos_pkt_mark") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, > "ls_in_pre_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, > "ls_in_nat_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ > >>> "ls_in_acl_after_lb_eval") \ > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ > >>> "ls_in_acl_after_lb_action") \ > >>> - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, > "ls_in_dhcp_options") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, > "ls_in_dhcp_response") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, > "ls_in_dns_response") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, > "ls_in_external_port") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, > "ls_in_dhcp_options") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, > "ls_in_dhcp_response") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, > "ls_in_dns_response") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, > "ls_in_external_port") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") > >>> \ > >>> > >>> \ > >>> /* Logical switch egress stages. */ > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") > >>> \ > >>> @@ -161,8 +162,9 @@ enum ovn_stage { > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, > >>> "ls_out_check_port_sec") \ > >>> - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, > >>> "ls_out_apply_port_sec") \ > >>> + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, > "ls_out_qos_pkt_mark") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, > >>> "ls_out_check_port_sec") \ > >>> + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, > >>> "ls_out_apply_port_sec") \ > >>> > \ > >>> /* Logical router ingress stages. */ > \ > >>> PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") > >>> \ > >>> @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct > >>> chassis_features *features, > >>> ds_destroy(&actions); > >>> } > >>> > >>> +#define QOS_MAX_DSCP 63 > >>> + > >>> static void > >>> build_qos(struct ovn_datapath *od, struct hmap *lflows) { > >>> struct ds action = DS_EMPTY_INITIALIZER; > >>> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap > >>> *lflows) { > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); > >>> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", > "next;"); > >>> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", > "next;"); > >>> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", > "next;"); > >>> > >>> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { > >>> struct nbrec_qos *qos = od->nbs->qos_rules[i]; > >>> bool ingress = !strcmp(qos->direction, "from-lport") ? true > >>> :false; > >>> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : > >>> S_SWITCH_OUT_QOS_MARK; > >>> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); > >>> int64_t rate = 0; > >>> int64_t burst = 0; > >>> > >>> for (size_t j = 0; j < qos->n_action; j++) { > >>> if (!strcmp(qos->key_action[j], "dscp")) { > >>> + if (qos->value_action[j] > QOS_MAX_DSCP) { > >>> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in > qos " > >>> + UUID_FMT, qos->value_action[j], > >>> + UUID_ARGS(&qos->header_.uuid)); > >>> + continue; > >>> + } > >>> + > >>> ds_clear(&action); > >>> ds_put_format(&action, "ip.dscp = %"PRId64"; next;", > >>> qos->value_action[j]); > >>> @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap > >>> *lflows) { > >>> qos->priority, > >>> qos->match, ds_cstr(&action), > >>> &qos->header_); > >>> + } else if (!strcmp(qos->key_action[j], "mark")) { > >>> + ds_clear(&action); > >>> + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", > >>> + qos->value_action[j]); > >>> + ovn_lflow_add_with_hint(lflows, od, > >>> + ingress ? S_SWITCH_IN_QOS_PKT_MARK > >>> + : S_SWITCH_OUT_QOS_PKT_MARK, > >>> + qos->priority, qos->match, ds_cstr(&action), > >>> + &qos->header_); > >>> } > >>> } > >>> > >>> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml > >>> index 068d47e1a..c1cd19947 100644 > >>> --- a/northd/ovn-northd.8.xml > >>> +++ b/northd/ovn-northd.8.xml > >>> @@ -1082,7 +1082,28 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 15: Pre-Hairpin</h3> > >>> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> > >>> + > >>> + <p> > >>> + Logical flows in this table closely reproduce those in the > >>> + <code>QoS</code> table with the <code>action</code> column set > in > >>> + the <code>OVN_Northbound</code> database for the > >>> + <code>from-lport</code> direction. > >>> + </p> > >>> + > >>> + <ul> > >>> + <li> > >>> + For every qos_rules entry in a logical switch with packet > marking > >>> + enabled, a flow will be added at the priority mentioned in the > >>> + QoS table. > >>> + </li> > >>> + > >>> + <li> > >>> + A priority-0 flow that simply moves traffic to the next table. > >>> + </li> > >>> + </ul> > >>> + > >>> + <h3>Ingress Table 16: Pre-Hairpin</h3> > >>> <ul> > >>> <li> > >>> If the logical switch has load balancer(s) configured, then a > >>> @@ -1100,7 +1121,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 16: Nat-Hairpin</h3> > >>> + <h3>Ingress Table 17: Nat-Hairpin</h3> > >>> <ul> > >>> <li> > >>> If the logical switch has load balancer(s) configured, then a > >>> @@ -1135,7 +1156,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 17: Hairpin</h3> > >>> + <h3>Ingress Table 18: Hairpin</h3> > >>> <ul> > >>> <li> > >>> <p> > >>> @@ -1173,7 +1194,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after > >>> LB</h3> > >>> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after > >>> LB</h3> > >>> > >>> <p> > >>> Logical flows in this table closely reproduce those in the > >>> @@ -1257,7 +1278,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after > LB</h3> > >>> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after > LB</h3> > >>> > >>> <p> > >>> Logical flows in this table decide how to proceed based on the > >>> values of > >>> @@ -1297,7 +1318,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 20: Stateful</h3> > >>> + <h3>Ingress Table 21: Stateful</h3> > >>> > >>> <ul> > >>> <li> > >>> @@ -1320,7 +1341,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 21: ARP/ND responder</h3> > >>> + <h3>Ingress Table 22: ARP/ND responder</h3> > >>> > >>> <p> > >>> This table implements ARP/ND responder in a logical switch for > known > >>> @@ -1653,7 +1674,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 22: DHCP option processing</h3> > >>> + <h3>Ingress Table 23: DHCP option processing</h3> > >>> > >>> <p> > >>> This table adds the DHCPv4 options to a DHCPv4 packet from the > >>> @@ -1714,7 +1735,7 @@ next; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 23: DHCP responses</h3> > >>> + <h3>Ingress Table 24: DHCP responses</h3> > >>> > >>> <p> > >>> This table implements DHCP responder for the DHCP replies > generated > >>> by > >>> @@ -1795,7 +1816,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 24 DNS Lookup</h3> > >>> + <h3>Ingress Table 25 DNS Lookup</h3> > >>> > >>> <p> > >>> This table looks up and resolves the DNS names to the > corresponding > >>> @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 25 DNS Responses</h3> > >>> + <h3>Ingress Table 26 DNS Responses</h3> > >>> > >>> <p> > >>> This table implements DNS responder for the DNS replies > generated by > >>> @@ -1859,7 +1880,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress table 26 External ports</h3> > >>> + <h3>Ingress table 27 External ports</h3> > >>> > >>> <p> > >>> Traffic from the <code>external</code> logical ports enter the > >>> ingress > >>> @@ -1902,7 +1923,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 27 Destination Lookup</h3> > >>> + <h3>Ingress Table 28 Destination Lookup</h3> > >>> > >>> <p> > >>> This table implements switching behavior. It contains these > logical > >>> @@ -2078,7 +2099,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 28 Destination unknown</h3> > >>> + <h3>Ingress Table 29 Destination unknown</h3> > >>> > >>> <p> > >>> This table handles the packets whose destination was not found > or > >>> @@ -2312,7 +2333,14 @@ output; > >>> there are no rules added for load balancing new connections. > >>> </p> > >>> > >>> - <h3>Egress Table 9: Egress Port Security - check</h3> > >>> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> > >>> + > >>> + <p> > >>> + This is similar to ingress table <code>QoS marking</code> except > >>> + they apply to <code>to-lport</code> QoS rules. > >>> + </p> > >>> + > >>> + <h3>Egress Table 10: Egress Port Security - check</h3> > >>> > >>> <p> > >>> This is similar to the port security logic in table > >>> @@ -2341,7 +2369,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Egress Table 10: Egress Port Security - Apply</h3> > >>> + <h3>Egress Table 11: Egress Port Security - Apply</h3> > >>> > >>> <p> > >>> This is similar to the ingress port security logic in ingress > table > >>> diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema > >>> index b2e0993e0..7bb8f36c0 100644 > >>> --- a/ovn-nb.ovsschema > >>> +++ b/ovn-nb.ovsschema > >>> @@ -1,7 +1,7 @@ > >>> { > >>> "name": "OVN_Northbound", > >>> - "version": "7.2.0", > >>> - "cksum": "1069338687 34162", > >>> + "version": "7.3.0", > >>> + "cksum": "2786772995 34106", > >>> "tables": { > >>> "NB_Global": { > >>> "columns": { > >>> @@ -293,10 +293,9 @@ > >>> "enum": ["set", > >>> ["from-lport", "to-lport"]]}}}, > >>> "match": {"type": "string"}, > >>> "action": {"type": {"key": {"type": "string", > >>> - "enum": ["set", > ["dscp"]]}, > >>> + "enum": ["set", ["dscp", > >>> "mark"]]}, > >>> "value": {"type": "integer", > >>> - "minInteger": 0, > >>> - "maxInteger": 63}, > >>> + "minInteger": 0}, > >>> "min": 0, "max": "unlimited"}}, > >>> "bandwidth": {"type": {"key": {"type": "string", > >>> "enum": ["set", > ["rate", > >>> diff --git a/ovn-nb.xml b/ovn-nb.xml > >>> index 765ffcf2e..5b593f6a7 100644 > >>> --- a/ovn-nb.xml > >>> +++ b/ovn-nb.xml > >>> @@ -2808,12 +2808,22 @@ or > >>> </column> > >>> > >>> <column name="action"> > >>> - <p>When specified, matching flows will have DSCP marking > >>> applied.</p> > >>> + <p> > >>> + When <code>dscp</code> action is specified, matching flows > will > >>> have > >>> + have DSCP marking applied. > >>> + When <code>mark</code> action is specified, matching flows > will > >>> have > >>> + packet marking applied. > >>> + </p> > >>> + > >>> <ul> > >>> <li> > >>> <code>dscp</code>: The value of this action should be in the > >>> range of 0 to 63 (inclusive). > >>> </li> > >>> + <li> > >>> + <code>mark</code>: The value of this action should be a > >>> positive > >>> + integer. > >>> + </li> > >>> </ul> > >>> </column> > >>> > >>> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at > >>> index b3d536471..5427d2d14 100644 > >>> --- a/tests/ovn-controller.at > >>> +++ b/tests/ovn-controller.at > >>> @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) > >>> port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) > >>> check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 > >>> > >>> -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | > grep > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > >>> +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | > grep > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -918,14 +918,14 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -940,15 +940,15 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 9; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((10 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((10 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -966,17 +966,17 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 2)) > >>> ]) > >>> done > >>> > >>> @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 > -- \ > >>> add address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.10], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.10], > >>> [0], [1 > >>> ]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.23], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.23], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1091,24 +1091,24 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$(($i + 4)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$(($i + 4)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1130,17 +1130,17 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((14 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((14 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -1156,11 +1156,11 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1172,7 +1172,7 @@ > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 > >>> actions=conjun > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 > >>> actions=conjunction,2/2) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > >>> ]) > >>> done > >>> > >>> @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 > -- \ > >>> add address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.10], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.10], > >>> [0], [1 > >>> ]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > 10\.0\.0\.23], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > 10\.0\.0\.23], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], > [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], > [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > [0], [0 > >>> @@ -1288,22 +1288,22 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=conjunction,1/2) > >>> @@ -1327,15 +1327,15 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -1382,16 +1382,16 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 9; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> elif test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> # 2 dst + (10 - i) src + 1 conj_id > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((10 - $i + 3)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((10 - $i + 3)) > >>> ]) > >>> fi > >>> done > >>> @@ -1445,27 +1445,27 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> done > >>> @@ -1483,9 +1483,9 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((20 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((20 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1541,30 +1541,30 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> elif test "$i" -lt 6; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((5 + $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((5 + $i)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> done > >>> @@ -1582,12 +1582,12 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" -lt 6; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((15 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((15 - $i)) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1639,22 +1639,22 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1676,15 +1676,15 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1700,11 +1700,11 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1719,7 +1719,7 @@ > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=co > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=conjunction,2/2) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > >>> ]) > >>> done > >>> > >>> @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync > >>> reprocess_count_old=$(read_counter consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - > >>> $reprocess_count_old))], [0], [1 > >>> # Delete 2 IPs > >>> reprocess_count_old=$(read_counter consider_logical_flow) > >>> check ovn-nbctl --wait=hv remove address_set as1 addresses > >>> 10.0.0.4,10.0.0.5 > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 > 'outport > >>> == "ls1-lp1" && ip4.src == $as > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && > ip4.src > >>> == $as2 && tcp && tcp.dst == {201, 202}' drop > >>> > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > >>> add address_set as2 addresses 10.0.0.24,10.0.0.33 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 > -- \ > >>> remove address_set as2 addresses 10.0.0.24,10.0.0.33 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1943,14 +1943,14 @@ for i in $(seq 5); do > >>> check ovn-nbctl add address_set as1 addresses > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> for i in $(seq 5); do > >>> check ovn-nbctl remove address_set as1 addresses > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" > >>> + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" > >>> if test "$i" = 4; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 5; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -2024,14 +2024,14 @@ for i in $(seq 5); do > >>> check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -2046,15 +2046,15 @@ for i in $(seq 5); do > >>> check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 4; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 5; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg > >>> ovn-nbctl create address_set name=as1 addresses=8.8.8.8 > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && > ip4.src > >>> == $as1' drop > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [1 > >>> ]) > >>> > >>> # pause ovn-northd > >>> @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause > >>> # undefined. This test runs the scenario ten times to make sure > different > >>> # orders are covered and handled properly. > >>> > >>> -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100") > >>> +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100") > >>> for i in $(seq 10); do > >>> # Delete and recreate the SB address set with same name and an > extra > >>> IP. > >>> addrs_=$(fetch_column address_set addresses name=as1) > >>> addrs=${addrs_// /,} > >>> AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set > >>> name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) > >>> - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int > table=46 | > >>> grep -c "priority=1100") = "$(($i + 1))"]) > >>> + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int > table=51 | > >>> grep -c "priority=1100") = "$(($i + 1))"]) > >>> done > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -2698,7 +2698,7 @@ done > >>> wait_for_ports_up > >>> ovn-nbctl --wait=hv sync > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | > grep > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > >>> [0],[dnl > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | > grep > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > >>> [0],[dnl > >>> 3 > >>> ]) > >>> > >>> @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do > >>> done > >>> ovn-nbctl --wait=hv sync > >>> > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q > >>> controller], [1]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q > >>> controller], [1]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at > >>> index 7f37d7716..b11e4ec6b 100644 > >>> --- a/tests/ovn-nbctl.at > >>> +++ b/tests/ovn-nbctl.at > >>> @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp > >>> dscp=0 rate=300 burst=3000]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 > >>> burst=30000]) > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) > >>> > >>> dnl Add duplicated qos > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 > >>> burst=30002], [1], [], [stderr]) > >>> @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 > >>> from-lport 400 (tcp) rate=300 burst=3000 dscp=0 > >>> to-lport 300 (tcp) dscp=48 > >>> to-lport 200 (ip) rate=101 > >>> + to-lport 102 (ip4) dscp=16 mark=17 > >>> + to-lport 101 (ip4) mark=15 > >>> to-lport 100 (ip4) rate=301 burst=30000 dscp=13 > >>> ]) > >>> > >>> @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip > >>> dscp=-1], [1], [], > >>> ]) > >>> > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], > >>> -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and > >>> "burst=" > >>> +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", > "burst=" > >>> and "mark=" > >>> ]) > >>> > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], > >>> -[ovn-nbctl: Either "rate" and/or "dscp" must be specified > >>> +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified > >>> ])]) > >>> > >>> dnl > --------------------------------------------------------------------- > >>> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > >>> index 67e81ddba..6a27b7dcf 100644 > >>> --- a/tests/ovn-northd.at > >>> +++ b/tests/ovn-northd.at > >>> @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ > >>> -- ls-lb-add ls lb > >>> > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, > match=(reg0[[17]] == > >>> 1), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, > match=(reg0[[17]] == > >>> 1), action=(reg8[[16]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=0 , match=(1), > action=(next;) > >>> table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && > >>> ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && > >>> ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) > >>> @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls > >>> ovn-nbctl --wait=sb clear logical_switch ls load_balancer > >>> > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=65535, match=(1), > action=(next;) > >>> table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> table=4 (ls_out_acl_eval ), priority=65535, match=(1), > action=(next;) > >>> @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 > >>> "00:00:00:00:00:01" > >>> @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 > 10.0.0.3 > >>> 1000::3" > >>> @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> # Disable sw0p1 > >>> @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "sw0p1"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 > >>> @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > == > >>> 1), action=(drop;) > >>> @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "sw0p1"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl set logical_switch_port sw0p1 enabled=true > >>> @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && > >>> icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && > >>> icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "localnetport"), action=(set_queue(10); reg0[[15]] = > check_in_port_sec(); > >>> next;) > >>> - table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) > >>> + table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=100 , match=(outport == > >>> "localnetport"), action=(set_queue(10); output;) > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > >>> @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> AT_CLEANUP > >>> @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options > >>> logical_port=public |grep -q 'qos > >>> AT_CLEANUP > >>> ]) > >>> > >>> +OVN_FOR_EACH_NORTHD_NO_HV([ > >>> +AT_SETUP([check OVN QoS mark/meter logical flows]) > >>> +AT_KEYWORDS([OVN-QoS]) > >>> +ovn_start > >>> + > >>> +check ovn-nbctl ls-add ls > >>> +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > >>> +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > >>> +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > >>> +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > >>> + > >>> +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > >>> +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > >>> +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > >>> +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > >>> +check ovn-nbctl --wait=sb sync > >>> + > >>> +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl > >>> + table=10(ls_in_qos_mark ), priority=0 , match=(1), > action=(next;) > >>> + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), > >>> action=(ip.dscp = 16; next;) > >>> + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), > >>> action=(ip.dscp = 17; next;) > >>> + table=11(ls_in_qos_meter ), priority=0 , match=(1), > action=(next;) > >>> + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), > >>> action=(set_meter(100, 1000); next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), > action=(next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), > >>> action=(pkt.mark = 15; next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), > >>> action=(pkt.mark = 18; next;) > >>> + table=6 (ls_out_qos_mark ), priority=0 , match=(1), > action=(next;) > >>> + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), > >>> action=(ip.dscp = 16; next;) > >>> + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), > >>> action=(ip.dscp = 17; next;) > >>> + table=7 (ls_out_qos_meter ), priority=0 , match=(1), > action=(next;) > >>> + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), > >>> action=(set_meter(100, 1000); next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), > action=(next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), > >>> action=(pkt.mark = 15; next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), > >>> action=(pkt.mark = 18; next;) > >>> +]) > >>> + > >>> +AT_CLEANUP > >>> +]) > >>> + > >>> AT_SETUP([Tiered ACL logical flows]) > >>> AT_KEYWORDS([acl]) > >>> > >>> @@ -9978,10 +10017,10 @@ acl_test() { > >>> } > >>> > >>> acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > >>> -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 18 > >>> +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 19 > >>> acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > >>> acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > >>> -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 18 > >>> +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 19 > >>> acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > >>> > >>> AT_CLEANUP > >>> diff --git a/tests/ovn.at b/tests/ovn.at > >>> index 28c6b6c34..9b158e79c 100644 > >>> --- a/tests/ovn.at > >>> +++ b/tests/ovn.at > >>> @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > >>> > >>> next(pipeline=egress); > >>> formats as next(pipeline=egress, table=11); > >>> - encodes as resubmit(,53) > >>> + encodes as resubmit(,58) > >>> > >>> next(pipeline=egress, table=5); > >>> - encodes as resubmit(,47) > >>> + encodes as resubmit(,52) > >>> > >>> next(table=10); > >>> formats as next(10); > >>> @@ -9719,18 +9719,18 @@ as hv1 > >>> AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface > localvif1 > >>> external_ids:iface-id=localvif1]) > >>> > >>> # On hv1, check that there are no flows outputting bcast to tunnel > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # On hv2, check that no flow outputs bcast to tunnel to hv1. > >>> as hv2 > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # Now bind vif2 on hv2. > >>> AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface > localvif2 > >>> external_ids:iface-id=localvif2]) > >>> > >>> # At this point, the broadcast flow on vif2 should be deleted. > >>> -# because, there is now a localnet vif bound (table=37 programming > logic) > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +# because, there is now a localnet vif bound (table=42 programming > logic) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # Verify that the local net patch port exists on hv2. > >>> OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port > >>> patch-br-int-to-ln_port" | wc -l` -eq 1]) > >>> @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare > --columns > >>> ofport find Interface name=ov > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find > Interface > >>> name=ovn-gw2-0) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> ]) > >>> > >>> test_ip_packet() > >>> @@ -11631,7 +11631,7 @@ AT_CHECK( > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> ]) > >>> > >>> test_ip_packet gw2 gw1 0 > >>> @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare > --columns > >>> ofport find Interface name=ov > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find > Interface > >>> name=ovn-gw2-0) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> ]) > >>> > >>> test_ip_packet() > >>> @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> ]) > >>> > >>> test_ip_packet gw2 gw1 > >>> @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > >>> > >>> AT_CHECK( > >>> [# Check that redirect mapping is programmed only on hv2 > >>> - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > >>> - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | > wc > >>> -l > >>> + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > >>> + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | > wc > >>> -l > >>> > >>> # Check that hv1 sends chassisredirect port traffic to hv2 > >>> - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc > -l > >>> - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > >>> + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc > -l > >>> + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > >>> > >>> # Check that arp reply on distributed gateway port is only > programmed > >>> on hv2 > >>> grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > >>> @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int > >>> in_port=hv1-vif1 $packet > >>> sleep 2 > >>> > >>> AS_BOX([On hv1, table 40 check that no packet goes via the tunnel > port]) > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > >>> | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > >>> echo $hv2_gw2_ofport > >>> > >>> echo "--- hv1 ---" > >>> -as hv1 ovs-ofctl dump-flows br-int table=39 > >>> +as hv1 ovs-ofctl dump-flows br-int table=44 > >>> > >>> echo "--- hv2 ---" > >>> -as hv2 ovs-ofctl dump-flows br-int table=39 > >>> +as hv2 ovs-ofctl dump-flows br-int table=44 > >>> > >>> gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > >>> gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13566,15 +13566,15 @@ sleep 10 > >>> > >>> as gw1 ovs-ofctl dump-flows br-int > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # make sure ARP responder flows for outside router port reside on gw1 > too > >>> through ls_in_arp_rsp table > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > >>> > >>> # check that the chassis redirect port has been claimed by the gw1 > chassis > >>> @@ -13598,12 +13598,12 @@ wait_for_ports_up > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # we make sure that the hypervisors noticed, and inverted the slave > ports > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > >>> Interface name=ovn-hv1-0],[0], > >>> ]]) > >>> > >>> # make sure that flows for handling the outside router port reside on > gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > >>> bfd_dump > >>> > >>> # make sure that flows for handling the outside router port reside on > gw1 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside > >>> ha_chassis_group=$hagrp1_uuid > >>> wait_row_count HA_Chassis_Group 1 > >>> wait_row_count HA_Chassis 2 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [0 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [0 > >>> ]) > >>> @@ -13777,26 +13777,26 @@ done > >>> # Re-add gw2 > >>> as gw2 ovn_attach n1 br-phys 192.168.0.1 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> # make sure that flows for handling the outside router port reside on > gw1 > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # make sure ARP responder flows for outside router port reside on gw1 > too > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > >>> > >>> # check that the chassis redirect port has been claimed by the gw1 > chassis > >>> @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" > HA_Chassis_Group > >>> ref_chassis > >>> # Increase the priority of gw2 > >>> ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > >>> Interface name=ovn-hv1-0],[0], > >>> ]]) > >>> > >>> # make sure that flows for handling the outside router port reside on > gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > >>> bfd_dump > >>> > >>> # make sure that flows for handling the outside router port reside on > gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > >>> AT_CAPTURE_FILE([sw0-flows]) > >>> > >>> AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed > >>> 's/table=../table=??/' | sort], [0], [dnl > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> ]) > >>> > >>> > >>> @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst > >>> $ipv6_src $ipv6_dst > >>> # Get total number of ipv4 packets that received on ovs > >>> > >>> # sender side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 > | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 > | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # receiver side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 > | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 > | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # Get total number of ipv6 packets that received on ovs > >>> > >>> # sender side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 > | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 > | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # receiver side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 > | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 > | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> OVN_CLEANUP([hv1], [hv2]) > >>> AT_CLEANUP > >>> @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' allow > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the less restrictive flows should have been > installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > >>> @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the second less restrictive allow ACL should have > been > >>> installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Remove the less restrictive allow ACL. > >>> @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the 10.0.0.1 conjunction should have been > reinstalled. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > >>> @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' allow > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the less restrictive flows should have been > installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Add another ACL that overlaps with the existing less restrictive > ones. > >>> @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > >>> # with an additional conjunction action. > >>> # > >>> # New non-conjunctive flows should be added to match on 'udp'. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> - table=46, priority=1003,udp,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,udp6,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,udp,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,udp6,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> ]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 > >>> 'outport == @pg1 && ip4.src == $as2' al > >>> > >>> wait_for_ports_up > >>> check ovn-nbctl --wait=hv sync > >>> -ovs-ofctl dump-flows br-int table=46 > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c > conj_id` = > >>> 2]) > >>> +ovs-ofctl dump-flows br-int table=51 > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c > conj_id` = > >>> 2]) > >>> > >>> echo ------- > >>> # Add another address in as1, so that the 1st ACL will now generate 2 > >>> conjunctions. > >>> ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > >>> check ovn-nbctl --wait=hv sync > >>> > >>> -ovs-ofctl dump-flows br-int table=46 > >>> +ovs-ofctl dump-flows br-int table=51 > >>> # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd > >>> ACL) > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c > conj_id` = > >>> 3]) > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c > conj_id` = > >>> 3]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > >>> # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 > destined > >>> # to router mac. > >>> AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > >>> -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > >>> +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > >>> grep -c "actions=drop"], [0], [1 > >>> ]) > >>> # Stop ovn-controllers on hv1 and hv3. > >>> @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy > $policy > >>> options:pkt_mark=100 > >>> check ovn-nbctl --wait=hv sync > >>> as hv2 > >>> # add a flow in egress pipeline to check pkt marking > >>> -ovs-ofctl --protocols=OpenFlow13 add-flow br-int > >>> "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > >>> actions=resubmit(,38)" > >>> +ovs-ofctl --protocols=OpenFlow13 add-flow br-int > >>> "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > >>> actions=resubmit(,43)" > >>> > >>> dst_ip=$(ip_to_hex 172 16 2 10) > >>> fip_ip=$(ip_to_hex 172 16 1 2) > >>> @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip > >>> $gw_router_ip) >> expected > >>> send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > >>> echo > >>> > "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" > >>>>> expected > >>> > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 > | > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 > | > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > >>> > >>> OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > >>> > >>> @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > >>> lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding > tunnel_key > >>> external_ids:name=lr0)) > >>> lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding > >>> tunnel_key logical_port=lr0-public)) > >>> > >>> - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip > | > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > >>> - table=46, priority=2000,ip,metadata=0x$sw0_dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip > | > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > >>> + table=51, priority=2000,ip,metadata=0x$sw0_dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> ]) > >>> > >>> AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | > >>> ofctl_strip_all | \ > >>> grep "priority=92" | grep 172.168.0.50], [0], [dnl > >>> - table=11, > >>> > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > >>> > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > >>> + table=11, > >>> > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > >>> > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > >>> ]) > >>> } > >>> > >>> check_virtual_offlows_not_present() { > >>> hv=$1 > >>> - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > >>> + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > >>> ]) > >>> > >>> AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | > >>> ofctl_strip_all | \ > >>> @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 > >>> logical_port=sw0-vir virtual_parent=sw0-p1 > >>> wait_for_ports_up sw0-vir > >>> check ovn-nbctl --wait=hv sync > >>> AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl > received > >>> packet-in" | \ > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > >>> > >>> wait_row_count Port_Binding 1 logical_port=sw0-vir6 > chassis=$hv1_ch_uuid > >>> check_row_count Port_Binding 1 logical_port=sw0-vir6 > virtual_parent=sw0-p1 > >>> @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > >>> OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], > >>> [vif-north.expected]) > >>> > >>> # Confirm that packets did not go out via tunnel port. > >>> - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > >>> + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # Confirm that packet went out via localnet port > >>> @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > >>> AT_CHECK([test ! -z $p2_zoneid]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc > -l) > >>> -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw1_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw1_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw1_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw1_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc > -l) > >>> -eq 1]) > >>> > >>> ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up > >>> sw0-p1) = xup]) > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> AT_CHECK([test ! -z $p1_zoneid]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc > -l) > >>> -eq 1]) > >>> > >>> ovs-vsctl del-port hv1-vif2 > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > >>> @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > >>> > >>> ovn-nbctl lsp-del sw0-p1 > >>> > >>> -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat > hv1/ovn-controller.pid)]) > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows are installed properly. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > ofctl_strip_all | > >>> \ > >>> grep "priority=2002" | grep conjunction | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> ]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set > interface > >>> lsp0-0 external_ids:iface-id=l > >>> ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 > >>> external_ids:iface-id=lsp0-1 > >>> > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 22]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 22]) > >>> > >>> # Save the current lflow_run counter > >>> lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter > lflow_run) > >>> @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller > >>> coverage/read-counter lflow_run) > >>> # 1. Remove half of the ports from pg1. The excepted conjunction flows > >>> should be: > >>> # 2 + 10 = 12 > >>> check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do > for j > >>> in 0 1; do echo lsp${i}-${j}; done; done) > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 12]) > >>> > >>> # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows > because > >>> the > >>> # port group const set should have only one member (lsp0-1). And > the > >>> total > >>> @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=46 | grep conjunction | wc -l > >>> # 10. > >>> ovs-vsctl del-port br-int lsp0-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 0]) > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 > | wc > >>> -l) == 10]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 0]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 > | wc > >>> -l) == 10]) > >>> > >>> # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > >>> ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 > >>> external_ids:iface-id=lsp0-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 12]) > >>> > >>> # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see > any > >>> change. > >>> ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 > >>> external_ids:iface-id=lsp9-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 12]) > >>> > >>> # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a > >>> different > >>> # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > >>> ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 > >>> external_ids:iface-id=lsp1-0 > >>> ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 > >>> external_ids:iface-id=lsp1-1 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > conjunction > >>> | wc -l) == 24]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > conjunction > >>> | wc -l) == 24]) > >>> > >>> # 6. Simulate a SB port-group "del and add" notification to > >>> ovn-controller in the > >>> # same IDL iteration. ovn-controller should still program the same > >>> flows. In > >>> @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Finally check flow count is the same as before. > >>> - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > >>> conjunction | wc -l) == 24]) > >>> + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > >>> conjunction | wc -l) == 24]) > >>> done > >>> > >>> # Make sure all the above was performed with I-P (no recompute) > >>> @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > >>> 'outport == "lp2" && ip4.src == 10.0. > >>> > >>> # The first ACL should be programmed, but the second one shouldn't. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], > [0], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], > [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > [1], > >>> [ignore]) > >>> > >>> # Now create the lport lp2. > >>> check ovn-nbctl lsp-add lsw0 lp2 \ > >>> @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > >>> > >>> check ovn-nbctl --wait=hv sync > >>> # Now the second ACL should be programmed. > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > [0], > >>> [ignore]) > >>> > >>> # Remove the lport lp2 again, the OVS flow for the second ACL should > be > >>> # removed. > >>> check ovn-nbctl --wait=hv lsp-del lp2 > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > [1], > >>> [ignore]) > >>> > >>> # Test similar scenario but when the referenced lport is not bound > >>> locally. > >>> > >>> @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > 'inport > >>> == "lp4" && ip4.dst == 10.0.0 > >>> > >>> # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], > [0], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], > [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], > [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], > [1], > >>> [ignore]) > >>> > >>> # Now create the lport lp4. > >>> check ovn-nbctl lsp-add lsw0 lp4 \ > >>> @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > >>> > >>> # Now the ACL for lp4 should be programmed. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], > [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], > [0], > >>> [ignore]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -33493,15 +33493,15 @@ done > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # hv0 should see flows for lsp1 but not lsp2 > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.2.2], > >>> [1]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.2.2], > >>> [1]) > >>> # hv2 should see flows for lsp2 but not lsp1 > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.2.2], > >>> [0], [ignore]) > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.1.2], > >>> [1]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.2.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.1.2], > >>> [1]) > >>> > >>> # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > >>> check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> > >>> # Change it back, and trigger recompute to make sure extra flows are > >>> removed > >>> # from hv2 (recompute is needed because currently I-P adds local > >>> datapaths but > >>> @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int > >>> table=29 | grep 10.0.1.2], [0], [ig > >>> check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > >>> as hv2 check ovn-appctl -t ovn-controller recompute > >>> ovn-nbctl --wait=hv sync > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.1.2], > >>> [1]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.1.2], > >>> [1]) > >>> > >>> # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > >>> AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr > >>> dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > 10.0.1.2], > >>> [0], [ignore]) > >>> > >>> OVN_CLEANUP([hv1],[hv2]) > >>> AT_CLEANUP > >>> @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > >>> # Use constants so that if tables or registers change, this test can > >>> # be updated easily. > >>> DNAT_TABLE=15 > >>> -SNAT_TABLE=45 > >>> +SNAT_TABLE=50 > >>> DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > >>> SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > >>> > >>> @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > >>> wait_for_ports_up > >>> OVN_POPULATE_ARP > >>> > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c > >>> controller], [0],[dnl > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c > >>> controller], [0],[dnl > >>> 9 > >>> ]) > >>> > >>> @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > >>> send_garp 1 1 $eth_src $eth_dst $spa $tpa > >>> > >>> OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl > >>> received packet-in" | \ > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > >>> > >>> sleep_controller hv1 > >>> > >>> @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1: > $TCP_PORT > >>> \ > >>> > >>> OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > >>> AT_CLEANUP > >>> + > >>> +OVN_FOR_EACH_NORTHD([ > >>> +AT_SETUP([QoS packet marking]) > >>> +AT_KEYWORDS([ovn-qos-pkt-marking]) > >>> +AT_SKIP_IF([test $HAVE_SCAPY = no]) > >>> +ovn_start > >>> + > >>> +check ovn-nbctl lr-add lr0 > >>> +check ovn-nbctl ls-add ls0 > >>> +check ovn-nbctl ls-add ls1 > >>> + > >>> +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > >>> +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > >>> + set Logical_Switch_Port lrp-s0 type=router \ > >>> + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > >>> +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > >>> +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > >>> + set Logical_Switch_Port lrp-s1 type=router \ > >>> + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > >>> + > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > >>> +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > >>> +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > >>> + > >>> +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > >>> +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > >>> +check ovn-nbctl --wait=sb sync > >>> + > >>> +net_add n1 > >>> +sim_add hv > >>> + > >>> +as hv > >>> +check ovs-vsctl add-br br-phys > >>> +ovn_attach n1 br-phys 192.168.0.1 > >>> + > >>> +check ovs-vsctl add-port br-int vif0 -- \ > >>> + set Interface vif0 external-ids:iface-id=lp0 \ > >>> + options:tx_pcap=hv/vif0-tx.pcap \ > >>> + options:rxq_pcap=hv/vif0-rx.pcap \ > >>> + ofport-request=1 > >>> +check ovs-vsctl add-port br-int vif1 -- \ > >>> + set Interface vif1 external-ids:iface-id=lp1 \ > >>> + options:tx_pcap=hv/vif1-tx.pcap \ > >>> + options:rxq_pcap=hv/vif1-rx.pcap \ > >>> + ofport-request=2 > >>> +check ovs-vsctl add-port br-int vif2 -- \ > >>> + set Interface vif2 external-ids:iface-id=lp2 \ > >>> + options:tx_pcap=hv/vif2-tx.pcap \ > >>> + options:rxq_pcap=hv/vif2-rx.pcap \ > >>> + ofport-request=3 > >>> + > >>> +# Create QoS rules for packet marking. > >>> +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" > >>> mark=48 > >>> +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" > >>> mark=49 > >>> +check_row_count nb:QoS 2 > >>> + > >>> +# Create some flows to count pkt marking. > >>> +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && > pkt.mark > >>> == 48" drop > >>> +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > >>> +wait_for_ports_up > >>> +check ovn-nbctl --wait=hv sync > >>> + > >>> +send_udp_packet() { > >>> + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > >>> + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', > src='${eth_src}')/ \ > >>> + IP(src='${ipv4_src}', dst='${ipv4_dst}', > >>> ttl=0x40)/ \ > >>> + UDP(sport=4242, dport=4343)") > >>> + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > >>> +} > >>> + > >>> +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > >>> external_ids:name=ls0)) > >>> +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > >>> external_ids:name=lr0)) > >>> + > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 > 10.0.0.2 > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > >>> "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > >>> + > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 > 10.0.0.10 > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > >>> "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > >>> + > >>> +OVN_CLEANUP([hv]) > >>> +AT_CLEANUP > >>> +]) > >>> diff --git a/tests/system-ovn.at b/tests/system-ovn.at > >>> index cb4124b70..1277f1057 100644 > >>> --- a/tests/system-ovn.at > >>> +++ b/tests/system-ovn.at > >>> @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > >>> grep 'nat(src=20.0.0.2)']) > >>> > >>> check ovs-appctl dpctl/flush-conntrack > >>> @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > >>> grep 'nat(src=20.0.0.2)']) > >>> > >>> rm -f wget*.log > >>> @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v > n_packets=0 | \ > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v > n_packets=0 | \ > >>> grep controller | grep tp_dst=84 -c) > >>> test $n_pkt -eq 1 > >>> ]) > >>> @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v > n_packets=0 | \ > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v > n_packets=0 | \ > >>> grep controller | grep tp_dst=84 -c) > >>> test $n_pkt -eq 1 > >>> ]) > >>> @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > >>> > >>> wait_igmp_flows_installed() > >>> { > >>> - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > >>> + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > >>> grep 'priority=90' | grep "nw_dst=$1"]) > >>> } > >>> > >>> @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:12345,192 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | > grep > >>> 'nat(src=20.0.0.2)']) > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | > grep > >>> 'nat(src=20.0.0.2)']) > >>> > >>> dnl Test load-balancing that includes L4 ports in NAT. > >>> for i in `seq 1 20`; do > >>> diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > >>> index 6f74bd557..f838393a6 100644 > >>> --- a/utilities/ovn-nbctl.8.xml > >>> +++ b/utilities/ovn-nbctl.8.xml > >>> @@ -482,6 +482,9 @@ > >>> <code>burst=</code><var>burst</var> specifies the burst rate > >>> limit in kilobits. <code>dscp</code> and/or > <code>rate</code> > >>> are required arguments. > >>> + If <code>mark=</code><var>mark</var> is specified, then > matching > >>> + packets will be marked (through <code>pkt.mark</code>). > >>> + <var>mark</var> must be a positive integer. > >>> </p> > >>> > >>> <p> > >>> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > >>> index 526369b68..0620d333a 100644 > >>> --- a/utilities/ovn-nbctl.c > >>> +++ b/utilities/ovn-nbctl.c > >>> @@ -283,7 +283,7 @@ ACL commands:\n\ > >>> print ACLs for SWITCH\n\ > >>> \n\ > >>> QoS commands:\n\ > >>> - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > >>> [dscp=DSCP]\n\ > >>> + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > >>> [dscp=DSCP] [mark=MARK]\n\ > >>> add an QoS rule to SWITCH\n\ > >>> qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > >>> remove QoS rules from SWITCH\n\ > >>> @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > >>> if (!strcmp(qos_rule->key_action[j], "dscp")) { > >>> ds_put_format(&ctx->output, " dscp=%"PRId64"", > >>> qos_rule->value_action[j]); > >>> + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > >>> + ds_put_format(&ctx->output, " mark=%"PRId64"", > >>> + qos_rule->value_action[j]); > >>> } > >>> } > >>> ds_put_cstr(&ctx->output, "\n"); > >>> @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > >>> + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > >>> } > >>> > >>> static void > >>> @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> const char *direction; > >>> int64_t priority; > >>> int64_t dscp = -1; > >>> + int64_t mark = 0; > >>> int64_t rate = 0; > >>> int64_t burst = 0; > >>> char *error; > >>> @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> return; > >>> } > >>> } > >>> + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > >>> + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark > < > >>> 0) { > >>> + ctl_error(ctx, "%s: mark must be a positive integer", > >>> + ctx->argv[i] + 5); > >>> + return; > >>> + } > >>> + } > >>> else if (!strncmp(ctx->argv[i], "rate=", 5)) { > >>> if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > >>> || rate < 1 || rate > UINT32_MAX) { > >>> @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> } > >>> } else { > >>> ctl_error(ctx, "%s: supported arguments are \"dscp=\", > >>> \"rate=\", " > >>> - "and \"burst=\"", ctx->argv[i]); > >>> + "\"burst=\" and \"mark=\"", ctx->argv[i]); > >>> return; > >>> } > >>> } > >>> > >>> /* Validate rate and dscp. */ > >>> - if (-1 == dscp && !rate) { > >>> - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be > >>> specified"); > >>> + if (-1 == dscp && !rate && !mark) { > >>> + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" > must be > >>> " > >>> + "specified"); > >>> return; > >>> } > >>> > >>> @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> nbrec_qos_set_priority(qos, priority); > >>> nbrec_qos_set_direction(qos, direction); > >>> nbrec_qos_set_match(qos, ctx->argv[4]); > >>> + if (mark) { > >>> + nbrec_qos_update_action_setkey(qos, "mark", mark); > >>> + } > >>> if (-1 != dscp) { > >>> - const char *dscp_key = "dscp"; > >>> - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > >>> + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > >>> } > >>> if (rate) { > >>> const char *bandwidth_key[2] = {"rate", "burst"}; > >>> -- > >>> 2.43.0 > >>> > >>> _______________________________________________ > >>> dev mailing list > >>> dev@openvswitch.org > >>> https://mail.openvswitch.org/mailman/listinfo/ovs-dev > >>> > >>> > >> Thanks, > >> Ales > >> > > > > Thanks, > > Dumitru > > > > > > Thanks, Ales
> On 1/31/24 13:22, Dumitru Ceara wrote: > > On 1/31/24 13:10, Ales Musil wrote: > >> On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < > >> lorenzo.bianconi@redhat.com> wrote: > >> > >>> Add the capbility to mark (through pkt.mark) incoming/outgoing packets > >>> in logical_switch datapath according to user configured QoS rule. > >>> > >>> Co-developed-by: Dumitru Ceara <dceara@redhat.com> > >>> Reported-at: https://issues.redhat.com/browse/FDP-42 > >>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > >>> --- > >>> > >> > >> Hi Lorenzo and Dumitru, > > > > Hi Ales, > > > >> I have one question, would it be possible to use existing QOS_MARK by > >> moving it after the lb/stateful stage in ingress/egress? Even if both dscp > >> and mark are set at the same time the action could set both in one logical > >> flow. That being said, we might even collapse all QoS stages into one that > >> will be a combination of dscp/mark/set_meter WDYT? However, I might have > >> missed something crucial why it isn't possible. > >> > > > > That's a significant behavior change IMO (that I'd like to avoid for > > now). We might be breaking existing QoS (DSCP) marking rules if we move > > the ls_in_qos_mark stage after load balancing. > > > > The CMS has more knowledge about the network than OVN does and it can > > attach it's own "metadata" (pkt.mark) to relay that to upper layers (or > > later stages in the OVN pipeline). In this specific case ovn-kubernetes > > can determine whether the mark should be set _only after_ load > > balancing. That's the reason why we addded the new stage after the lb one. > > > > But I think we're definitely open to alternatives if you have ideas. > > > > I had another look and because we send all traffic to conntrack in stage > pre_stateful if load balancers are enabled it's probably fine to move > the pkt marking stage (the new one) next to the qos stages. > > I wouldn't merge QoS stages them in this patch though given that we're > late in the dev cycle. It's probably fine to merge them as a follow up > for 24.09. > > Lorenzo, what do you think? Yes, I agree considering the point we are in development cycle. Regards, Lorenzo > > Regards, > Dumitru > > >> > >> > >>> NEWS | 2 + > >>> controller/lflow.h | 15 +- > >>> lib/ovn-util.h | 2 +- > >>> northd/northd.c | 55 +++-- > >>> northd/ovn-northd.8.xml | 60 ++++-- > >>> ovn-nb.ovsschema | 9 +- > >>> ovn-nb.xml | 12 +- > >>> tests/ovn-controller.at | 308 +++++++++++++-------------- > >>> tests/ovn-nbctl.at | 8 +- > >>> tests/ovn-northd.at | 103 ++++++--- > >>> tests/ovn.at | 429 +++++++++++++++++++++++--------------- > >>> tests/system-ovn.at | 12 +- > >>> utilities/ovn-nbctl.8.xml | 3 + > >>> utilities/ovn-nbctl.c | 27 ++- > >>> 14 files changed, 627 insertions(+), 418 deletions(-) > >>> > >>> diff --git a/NEWS b/NEWS > >>> index 6553bd078..7300345f1 100644 > >>> --- a/NEWS > >>> +++ b/NEWS > >>> @@ -18,6 +18,8 @@ Post v23.09.0 > >>> - Support selecting encapsulation IP based on the source/destination > >>> VIF's > >>> settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more > >>> details. > >>> + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets > >>> + in the logical switch datapath according to user configured QoS rule. > >>> > >>> OVN v23.09.0 - 15 Sep 2023 > >>> -------------------------- > >>> diff --git a/controller/lflow.h b/controller/lflow.h > >>> index 9b7ffa19c..f7f6c7950 100644 > >>> --- a/controller/lflow.h > >>> +++ b/controller/lflow.h > >>> @@ -67,17 +67,20 @@ struct uuid; > >>> > >>> /* Start of LOG_PIPELINE_LEN tables. */ > >>> #define OFTABLE_LOG_INGRESS_PIPELINE 8 > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > >>> -#define OFTABLE_REMOTE_OUTPUT 39 > >>> -#define OFTABLE_LOCAL_OUTPUT 40 > >>> -#define OFTABLE_CHECK_LOOPBACK 41 > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > >>> +#define OFTABLE_REMOTE_OUTPUT 44 > >>> +#define OFTABLE_LOCAL_OUTPUT 45 > >>> +#define OFTABLE_CHECK_LOOPBACK 46 > >>> > >>> /* Start of the OUTPUT section of the pipeline. */ > >>> #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT > >>> +BUILD_ASSERT_DECL( > >>> + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT > >>> +); > >>> > >>> /* Start of LOG_PIPELINE_LEN tables. */ > >>> -#define OFTABLE_LOG_EGRESS_PIPELINE 42 > >>> +#define OFTABLE_LOG_EGRESS_PIPELINE 47 > >>> #define OFTABLE_SAVE_INPORT 64 > >>> #define OFTABLE_LOG_TO_PHY 65 > >>> #define OFTABLE_MAC_BINDING 66 > >>> diff --git a/lib/ovn-util.h b/lib/ovn-util.h > >>> index 2afff0d07..3e1d68cf9 100644 > >>> --- a/lib/ovn-util.h > >>> +++ b/lib/ovn-util.h > >>> @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( > >>> #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) > >>> > >>> /* The number of tables for the ingress and egress pipelines. */ > >>> -#define LOG_PIPELINE_LEN 29 > >>> +#define LOG_PIPELINE_LEN 30 > >>> > >>> static inline uint32_t > >>> hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) > >>> diff --git a/northd/northd.c b/northd/northd.c > >>> index d2091d4bc..597d203ca 100644 > >>> --- a/northd/northd.c > >>> +++ b/northd/northd.c > >>> @@ -134,22 +134,23 @@ enum ovn_stage { > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") > >>> \ > >>> PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") > >>> \ > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ > >>> + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ > >>> "ls_in_acl_after_lb_eval") \ > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ > >>> "ls_in_acl_after_lb_action") \ > >>> - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") > >>> \ > >>> > >>> \ > >>> /* Logical switch egress stages. */ > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") > >>> \ > >>> @@ -161,8 +162,9 @@ enum ovn_stage { > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") > >>> \ > >>> PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") > >>> \ > >>> - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, > >>> "ls_out_check_port_sec") \ > >>> - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, > >>> "ls_out_apply_port_sec") \ > >>> + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") > >>> \ > >>> + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, > >>> "ls_out_check_port_sec") \ > >>> + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, > >>> "ls_out_apply_port_sec") \ > >>> \ > >>> /* Logical router ingress stages. */ \ > >>> PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") > >>> \ > >>> @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct > >>> chassis_features *features, > >>> ds_destroy(&actions); > >>> } > >>> > >>> +#define QOS_MAX_DSCP 63 > >>> + > >>> static void > >>> build_qos(struct ovn_datapath *od, struct hmap *lflows) { > >>> struct ds action = DS_EMPTY_INITIALIZER; > >>> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap > >>> *lflows) { > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); > >>> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); > >>> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); > >>> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); > >>> > >>> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { > >>> struct nbrec_qos *qos = od->nbs->qos_rules[i]; > >>> bool ingress = !strcmp(qos->direction, "from-lport") ? true > >>> :false; > >>> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : > >>> S_SWITCH_OUT_QOS_MARK; > >>> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); > >>> int64_t rate = 0; > >>> int64_t burst = 0; > >>> > >>> for (size_t j = 0; j < qos->n_action; j++) { > >>> if (!strcmp(qos->key_action[j], "dscp")) { > >>> + if (qos->value_action[j] > QOS_MAX_DSCP) { > >>> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " > >>> + UUID_FMT, qos->value_action[j], > >>> + UUID_ARGS(&qos->header_.uuid)); > >>> + continue; > >>> + } > >>> + > >>> ds_clear(&action); > >>> ds_put_format(&action, "ip.dscp = %"PRId64"; next;", > >>> qos->value_action[j]); > >>> @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap > >>> *lflows) { > >>> qos->priority, > >>> qos->match, ds_cstr(&action), > >>> &qos->header_); > >>> + } else if (!strcmp(qos->key_action[j], "mark")) { > >>> + ds_clear(&action); > >>> + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", > >>> + qos->value_action[j]); > >>> + ovn_lflow_add_with_hint(lflows, od, > >>> + ingress ? S_SWITCH_IN_QOS_PKT_MARK > >>> + : S_SWITCH_OUT_QOS_PKT_MARK, > >>> + qos->priority, qos->match, ds_cstr(&action), > >>> + &qos->header_); > >>> } > >>> } > >>> > >>> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml > >>> index 068d47e1a..c1cd19947 100644 > >>> --- a/northd/ovn-northd.8.xml > >>> +++ b/northd/ovn-northd.8.xml > >>> @@ -1082,7 +1082,28 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 15: Pre-Hairpin</h3> > >>> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> > >>> + > >>> + <p> > >>> + Logical flows in this table closely reproduce those in the > >>> + <code>QoS</code> table with the <code>action</code> column set in > >>> + the <code>OVN_Northbound</code> database for the > >>> + <code>from-lport</code> direction. > >>> + </p> > >>> + > >>> + <ul> > >>> + <li> > >>> + For every qos_rules entry in a logical switch with packet marking > >>> + enabled, a flow will be added at the priority mentioned in the > >>> + QoS table. > >>> + </li> > >>> + > >>> + <li> > >>> + A priority-0 flow that simply moves traffic to the next table. > >>> + </li> > >>> + </ul> > >>> + > >>> + <h3>Ingress Table 16: Pre-Hairpin</h3> > >>> <ul> > >>> <li> > >>> If the logical switch has load balancer(s) configured, then a > >>> @@ -1100,7 +1121,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 16: Nat-Hairpin</h3> > >>> + <h3>Ingress Table 17: Nat-Hairpin</h3> > >>> <ul> > >>> <li> > >>> If the logical switch has load balancer(s) configured, then a > >>> @@ -1135,7 +1156,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 17: Hairpin</h3> > >>> + <h3>Ingress Table 18: Hairpin</h3> > >>> <ul> > >>> <li> > >>> <p> > >>> @@ -1173,7 +1194,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after > >>> LB</h3> > >>> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after > >>> LB</h3> > >>> > >>> <p> > >>> Logical flows in this table closely reproduce those in the > >>> @@ -1257,7 +1278,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> > >>> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> > >>> > >>> <p> > >>> Logical flows in this table decide how to proceed based on the > >>> values of > >>> @@ -1297,7 +1318,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 20: Stateful</h3> > >>> + <h3>Ingress Table 21: Stateful</h3> > >>> > >>> <ul> > >>> <li> > >>> @@ -1320,7 +1341,7 @@ > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 21: ARP/ND responder</h3> > >>> + <h3>Ingress Table 22: ARP/ND responder</h3> > >>> > >>> <p> > >>> This table implements ARP/ND responder in a logical switch for known > >>> @@ -1653,7 +1674,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 22: DHCP option processing</h3> > >>> + <h3>Ingress Table 23: DHCP option processing</h3> > >>> > >>> <p> > >>> This table adds the DHCPv4 options to a DHCPv4 packet from the > >>> @@ -1714,7 +1735,7 @@ next; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 23: DHCP responses</h3> > >>> + <h3>Ingress Table 24: DHCP responses</h3> > >>> > >>> <p> > >>> This table implements DHCP responder for the DHCP replies generated > >>> by > >>> @@ -1795,7 +1816,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 24 DNS Lookup</h3> > >>> + <h3>Ingress Table 25 DNS Lookup</h3> > >>> > >>> <p> > >>> This table looks up and resolves the DNS names to the corresponding > >>> @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 25 DNS Responses</h3> > >>> + <h3>Ingress Table 26 DNS Responses</h3> > >>> > >>> <p> > >>> This table implements DNS responder for the DNS replies generated by > >>> @@ -1859,7 +1880,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress table 26 External ports</h3> > >>> + <h3>Ingress table 27 External ports</h3> > >>> > >>> <p> > >>> Traffic from the <code>external</code> logical ports enter the > >>> ingress > >>> @@ -1902,7 +1923,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 27 Destination Lookup</h3> > >>> + <h3>Ingress Table 28 Destination Lookup</h3> > >>> > >>> <p> > >>> This table implements switching behavior. It contains these logical > >>> @@ -2078,7 +2099,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Ingress Table 28 Destination unknown</h3> > >>> + <h3>Ingress Table 29 Destination unknown</h3> > >>> > >>> <p> > >>> This table handles the packets whose destination was not found or > >>> @@ -2312,7 +2333,14 @@ output; > >>> there are no rules added for load balancing new connections. > >>> </p> > >>> > >>> - <h3>Egress Table 9: Egress Port Security - check</h3> > >>> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> > >>> + > >>> + <p> > >>> + This is similar to ingress table <code>QoS marking</code> except > >>> + they apply to <code>to-lport</code> QoS rules. > >>> + </p> > >>> + > >>> + <h3>Egress Table 10: Egress Port Security - check</h3> > >>> > >>> <p> > >>> This is similar to the port security logic in table > >>> @@ -2341,7 +2369,7 @@ output; > >>> </li> > >>> </ul> > >>> > >>> - <h3>Egress Table 10: Egress Port Security - Apply</h3> > >>> + <h3>Egress Table 11: Egress Port Security - Apply</h3> > >>> > >>> <p> > >>> This is similar to the ingress port security logic in ingress table > >>> diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema > >>> index b2e0993e0..7bb8f36c0 100644 > >>> --- a/ovn-nb.ovsschema > >>> +++ b/ovn-nb.ovsschema > >>> @@ -1,7 +1,7 @@ > >>> { > >>> "name": "OVN_Northbound", > >>> - "version": "7.2.0", > >>> - "cksum": "1069338687 34162", > >>> + "version": "7.3.0", > >>> + "cksum": "2786772995 34106", > >>> "tables": { > >>> "NB_Global": { > >>> "columns": { > >>> @@ -293,10 +293,9 @@ > >>> "enum": ["set", > >>> ["from-lport", "to-lport"]]}}}, > >>> "match": {"type": "string"}, > >>> "action": {"type": {"key": {"type": "string", > >>> - "enum": ["set", ["dscp"]]}, > >>> + "enum": ["set", ["dscp", > >>> "mark"]]}, > >>> "value": {"type": "integer", > >>> - "minInteger": 0, > >>> - "maxInteger": 63}, > >>> + "minInteger": 0}, > >>> "min": 0, "max": "unlimited"}}, > >>> "bandwidth": {"type": {"key": {"type": "string", > >>> "enum": ["set", ["rate", > >>> diff --git a/ovn-nb.xml b/ovn-nb.xml > >>> index 765ffcf2e..5b593f6a7 100644 > >>> --- a/ovn-nb.xml > >>> +++ b/ovn-nb.xml > >>> @@ -2808,12 +2808,22 @@ or > >>> </column> > >>> > >>> <column name="action"> > >>> - <p>When specified, matching flows will have DSCP marking > >>> applied.</p> > >>> + <p> > >>> + When <code>dscp</code> action is specified, matching flows will > >>> have > >>> + have DSCP marking applied. > >>> + When <code>mark</code> action is specified, matching flows will > >>> have > >>> + packet marking applied. > >>> + </p> > >>> + > >>> <ul> > >>> <li> > >>> <code>dscp</code>: The value of this action should be in the > >>> range of 0 to 63 (inclusive). > >>> </li> > >>> + <li> > >>> + <code>mark</code>: The value of this action should be a > >>> positive > >>> + integer. > >>> + </li> > >>> </ul> > >>> </column> > >>> > >>> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at > >>> index b3d536471..5427d2d14 100644 > >>> --- a/tests/ovn-controller.at > >>> +++ b/tests/ovn-controller.at > >>> @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) > >>> port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) > >>> check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 > >>> > >>> -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > >>> +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -918,14 +918,14 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -940,15 +940,15 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 9; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((10 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((10 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -966,17 +966,17 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 2)) > >>> ]) > >>> done > >>> > >>> @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> add address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], > >>> [0], [1 > >>> ]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1091,24 +1091,24 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i + 4)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i + 4)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1130,17 +1130,17 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((14 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((14 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -1156,11 +1156,11 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1172,7 +1172,7 @@ > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 > >>> actions=conjun > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 > >>> actions=conjunction,2/2) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > >>> ]) > >>> done > >>> > >>> @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > >>> add address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], > >>> [0], [1 > >>> ]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > >>> remove address_set as1 addresses 10.0.0.10 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], > >>> [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], > >>> [0], [1 > >>> ]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], > >>> [ignore]) > >>> > >>> reprocess_count_new=$(read_counter consider_logical_flow) > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > >>> @@ -1288,22 +1288,22 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=conjunction,1/2) > >>> @@ -1327,15 +1327,15 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -1382,16 +1382,16 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 9; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> elif test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> # 2 dst + (10 - i) src + 1 conj_id > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((10 - $i + 3)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((10 - $i + 3)) > >>> ]) > >>> fi > >>> done > >>> @@ -1445,27 +1445,27 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> done > >>> @@ -1483,9 +1483,9 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((20 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((20 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1541,30 +1541,30 @@ for i in $(seq 10); do > >>> add address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> elif test "$i" -lt 6; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i*2)) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((5 + $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((5 + $i)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> done > >>> @@ -1582,12 +1582,12 @@ for i in $(seq 10); do > >>> remove address_set as2 addresses 10.0.0.$j > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" -lt 6; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((15 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((15 - $i)) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1639,22 +1639,22 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 1; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i*2 + 1)) > >>> ]) > >>> fi > >>> > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1676,15 +1676,15 @@ for i in $(seq 10); do > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 10; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> elif test "$i" = 9; then > >>> # no conjunction left > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((21 - $i*2)) > >>> ]) > >>> fi > >>> done > >>> @@ -1700,11 +1700,11 @@ for i in $(seq 10); do > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > >>> [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1719,7 +1719,7 @@ > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > >>> actions=co > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > >>> actions=conjunction,2/2) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > >>> ]) > >>> done > >>> > >>> @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync > >>> reprocess_count_old=$(read_counter consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - > >>> $reprocess_count_old))], [0], [1 > >>> # Delete 2 IPs > >>> reprocess_count_old=$(read_counter consider_logical_flow) > >>> check ovn-nbctl --wait=hv remove address_set as1 addresses > >>> 10.0.0.4,10.0.0.5 > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > >>> actions=conjunction,1/2) > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > >>> actions=conjunction,1/2) > >>> @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport > >>> == "ls1-lp1" && ip4.src == $as > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src > >>> == $as2 && tcp && tcp.dst == {201, 202}' drop > >>> > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > >>> add address_set as2 addresses 10.0.0.24,10.0.0.33 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > >>> remove address_set as2 addresses 10.0.0.24,10.0.0.33 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key > >>> | \ > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key > >>> | \ > >>> grep -v reply | awk '{print $7, $8}' | \ > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,conj_id=,metadata=0x$dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > >>> actions=conjunction,1/2) > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > >>> actions=conjunction,1/2) > >>> @@ -1943,14 +1943,14 @@ for i in $(seq 5); do > >>> check ovn-nbctl add address_set as1 addresses > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter > >>> consider_logical_flow) > >>> for i in $(seq 5); do > >>> check ovn-nbctl remove address_set as1 addresses > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" > >>> + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" > >>> if test "$i" = 4; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 5; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -2024,14 +2024,14 @@ for i in $(seq 5); do > >>> check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 3; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$i > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$i > >>> ]) > >>> done > >>> > >>> @@ -2046,15 +2046,15 @@ for i in $(seq 5); do > >>> check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" > >>> check ovn-nbctl --wait=hv sync > >>> if test "$i" = 4; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=46,reg15=0x$port_key | \ > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > >>> table=51,reg15=0x$port_key | \ > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > >>> ]) > >>> fi > >>> if test "$i" = 5; then > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > >>> "priority=1100"], [1], [ignore]) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > >>> "priority=1100"], [1], [ignore]) > >>> else > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [$((5 - $i)) > >>> ]) > >>> fi > >>> done > >>> @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg > >>> ovn-nbctl create address_set name=as1 addresses=8.8.8.8 > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src > >>> == $as1' drop > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100"], [0], [1 > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100"], [0], [1 > >>> ]) > >>> > >>> # pause ovn-northd > >>> @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause > >>> # undefined. This test runs the scenario ten times to make sure different > >>> # orders are covered and handled properly. > >>> > >>> -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c > >>> "priority=1100") > >>> +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c > >>> "priority=1100") > >>> for i in $(seq 10); do > >>> # Delete and recreate the SB address set with same name and an extra > >>> IP. > >>> addrs_=$(fetch_column address_set addresses name=as1) > >>> addrs=${addrs_// /,} > >>> AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set > >>> name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) > >>> - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | > >>> grep -c "priority=1100") = "$(($i + 1))"]) > >>> + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | > >>> grep -c "priority=1100") = "$(($i + 1))"]) > >>> done > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -2698,7 +2698,7 @@ done > >>> wait_for_ports_up > >>> ovn-nbctl --wait=hv sync > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > >>> [0],[dnl > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > >>> [0],[dnl > >>> 3 > >>> ]) > >>> > >>> @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do > >>> done > >>> ovn-nbctl --wait=hv sync > >>> > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q > >>> controller], [1]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q > >>> controller], [1]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at > >>> index 7f37d7716..b11e4ec6b 100644 > >>> --- a/tests/ovn-nbctl.at > >>> +++ b/tests/ovn-nbctl.at > >>> @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp > >>> dscp=0 rate=300 burst=3000]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 > >>> burst=30000]) > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) > >>> > >>> dnl Add duplicated qos > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 > >>> burst=30002], [1], [], [stderr]) > >>> @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 > >>> from-lport 400 (tcp) rate=300 burst=3000 dscp=0 > >>> to-lport 300 (tcp) dscp=48 > >>> to-lport 200 (ip) rate=101 > >>> + to-lport 102 (ip4) dscp=16 mark=17 > >>> + to-lport 101 (ip4) mark=15 > >>> to-lport 100 (ip4) rate=301 burst=30000 dscp=13 > >>> ]) > >>> > >>> @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip > >>> dscp=-1], [1], [], > >>> ]) > >>> > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], > >>> -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and > >>> "burst=" > >>> +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" > >>> and "mark=" > >>> ]) > >>> > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], > >>> -[ovn-nbctl: Either "rate" and/or "dscp" must be specified > >>> +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified > >>> ])]) > >>> > >>> dnl --------------------------------------------------------------------- > >>> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > >>> index 67e81ddba..6a27b7dcf 100644 > >>> --- a/tests/ovn-northd.at > >>> +++ b/tests/ovn-northd.at > >>> @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ > >>> -- ls-lb-add ls lb > >>> > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == > >>> 1), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == > >>> 1), action=(reg8[[16]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) > >>> table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && > >>> ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && > >>> ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) > >>> @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls > >>> ovn-nbctl --wait=sb clear logical_switch ls load_balancer > >>> > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > >>> action=(next;) > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) > >>> table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) > >>> @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > >>> @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > >>> action=(reg8[[16]] = 1; next;) > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > >>> @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" > >>> | sed 's/table=../table=??/ > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), > >>> action=(next;) > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > >>> @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 > >>> "00:00:00:00:00:01" > >>> @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 > >>> 1000::3" > >>> @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> # Disable sw0p1 > >>> @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > >>> action=(outport = get_fdb(eth.dst); next;) > >>> @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "sw0p1"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 > >>> @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "sw0p1"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> check ovn-nbctl set logical_switch_port sw0p1 enabled=true > >>> @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && > >>> icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && > >>> icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > >>> next;) > >>> - table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) > >>> + table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > >>> action=(next;) > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > >>> 1), action=(drop;) > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_out_apply_port_sec), priority=100 , match=(outport == > >>> "localnetport"), action=(set_queue(10); output;) > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > >>> @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > >>> action=(outport = "_MC_flood"; output;) > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > >>> action=(output;) > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > >>> "none"), action=(drop;) > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > >>> action=(reg0[[15]] = 0; next;) > >>> ]) > >>> > >>> AT_CLEANUP > >>> @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options > >>> logical_port=public |grep -q 'qos > >>> AT_CLEANUP > >>> ]) > >>> > >>> +OVN_FOR_EACH_NORTHD_NO_HV([ > >>> +AT_SETUP([check OVN QoS mark/meter logical flows]) > >>> +AT_KEYWORDS([OVN-QoS]) > >>> +ovn_start > >>> + > >>> +check ovn-nbctl ls-add ls > >>> +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > >>> +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > >>> +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > >>> +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > >>> + > >>> +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > >>> +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > >>> +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > >>> +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > >>> +check ovn-nbctl --wait=sb sync > >>> + > >>> +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl > >>> + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) > >>> + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), > >>> action=(ip.dscp = 16; next;) > >>> + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), > >>> action=(ip.dscp = 17; next;) > >>> + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) > >>> + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), > >>> action=(set_meter(100, 1000); next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), > >>> action=(pkt.mark = 15; next;) > >>> + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), > >>> action=(pkt.mark = 18; next;) > >>> + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) > >>> + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), > >>> action=(ip.dscp = 16; next;) > >>> + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), > >>> action=(ip.dscp = 17; next;) > >>> + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) > >>> + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), > >>> action=(set_meter(100, 1000); next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), > >>> action=(pkt.mark = 15; next;) > >>> + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), > >>> action=(pkt.mark = 18; next;) > >>> +]) > >>> + > >>> +AT_CLEANUP > >>> +]) > >>> + > >>> AT_SETUP([Tiered ACL logical flows]) > >>> AT_KEYWORDS([acl]) > >>> > >>> @@ -9978,10 +10017,10 @@ acl_test() { > >>> } > >>> > >>> acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > >>> -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 18 > >>> +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 19 > >>> acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > >>> acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > >>> -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 18 > >>> +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > >>> ls_in_acl_after_lb_action 19 > >>> acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > >>> > >>> AT_CLEANUP > >>> diff --git a/tests/ovn.at b/tests/ovn.at > >>> index 28c6b6c34..9b158e79c 100644 > >>> --- a/tests/ovn.at > >>> +++ b/tests/ovn.at > >>> @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > >>> > >>> next(pipeline=egress); > >>> formats as next(pipeline=egress, table=11); > >>> - encodes as resubmit(,53) > >>> + encodes as resubmit(,58) > >>> > >>> next(pipeline=egress, table=5); > >>> - encodes as resubmit(,47) > >>> + encodes as resubmit(,52) > >>> > >>> next(table=10); > >>> formats as next(10); > >>> @@ -9719,18 +9719,18 @@ as hv1 > >>> AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 > >>> external_ids:iface-id=localvif1]) > >>> > >>> # On hv1, check that there are no flows outputting bcast to tunnel > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # On hv2, check that no flow outputs bcast to tunnel to hv1. > >>> as hv2 > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # Now bind vif2 on hv2. > >>> AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 > >>> external_ids:iface-id=localvif2]) > >>> > >>> # At this point, the broadcast flow on vif2 should be deleted. > >>> -# because, there is now a localnet vif bound (table=37 programming logic) > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> +# because, there is now a localnet vif bound (table=42 programming logic) > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip > >>> | grep output | wc -l` -eq 0]) > >>> > >>> # Verify that the local net patch port exists on hv2. > >>> OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port > >>> patch-br-int-to-ln_port" | wc -l` -eq 1]) > >>> @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns > >>> ofport find Interface name=ov > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface > >>> name=ovn-gw2-0) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> ]) > >>> > >>> test_ip_packet() > >>> @@ -11631,7 +11631,7 @@ AT_CHECK( > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> ]) > >>> > >>> test_ip_packet gw2 gw1 0 > >>> @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns > >>> ofport find Interface name=ov > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface > >>> name=ovn-gw2-0) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > >>> ]) > >>> > >>> test_ip_packet() > >>> @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > >>> ]) > >>> > >>> test_ip_packet gw2 gw1 > >>> @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > >>> > >>> AT_CHECK( > >>> [# Check that redirect mapping is programmed only on hv2 > >>> - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > >>> - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc > >>> -l > >>> + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > >>> + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc > >>> -l > >>> > >>> # Check that hv1 sends chassisredirect port traffic to hv2 > >>> - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > >>> - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > >>> + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > >>> + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > >>> > >>> # Check that arp reply on distributed gateway port is only programmed > >>> on hv2 > >>> grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > >>> @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int > >>> in_port=hv1-vif1 $packet > >>> sleep 2 > >>> > >>> AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > >>> | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > >>> echo $hv2_gw2_ofport > >>> > >>> echo "--- hv1 ---" > >>> -as hv1 ovs-ofctl dump-flows br-int table=39 > >>> +as hv1 ovs-ofctl dump-flows br-int table=44 > >>> > >>> echo "--- hv2 ---" > >>> -as hv2 ovs-ofctl dump-flows br-int table=39 > >>> +as hv2 ovs-ofctl dump-flows br-int table=44 > >>> > >>> gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > >>> gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13566,15 +13566,15 @@ sleep 10 > >>> > >>> as gw1 ovs-ofctl dump-flows br-int > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # make sure ARP responder flows for outside router port reside on gw1 too > >>> through ls_in_arp_rsp table > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > >>> > >>> # check that the chassis redirect port has been claimed by the gw1 chassis > >>> @@ -13598,12 +13598,12 @@ wait_for_ports_up > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # we make sure that the hypervisors noticed, and inverted the slave ports > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > >>> Interface name=ovn-hv1-0],[0], > >>> ]]) > >>> > >>> # make sure that flows for handling the outside router port reside on gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > >>> bfd_dump > >>> > >>> # make sure that flows for handling the outside router port reside on gw1 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside > >>> ha_chassis_group=$hagrp1_uuid > >>> wait_row_count HA_Chassis_Group 1 > >>> wait_row_count HA_Chassis 2 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [0 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [0 > >>> ]) > >>> @@ -13777,26 +13777,26 @@ done > >>> # Re-add gw2 > >>> as gw2 ovn_attach n1 br-phys 192.168.0.1 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> # make sure that flows for handling the outside router port reside on gw1 > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # make sure ARP responder flows for outside router port reside on gw1 too > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > >>> > >>> # check that the chassis redirect port has been claimed by the gw1 chassis > >>> @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group > >>> ref_chassis > >>> # Increase the priority of gw2 > >>> ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > >>> | wc -l], [0], [1 > >>> ]) > >>> @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > >>> Interface name=ovn-hv1-0],[0], > >>> ]]) > >>> > >>> # make sure that flows for handling the outside router port reside on gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > >>> bfd_dump > >>> > >>> # make sure that flows for handling the outside router port reside on gw2 > >>> now > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > >>> ]]) > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > >>> ]]) > >>> > >>> @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > >>> AT_CAPTURE_FILE([sw0-flows]) > >>> > >>> AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed > >>> 's/table=../table=??/' | sort], [0], [dnl > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=27); };) > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > >>> inport; next(pipeline=ingress,table=28); };) > >>> ]) > >>> > >>> > >>> @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst > >>> $ipv6_src $ipv6_dst > >>> # Get total number of ipv4 packets that received on ovs > >>> > >>> # sender side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # receiver side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # Get total number of ipv6 packets that received on ovs > >>> > >>> # sender side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> # receiver side > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > >>> > >>> OVN_CLEANUP([hv1], [hv2]) > >>> AT_CLEANUP > >>> @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' allow > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the less restrictive flows should have been installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > >>> @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the second less restrictive allow ACL should have been > >>> installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Remove the less restrictive allow ACL. > >>> @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > >>> @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > >>> 'ip4.src==10.0.0.1' allow > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows, the less restrictive flows should have been installed. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> ]) > >>> > >>> # Add another ACL that overlaps with the existing less restrictive ones. > >>> @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > >>> # with an additional conjunction action. > >>> # > >>> # New non-conjunctive flows should be added to match on 'udp'. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> \ > >>> grep "priority=1003" | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction(),conjunction() > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> - table=46, priority=1003,udp,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> - table=46, priority=1003,udp6,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > >>> actions=conjunction(),conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > >>> actions=conjunction(),conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > >>> actions=conjunction(),conjunction() > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > >>> actions=conjunction() > >>> + table=51, priority=1003,udp,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> + table=51, priority=1003,udp6,metadata=0x1 > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> ]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 > >>> 'outport == @pg1 && ip4.src == $as2' al > >>> > >>> wait_for_ports_up > >>> check ovn-nbctl --wait=hv sync > >>> -ovs-ofctl dump-flows br-int table=46 > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = > >>> 2]) > >>> +ovs-ofctl dump-flows br-int table=51 > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = > >>> 2]) > >>> > >>> echo ------- > >>> # Add another address in as1, so that the 1st ACL will now generate 2 > >>> conjunctions. > >>> ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > >>> check ovn-nbctl --wait=hv sync > >>> > >>> -ovs-ofctl dump-flows br-int table=46 > >>> +ovs-ofctl dump-flows br-int table=51 > >>> # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd > >>> ACL) > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = > >>> 3]) > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = > >>> 3]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > >>> # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined > >>> # to router mac. > >>> AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > >>> -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > >>> +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > >>> grep -c "actions=drop"], [0], [1 > >>> ]) > >>> # Stop ovn-controllers on hv1 and hv3. > >>> @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy > >>> options:pkt_mark=100 > >>> check ovn-nbctl --wait=hv sync > >>> as hv2 > >>> # add a flow in egress pipeline to check pkt marking > >>> -ovs-ofctl --protocols=OpenFlow13 add-flow br-int > >>> "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > >>> actions=resubmit(,38)" > >>> +ovs-ofctl --protocols=OpenFlow13 add-flow br-int > >>> "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > >>> actions=resubmit(,43)" > >>> > >>> dst_ip=$(ip_to_hex 172 16 2 10) > >>> fip_ip=$(ip_to_hex 172 16 1 2) > >>> @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip > >>> $gw_router_ip) >> expected > >>> send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > >>> echo > >>> "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" > >>>>> expected > >>> > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > >>> > >>> OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > >>> > >>> @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > >>> lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key > >>> external_ids:name=lr0)) > >>> lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding > >>> tunnel_key logical_port=lr0-public)) > >>> > >>> - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > >>> - table=46, priority=2000,ip,metadata=0x$sw0_dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > >>> + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > >>> + table=51, priority=2000,ip,metadata=0x$sw0_dp_key > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > >>> ]) > >>> > >>> AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | > >>> ofctl_strip_all | \ > >>> grep "priority=92" | grep 172.168.0.50], [0], [dnl > >>> - table=11, > >>> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > >>> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > >>> + table=11, > >>> priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > >>> actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > >>> ]) > >>> } > >>> > >>> check_virtual_offlows_not_present() { > >>> hv=$1 > >>> - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > >>> + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > >>> ]) > >>> > >>> AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | > >>> ofctl_strip_all | \ > >>> @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 > >>> logical_port=sw0-vir virtual_parent=sw0-p1 > >>> wait_for_ports_up sw0-vir > >>> check ovn-nbctl --wait=hv sync > >>> AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received > >>> packet-in" | \ > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > >>> > >>> wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid > >>> check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 > >>> @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > >>> OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], > >>> [vif-north.expected]) > >>> > >>> # Confirm that packets did not go out via tunnel port. > >>> - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > >>> + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > >>> ]]) > >>> > >>> # Confirm that packet went out via localnet port > >>> @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > >>> AT_CHECK([test ! -z $p2_zoneid]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) > >>> -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw1_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw1_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw1_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw1_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) > >>> -eq 1]) > >>> > >>> ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up > >>> sw0-p1) = xup]) > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> AT_CHECK([test ! -z $p1_zoneid]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) > >>> -eq 1]) > >>> > >>> ovs-vsctl del-port hv1-vif2 > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > >>> > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > >>> @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > >>> > >>> ovn-nbctl lsp-del sw0-p1 > >>> > >>> -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > >>> table=40,metadata=${sw0_dpkey},\ > >>> +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > >>> table=45,metadata=${sw0_dpkey},\ > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > >>> > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > >>> @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Check OVS flows are installed properly. > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > >>> \ > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > >>> \ > >>> grep "priority=2002" | grep conjunction | \ > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > >>> sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> - table=46, > >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> + table=51, > >>> priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > >>> actions=conjunction() > >>> ]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface > >>> lsp0-0 external_ids:iface-id=l > >>> ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 > >>> external_ids:iface-id=lsp0-1 > >>> > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 22]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 22]) > >>> > >>> # Save the current lflow_run counter > >>> lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > >>> @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller > >>> coverage/read-counter lflow_run) > >>> # 1. Remove half of the ports from pg1. The excepted conjunction flows > >>> should be: > >>> # 2 + 10 = 12 > >>> check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j > >>> in 0 1; do echo lsp${i}-${j}; done; done) > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 12]) > >>> > >>> # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because > >>> the > >>> # port group const set should have only one member (lsp0-1). And the > >>> total > >>> @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int > >>> table=46 | grep conjunction | wc -l > >>> # 10. > >>> ovs-vsctl del-port br-int lsp0-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 0]) > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc > >>> -l) == 10]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 0]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc > >>> -l) == 10]) > >>> > >>> # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > >>> ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 > >>> external_ids:iface-id=lsp0-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 12]) > >>> > >>> # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any > >>> change. > >>> ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 > >>> external_ids:iface-id=lsp9-0 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 12]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 12]) > >>> > >>> # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a > >>> different > >>> # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > >>> ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 > >>> external_ids:iface-id=lsp1-0 > >>> ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 > >>> external_ids:iface-id=lsp1-1 > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction > >>> | wc -l) == 24]) > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction > >>> | wc -l) == 24]) > >>> > >>> # 6. Simulate a SB port-group "del and add" notification to > >>> ovn-controller in the > >>> # same IDL iteration. ovn-controller should still program the same > >>> flows. In > >>> @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # Finally check flow count is the same as before. > >>> - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > >>> conjunction | wc -l) == 24]) > >>> + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > >>> conjunction | wc -l) == 24]) > >>> done > >>> > >>> # Make sure all the above was performed with I-P (no recompute) > >>> @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > >>> 'outport == "lp2" && ip4.src == 10.0. > >>> > >>> # The first ACL should be programmed, but the second one shouldn't. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], > >>> [ignore]) > >>> > >>> # Now create the lport lp2. > >>> check ovn-nbctl lsp-add lsw0 lp2 \ > >>> @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > >>> > >>> check ovn-nbctl --wait=hv sync > >>> # Now the second ACL should be programmed. > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], > >>> [ignore]) > >>> > >>> # Remove the lport lp2 again, the OVS flow for the second ACL should be > >>> # removed. > >>> check ovn-nbctl --wait=hv lsp-del lp2 > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], > >>> [ignore]) > >>> > >>> # Test similar scenario but when the referenced lport is not bound > >>> locally. > >>> > >>> @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport > >>> == "lp4" && ip4.dst == 10.0.0 > >>> > >>> # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], > >>> [ignore]) > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], > >>> [ignore]) > >>> > >>> # Now create the lport lp4. > >>> check ovn-nbctl lsp-add lsw0 lp4 \ > >>> @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > >>> > >>> # Now the ACL for lp4 should be programmed. > >>> check ovn-nbctl --wait=hv sync > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], > >>> [ignore]) > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], > >>> [ignore]) > >>> > >>> OVN_CLEANUP([hv1]) > >>> AT_CLEANUP > >>> @@ -33493,15 +33493,15 @@ done > >>> check ovn-nbctl --wait=hv sync > >>> > >>> # hv0 should see flows for lsp1 but not lsp2 > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], > >>> [1]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], > >>> [1]) > >>> # hv2 should see flows for lsp2 but not lsp1 > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], > >>> [0], [ignore]) > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > >>> [1]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > >>> [1]) > >>> > >>> # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > >>> check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> > >>> # Change it back, and trigger recompute to make sure extra flows are > >>> removed > >>> # from hv2 (recompute is needed because currently I-P adds local > >>> datapaths but > >>> @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int > >>> table=29 | grep 10.0.1.2], [0], [ig > >>> check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > >>> as hv2 check ovn-appctl -t ovn-controller recompute > >>> ovn-nbctl --wait=hv sync > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > >>> [1]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > >>> [1]) > >>> > >>> # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > >>> AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr > >>> dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], > >>> [0], [ignore]) > >>> > >>> OVN_CLEANUP([hv1],[hv2]) > >>> AT_CLEANUP > >>> @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > >>> # Use constants so that if tables or registers change, this test can > >>> # be updated easily. > >>> DNAT_TABLE=15 > >>> -SNAT_TABLE=45 > >>> +SNAT_TABLE=50 > >>> DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > >>> SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > >>> > >>> @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > >>> wait_for_ports_up > >>> OVN_POPULATE_ARP > >>> > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c > >>> controller], [0],[dnl > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c > >>> controller], [0],[dnl > >>> 9 > >>> ]) > >>> > >>> @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > >>> send_garp 1 1 $eth_src $eth_dst $spa $tpa > >>> > >>> OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl > >>> received packet-in" | \ > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > >>> > >>> sleep_controller hv1 > >>> > >>> @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT > >>> \ > >>> > >>> OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > >>> AT_CLEANUP > >>> + > >>> +OVN_FOR_EACH_NORTHD([ > >>> +AT_SETUP([QoS packet marking]) > >>> +AT_KEYWORDS([ovn-qos-pkt-marking]) > >>> +AT_SKIP_IF([test $HAVE_SCAPY = no]) > >>> +ovn_start > >>> + > >>> +check ovn-nbctl lr-add lr0 > >>> +check ovn-nbctl ls-add ls0 > >>> +check ovn-nbctl ls-add ls1 > >>> + > >>> +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > >>> +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > >>> + set Logical_Switch_Port lrp-s0 type=router \ > >>> + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > >>> +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > >>> +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > >>> + set Logical_Switch_Port lrp-s1 type=router \ > >>> + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > >>> + > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > >>> +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > >>> +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > >>> + > >>> +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > >>> +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > >>> +check ovn-nbctl --wait=sb sync > >>> + > >>> +net_add n1 > >>> +sim_add hv > >>> + > >>> +as hv > >>> +check ovs-vsctl add-br br-phys > >>> +ovn_attach n1 br-phys 192.168.0.1 > >>> + > >>> +check ovs-vsctl add-port br-int vif0 -- \ > >>> + set Interface vif0 external-ids:iface-id=lp0 \ > >>> + options:tx_pcap=hv/vif0-tx.pcap \ > >>> + options:rxq_pcap=hv/vif0-rx.pcap \ > >>> + ofport-request=1 > >>> +check ovs-vsctl add-port br-int vif1 -- \ > >>> + set Interface vif1 external-ids:iface-id=lp1 \ > >>> + options:tx_pcap=hv/vif1-tx.pcap \ > >>> + options:rxq_pcap=hv/vif1-rx.pcap \ > >>> + ofport-request=2 > >>> +check ovs-vsctl add-port br-int vif2 -- \ > >>> + set Interface vif2 external-ids:iface-id=lp2 \ > >>> + options:tx_pcap=hv/vif2-tx.pcap \ > >>> + options:rxq_pcap=hv/vif2-rx.pcap \ > >>> + ofport-request=3 > >>> + > >>> +# Create QoS rules for packet marking. > >>> +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" > >>> mark=48 > >>> +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" > >>> mark=49 > >>> +check_row_count nb:QoS 2 > >>> + > >>> +# Create some flows to count pkt marking. > >>> +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark > >>> == 48" drop > >>> +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > >>> +wait_for_ports_up > >>> +check ovn-nbctl --wait=hv sync > >>> + > >>> +send_udp_packet() { > >>> + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > >>> + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ > >>> + IP(src='${ipv4_src}', dst='${ipv4_dst}', > >>> ttl=0x40)/ \ > >>> + UDP(sport=4242, dport=4343)") > >>> + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > >>> +} > >>> + > >>> +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > >>> external_ids:name=ls0)) > >>> +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > >>> external_ids:name=lr0)) > >>> + > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > >>> "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > >>> + > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > >>> "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > >>> + > >>> +OVN_CLEANUP([hv]) > >>> +AT_CLEANUP > >>> +]) > >>> diff --git a/tests/system-ovn.at b/tests/system-ovn.at > >>> index cb4124b70..1277f1057 100644 > >>> --- a/tests/system-ovn.at > >>> +++ b/tests/system-ovn.at > >>> @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > >>> grep 'nat(src=20.0.0.2)']) > >>> > >>> check ovs-appctl dpctl/flush-conntrack > >>> @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > >>> grep 'nat(src=20.0.0.2)']) > >>> > >>> rm -f wget*.log > >>> @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > >>> grep controller | grep tp_dst=84 -c) > >>> test $n_pkt -eq 1 > >>> ]) > >>> @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > >>> ]) > >>> > >>> OVS_WAIT_UNTIL([ > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > >>> grep controller | grep tp_dst=84 -c) > >>> test $n_pkt -eq 1 > >>> ]) > >>> @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > >>> > >>> wait_igmp_flows_installed() > >>> { > >>> - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > >>> + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > >>> grep 'priority=90' | grep "nw_dst=$1"]) > >>> } > >>> > >>> @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > >>> 30.0.0.2:8000"'='"192.168.1.2:12345,192 > >>> > >>> ovn-nbctl list load_balancer > >>> ovn-sbctl dump-flows R2 > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep > >>> 'nat(src=20.0.0.2)']) > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep > >>> 'nat(src=20.0.0.2)']) > >>> > >>> dnl Test load-balancing that includes L4 ports in NAT. > >>> for i in `seq 1 20`; do > >>> diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > >>> index 6f74bd557..f838393a6 100644 > >>> --- a/utilities/ovn-nbctl.8.xml > >>> +++ b/utilities/ovn-nbctl.8.xml > >>> @@ -482,6 +482,9 @@ > >>> <code>burst=</code><var>burst</var> specifies the burst rate > >>> limit in kilobits. <code>dscp</code> and/or <code>rate</code> > >>> are required arguments. > >>> + If <code>mark=</code><var>mark</var> is specified, then matching > >>> + packets will be marked (through <code>pkt.mark</code>). > >>> + <var>mark</var> must be a positive integer. > >>> </p> > >>> > >>> <p> > >>> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > >>> index 526369b68..0620d333a 100644 > >>> --- a/utilities/ovn-nbctl.c > >>> +++ b/utilities/ovn-nbctl.c > >>> @@ -283,7 +283,7 @@ ACL commands:\n\ > >>> print ACLs for SWITCH\n\ > >>> \n\ > >>> QoS commands:\n\ > >>> - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > >>> [dscp=DSCP]\n\ > >>> + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > >>> [dscp=DSCP] [mark=MARK]\n\ > >>> add an QoS rule to SWITCH\n\ > >>> qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > >>> remove QoS rules from SWITCH\n\ > >>> @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > >>> if (!strcmp(qos_rule->key_action[j], "dscp")) { > >>> ds_put_format(&ctx->output, " dscp=%"PRId64"", > >>> qos_rule->value_action[j]); > >>> + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > >>> + ds_put_format(&ctx->output, " mark=%"PRId64"", > >>> + qos_rule->value_action[j]); > >>> } > >>> } > >>> ds_put_cstr(&ctx->output, "\n"); > >>> @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > >>> + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > >>> } > >>> > >>> static void > >>> @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> const char *direction; > >>> int64_t priority; > >>> int64_t dscp = -1; > >>> + int64_t mark = 0; > >>> int64_t rate = 0; > >>> int64_t burst = 0; > >>> char *error; > >>> @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> return; > >>> } > >>> } > >>> + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > >>> + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < > >>> 0) { > >>> + ctl_error(ctx, "%s: mark must be a positive integer", > >>> + ctx->argv[i] + 5); > >>> + return; > >>> + } > >>> + } > >>> else if (!strncmp(ctx->argv[i], "rate=", 5)) { > >>> if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > >>> || rate < 1 || rate > UINT32_MAX) { > >>> @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> } > >>> } else { > >>> ctl_error(ctx, "%s: supported arguments are \"dscp=\", > >>> \"rate=\", " > >>> - "and \"burst=\"", ctx->argv[i]); > >>> + "\"burst=\" and \"mark=\"", ctx->argv[i]); > >>> return; > >>> } > >>> } > >>> > >>> /* Validate rate and dscp. */ > >>> - if (-1 == dscp && !rate) { > >>> - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be > >>> specified"); > >>> + if (-1 == dscp && !rate && !mark) { > >>> + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be > >>> " > >>> + "specified"); > >>> return; > >>> } > >>> > >>> @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > >>> nbrec_qos_set_priority(qos, priority); > >>> nbrec_qos_set_direction(qos, direction); > >>> nbrec_qos_set_match(qos, ctx->argv[4]); > >>> + if (mark) { > >>> + nbrec_qos_update_action_setkey(qos, "mark", mark); > >>> + } > >>> if (-1 != dscp) { > >>> - const char *dscp_key = "dscp"; > >>> - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > >>> + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > >>> } > >>> if (rate) { > >>> const char *bandwidth_key[2] = {"rate", "burst"}; > >>> -- > >>> 2.43.0 > >>> > >>> _______________________________________________ > >>> dev mailing list > >>> dev@openvswitch.org > >>> https://mail.openvswitch.org/mailman/listinfo/ovs-dev > >>> > >>> > >> Thanks, > >> Ales > >> > > > > Thanks, > > Dumitru > > > > >
> On Wed, Jan 31, 2024 at 1:37 PM Dumitru Ceara <dceara@redhat.com> wrote: > > > On 1/31/24 13:22, Dumitru Ceara wrote: > > > On 1/31/24 13:10, Ales Musil wrote: > > >> On Tue, Jan 30, 2024 at 3:54 PM Lorenzo Bianconi < > > >> lorenzo.bianconi@redhat.com> wrote: > > >> > > >>> Add the capbility to mark (through pkt.mark) incoming/outgoing packets > > >>> in logical_switch datapath according to user configured QoS rule. > > >>> > > >>> Co-developed-by: Dumitru Ceara <dceara@redhat.com> > > >>> Reported-at: https://issues.redhat.com/browse/FDP-42 > > >>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > > >>> --- > > >>> > > >> > > >> Hi Lorenzo and Dumitru, > > > > > > Hi Ales, > > > > > >> I have one question, would it be possible to use existing QOS_MARK by > > >> moving it after the lb/stateful stage in ingress/egress? Even if both > > dscp > > >> and mark are set at the same time the action could set both in one > > logical > > >> flow. That being said, we might even collapse all QoS stages into one > > that > > >> will be a combination of dscp/mark/set_meter WDYT? However, I might have > > >> missed something crucial why it isn't possible. > > >> > > > > > > That's a significant behavior change IMO (that I'd like to avoid for > > > now). We might be breaking existing QoS (DSCP) marking rules if we move > > > the ls_in_qos_mark stage after load balancing. > > > > > > The CMS has more knowledge about the network than OVN does and it can > > > attach it's own "metadata" (pkt.mark) to relay that to upper layers (or > > > later stages in the OVN pipeline). In this specific case ovn-kubernetes > > > can determine whether the mark should be set _only after_ load > > > balancing. That's the reason why we addded the new stage after the lb > > one. > > > > > > But I think we're definitely open to alternatives if you have ideas. > > > > > > > I had another look and because we send all traffic to conntrack in stage > > pre_stateful if load balancers are enabled it's probably fine to move > > the pkt marking stage (the new one) next to the qos stages. > > > > That would be more consistent from a CMS perspective IMO. > > > > > > I wouldn't merge QoS stages them in this patch though given that we're > > late in the dev cycle. It's probably fine to merge them as a follow up > > for 24.09. > > > > Sure that's fine. > > Lorenzo, would you mind splitting this into two patches? One that makes the > space for an additional stage by shifting the table numbers and second that > will add the packet mark? ack, I will do it in v2. Regards, Lorenzo > > > > > > Lorenzo, what do you think? > > > > Regards, > > Dumitru > > > > >> > > >> > > >>> NEWS | 2 + > > >>> controller/lflow.h | 15 +- > > >>> lib/ovn-util.h | 2 +- > > >>> northd/northd.c | 55 +++-- > > >>> northd/ovn-northd.8.xml | 60 ++++-- > > >>> ovn-nb.ovsschema | 9 +- > > >>> ovn-nb.xml | 12 +- > > >>> tests/ovn-controller.at | 308 +++++++++++++-------------- > > >>> tests/ovn-nbctl.at | 8 +- > > >>> tests/ovn-northd.at | 103 ++++++--- > > >>> tests/ovn.at | 429 > > +++++++++++++++++++++++--------------- > > >>> tests/system-ovn.at | 12 +- > > >>> utilities/ovn-nbctl.8.xml | 3 + > > >>> utilities/ovn-nbctl.c | 27 ++- > > >>> 14 files changed, 627 insertions(+), 418 deletions(-) > > >>> > > >>> diff --git a/NEWS b/NEWS > > >>> index 6553bd078..7300345f1 100644 > > >>> --- a/NEWS > > >>> +++ b/NEWS > > >>> @@ -18,6 +18,8 @@ Post v23.09.0 > > >>> - Support selecting encapsulation IP based on the source/destination > > >>> VIF's > > >>> settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for > > more > > >>> details. > > >>> + - Add the capbility to mark (through pkt.mark) incoming/outgoing > > packets > > >>> + in the logical switch datapath according to user configured QoS > > rule. > > >>> > > >>> OVN v23.09.0 - 15 Sep 2023 > > >>> -------------------------- > > >>> diff --git a/controller/lflow.h b/controller/lflow.h > > >>> index 9b7ffa19c..f7f6c7950 100644 > > >>> --- a/controller/lflow.h > > >>> +++ b/controller/lflow.h > > >>> @@ -67,17 +67,20 @@ struct uuid; > > >>> > > >>> /* Start of LOG_PIPELINE_LEN tables. */ > > >>> #define OFTABLE_LOG_INGRESS_PIPELINE 8 > > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > > >>> -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > > >>> -#define OFTABLE_REMOTE_OUTPUT 39 > > >>> -#define OFTABLE_LOCAL_OUTPUT 40 > > >>> -#define OFTABLE_CHECK_LOOPBACK 41 > > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > > >>> +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > > >>> +#define OFTABLE_REMOTE_OUTPUT 44 > > >>> +#define OFTABLE_LOCAL_OUTPUT 45 > > >>> +#define OFTABLE_CHECK_LOOPBACK 46 > > >>> > > >>> /* Start of the OUTPUT section of the pipeline. */ > > >>> #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT > > >>> +BUILD_ASSERT_DECL( > > >>> + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < > > OFTABLE_OUTPUT_INIT > > >>> +); > > >>> > > >>> /* Start of LOG_PIPELINE_LEN tables. */ > > >>> -#define OFTABLE_LOG_EGRESS_PIPELINE 42 > > >>> +#define OFTABLE_LOG_EGRESS_PIPELINE 47 > > >>> #define OFTABLE_SAVE_INPORT 64 > > >>> #define OFTABLE_LOG_TO_PHY 65 > > >>> #define OFTABLE_MAC_BINDING 66 > > >>> diff --git a/lib/ovn-util.h b/lib/ovn-util.h > > >>> index 2afff0d07..3e1d68cf9 100644 > > >>> --- a/lib/ovn-util.h > > >>> +++ b/lib/ovn-util.h > > >>> @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( > > >>> #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) > > >>> > > >>> /* The number of tables for the ingress and egress pipelines. */ > > >>> -#define LOG_PIPELINE_LEN 29 > > >>> +#define LOG_PIPELINE_LEN 30 > > >>> > > >>> static inline uint32_t > > >>> hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) > > >>> diff --git a/northd/northd.c b/northd/northd.c > > >>> index d2091d4bc..597d203ca 100644 > > >>> --- a/northd/northd.c > > >>> +++ b/northd/northd.c > > >>> @@ -134,22 +134,23 @@ enum ovn_stage { > > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, > > "ls_in_lb_aff_check") > > >>> \ > > >>> PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") > > >>> \ > > >>> PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, > > "ls_in_lb_aff_learn") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, > > "ls_in_pre_hairpin") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, > > "ls_in_nat_hairpin") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ > > >>> + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, > > "ls_in_qos_pkt_mark") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, > > "ls_in_pre_hairpin") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, > > "ls_in_nat_hairpin") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ > > >>> "ls_in_acl_after_lb_eval") \ > > >>> - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ > > >>> + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ > > >>> "ls_in_acl_after_lb_action") \ > > >>> - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, > > "ls_in_dhcp_options") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, > > "ls_in_dhcp_response") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, > > "ls_in_dns_response") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, > > "ls_in_external_port") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, > > "ls_in_dhcp_options") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, > > "ls_in_dhcp_response") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, > > "ls_in_dns_response") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, > > "ls_in_external_port") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") > > >>> \ > > >>> > > >>> \ > > >>> /* Logical switch egress stages. */ > > >>> \ > > >>> PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") > > >>> \ > > >>> @@ -161,8 +162,9 @@ enum ovn_stage { > > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") > > >>> \ > > >>> PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") > > >>> \ > > >>> PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") > > >>> \ > > >>> - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, > > >>> "ls_out_check_port_sec") \ > > >>> - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, > > >>> "ls_out_apply_port_sec") \ > > >>> + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, > > "ls_out_qos_pkt_mark") > > >>> \ > > >>> + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, > > >>> "ls_out_check_port_sec") \ > > >>> + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, > > >>> "ls_out_apply_port_sec") \ > > >>> > > \ > > >>> /* Logical router ingress stages. */ > > \ > > >>> PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") > > >>> \ > > >>> @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct > > >>> chassis_features *features, > > >>> ds_destroy(&actions); > > >>> } > > >>> > > >>> +#define QOS_MAX_DSCP 63 > > >>> + > > >>> static void > > >>> build_qos(struct ovn_datapath *od, struct hmap *lflows) { > > >>> struct ds action = DS_EMPTY_INITIALIZER; > > >>> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap > > >>> *lflows) { > > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); > > >>> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); > > >>> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", > > "next;"); > > >>> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", > > "next;"); > > >>> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", > > "next;"); > > >>> > > >>> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { > > >>> struct nbrec_qos *qos = od->nbs->qos_rules[i]; > > >>> bool ingress = !strcmp(qos->direction, "from-lport") ? true > > >>> :false; > > >>> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : > > >>> S_SWITCH_OUT_QOS_MARK; > > >>> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); > > >>> int64_t rate = 0; > > >>> int64_t burst = 0; > > >>> > > >>> for (size_t j = 0; j < qos->n_action; j++) { > > >>> if (!strcmp(qos->key_action[j], "dscp")) { > > >>> + if (qos->value_action[j] > QOS_MAX_DSCP) { > > >>> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in > > qos " > > >>> + UUID_FMT, qos->value_action[j], > > >>> + UUID_ARGS(&qos->header_.uuid)); > > >>> + continue; > > >>> + } > > >>> + > > >>> ds_clear(&action); > > >>> ds_put_format(&action, "ip.dscp = %"PRId64"; next;", > > >>> qos->value_action[j]); > > >>> @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap > > >>> *lflows) { > > >>> qos->priority, > > >>> qos->match, ds_cstr(&action), > > >>> &qos->header_); > > >>> + } else if (!strcmp(qos->key_action[j], "mark")) { > > >>> + ds_clear(&action); > > >>> + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", > > >>> + qos->value_action[j]); > > >>> + ovn_lflow_add_with_hint(lflows, od, > > >>> + ingress ? S_SWITCH_IN_QOS_PKT_MARK > > >>> + : S_SWITCH_OUT_QOS_PKT_MARK, > > >>> + qos->priority, qos->match, ds_cstr(&action), > > >>> + &qos->header_); > > >>> } > > >>> } > > >>> > > >>> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml > > >>> index 068d47e1a..c1cd19947 100644 > > >>> --- a/northd/ovn-northd.8.xml > > >>> +++ b/northd/ovn-northd.8.xml > > >>> @@ -1082,7 +1082,28 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 15: Pre-Hairpin</h3> > > >>> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> > > >>> + > > >>> + <p> > > >>> + Logical flows in this table closely reproduce those in the > > >>> + <code>QoS</code> table with the <code>action</code> column set > > in > > >>> + the <code>OVN_Northbound</code> database for the > > >>> + <code>from-lport</code> direction. > > >>> + </p> > > >>> + > > >>> + <ul> > > >>> + <li> > > >>> + For every qos_rules entry in a logical switch with packet > > marking > > >>> + enabled, a flow will be added at the priority mentioned in the > > >>> + QoS table. > > >>> + </li> > > >>> + > > >>> + <li> > > >>> + A priority-0 flow that simply moves traffic to the next table. > > >>> + </li> > > >>> + </ul> > > >>> + > > >>> + <h3>Ingress Table 16: Pre-Hairpin</h3> > > >>> <ul> > > >>> <li> > > >>> If the logical switch has load balancer(s) configured, then a > > >>> @@ -1100,7 +1121,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 16: Nat-Hairpin</h3> > > >>> + <h3>Ingress Table 17: Nat-Hairpin</h3> > > >>> <ul> > > >>> <li> > > >>> If the logical switch has load balancer(s) configured, then a > > >>> @@ -1135,7 +1156,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 17: Hairpin</h3> > > >>> + <h3>Ingress Table 18: Hairpin</h3> > > >>> <ul> > > >>> <li> > > >>> <p> > > >>> @@ -1173,7 +1194,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after > > >>> LB</h3> > > >>> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after > > >>> LB</h3> > > >>> > > >>> <p> > > >>> Logical flows in this table closely reproduce those in the > > >>> @@ -1257,7 +1278,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after > > LB</h3> > > >>> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after > > LB</h3> > > >>> > > >>> <p> > > >>> Logical flows in this table decide how to proceed based on the > > >>> values of > > >>> @@ -1297,7 +1318,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 20: Stateful</h3> > > >>> + <h3>Ingress Table 21: Stateful</h3> > > >>> > > >>> <ul> > > >>> <li> > > >>> @@ -1320,7 +1341,7 @@ > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 21: ARP/ND responder</h3> > > >>> + <h3>Ingress Table 22: ARP/ND responder</h3> > > >>> > > >>> <p> > > >>> This table implements ARP/ND responder in a logical switch for > > known > > >>> @@ -1653,7 +1674,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 22: DHCP option processing</h3> > > >>> + <h3>Ingress Table 23: DHCP option processing</h3> > > >>> > > >>> <p> > > >>> This table adds the DHCPv4 options to a DHCPv4 packet from the > > >>> @@ -1714,7 +1735,7 @@ next; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 23: DHCP responses</h3> > > >>> + <h3>Ingress Table 24: DHCP responses</h3> > > >>> > > >>> <p> > > >>> This table implements DHCP responder for the DHCP replies > > generated > > >>> by > > >>> @@ -1795,7 +1816,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 24 DNS Lookup</h3> > > >>> + <h3>Ingress Table 25 DNS Lookup</h3> > > >>> > > >>> <p> > > >>> This table looks up and resolves the DNS names to the > > corresponding > > >>> @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 25 DNS Responses</h3> > > >>> + <h3>Ingress Table 26 DNS Responses</h3> > > >>> > > >>> <p> > > >>> This table implements DNS responder for the DNS replies > > generated by > > >>> @@ -1859,7 +1880,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress table 26 External ports</h3> > > >>> + <h3>Ingress table 27 External ports</h3> > > >>> > > >>> <p> > > >>> Traffic from the <code>external</code> logical ports enter the > > >>> ingress > > >>> @@ -1902,7 +1923,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 27 Destination Lookup</h3> > > >>> + <h3>Ingress Table 28 Destination Lookup</h3> > > >>> > > >>> <p> > > >>> This table implements switching behavior. It contains these > > logical > > >>> @@ -2078,7 +2099,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Ingress Table 28 Destination unknown</h3> > > >>> + <h3>Ingress Table 29 Destination unknown</h3> > > >>> > > >>> <p> > > >>> This table handles the packets whose destination was not found > > or > > >>> @@ -2312,7 +2333,14 @@ output; > > >>> there are no rules added for load balancing new connections. > > >>> </p> > > >>> > > >>> - <h3>Egress Table 9: Egress Port Security - check</h3> > > >>> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> > > >>> + > > >>> + <p> > > >>> + This is similar to ingress table <code>QoS marking</code> except > > >>> + they apply to <code>to-lport</code> QoS rules. > > >>> + </p> > > >>> + > > >>> + <h3>Egress Table 10: Egress Port Security - check</h3> > > >>> > > >>> <p> > > >>> This is similar to the port security logic in table > > >>> @@ -2341,7 +2369,7 @@ output; > > >>> </li> > > >>> </ul> > > >>> > > >>> - <h3>Egress Table 10: Egress Port Security - Apply</h3> > > >>> + <h3>Egress Table 11: Egress Port Security - Apply</h3> > > >>> > > >>> <p> > > >>> This is similar to the ingress port security logic in ingress > > table > > >>> diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema > > >>> index b2e0993e0..7bb8f36c0 100644 > > >>> --- a/ovn-nb.ovsschema > > >>> +++ b/ovn-nb.ovsschema > > >>> @@ -1,7 +1,7 @@ > > >>> { > > >>> "name": "OVN_Northbound", > > >>> - "version": "7.2.0", > > >>> - "cksum": "1069338687 34162", > > >>> + "version": "7.3.0", > > >>> + "cksum": "2786772995 34106", > > >>> "tables": { > > >>> "NB_Global": { > > >>> "columns": { > > >>> @@ -293,10 +293,9 @@ > > >>> "enum": ["set", > > >>> ["from-lport", "to-lport"]]}}}, > > >>> "match": {"type": "string"}, > > >>> "action": {"type": {"key": {"type": "string", > > >>> - "enum": ["set", > > ["dscp"]]}, > > >>> + "enum": ["set", ["dscp", > > >>> "mark"]]}, > > >>> "value": {"type": "integer", > > >>> - "minInteger": 0, > > >>> - "maxInteger": 63}, > > >>> + "minInteger": 0}, > > >>> "min": 0, "max": "unlimited"}}, > > >>> "bandwidth": {"type": {"key": {"type": "string", > > >>> "enum": ["set", > > ["rate", > > >>> diff --git a/ovn-nb.xml b/ovn-nb.xml > > >>> index 765ffcf2e..5b593f6a7 100644 > > >>> --- a/ovn-nb.xml > > >>> +++ b/ovn-nb.xml > > >>> @@ -2808,12 +2808,22 @@ or > > >>> </column> > > >>> > > >>> <column name="action"> > > >>> - <p>When specified, matching flows will have DSCP marking > > >>> applied.</p> > > >>> + <p> > > >>> + When <code>dscp</code> action is specified, matching flows > > will > > >>> have > > >>> + have DSCP marking applied. > > >>> + When <code>mark</code> action is specified, matching flows > > will > > >>> have > > >>> + packet marking applied. > > >>> + </p> > > >>> + > > >>> <ul> > > >>> <li> > > >>> <code>dscp</code>: The value of this action should be in the > > >>> range of 0 to 63 (inclusive). > > >>> </li> > > >>> + <li> > > >>> + <code>mark</code>: The value of this action should be a > > >>> positive > > >>> + integer. > > >>> + </li> > > >>> </ul> > > >>> </column> > > >>> > > >>> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at > > >>> index b3d536471..5427d2d14 100644 > > >>> --- a/tests/ovn-controller.at > > >>> +++ b/tests/ovn-controller.at > > >>> @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) > > >>> port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) > > >>> check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 > > >>> > > >>> -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | > > grep > > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > > >>> +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | > > grep > > >>> -q "reg15=0x${port},metadata=0x${meta}"]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> AT_CLEANUP > > >>> @@ -918,14 +918,14 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> ]) > > >>> done > > >>> > > >>> @@ -940,15 +940,15 @@ for i in $(seq 10); do > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 9; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - $i)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -966,17 +966,17 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$(($i * 2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$(($i * 2)) > > >>> ]) > > >>> done > > >>> > > >>> @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > > >>> remove address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 > > -- \ > > >>> add address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.10], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.10], > > >>> [0], [1 > > >>> ]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > > >>> remove address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.23], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.23], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1091,24 +1091,24 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 1; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$(($i + 4)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$(($i + 4)) > > >>> ]) > > >>> fi > > >>> > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > > >>> [0], [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1130,17 +1130,17 @@ for i in $(seq 10); do > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> elif test "$i" = 9; then > > >>> # no conjunction left > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((14 - $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((14 - $i)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1156,11 +1156,11 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > > >>> [0], [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1172,7 +1172,7 @@ > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 > > >>> actions=conjun > > >>> priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 > > >>> actions=conjunction,2/2) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$(($i * 2 + 4)) > > >>> ]) > > >>> done > > >>> > > >>> @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > > >>> remove address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 > > -- \ > > >>> add address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.10], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.10], > > >>> [0], [1 > > >>> ]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > > >>> remove address_set as1 addresses 10.0.0.10 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.21], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > > >>> remove address_set as1 addresses 10.0.0.9,10.0.0.8 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.22], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > 10\.0\.0\.23], > > >>> [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > 10\.0\.0\.23], > > >>> [0], [1 > > >>> ]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], > > [1], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], > > [1], > > >>> [ignore]) > > >>> > > >>> reprocess_count_new=$(read_counter consider_logical_flow) > > >>> AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], > > [0], [0 > > >>> @@ -1288,22 +1288,22 @@ for i in $(seq 10); do > > >>> add address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 1; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2 + 1)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2 + 1)) > > >>> ]) > > >>> fi > > >>> > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > > >>> [0], [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > > >>> actions=conjunction,1/2) > > >>> @@ -1327,15 +1327,15 @@ for i in $(seq 10); do > > >>> remove address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> elif test "$i" = 9; then > > >>> # no conjunction left > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((21 - $i*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((21 - $i*2)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> ]) > > >>> done > > >>> > > >>> @@ -1382,16 +1382,16 @@ for i in $(seq 10); do > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 9; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> elif test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> else > > >>> # 2 dst + (10 - i) src + 1 conj_id > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - $i + 3)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - $i + 3)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1445,27 +1445,27 @@ for i in $(seq 10); do > > >>> add address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 1; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2)) > > >>> ]) > > >>> fi > > >>> > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1483,9 +1483,9 @@ for i in $(seq 10); do > > >>> remove address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((20 - $i*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((20 - $i*2)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1541,30 +1541,30 @@ for i in $(seq 10); do > > >>> add address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 1; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> elif test "$i" -lt 6; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2)) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((5 + $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((5 + $i)) > > >>> ]) > > >>> fi > > >>> > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1582,12 +1582,12 @@ for i in $(seq 10); do > > >>> remove address_set as2 addresses 10.0.0.$j > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> elif test "$i" -lt 6; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((15 - $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((15 - $i)) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((10 - ($i - 5)*2)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1639,22 +1639,22 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 1; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2 + 1)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$(($i*2 + 1)) > > >>> ]) > > >>> fi > > >>> > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > > >>> [0], [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1676,15 +1676,15 @@ for i in $(seq 10); do > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 10; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> elif test "$i" = 9; then > > >>> # no conjunction left > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((21 - $i*2)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((21 - $i*2)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -1700,11 +1700,11 @@ for i in $(seq 10); do > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], > > >>> [0], [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1719,7 +1719,7 @@ > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 > > >>> actions=co > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 > > >>> actions=conjunction,2/2) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$(($i * 4 + 1)) > > >>> ]) > > >>> done > > >>> > > >>> @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync > > >>> reprocess_count_old=$(read_counter consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=46,reg15=0x$port_key > > >>> | \ > > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=51,reg15=0x$port_key > > >>> | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > > [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - > > >>> $reprocess_count_old))], [0], [1 > > >>> # Delete 2 IPs > > >>> reprocess_count_old=$(read_counter consider_logical_flow) > > >>> check ovn-nbctl --wait=hv remove address_set as1 addresses > > >>> 10.0.0.4,10.0.0.5 > > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=46,reg15=0x$port_key > > >>> | \ > > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=51,reg15=0x$port_key > > >>> | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.*,/conjunction,/' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > > [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 > > >>> actions=conjunction,1/2) > > >>> priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 > > >>> actions=conjunction,1/2) > > >>> @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 > > 'outport > > >>> == "ls1-lp1" && ip4.src == $as > > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && > > ip4.src > > >>> == $as2 && tcp && tcp.dst == {201, 202}' drop > > >>> > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=46,reg15=0x$port_key > > >>> | \ > > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=51,reg15=0x$port_key > > >>> | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > > [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > > >>> actions=conjunction,1/2) > > >>> @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > > >>> add address_set as2 addresses 10.0.0.24,10.0.0.33 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=46,reg15=0x$port_key > > >>> | \ > > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=51,reg15=0x$port_key > > >>> | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > > [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > > >>> actions=conjunction,1/2) > > >>> @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 > > -- \ > > >>> remove address_set as2 addresses 10.0.0.24,10.0.0.33 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=46,reg15=0x$port_key > > >>> | \ > > >>> +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > table=51,reg15=0x$port_key > > >>> | \ > > >>> grep -v reply | awk '{print $7, $8}' | \ > > >>> sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > > >>> sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], > > [dnl > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,conj_id=,metadata=0x$dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 > > >>> actions=conjunction,1/2) > > >>> > > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 > > >>> actions=conjunction,1/2) > > >>> @@ -1943,14 +1943,14 @@ for i in $(seq 5); do > > >>> check ovn-nbctl add address_set as1 addresses > > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> > > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> > > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> ]) > > >>> done > > >>> > > >>> @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter > > >>> consider_logical_flow) > > >>> for i in $(seq 5); do > > >>> check ovn-nbctl remove address_set as1 addresses > > >>> "aa\:aa\:aa\:aa\:aa\:0$i" > > >>> check ovn-nbctl --wait=hv sync > > >>> - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" > > >>> + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" > > >>> if test "$i" = 4; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > > >>> > > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> > > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> if test "$i" = 5; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((5 - $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((5 - $i)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -2024,14 +2024,14 @@ for i in $(seq 5); do > > >>> check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 3; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [$i > > >>> ]) > > >>> done > > >>> > > >>> @@ -2046,15 +2046,15 @@ for i in $(seq 5); do > > >>> check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" > > >>> check ovn-nbctl --wait=hv sync > > >>> if test "$i" = 4; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=46,reg15=0x$port_key | \ > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int > > >>> table=51,reg15=0x$port_key | \ > > >>> grep -v reply | awk '{print $7, $8}'], [0], [dnl > > >>> -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > > >>> +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > > >>> ]) > > >>> fi > > >>> if test "$i" = 5; then > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep > > >>> "priority=1100"], [1], [ignore]) > > >>> else > > >>> - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | > > grep -c > > >>> "priority=1100"], [0], [$((5 - $i)) > > >>> + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | > > grep -c > > >>> "priority=1100"], [0], [$((5 - $i)) > > >>> ]) > > >>> fi > > >>> done > > >>> @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg > > >>> ovn-nbctl create address_set name=as1 addresses=8.8.8.8 > > >>> check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && > > ip4.src > > >>> == $as1' drop > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100"], [0], [1 > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100"], [0], [1 > > >>> ]) > > >>> > > >>> # pause ovn-northd > > >>> @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause > > >>> # undefined. This test runs the scenario ten times to make sure > > different > > >>> # orders are covered and handled properly. > > >>> > > >>> -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c > > >>> "priority=1100") > > >>> +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c > > >>> "priority=1100") > > >>> for i in $(seq 10); do > > >>> # Delete and recreate the SB address set with same name and an > > extra > > >>> IP. > > >>> addrs_=$(fetch_column address_set addresses name=as1) > > >>> addrs=${addrs_// /,} > > >>> AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set > > >>> name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) > > >>> - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int > > table=46 | > > >>> grep -c "priority=1100") = "$(($i + 1))"]) > > >>> + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int > > table=51 | > > >>> grep -c "priority=1100") = "$(($i + 1))"]) > > >>> done > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> @@ -2698,7 +2698,7 @@ done > > >>> wait_for_ports_up > > >>> ovn-nbctl --wait=hv sync > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | > > grep > > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > > >>> [0],[dnl > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | > > grep > > >>> reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], > > >>> [0],[dnl > > >>> 3 > > >>> ]) > > >>> > > >>> @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do > > >>> done > > >>> ovn-nbctl --wait=hv sync > > >>> > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q > > >>> controller], [1]) > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q > > >>> controller], [1]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> AT_CLEANUP > > >>> diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at > > >>> index 7f37d7716..b11e4ec6b 100644 > > >>> --- a/tests/ovn-nbctl.at > > >>> +++ b/tests/ovn-nbctl.at > > >>> @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp > > >>> dscp=0 rate=300 burst=3000]) > > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) > > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) > > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 > > >>> burst=30000]) > > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) > > >>> +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) > > >>> > > >>> dnl Add duplicated qos > > >>> AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 > > >>> burst=30002], [1], [], [stderr]) > > >>> @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 > > >>> from-lport 400 (tcp) rate=300 burst=3000 dscp=0 > > >>> to-lport 300 (tcp) dscp=48 > > >>> to-lport 200 (ip) rate=101 > > >>> + to-lport 102 (ip4) dscp=16 mark=17 > > >>> + to-lport 101 (ip4) mark=15 > > >>> to-lport 100 (ip4) rate=301 burst=30000 dscp=13 > > >>> ]) > > >>> > > >>> @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip > > >>> dscp=-1], [1], [], > > >>> ]) > > >>> > > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], > > >>> -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and > > >>> "burst=" > > >>> +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", > > "burst=" > > >>> and "mark=" > > >>> ]) > > >>> > > >>> AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], > > >>> -[ovn-nbctl: Either "rate" and/or "dscp" must be specified > > >>> +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified > > >>> ])]) > > >>> > > >>> dnl > > --------------------------------------------------------------------- > > >>> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > > >>> index 67e81ddba..6a27b7dcf 100644 > > >>> --- a/tests/ovn-northd.at > > >>> +++ b/tests/ovn-northd.at > > >>> @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ > > >>> -- ls-lb-add ls lb > > >>> > > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > > >>> action=(next;) > > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > > nd_ra > > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, > > match=(reg0[[17]] == > > >>> 1), action=(reg8[[16]] = 1; next;) > > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > > >>> action=(next;) > > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > > nd_ra > > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, > > match=(reg0[[17]] == > > >>> 1), action=(reg8[[16]] = 1; next;) > > >>> table=3 (ls_out_acl_hint ), priority=0 , match=(1), > > action=(next;) > > >>> table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && > > >>> ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) > > >>> table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && > > >>> ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) > > >>> @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls > > >>> ovn-nbctl --wait=sb clear logical_switch ls load_balancer > > >>> > > >>> AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e > > >>> ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e > > >>> ls_in_acl_after_lb_eval | sort], [0], [dnl > > >>> - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), > > >>> action=(next;) > > >>> - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > > nd_ra > > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), > > >>> action=(next;) > > >>> + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || > > nd_ra > > >>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> table=3 (ls_out_acl_hint ), priority=65535, match=(1), > > action=(next;) > > >>> table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> table=4 (ls_out_acl_eval ), priority=65535, match=(1), > > action=(next;) > > >>> @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > > !ct.est), > > >>> action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > > && > > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > > >>> @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || > > >>> nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > > >>> @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > > !ct.est), > > >>> action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > > && > > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > > >>> @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > > >>> action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > > >>> action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), > > >>> action=(reg8[[16]] = 1; next;) > > >>> table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == > > >>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > > >>> @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E > > "ls_.*_acl" > > >>> | sed 's/table=../table=??/ > > >>> table=??(ls_out_acl_action ), priority=0 , match=(1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > > >>> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> table=??(ls_out_acl_eval ), priority=0 , match=(1), > > action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && > > !ct.est), > > >>> action=(next;) > > >>> table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est > > && > > >>> ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > > >>> @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > > == > > >>> 1), action=(drop;) > > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > > >>> action=(outport = get_fdb(eth.dst); next;) > > >>> @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > > >>> action=(outport = "_MC_flood"; output;) > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 > > >>> "00:00:00:00:00:01" > > >>> @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > > == > > >>> 1), action=(drop;) > > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > > >>> action=(outport = get_fdb(eth.dst); next;) > > >>> @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > > >>> action=(outport = "_MC_flood"; output;) > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 > > 10.0.0.3 > > >>> 1000::3" > > >>> @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > > == > > >>> 1), action=(drop;) > > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > > >>> action=(outport = get_fdb(eth.dst); next;) > > >>> @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > > >>> action=(outport = "_MC_flood"; output;) > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> # Disable sw0p1 > > >>> @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > > == > > >>> 1), action=(drop;) > > >>> table=??(ls_in_l2_lkup ), priority=0 , match=(1), > > >>> action=(outport = get_fdb(eth.dst); next;) > > >>> @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "sw0p1"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 > > >>> @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > > next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > > >>> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] > > == > > >>> 1), action=(drop;) > > >>> @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "sw0p1"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> check ovn-nbctl set logical_switch_port sw0p1 enabled=true > > >>> @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && > > >>> icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && > > >>> icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) > > >>> table=??(ls_in_check_port_sec), priority=50 , match=(1), > > >>> action=(reg0[[15]] = check_in_port_sec(); next;) > > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > > >>> "localnetport"), action=(set_queue(10); reg0[[15]] = > > check_in_port_sec(); > > >>> next;) > > >>> - table=??(ls_in_check_port_sec), priority=70 , match=(inport == > > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) > > >>> + table=??(ls_in_check_port_sec), priority=70 , match=(inport == > > >>> "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) > > >>> table=??(ls_in_check_port_sec), priority=70 , match=(inport == > > >>> "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); > > next;) > > >>> table=??(ls_in_apply_port_sec), priority=0 , match=(1), > > >>> action=(next;) > > >>> table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == > > >>> 1), action=(drop;) > > >>> + table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> table=??(ls_out_apply_port_sec), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_out_apply_port_sec), priority=100 , match=(outport == > > >>> "localnetport"), action=(set_queue(10); output;) > > >>> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == > > >>> "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > > >>> @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > > >>> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), > > >>> action=(outport = "_MC_flood"; output;) > > >>> table=??(ls_in_l2_unknown ), priority=0 , match=(1), > > >>> action=(output;) > > >>> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == > > >>> "none"), action=(drop;) > > >>> - table=??(ls_out_check_port_sec), priority=0 , match=(1), > > >>> action=(reg0[[15]] = check_out_port_sec(); next;) > > >>> - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), > > >>> action=(reg0[[15]] = 0; next;) > > >>> ]) > > >>> > > >>> AT_CLEANUP > > >>> @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options > > >>> logical_port=public |grep -q 'qos > > >>> AT_CLEANUP > > >>> ]) > > >>> > > >>> +OVN_FOR_EACH_NORTHD_NO_HV([ > > >>> +AT_SETUP([check OVN QoS mark/meter logical flows]) > > >>> +AT_KEYWORDS([OVN-QoS]) > > >>> +ovn_start > > >>> + > > >>> +check ovn-nbctl ls-add ls > > >>> +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > > >>> +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > > >>> +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > > >>> +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > > >>> + > > >>> +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > > >>> +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > > >>> +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > > >>> +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > > >>> +check ovn-nbctl --wait=sb sync > > >>> + > > >>> +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl > > >>> + table=10(ls_in_qos_mark ), priority=0 , match=(1), > > action=(next;) > > >>> + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), > > >>> action=(ip.dscp = 16; next;) > > >>> + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), > > >>> action=(ip.dscp = 17; next;) > > >>> + table=11(ls_in_qos_meter ), priority=0 , match=(1), > > action=(next;) > > >>> + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), > > >>> action=(set_meter(100, 1000); next;) > > >>> + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), > > action=(next;) > > >>> + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), > > >>> action=(pkt.mark = 15; next;) > > >>> + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), > > >>> action=(pkt.mark = 18; next;) > > >>> + table=6 (ls_out_qos_mark ), priority=0 , match=(1), > > action=(next;) > > >>> + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), > > >>> action=(ip.dscp = 16; next;) > > >>> + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), > > >>> action=(ip.dscp = 17; next;) > > >>> + table=7 (ls_out_qos_meter ), priority=0 , match=(1), > > action=(next;) > > >>> + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), > > >>> action=(set_meter(100, 1000); next;) > > >>> + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), > > action=(next;) > > >>> + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), > > >>> action=(pkt.mark = 15; next;) > > >>> + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), > > >>> action=(pkt.mark = 18; next;) > > >>> +]) > > >>> + > > >>> +AT_CLEANUP > > >>> +]) > > >>> + > > >>> AT_SETUP([Tiered ACL logical flows]) > > >>> AT_KEYWORDS([acl]) > > >>> > > >>> @@ -9978,10 +10017,10 @@ acl_test() { > > >>> } > > >>> > > >>> acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > > >>> -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > > >>> ls_in_acl_after_lb_action 18 > > >>> +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval > > >>> ls_in_acl_after_lb_action 19 > > >>> acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > > >>> acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > > >>> -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > > >>> ls_in_acl_after_lb_action 18 > > >>> +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval > > >>> ls_in_acl_after_lb_action 19 > > >>> acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > > >>> > > >>> AT_CLEANUP > > >>> diff --git a/tests/ovn.at b/tests/ovn.at > > >>> index 28c6b6c34..9b158e79c 100644 > > >>> --- a/tests/ovn.at > > >>> +++ b/tests/ovn.at > > >>> @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > > >>> > > >>> next(pipeline=egress); > > >>> formats as next(pipeline=egress, table=11); > > >>> - encodes as resubmit(,53) > > >>> + encodes as resubmit(,58) > > >>> > > >>> next(pipeline=egress, table=5); > > >>> - encodes as resubmit(,47) > > >>> + encodes as resubmit(,52) > > >>> > > >>> next(table=10); > > >>> formats as next(10); > > >>> @@ -9719,18 +9719,18 @@ as hv1 > > >>> AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface > > localvif1 > > >>> external_ids:iface-id=localvif1]) > > >>> > > >>> # On hv1, check that there are no flows outputting bcast to tunnel > > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> > > >>> # On hv2, check that no flow outputs bcast to tunnel to hv1. > > >>> as hv2 > > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> > > >>> # Now bind vif2 on hv2. > > >>> AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface > > localvif2 > > >>> external_ids:iface-id=localvif2]) > > >>> > > >>> # At this point, the broadcast flow on vif2 should be deleted. > > >>> -# because, there is now a localnet vif bound (table=37 programming > > logic) > > >>> -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> +# because, there is now a localnet vif bound (table=42 programming > > logic) > > >>> +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | > > ofctl_strip > > >>> | grep output | wc -l` -eq 0]) > > >>> > > >>> # Verify that the local net patch port exists on hv2. > > >>> OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port > > >>> patch-br-int-to-ln_port" | wc -l` -eq 1]) > > >>> @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare > > --columns > > >>> ofport find Interface name=ov > > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find > > Interface > > >>> name=ovn-gw2-0) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > >>> ]) > > >>> > > >>> test_ip_packet() > > >>> @@ -11631,7 +11631,7 @@ AT_CHECK( > > >>> ]) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > >>> ]) > > >>> > > >>> test_ip_packet gw2 gw1 0 > > >>> @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare > > --columns > > >>> ofport find Interface name=ov > > >>> hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find > > Interface > > >>> name=ovn-gw2-0) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > >>> ]) > > >>> > > >>> test_ip_packet() > > >>> @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > > >>> ]) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > >>> + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c > > >>> "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > >>> ]) > > >>> > > >>> test_ip_packet gw2 gw1 > > >>> @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > > >>> > > >>> AT_CHECK( > > >>> [# Check that redirect mapping is programmed only on hv2 > > >>> - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > > >>> - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | > > wc > > >>> -l > > >>> + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > > >>> + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | > > wc > > >>> -l > > >>> > > >>> # Check that hv1 sends chassisredirect port traffic to hv2 > > >>> - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc > > -l > > >>> - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > > >>> + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc > > -l > > >>> + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > > >>> > > >>> # Check that arp reply on distributed gateway port is only > > programmed > > >>> on hv2 > > >>> grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > > >>> @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int > > >>> in_port=hv1-vif1 $packet > > >>> sleep 2 > > >>> > > >>> AS_BOX([On hv1, table 40 check that no packet goes via the tunnel > > port]) > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > > >>> | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > > >>> echo $hv2_gw2_ofport > > >>> > > >>> echo "--- hv1 ---" > > >>> -as hv1 ovs-ofctl dump-flows br-int table=39 > > >>> +as hv1 ovs-ofctl dump-flows br-int table=44 > > >>> > > >>> echo "--- hv2 ---" > > >>> -as hv2 ovs-ofctl dump-flows br-int table=39 > > >>> +as hv2 ovs-ofctl dump-flows br-int table=44 > > >>> > > >>> gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > > >>> gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> @@ -13566,15 +13566,15 @@ sleep 10 > > >>> > > >>> as gw1 ovs-ofctl dump-flows br-int > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> # make sure ARP responder flows for outside router port reside on gw1 > > too > > >>> through ls_in_arp_rsp table > > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > > >>> > > >>> # check that the chassis redirect port has been claimed by the gw1 > > chassis > > >>> @@ -13598,12 +13598,12 @@ wait_for_ports_up > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # we make sure that the hypervisors noticed, and inverted the slave > > ports > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > > >>> Interface name=ovn-hv1-0],[0], > > >>> ]]) > > >>> > > >>> # make sure that flows for handling the outside router port reside on > > gw2 > > >>> now > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > > >>> bfd_dump > > >>> > > >>> # make sure that flows for handling the outside router port reside on > > gw1 > > >>> now > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside > > >>> ha_chassis_group=$hagrp1_uuid > > >>> wait_row_count HA_Chassis_Group 1 > > >>> wait_row_count HA_Chassis 2 > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > >>> | wc -l], [0], [0 > > >>> ]) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > >>> | wc -l], [0], [0 > > >>> ]) > > >>> @@ -13777,26 +13777,26 @@ done > > >>> # Re-add gw2 > > >>> as gw2 ovn_attach n1 br-phys 192.168.0.1 > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> > > >>> # make sure that flows for handling the outside router port reside on > > gw1 > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> # make sure ARP responder flows for outside router port reside on gw1 > > too > > >>> -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > > >>> +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > > >>> grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > > >>> > > >>> # check that the chassis redirect port has been claimed by the gw1 > > chassis > > >>> @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" > > HA_Chassis_Group > > >>> ref_chassis > > >>> # Increase the priority of gw2 > > >>> ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> > > >>> -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > >>> grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > > >>> | wc -l], [0], [1 > > >>> ]) > > >>> @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find > > >>> Interface name=ovn-hv1-0],[0], > > >>> ]]) > > >>> > > >>> # make sure that flows for handling the outside router port reside on > > gw2 > > >>> now > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > > >>> bfd_dump > > >>> > > >>> # make sure that flows for handling the outside router port reside on > > gw2 > > >>> now > > >>> -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > >>> ]]) > > >>> -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > >>> +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > > >>> AT_CAPTURE_FILE([sw0-flows]) > > >>> > > >>> AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed > > >>> 's/table=../table=??/' | sort], [0], [dnl > > >>> - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=27); };) > > >>> + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == > > 1), > > >>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; > > reject { > > >>> /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> > > >>> inport; next(pipeline=ingress,table=28); };) > > >>> ]) > > >>> > > >>> > > >>> @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst > > >>> $ipv6_src $ipv6_dst > > >>> # Get total number of ipv4 packets that received on ovs > > >>> > > >>> # sender side > > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 > > | > > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 > > | > > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > >>> > > >>> # receiver side > > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 > > | > > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 > > | > > >>> grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > >>> > > >>> # Get total number of ipv6 packets that received on ovs > > >>> > > >>> # sender side > > >>> -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 > > | > > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > >>> +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 > > | > > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > >>> > > >>> # receiver side > > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 > > | > > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 > > | > > >>> grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > >>> > > >>> OVN_CLEANUP([hv1], [hv2]) > > >>> AT_CLEANUP > > >>> @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > > >>> 'ip4.src==10.0.0.1' allow > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Check OVS flows, the less restrictive flows should have been > > installed. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> grep "priority=1003" | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> ]) > > >>> > > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > > >>> @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > > >>> 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Check OVS flows, the second less restrictive allow ACL should have > > been > > >>> installed. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> \ > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> \ > > >>> grep "priority=1003" | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> ]) > > >>> > > >>> # Remove the less restrictive allow ACL. > > >>> @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 > > >>> 'ip4.src==10.0.0.1' > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Check OVS flows, the 10.0.0.1 conjunction should have been > > reinstalled. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> \ > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> \ > > >>> grep "priority=1003" | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> ]) > > >>> > > >>> # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > > >>> @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 > > >>> 'ip4.src==10.0.0.1' allow > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Check OVS flows, the less restrictive flows should have been > > installed. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> \ > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> \ > > >>> grep "priority=1003" | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> ]) > > >>> > > >>> # Add another ACL that overlaps with the existing less restrictive > > ones. > > >>> @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > > >>> # with an additional conjunction action. > > >>> # > > >>> # New non-conjunctive flows should be added to match on 'udp'. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> \ > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> \ > > >>> grep "priority=1003" | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction(),conjunction() > > >>> - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> - table=46, priority=1003,udp,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> - table=46, priority=1003,udp6,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 > > >>> actions=conjunction(),conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 > > >>> actions=conjunction(),conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 > > >>> actions=conjunction(),conjunction() > > >>> + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 > > >>> actions=conjunction() > > >>> + table=51, priority=1003,udp,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> + table=51, priority=1003,udp6,metadata=0x1 > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> ]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 > > >>> 'outport == @pg1 && ip4.src == $as2' al > > >>> > > >>> wait_for_ports_up > > >>> check ovn-nbctl --wait=hv sync > > >>> -ovs-ofctl dump-flows br-int table=46 > > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c > > conj_id` = > > >>> 2]) > > >>> +ovs-ofctl dump-flows br-int table=51 > > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c > > conj_id` = > > >>> 2]) > > >>> > > >>> echo ------- > > >>> # Add another address in as1, so that the 1st ACL will now generate 2 > > >>> conjunctions. > > >>> ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> -ovs-ofctl dump-flows br-int table=46 > > >>> +ovs-ofctl dump-flows br-int table=51 > > >>> # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd > > >>> ACL) > > >>> -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c > > conj_id` = > > >>> 3]) > > >>> +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c > > conj_id` = > > >>> 3]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> AT_CLEANUP > > >>> @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > > >>> # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 > > destined > > >>> # to router mac. > > >>> AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > > >>> -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > > >>> +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > > >>> grep -c "actions=drop"], [0], [1 > > >>> ]) > > >>> # Stop ovn-controllers on hv1 and hv3. > > >>> @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy > > $policy > > >>> options:pkt_mark=100 > > >>> check ovn-nbctl --wait=hv sync > > >>> as hv2 > > >>> # add a flow in egress pipeline to check pkt marking > > >>> -ovs-ofctl --protocols=OpenFlow13 add-flow br-int > > >>> "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > > >>> actions=resubmit(,38)" > > >>> +ovs-ofctl --protocols=OpenFlow13 add-flow br-int > > >>> "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 > > >>> actions=resubmit(,43)" > > >>> > > >>> dst_ip=$(ip_to_hex 172 16 2 10) > > >>> fip_ip=$(ip_to_hex 172 16 1 2) > > >>> @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip > > >>> $gw_router_ip) >> expected > > >>> send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > > >>> echo > > >>> > > "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" > > >>>>> expected > > >>> > > >>> -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 > > | > > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > > >>> +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 > > | > > >>> grep pkt_mark=0x64 | grep -c n_packets=1`]) > > >>> > > >>> OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > > >>> > > >>> @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > > >>> lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding > > tunnel_key > > >>> external_ids:name=lr0)) > > >>> lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding > > >>> tunnel_key logical_port=lr0-public)) > > >>> > > >>> - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip > > | > > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > > >>> - table=46, priority=2000,ip,metadata=0x$sw0_dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > >>> + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip > > | > > >>> ofctl_strip_all | grep "priority=2000"], [0], [dnl > > >>> + table=51, priority=2000,ip,metadata=0x$sw0_dp_key > > >>> actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > >>> ]) > > >>> > > >>> AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | > > >>> ofctl_strip_all | \ > > >>> grep "priority=92" | grep 172.168.0.50], [0], [dnl > > >>> - table=11, > > >>> > > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > > >>> > > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > > >>> + table=11, > > >>> > > priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 > > >>> > > actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > > >>> ]) > > >>> } > > >>> > > >>> check_virtual_offlows_not_present() { > > >>> hv=$1 > > >>> - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | > > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > > >>> + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | > > >>> ofctl_strip_all | grep "priority=2000"], [1], [dnl > > >>> ]) > > >>> > > >>> AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | > > >>> ofctl_strip_all | \ > > >>> @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 > > >>> logical_port=sw0-vir virtual_parent=sw0-p1 > > >>> wait_for_ports_up sw0-vir > > >>> check ovn-nbctl --wait=hv sync > > >>> AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl > > received > > >>> packet-in" | \ > > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > >>> > > >>> wait_row_count Port_Binding 1 logical_port=sw0-vir6 > > chassis=$hv1_ch_uuid > > >>> check_row_count Port_Binding 1 logical_port=sw0-vir6 > > virtual_parent=sw0-p1 > > >>> @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > > >>> OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], > > >>> [vif-north.expected]) > > >>> > > >>> # Confirm that packets did not go out via tunnel port. > > >>> - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep > > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > > >>> + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep > > >>> NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > > >>> ]]) > > >>> > > >>> # Confirm that packet went out via localnet port > > >>> @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > > >>> AT_CHECK([test ! -z $p2_zoneid]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc > > -l) > > >>> -eq 1]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw1_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw1_dpkey},\ > > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw1_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw1_dpkey},\ > > >>> reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc > > -l) > > >>> -eq 1]) > > >>> > > >>> ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > >>> > > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > >>> @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up > > >>> sw0-p1) = xup]) > > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > >>> AT_CHECK([test ! -z $p1_zoneid]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc > > -l) > > >>> -eq 1]) > > >>> > > >>> ovs-vsctl del-port hv1-vif2 > > >>> OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > > >>> > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > > >>> > > >>> p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int > > >>> external_ids:ct-zone-sw0-p2 | sed 's/"//g') > > >>> @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > > >>> > > >>> ovn-nbctl lsp-del sw0-p1 > > >>> > > >>> -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > > >>> table=40,metadata=${sw0_dpkey},\ > > >>> +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int > > >>> table=45,metadata=${sw0_dpkey},\ > > >>> reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > >>> > > >>> p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int > > >>> external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > >>> @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat > > hv1/ovn-controller.pid)]) > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Check OVS flows are installed properly. > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | > > ofctl_strip_all | > > >>> \ > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | > > ofctl_strip_all | > > >>> \ > > >>> grep "priority=2002" | grep conjunction | \ > > >>> sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > >>> sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> - table=46, > > >>> > > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> + table=51, > > >>> > > priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 > > >>> actions=conjunction() > > >>> ]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set > > interface > > >>> lsp0-0 external_ids:iface-id=l > > >>> ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 > > >>> external_ids:iface-id=lsp0-1 > > >>> > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 22]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 22]) > > >>> > > >>> # Save the current lflow_run counter > > >>> lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter > > lflow_run) > > >>> @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller > > >>> coverage/read-counter lflow_run) > > >>> # 1. Remove half of the ports from pg1. The excepted conjunction flows > > >>> should be: > > >>> # 2 + 10 = 12 > > >>> check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do > > for j > > >>> in 0 1; do echo lsp${i}-${j}; done; done) > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> > > >>> # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows > > because > > >>> the > > >>> # port group const set should have only one member (lsp0-1). And > > the > > >>> total > > >>> @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int > > >>> table=46 | grep conjunction | wc -l > > >>> # 10. > > >>> ovs-vsctl del-port br-int lsp0-0 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 0]) > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 > > | wc > > >>> -l) == 10]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 0]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 > > | wc > > >>> -l) == 10]) > > >>> > > >>> # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > > >>> ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 > > >>> external_ids:iface-id=lsp0-0 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> > > >>> # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see > > any > > >>> change. > > >>> ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 > > >>> external_ids:iface-id=lsp9-0 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 12]) > > >>> > > >>> # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a > > >>> different > > >>> # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > > >>> ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 > > >>> external_ids:iface-id=lsp1-0 > > >>> ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 > > >>> external_ids:iface-id=lsp1-1 > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > conjunction > > >>> | wc -l) == 24]) > > >>> +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > conjunction > > >>> | wc -l) == 24]) > > >>> > > >>> # 6. Simulate a SB port-group "del and add" notification to > > >>> ovn-controller in the > > >>> # same IDL iteration. ovn-controller should still program the same > > >>> flows. In > > >>> @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # Finally check flow count is the same as before. > > >>> - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep > > >>> conjunction | wc -l) == 24]) > > >>> + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep > > >>> conjunction | wc -l) == 24]) > > >>> done > > >>> > > >>> # Make sure all the above was performed with I-P (no recompute) > > >>> @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > > >>> 'outport == "lp2" && ip4.src == 10.0. > > >>> > > >>> # The first ACL should be programmed, but the second one shouldn't. > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], > > [0], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], > > [0], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > > [1], > > >>> [ignore]) > > >>> > > >>> # Now create the lport lp2. > > >>> check ovn-nbctl lsp-add lsw0 lp2 \ > > >>> @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > > >>> > > >>> check ovn-nbctl --wait=hv sync > > >>> # Now the second ACL should be programmed. > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > > [0], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > > [0], > > >>> [ignore]) > > >>> > > >>> # Remove the lport lp2 again, the OVS flow for the second ACL should > > be > > >>> # removed. > > >>> check ovn-nbctl --wait=hv lsp-del lp2 > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], > > [1], > > >>> [ignore]) > > >>> > > >>> # Test similar scenario but when the referenced lport is not bound > > >>> locally. > > >>> > > >>> @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 > > 'inport > > >>> == "lp4" && ip4.dst == 10.0.0 > > >>> > > >>> # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], > > [0], > > >>> [ignore]) > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], > > [1], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], > > [0], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], > > [1], > > >>> [ignore]) > > >>> > > >>> # Now create the lport lp4. > > >>> check ovn-nbctl lsp-add lsw0 lp4 \ > > >>> @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > > >>> > > >>> # Now the ACL for lp4 should be programmed. > > >>> check ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], > > [0], > > >>> [ignore]) > > >>> +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], > > [0], > > >>> [ignore]) > > >>> > > >>> OVN_CLEANUP([hv1]) > > >>> AT_CLEANUP > > >>> @@ -33493,15 +33493,15 @@ done > > >>> check ovn-nbctl --wait=hv sync > > >>> > > >>> # hv0 should see flows for lsp1 but not lsp2 > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.2.2], > > >>> [1]) > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.2.2], > > >>> [1]) > > >>> # hv2 should see flows for lsp2 but not lsp1 > > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.2.2], > > >>> [0], [ignore]) > > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.1.2], > > >>> [1]) > > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.2.2], > > >>> [0], [ignore]) > > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.1.2], > > >>> [1]) > > >>> > > >>> # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > > >>> check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> > > >>> # Change it back, and trigger recompute to make sure extra flows are > > >>> removed > > >>> # from hv2 (recompute is needed because currently I-P adds local > > >>> datapaths but > > >>> @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int > > >>> table=29 | grep 10.0.1.2], [0], [ig > > >>> check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > > >>> as hv2 check ovn-appctl -t ovn-controller recompute > > >>> ovn-nbctl --wait=hv sync > > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.1.2], > > >>> [1]) > > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.1.2], > > >>> [1]) > > >>> > > >>> # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > > >>> AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr > > >>> dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > > >>> -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep > > 10.0.1.2], > > >>> [0], [ignore]) > > >>> > > >>> OVN_CLEANUP([hv1],[hv2]) > > >>> AT_CLEANUP > > >>> @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > > >>> # Use constants so that if tables or registers change, this test can > > >>> # be updated easily. > > >>> DNAT_TABLE=15 > > >>> -SNAT_TABLE=45 > > >>> +SNAT_TABLE=50 > > >>> DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > > >>> SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > > >>> > > >>> @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > > >>> wait_for_ports_up > > >>> OVN_POPULATE_ARP > > >>> > > >>> -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c > > >>> controller], [0],[dnl > > >>> +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c > > >>> controller], [0],[dnl > > >>> 9 > > >>> ]) > > >>> > > >>> @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > > >>> send_garp 1 1 $eth_src $eth_dst $spa $tpa > > >>> > > >>> OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl > > >>> received packet-in" | \ > > >>> -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > > >>> +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > >>> > > >>> sleep_controller hv1 > > >>> > > >>> @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1: > > $TCP_PORT > > >>> \ > > >>> > > >>> OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > > >>> AT_CLEANUP > > >>> + > > >>> +OVN_FOR_EACH_NORTHD([ > > >>> +AT_SETUP([QoS packet marking]) > > >>> +AT_KEYWORDS([ovn-qos-pkt-marking]) > > >>> +AT_SKIP_IF([test $HAVE_SCAPY = no]) > > >>> +ovn_start > > >>> + > > >>> +check ovn-nbctl lr-add lr0 > > >>> +check ovn-nbctl ls-add ls0 > > >>> +check ovn-nbctl ls-add ls1 > > >>> + > > >>> +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > > >>> +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > > >>> + set Logical_Switch_Port lrp-s0 type=router \ > > >>> + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > > >>> +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > > >>> +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > > >>> + set Logical_Switch_Port lrp-s1 type=router \ > > >>> + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > > >>> + > > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > > >>> +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > > >>> +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > > >>> +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > > >>> + > > >>> +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > > >>> +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > > >>> +check ovn-nbctl --wait=sb sync > > >>> + > > >>> +net_add n1 > > >>> +sim_add hv > > >>> + > > >>> +as hv > > >>> +check ovs-vsctl add-br br-phys > > >>> +ovn_attach n1 br-phys 192.168.0.1 > > >>> + > > >>> +check ovs-vsctl add-port br-int vif0 -- \ > > >>> + set Interface vif0 external-ids:iface-id=lp0 \ > > >>> + options:tx_pcap=hv/vif0-tx.pcap \ > > >>> + options:rxq_pcap=hv/vif0-rx.pcap \ > > >>> + ofport-request=1 > > >>> +check ovs-vsctl add-port br-int vif1 -- \ > > >>> + set Interface vif1 external-ids:iface-id=lp1 \ > > >>> + options:tx_pcap=hv/vif1-tx.pcap \ > > >>> + options:rxq_pcap=hv/vif1-rx.pcap \ > > >>> + ofport-request=2 > > >>> +check ovs-vsctl add-port br-int vif2 -- \ > > >>> + set Interface vif2 external-ids:iface-id=lp2 \ > > >>> + options:tx_pcap=hv/vif2-tx.pcap \ > > >>> + options:rxq_pcap=hv/vif2-rx.pcap \ > > >>> + ofport-request=3 > > >>> + > > >>> +# Create QoS rules for packet marking. > > >>> +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" > > >>> mark=48 > > >>> +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" > > >>> mark=49 > > >>> +check_row_count nb:QoS 2 > > >>> + > > >>> +# Create some flows to count pkt marking. > > >>> +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && > > pkt.mark > > >>> == 48" drop > > >>> +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > > >>> +wait_for_ports_up > > >>> +check ovn-nbctl --wait=hv sync > > >>> + > > >>> +send_udp_packet() { > > >>> + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > > >>> + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', > > src='${eth_src}')/ \ > > >>> + IP(src='${ipv4_src}', dst='${ipv4_dst}', > > >>> ttl=0x40)/ \ > > >>> + UDP(sport=4242, dport=4343)") > > >>> + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > > >>> +} > > >>> + > > >>> +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > > >>> external_ids:name=ls0)) > > >>> +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key > > >>> external_ids:name=lr0)) > > >>> + > > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 > > 10.0.0.2 > > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > > >>> "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > > >>> + > > >>> +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 > > 10.0.0.10 > > >>> +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E > > >>> "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > > >>> + > > >>> +OVN_CLEANUP([hv]) > > >>> +AT_CLEANUP > > >>> +]) > > >>> diff --git a/tests/system-ovn.at b/tests/system-ovn.at > > >>> index cb4124b70..1277f1057 100644 > > >>> --- a/tests/system-ovn.at > > >>> +++ b/tests/system-ovn.at > > >>> @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > >>> > > >>> ovn-nbctl list load_balancer > > >>> ovn-sbctl dump-flows R2 > > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > > >>> grep 'nat(src=20.0.0.2)']) > > >>> > > >>> check ovs-appctl dpctl/flush-conntrack > > >>> @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > > >>> 30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > >>> > > >>> ovn-nbctl list load_balancer > > >>> ovn-sbctl dump-flows R2 > > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > > >>> grep 'nat(src=20.0.0.2)']) > > >>> > > >>> rm -f wget*.log > > >>> @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > > >>> ]) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v > > n_packets=0 | \ > > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v > > n_packets=0 | \ > > >>> grep controller | grep tp_dst=84 -c) > > >>> test $n_pkt -eq 1 > > >>> ]) > > >>> @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > > >>> ]) > > >>> > > >>> OVS_WAIT_UNTIL([ > > >>> - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v > > n_packets=0 | \ > > >>> + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v > > n_packets=0 | \ > > >>> grep controller | grep tp_dst=84 -c) > > >>> test $n_pkt -eq 1 > > >>> ]) > > >>> @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > > >>> > > >>> wait_igmp_flows_installed() > > >>> { > > >>> - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > > >>> + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > > >>> grep 'priority=90' | grep "nw_dst=$1"]) > > >>> } > > >>> > > >>> @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'" > > >>> 30.0.0.2:8000"'='"192.168.1.2:12345,192 > > >>> > > >>> ovn-nbctl list load_balancer > > >>> ovn-sbctl dump-flows R2 > > >>> -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | > > grep > > >>> 'nat(src=20.0.0.2)']) > > >>> +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | > > grep > > >>> 'nat(src=20.0.0.2)']) > > >>> > > >>> dnl Test load-balancing that includes L4 ports in NAT. > > >>> for i in `seq 1 20`; do > > >>> diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > > >>> index 6f74bd557..f838393a6 100644 > > >>> --- a/utilities/ovn-nbctl.8.xml > > >>> +++ b/utilities/ovn-nbctl.8.xml > > >>> @@ -482,6 +482,9 @@ > > >>> <code>burst=</code><var>burst</var> specifies the burst rate > > >>> limit in kilobits. <code>dscp</code> and/or > > <code>rate</code> > > >>> are required arguments. > > >>> + If <code>mark=</code><var>mark</var> is specified, then > > matching > > >>> + packets will be marked (through <code>pkt.mark</code>). > > >>> + <var>mark</var> must be a positive integer. > > >>> </p> > > >>> > > >>> <p> > > >>> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > > >>> index 526369b68..0620d333a 100644 > > >>> --- a/utilities/ovn-nbctl.c > > >>> +++ b/utilities/ovn-nbctl.c > > >>> @@ -283,7 +283,7 @@ ACL commands:\n\ > > >>> print ACLs for SWITCH\n\ > > >>> \n\ > > >>> QoS commands:\n\ > > >>> - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > > >>> [dscp=DSCP]\n\ > > >>> + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] > > >>> [dscp=DSCP] [mark=MARK]\n\ > > >>> add an QoS rule to SWITCH\n\ > > >>> qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > > >>> remove QoS rules from SWITCH\n\ > > >>> @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > > >>> if (!strcmp(qos_rule->key_action[j], "dscp")) { > > >>> ds_put_format(&ctx->output, " dscp=%"PRId64"", > > >>> qos_rule->value_action[j]); > > >>> + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > > >>> + ds_put_format(&ctx->output, " mark=%"PRId64"", > > >>> + qos_rule->value_action[j]); > > >>> } > > >>> } > > >>> ds_put_cstr(&ctx->output, "\n"); > > >>> @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > > >>> ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > > >>> + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > > >>> } > > >>> > > >>> static void > > >>> @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > > >>> const char *direction; > > >>> int64_t priority; > > >>> int64_t dscp = -1; > > >>> + int64_t mark = 0; > > >>> int64_t rate = 0; > > >>> int64_t burst = 0; > > >>> char *error; > > >>> @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > > >>> return; > > >>> } > > >>> } > > >>> + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > > >>> + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark > > < > > >>> 0) { > > >>> + ctl_error(ctx, "%s: mark must be a positive integer", > > >>> + ctx->argv[i] + 5); > > >>> + return; > > >>> + } > > >>> + } > > >>> else if (!strncmp(ctx->argv[i], "rate=", 5)) { > > >>> if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > > >>> || rate < 1 || rate > UINT32_MAX) { > > >>> @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > > >>> } > > >>> } else { > > >>> ctl_error(ctx, "%s: supported arguments are \"dscp=\", > > >>> \"rate=\", " > > >>> - "and \"burst=\"", ctx->argv[i]); > > >>> + "\"burst=\" and \"mark=\"", ctx->argv[i]); > > >>> return; > > >>> } > > >>> } > > >>> > > >>> /* Validate rate and dscp. */ > > >>> - if (-1 == dscp && !rate) { > > >>> - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be > > >>> specified"); > > >>> + if (-1 == dscp && !rate && !mark) { > > >>> + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" > > must be > > >>> " > > >>> + "specified"); > > >>> return; > > >>> } > > >>> > > >>> @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > > >>> nbrec_qos_set_priority(qos, priority); > > >>> nbrec_qos_set_direction(qos, direction); > > >>> nbrec_qos_set_match(qos, ctx->argv[4]); > > >>> + if (mark) { > > >>> + nbrec_qos_update_action_setkey(qos, "mark", mark); > > >>> + } > > >>> if (-1 != dscp) { > > >>> - const char *dscp_key = "dscp"; > > >>> - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > > >>> + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > > >>> } > > >>> if (rate) { > > >>> const char *bandwidth_key[2] = {"rate", "burst"}; > > >>> -- > > >>> 2.43.0 > > >>> > > >>> _______________________________________________ > > >>> dev mailing list > > >>> dev@openvswitch.org > > >>> https://mail.openvswitch.org/mailman/listinfo/ovs-dev > > >>> > > >>> > > >> Thanks, > > >> Ales > > >> > > > > > > Thanks, > > > Dumitru > > > > > > > > > > > Thanks, > Ales > > -- > > Ales Musil > > Senior Software Engineer - OVN Core > > Red Hat EMEA <https://www.redhat.com> > > amusil@redhat.com > <https://red.ht/sig>
Hi Lorenzo, I have just a few small comments below. On 1/30/24 09:53, Lorenzo Bianconi wrote: > Add the capbility to mark (through pkt.mark) incoming/outgoing packets > in logical_switch datapath according to user configured QoS rule. > > Co-developed-by: Dumitru Ceara <dceara@redhat.com> > Reported-at: https://issues.redhat.com/browse/FDP-42 > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > --- > NEWS | 2 + > controller/lflow.h | 15 +- > lib/ovn-util.h | 2 +- > northd/northd.c | 55 +++-- > northd/ovn-northd.8.xml | 60 ++++-- > ovn-nb.ovsschema | 9 +- > ovn-nb.xml | 12 +- > tests/ovn-controller.at | 308 +++++++++++++-------------- > tests/ovn-nbctl.at | 8 +- > tests/ovn-northd.at | 103 ++++++--- > tests/ovn.at | 429 +++++++++++++++++++++++--------------- > tests/system-ovn.at | 12 +- > utilities/ovn-nbctl.8.xml | 3 + > utilities/ovn-nbctl.c | 27 ++- > 14 files changed, 627 insertions(+), 418 deletions(-) > > diff --git a/NEWS b/NEWS > index 6553bd078..7300345f1 100644 > --- a/NEWS > +++ b/NEWS > @@ -18,6 +18,8 @@ Post v23.09.0 > - Support selecting encapsulation IP based on the source/destination VIF's > settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more > details. > + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets s/capbility/capability/ > + in the logical switch datapath according to user configured QoS rule. > > OVN v23.09.0 - 15 Sep 2023 > -------------------------- > diff --git a/controller/lflow.h b/controller/lflow.h > index 9b7ffa19c..f7f6c7950 100644 > --- a/controller/lflow.h > +++ b/controller/lflow.h > @@ -67,17 +67,20 @@ struct uuid; > > /* Start of LOG_PIPELINE_LEN tables. */ > #define OFTABLE_LOG_INGRESS_PIPELINE 8 > -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > -#define OFTABLE_REMOTE_OUTPUT 39 > -#define OFTABLE_LOCAL_OUTPUT 40 > -#define OFTABLE_CHECK_LOOPBACK 41 > +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > +#define OFTABLE_REMOTE_OUTPUT 44 > +#define OFTABLE_LOCAL_OUTPUT 45 > +#define OFTABLE_CHECK_LOOPBACK 46 > > /* Start of the OUTPUT section of the pipeline. */ > #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT > +BUILD_ASSERT_DECL( > + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT > +); > > /* Start of LOG_PIPELINE_LEN tables. */ > -#define OFTABLE_LOG_EGRESS_PIPELINE 42 > +#define OFTABLE_LOG_EGRESS_PIPELINE 47 > #define OFTABLE_SAVE_INPORT 64 > #define OFTABLE_LOG_TO_PHY 65 > #define OFTABLE_MAC_BINDING 66 > diff --git a/lib/ovn-util.h b/lib/ovn-util.h > index 2afff0d07..3e1d68cf9 100644 > --- a/lib/ovn-util.h > +++ b/lib/ovn-util.h > @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( > #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) > > /* The number of tables for the ingress and egress pipelines. */ > -#define LOG_PIPELINE_LEN 29 > +#define LOG_PIPELINE_LEN 30 > > static inline uint32_t > hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) > diff --git a/northd/northd.c b/northd/northd.c > index d2091d4bc..597d203ca 100644 > --- a/northd/northd.c > +++ b/northd/northd.c > @@ -134,22 +134,23 @@ enum ovn_stage { > PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") \ > PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") \ > PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") \ > - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") \ > - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") \ > - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") \ > - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ > + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") \ > + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") \ > + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") \ > + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") \ > + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ > "ls_in_acl_after_lb_eval") \ > - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ > + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ > "ls_in_acl_after_lb_action") \ > - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") \ > - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") \ > - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") \ > - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") \ > - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") \ > - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") \ > - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") \ > - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") \ > - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") \ > + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") \ > + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") \ > + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") \ > + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") \ > + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") \ > + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") \ > + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") \ > + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") \ > + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") \ > \ > /* Logical switch egress stages. */ \ > PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") \ > @@ -161,8 +162,9 @@ enum ovn_stage { > PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") \ > PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") \ > PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") \ > - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, "ls_out_check_port_sec") \ > - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, "ls_out_apply_port_sec") \ > + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") \ > + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, "ls_out_check_port_sec") \ > + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, "ls_out_apply_port_sec") \ > \ > /* Logical router ingress stages. */ \ > PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") \ > @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct chassis_features *features, > ds_destroy(&actions); > } > > +#define QOS_MAX_DSCP 63 > + > static void > build_qos(struct ovn_datapath *od, struct hmap *lflows) { > struct ds action = DS_EMPTY_INITIALIZER; > @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap *lflows) { > ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); > ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); > ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); > + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); > + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); > > for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { > struct nbrec_qos *qos = od->nbs->qos_rules[i]; > bool ingress = !strcmp(qos->direction, "from-lport") ? true :false; > enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : S_SWITCH_OUT_QOS_MARK; > + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); > int64_t rate = 0; > int64_t burst = 0; > > for (size_t j = 0; j < qos->n_action; j++) { > if (!strcmp(qos->key_action[j], "dscp")) { > + if (qos->value_action[j] > QOS_MAX_DSCP) { > + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " > + UUID_FMT, qos->value_action[j], > + UUID_ARGS(&qos->header_.uuid)); > + continue; > + } > + This seems unrelated to packet marking. Should this be done in a separate patch? > ds_clear(&action); > ds_put_format(&action, "ip.dscp = %"PRId64"; next;", > qos->value_action[j]); > @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap *lflows) { > qos->priority, > qos->match, ds_cstr(&action), > &qos->header_); > + } else if (!strcmp(qos->key_action[j], "mark")) { > + ds_clear(&action); > + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", > + qos->value_action[j]); > + ovn_lflow_add_with_hint(lflows, od, > + ingress ? S_SWITCH_IN_QOS_PKT_MARK > + : S_SWITCH_OUT_QOS_PKT_MARK, > + qos->priority, qos->match, ds_cstr(&action), > + &qos->header_); > } > } > > diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml > index 068d47e1a..c1cd19947 100644 > --- a/northd/ovn-northd.8.xml > +++ b/northd/ovn-northd.8.xml > @@ -1082,7 +1082,28 @@ > </li> > </ul> > > - <h3>Ingress Table 15: Pre-Hairpin</h3> > + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> > + > + <p> > + Logical flows in this table closely reproduce those in the > + <code>QoS</code> table with the <code>action</code> column set in > + the <code>OVN_Northbound</code> database for the > + <code>from-lport</code> direction. > + </p> > + > + <ul> > + <li> > + For every qos_rules entry in a logical switch with packet marking > + enabled, a flow will be added at the priority mentioned in the > + QoS table. > + </li> > + > + <li> > + A priority-0 flow that simply moves traffic to the next table. > + </li> > + </ul> > + > + <h3>Ingress Table 16: Pre-Hairpin</h3> > <ul> > <li> > If the logical switch has load balancer(s) configured, then a > @@ -1100,7 +1121,7 @@ > </li> > </ul> > > - <h3>Ingress Table 16: Nat-Hairpin</h3> > + <h3>Ingress Table 17: Nat-Hairpin</h3> > <ul> > <li> > If the logical switch has load balancer(s) configured, then a > @@ -1135,7 +1156,7 @@ > </li> > </ul> > > - <h3>Ingress Table 17: Hairpin</h3> > + <h3>Ingress Table 18: Hairpin</h3> > <ul> > <li> > <p> > @@ -1173,7 +1194,7 @@ > </li> > </ul> > > - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after LB</h3> > + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after LB</h3> > > <p> > Logical flows in this table closely reproduce those in the > @@ -1257,7 +1278,7 @@ > </li> > </ul> > > - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> > + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> > > <p> > Logical flows in this table decide how to proceed based on the values of > @@ -1297,7 +1318,7 @@ > </li> > </ul> > > - <h3>Ingress Table 20: Stateful</h3> > + <h3>Ingress Table 21: Stateful</h3> > > <ul> > <li> > @@ -1320,7 +1341,7 @@ > </li> > </ul> > > - <h3>Ingress Table 21: ARP/ND responder</h3> > + <h3>Ingress Table 22: ARP/ND responder</h3> > > <p> > This table implements ARP/ND responder in a logical switch for known > @@ -1653,7 +1674,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 22: DHCP option processing</h3> > + <h3>Ingress Table 23: DHCP option processing</h3> > > <p> > This table adds the DHCPv4 options to a DHCPv4 packet from the > @@ -1714,7 +1735,7 @@ next; > </li> > </ul> > > - <h3>Ingress Table 23: DHCP responses</h3> > + <h3>Ingress Table 24: DHCP responses</h3> > > <p> > This table implements DHCP responder for the DHCP replies generated by > @@ -1795,7 +1816,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 24 DNS Lookup</h3> > + <h3>Ingress Table 25 DNS Lookup</h3> > > <p> > This table looks up and resolves the DNS names to the corresponding > @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; > </li> > </ul> > > - <h3>Ingress Table 25 DNS Responses</h3> > + <h3>Ingress Table 26 DNS Responses</h3> > > <p> > This table implements DNS responder for the DNS replies generated by > @@ -1859,7 +1880,7 @@ output; > </li> > </ul> > > - <h3>Ingress table 26 External ports</h3> > + <h3>Ingress table 27 External ports</h3> > > <p> > Traffic from the <code>external</code> logical ports enter the ingress > @@ -1902,7 +1923,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 27 Destination Lookup</h3> > + <h3>Ingress Table 28 Destination Lookup</h3> > > <p> > This table implements switching behavior. It contains these logical > @@ -2078,7 +2099,7 @@ output; > </li> > </ul> > > - <h3>Ingress Table 28 Destination unknown</h3> > + <h3>Ingress Table 29 Destination unknown</h3> > > <p> > This table handles the packets whose destination was not found or > @@ -2312,7 +2333,14 @@ output; > there are no rules added for load balancing new connections. > </p> > > - <h3>Egress Table 9: Egress Port Security - check</h3> > + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> > + > + <p> > + This is similar to ingress table <code>QoS marking</code> except > + they apply to <code>to-lport</code> QoS rules. > + </p> > + > + <h3>Egress Table 10: Egress Port Security - check</h3> > > <p> > This is similar to the port security logic in table > @@ -2341,7 +2369,7 @@ output; > </li> > </ul> > > - <h3>Egress Table 10: Egress Port Security - Apply</h3> > + <h3>Egress Table 11: Egress Port Security - Apply</h3> > > <p> > This is similar to the ingress port security logic in ingress table > diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema > index b2e0993e0..7bb8f36c0 100644 > --- a/ovn-nb.ovsschema > +++ b/ovn-nb.ovsschema > @@ -1,7 +1,7 @@ > { > "name": "OVN_Northbound", > - "version": "7.2.0", > - "cksum": "1069338687 34162", > + "version": "7.3.0", > + "cksum": "2786772995 34106", > "tables": { > "NB_Global": { > "columns": { > @@ -293,10 +293,9 @@ > "enum": ["set", ["from-lport", "to-lport"]]}}}, > "match": {"type": "string"}, > "action": {"type": {"key": {"type": "string", > - "enum": ["set", ["dscp"]]}, > + "enum": ["set", ["dscp", "mark"]]}, > "value": {"type": "integer", > - "minInteger": 0, > - "maxInteger": 63}, > + "minInteger": 0}, > "min": 0, "max": "unlimited"}}, > "bandwidth": {"type": {"key": {"type": "string", > "enum": ["set", ["rate", > diff --git a/ovn-nb.xml b/ovn-nb.xml > index 765ffcf2e..5b593f6a7 100644 > --- a/ovn-nb.xml > +++ b/ovn-nb.xml > @@ -2808,12 +2808,22 @@ or > </column> > > <column name="action"> > - <p>When specified, matching flows will have DSCP marking applied.</p> > + <p> > + When <code>dscp</code> action is specified, matching flows will have > + have DSCP marking applied. > + When <code>mark</code> action is specified, matching flows will have > + packet marking applied. > + </p> > + > <ul> > <li> > <code>dscp</code>: The value of this action should be in the > range of 0 to 63 (inclusive). > </li> > + <li> > + <code>mark</code>: The value of this action should be a positive > + integer. > + </li> > </ul> > </column> > > diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at > index b3d536471..5427d2d14 100644 > --- a/tests/ovn-controller.at > +++ b/tests/ovn-controller.at > @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) > port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) > check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 > > -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep -q "reg15=0x${port},metadata=0x${meta}"]) > +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep -q "reg15=0x${port},metadata=0x${meta}"]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -918,14 +918,14 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i > ]) > done > > @@ -940,15 +940,15 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 9; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - $i)) > ]) > fi > done > @@ -966,17 +966,17 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 2)) > ]) > done > > @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > add address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], [0], [1 > ]) > > reprocess_count_new=$(read_counter consider_logical_flow) > @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > remove address_set as1 addresses 10.0.0.9,10.0.0.8 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1091,24 +1091,24 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i + 4)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i + 4)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=conjunction,1/2) > @@ -1130,17 +1130,17 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((14 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((14 - $i)) > ]) > fi > done > @@ -1156,11 +1156,11 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=conjunction,1/2) > @@ -1172,7 +1172,7 @@ priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 actions=conjun > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 actions=conjunction,2/2) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 2 + 4)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 2 + 4)) > ]) > done > > @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ > add address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], [0], [1 > ]) > > reprocess_count_new=$(read_counter consider_logical_flow) > @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ > remove address_set as1 addresses 10.0.0.10 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ > remove address_set as1 addresses 10.0.0.9,10.0.0.8 > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], [0], [1 > ]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], [ignore]) > > reprocess_count_new=$(read_counter consider_logical_flow) > AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 > @@ -1288,22 +1288,22 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=conjunction,1/2) > @@ -1327,15 +1327,15 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((21 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((21 - $i*2)) > ]) > fi > done > @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i > ]) > done > > @@ -1382,16 +1382,16 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 9; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > elif test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > else > # 2 dst + (10 - i) src + 1 conj_id > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - $i + 3)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - $i + 3)) > ]) > fi > done > @@ -1445,27 +1445,27 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > done > @@ -1483,9 +1483,9 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((20 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((20 - $i*2)) > ]) > fi > done > @@ -1541,30 +1541,30 @@ for i in $(seq 10); do > add address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > elif test "$i" -lt 6; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2)) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 + $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 + $i)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > done > @@ -1582,12 +1582,12 @@ for i in $(seq 10); do > remove address_set as2 addresses 10.0.0.$j > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > elif test "$i" -lt 6; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((15 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((15 - $i)) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - ($i - 5)*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - ($i - 5)*2)) > ]) > fi > done > @@ -1639,22 +1639,22 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 1; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) > ]) > fi > > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) > @@ -1676,15 +1676,15 @@ for i in $(seq 10); do > check ovn-nbctl remove address_set as1 addresses 10.0.0.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 10; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > elif test "$i" = 9; then > # no conjunction left > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((21 - $i*2)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((21 - $i*2)) > ]) > fi > done > @@ -1700,11 +1700,11 @@ for i in $(seq 10); do > check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) > @@ -1719,7 +1719,7 @@ priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=co > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=conjunction,2/2) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 4 + 1)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 4 + 1)) > ]) > done > > @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync > reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) > @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [1 > # Delete 2 IPs > reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl --wait=hv remove address_set as1 addresses 10.0.0.4,10.0.0.5 > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.*,/conjunction,/' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) > priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) > @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as > check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as2 && tcp && tcp.dst == {201, 202}' drop > > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) > @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > add address_set as2 addresses 10.0.0.24,10.0.0.33 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) > @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) > check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ > remove address_set as2 addresses 10.0.0.24,10.0.0.33 > check ovn-nbctl --wait=hv sync > -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | \ > sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ > sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) > priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) > @@ -1943,14 +1943,14 @@ for i in $(seq 5); do > check ovn-nbctl add address_set as1 addresses "aa\:aa\:aa\:aa\:aa\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i > ]) > done > > @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter consider_logical_flow) > for i in $(seq 5); do > check ovn-nbctl remove address_set as1 addresses "aa\:aa\:aa\:aa\:aa\:0$i" > check ovn-nbctl --wait=hv sync > - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" > + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" > if test "$i" = 4; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 5; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 - $i)) > ]) > fi > done > @@ -2024,14 +2024,14 @@ for i in $(seq 5); do > check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 3; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i > ]) > done > > @@ -2046,15 +2046,15 @@ for i in $(seq 5); do > check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" > check ovn-nbctl --wait=hv sync > if test "$i" = 4; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ > grep -v reply | awk '{print $7, $8}'], [0], [dnl > -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) > +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) > ]) > fi > if test "$i" = 5; then > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) > else > - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 - $i)) > + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 - $i)) > ]) > fi > done > @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg > ovn-nbctl create address_set name=as1 addresses=8.8.8.8 > check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as1' drop > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [1 > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [1 > ]) > > # pause ovn-northd > @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause > # undefined. This test runs the scenario ten times to make sure different > # orders are covered and handled properly. > > -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100") > +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100") > for i in $(seq 10); do > # Delete and recreate the SB address set with same name and an extra IP. > addrs_=$(fetch_column address_set addresses name=as1) > addrs=${addrs_// /,} > AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) > - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100") = "$(($i + 1))"]) > + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100") = "$(($i + 1))"]) > done > > OVN_CLEANUP([hv1]) > @@ -2698,7 +2698,7 @@ done > wait_for_ports_up > ovn-nbctl --wait=hv sync > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], [0],[dnl > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], [0],[dnl > 3 > ]) > > @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do > done > ovn-nbctl --wait=hv sync > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q controller], [1]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q controller], [1]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at > index 7f37d7716..b11e4ec6b 100644 > --- a/tests/ovn-nbctl.at > +++ b/tests/ovn-nbctl.at > @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp dscp=0 rate=300 burst=3000]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 burst=30000]) > +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) > +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) > > dnl Add duplicated qos > AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 burst=30002], [1], [], [stderr]) > @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 > from-lport 400 (tcp) rate=300 burst=3000 dscp=0 > to-lport 300 (tcp) dscp=48 > to-lport 200 (ip) rate=101 > + to-lport 102 (ip4) dscp=16 mark=17 > + to-lport 101 (ip4) mark=15 > to-lport 100 (ip4) rate=301 burst=30000 dscp=13 > ]) > > @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscp=-1], [1], [], > ]) > > AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], > -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and "burst=" > +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" and "mark=" > ]) > > AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], > -[ovn-nbctl: Either "rate" and/or "dscp" must be specified > +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified > ])]) > > dnl --------------------------------------------------------------------- > diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > index 67e81ddba..6a27b7dcf 100644 > --- a/tests/ovn-northd.at > +++ b/tests/ovn-northd.at > @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ > -- ls-lb-add ls lb > > AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e ls_in_acl_after_lb_eval | sort], [0], [dnl > - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == 1), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == 1), action=(reg8[[16]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) > table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) > @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls > ovn-nbctl --wait=sb clear logical_switch ls load_balancer > > AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e ls_in_acl_after_lb_eval | sort], [0], [dnl > - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) > - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) > + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) > table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) > @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) > @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) > table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) > @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ > table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) > table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) > table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) > @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) > @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 "00:00:00:00:00:01" > @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) > @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 1000::3" > @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) > @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > # Disable sw0p1 > @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) > @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "sw0p1"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 > @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=110 , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "sw0p1"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > check ovn-nbctl set logical_switch_port sw0p1 enabled=true > @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) > table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_check_port_sec), priority=70 , match=(inport == "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > - table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) > + table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) > table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) > table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) > table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) > + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) > table=??(ls_out_apply_port_sec), priority=100 , match=(outport == "localnetport"), action=(set_queue(10); output;) > table=??(ls_out_apply_port_sec), priority=110 , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) > @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl > table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) > table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) > table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) > - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) > - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) > ]) > > AT_CLEANUP > @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options logical_port=public |grep -q 'qos > AT_CLEANUP > ]) > > +OVN_FOR_EACH_NORTHD_NO_HV([ > +AT_SETUP([check OVN QoS mark/meter logical flows]) > +AT_KEYWORDS([OVN-QoS]) > +ovn_start > + > +check ovn-nbctl ls-add ls > +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > + > +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > +check ovn-nbctl --wait=sb sync > + > +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl Remember how you had to adjust a bunch of tests because the table numbers changed? It's probably a good idea to mask the table numbers in this test so that nobody has to adjust this test the next time the table numbers change. > + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) > + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) > + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) > + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) > + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) > + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) > + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) > + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) > + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) > + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) > + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) > + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) > + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) > + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) > + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) > + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) > +]) > + > +AT_CLEANUP > +]) > + > AT_SETUP([Tiered ACL logical flows]) > AT_KEYWORDS([acl]) > > @@ -9978,10 +10017,10 @@ acl_test() { > } > > acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 > +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 > acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 > +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 > acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > > AT_CLEANUP > diff --git a/tests/ovn.at b/tests/ovn.at > index 28c6b6c34..9b158e79c 100644 > --- a/tests/ovn.at > +++ b/tests/ovn.at > @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > > next(pipeline=egress); > formats as next(pipeline=egress, table=11); > - encodes as resubmit(,53) > + encodes as resubmit(,58) > > next(pipeline=egress, table=5); > - encodes as resubmit(,47) > + encodes as resubmit(,52) > > next(table=10); > formats as next(10); > @@ -9719,18 +9719,18 @@ as hv1 > AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 external_ids:iface-id=localvif1]) > > # On hv1, check that there are no flows outputting bcast to tunnel > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # On hv2, check that no flow outputs bcast to tunnel to hv1. > as hv2 > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # Now bind vif2 on hv2. > AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 external_ids:iface-id=localvif2]) > > # At this point, the broadcast flow on vif2 should be deleted. > -# because, there is now a localnet vif bound (table=37 programming logic) > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > +# because, there is now a localnet vif bound (table=42 programming logic) > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # Verify that the local net patch port exists on hv2. > OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port patch-br-int-to-ln_port" | wc -l` -eq 1]) > @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > ]) > > test_ip_packet() > @@ -11631,7 +11631,7 @@ AT_CHECK( > ]) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > ]) > > test_ip_packet gw2 gw1 0 > @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > ]) > > test_ip_packet() > @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > ]) > > OVS_WAIT_UNTIL([ > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > ]) > > test_ip_packet gw2 gw1 > @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > > AT_CHECK( > [# Check that redirect mapping is programmed only on hv2 > - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l > + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l > > # Check that hv1 sends chassisredirect port traffic to hv2 > - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > > # Check that arp reply on distributed gateway port is only programmed on hv2 > grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int in_port=hv1-vif1 $packet > sleep 2 > > AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > ]]) > > @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > echo $hv2_gw2_ofport > > echo "--- hv1 ---" > -as hv1 ovs-ofctl dump-flows br-int table=39 > +as hv1 ovs-ofctl dump-flows br-int table=44 > > echo "--- hv2 ---" > -as hv2 ovs-ofctl dump-flows br-int table=39 > +as hv2 ovs-ofctl dump-flows br-int table=44 > > gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [1 > ]) > @@ -13566,15 +13566,15 @@ sleep 10 > > as gw1 ovs-ofctl dump-flows br-int > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too through ls_in_arp_rsp table > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > @@ -13598,12 +13598,12 @@ wait_for_ports_up > check ovn-nbctl --wait=hv sync > > # we make sure that the hypervisors noticed, and inverted the slave ports > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > | wc -l], [0], [1 > ]) > @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], > ]]) > > # make sure that flows for handling the outside router port reside on gw2 now > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > bfd_dump > > # make sure that flows for handling the outside router port reside on gw1 now > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside ha_chassis_group=$hagrp1_uuid > wait_row_count HA_Chassis_Group 1 > wait_row_count HA_Chassis 2 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [0 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [0 > ]) > @@ -13777,26 +13777,26 @@ done > # Re-add gw2 > as gw2 ovn_attach n1 br-phys 192.168.0.1 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > | wc -l], [0], [1 > ]) > > # make sure that flows for handling the outside router port reside on gw1 > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group ref_chassis > # Increase the priority of gw2 > ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > | wc -l], [0], [1 > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > | wc -l], [0], [1 > ]) > @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], > ]]) > > # make sure that flows for handling the outside router port reside on gw2 now > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > bfd_dump > > # make sure that flows for handling the outside router port reside on gw2 now > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > ]]) > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > ]]) > > @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > AT_CAPTURE_FILE([sw0-flows]) > > AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed 's/table=../table=??/' | sort], [0], [dnl > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > ]) > > > @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst $ipv6_src $ipv6_dst > # Get total number of ipv4 packets that received on ovs > > # sender side > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # Get total number of ipv6 packets that received on ovs > > # sender side > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > OVN_CLEANUP([hv1], [hv2]) > AT_CLEANUP > @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the second less restrictive allow ACL should have been installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > ]) > > # Remove the less restrictive allow ACL. > @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1' > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > ]) > > # Add another ACL that overlaps with the existing less restrictive ones. > @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > # with an additional conjunction action. > # > # New non-conjunctive flows should be added to match on 'udp'. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > grep "priority=1003" | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > - table=46, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > - table=46, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > + table=51, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > + table=51, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > ]) > > OVN_CLEANUP([hv1]) > @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 'outport == @pg1 && ip4.src == $as2' al > > wait_for_ports_up > check ovn-nbctl --wait=hv sync > -ovs-ofctl dump-flows br-int table=46 > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 2]) > +ovs-ofctl dump-flows br-int table=51 > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 2]) > > echo ------- > # Add another address in as1, so that the 1st ACL will now generate 2 conjunctions. > ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > check ovn-nbctl --wait=hv sync > > -ovs-ofctl dump-flows br-int table=46 > +ovs-ofctl dump-flows br-int table=51 > # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd ACL) > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 3]) > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 3]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined > # to router mac. > AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > grep -c "actions=drop"], [0], [1 > ]) > # Stop ovn-controllers on hv1 and hv3. > @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy options:pkt_mark=100 > check ovn-nbctl --wait=hv sync > as hv2 > # add a flow in egress pipeline to check pkt marking > -ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,38)" > +ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,43)" > > dst_ip=$(ip_to_hex 172 16 2 10) > fip_ip=$(ip_to_hex 172 16 1 2) > @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip $gw_router_ip) >> expected > send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > echo "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" >> expected > > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | grep pkt_mark=0x64 | grep -c n_packets=1`]) > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | grep pkt_mark=0x64 | grep -c n_packets=1`]) > > OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > > @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) > lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding tunnel_key logical_port=lr0-public)) > > - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl > - table=46, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl > + table=51, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > ]) > > AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ > grep "priority=92" | grep 172.168.0.50], [0], [dnl > - table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > + table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > ]) > } > > check_virtual_offlows_not_present() { > hv=$1 > - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl > + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl > ]) > > AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ > @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 logical_port=sw0-vir virtual_parent=sw0-p1 > wait_for_ports_up sw0-vir > check ovn-nbctl --wait=hv sync > AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid > check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 > @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], [vif-north.expected]) > > # Confirm that packets did not go out via tunnel port. > - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > ]]) > > # Confirm that packet went out via localnet port > @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') > AT_CHECK([test ! -z $p2_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ > reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xup]) > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > AT_CHECK([test ! -z $p1_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > ovs-vsctl del-port hv1-vif2 > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') > @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > > ovn-nbctl lsp-del sw0-p1 > > -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) > check ovn-nbctl --wait=hv sync > > # Check OVS flows are installed properly. > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > grep "priority=2002" | grep conjunction | \ > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > ]) > > OVN_CLEANUP([hv1]) > @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=l > ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 external_ids:iface-id=lsp0-1 > > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 22]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 22]) > > # Save the current lflow_run counter > lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > # 1. Remove half of the ports from pg1. The excepted conjunction flows should be: > # 2 + 10 = 12 > check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j in 0 1; do echo lsp${i}-${j}; done; done) > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because the > # port group const set should have only one member (lsp0-1). And the total > @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l > # 10. > ovs-vsctl del-port br-int lsp0-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 0]) > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc -l) == 10]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 0]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc -l) == 10]) > > # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=lsp0-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any change. > ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 external_ids:iface-id=lsp9-0 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a different > # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 external_ids:iface-id=lsp1-0 > ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 external_ids:iface-id=lsp1-1 > check ovn-nbctl --wait=hv sync > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) > > # 6. Simulate a SB port-group "del and add" notification to ovn-controller in the > # same IDL iteration. ovn-controller should still program the same flows. In > @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > check ovn-nbctl --wait=hv sync > > # Finally check flow count is the same as before. > - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) > + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) > done > > # Make sure all the above was performed with I-P (no recompute) > @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'outport == "lp2" && ip4.src == 10.0. > > # The first ACL should be programmed, but the second one shouldn't. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) > > # Now create the lport lp2. > check ovn-nbctl lsp-add lsw0 lp2 \ > @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > > check ovn-nbctl --wait=hv sync > # Now the second ACL should be programmed. > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], [ignore]) > > # Remove the lport lp2 again, the OVS flow for the second ACL should be > # removed. > check ovn-nbctl --wait=hv lsp-del lp2 > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) > > # Test similar scenario but when the referenced lport is not bound locally. > > @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport == "lp4" && ip4.dst == 10.0.0 > > # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], [ignore]) > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], [ignore]) > > # Now create the lport lp4. > check ovn-nbctl lsp-add lsw0 lp4 \ > @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > > # Now the ACL for lp4 should be programmed. > check ovn-nbctl --wait=hv sync > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], [ignore]) > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], [ignore]) > > OVN_CLEANUP([hv1]) > AT_CLEANUP > @@ -33493,15 +33493,15 @@ done > check ovn-nbctl --wait=hv sync > > # hv0 should see flows for lsp1 but not lsp2 > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [1]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [1]) > # hv2 should see flows for lsp2 but not lsp1 > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [0], [ignore]) > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) > > # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > > # Change it back, and trigger recompute to make sure extra flows are removed > # from hv2 (recompute is needed because currently I-P adds local datapaths but > @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ig > check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > as hv2 check ovn-appctl -t ovn-controller recompute > ovn-nbctl --wait=hv sync > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) > > # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > > OVN_CLEANUP([hv1],[hv2]) > AT_CLEANUP > @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > # Use constants so that if tables or registers change, this test can > # be updated easily. > DNAT_TABLE=15 > -SNAT_TABLE=45 > +SNAT_TABLE=50 > DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > > @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > wait_for_ports_up > OVN_POPULATE_ARP > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c controller], [0],[dnl > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c controller], [0],[dnl > 9 > ]) > > @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > send_garp 1 1 $eth_src $eth_dst $spa $tpa > > OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > sleep_controller hv1 > > @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ > > OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > AT_CLEANUP > + > +OVN_FOR_EACH_NORTHD([ > +AT_SETUP([QoS packet marking]) > +AT_KEYWORDS([ovn-qos-pkt-marking]) > +AT_SKIP_IF([test $HAVE_SCAPY = no]) > +ovn_start > + > +check ovn-nbctl lr-add lr0 > +check ovn-nbctl ls-add ls0 > +check ovn-nbctl ls-add ls1 > + > +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > + set Logical_Switch_Port lrp-s0 type=router \ > + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > + set Logical_Switch_Port lrp-s1 type=router \ > + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > + > +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > + > +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > +check ovn-nbctl --wait=sb sync > + > +net_add n1 > +sim_add hv > + > +as hv > +check ovs-vsctl add-br br-phys > +ovn_attach n1 br-phys 192.168.0.1 > + > +check ovs-vsctl add-port br-int vif0 -- \ > + set Interface vif0 external-ids:iface-id=lp0 \ > + options:tx_pcap=hv/vif0-tx.pcap \ > + options:rxq_pcap=hv/vif0-rx.pcap \ > + ofport-request=1 > +check ovs-vsctl add-port br-int vif1 -- \ > + set Interface vif1 external-ids:iface-id=lp1 \ > + options:tx_pcap=hv/vif1-tx.pcap \ > + options:rxq_pcap=hv/vif1-rx.pcap \ > + ofport-request=2 > +check ovs-vsctl add-port br-int vif2 -- \ > + set Interface vif2 external-ids:iface-id=lp2 \ > + options:tx_pcap=hv/vif2-tx.pcap \ > + options:rxq_pcap=hv/vif2-rx.pcap \ > + ofport-request=3 > + > +# Create QoS rules for packet marking. > +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" mark=48 > +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" mark=49 > +check_row_count nb:QoS 2 > + > +# Create some flows to count pkt marking. > +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark == 48" drop > +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > +wait_for_ports_up > +check ovn-nbctl --wait=hv sync > + > +send_udp_packet() { > + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ > + IP(src='${ipv4_src}', dst='${ipv4_dst}', ttl=0x40)/ \ > + UDP(sport=4242, dport=4343)") > + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > +} > + > +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=ls0)) > +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) > + > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > + > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > + > +OVN_CLEANUP([hv]) > +AT_CLEANUP > +]) > diff --git a/tests/system-ovn.at b/tests/system-ovn.at > index cb4124b70..1277f1057 100644 > --- a/tests/system-ovn.at > +++ b/tests/system-ovn.at > @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > grep 'nat(src=20.0.0.2)']) > > check ovs-appctl dpctl/flush-conntrack > @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > grep 'nat(src=20.0.0.2)']) > > rm -f wget*.log > @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > ]) > > OVS_WAIT_UNTIL([ > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > grep controller | grep tp_dst=84 -c) > test $n_pkt -eq 1 > ]) > @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > ]) > > OVS_WAIT_UNTIL([ > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > grep controller | grep tp_dst=84 -c) > test $n_pkt -eq 1 > ]) > @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > > wait_igmp_flows_installed() > { > - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > grep 'priority=90' | grep "nw_dst=$1"]) > } > > @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:12345,192 > > ovn-nbctl list load_balancer > ovn-sbctl dump-flows R2 > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep 'nat(src=20.0.0.2)']) > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep 'nat(src=20.0.0.2)']) > > dnl Test load-balancing that includes L4 ports in NAT. > for i in `seq 1 20`; do > diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > index 6f74bd557..f838393a6 100644 > --- a/utilities/ovn-nbctl.8.xml > +++ b/utilities/ovn-nbctl.8.xml > @@ -482,6 +482,9 @@ > <code>burst=</code><var>burst</var> specifies the burst rate > limit in kilobits. <code>dscp</code> and/or <code>rate</code> > are required arguments. > + If <code>mark=</code><var>mark</var> is specified, then matching > + packets will be marked (through <code>pkt.mark</code>). > + <var>mark</var> must be a positive integer. > </p> > > <p> > diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > index 526369b68..0620d333a 100644 > --- a/utilities/ovn-nbctl.c > +++ b/utilities/ovn-nbctl.c > @@ -283,7 +283,7 @@ ACL commands:\n\ > print ACLs for SWITCH\n\ > \n\ > QoS commands:\n\ > - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP]\n\ > + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP] [mark=MARK]\n\ > add an QoS rule to SWITCH\n\ > qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > remove QoS rules from SWITCH\n\ > @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > if (!strcmp(qos_rule->key_action[j], "dscp")) { > ds_put_format(&ctx->output, " dscp=%"PRId64"", > qos_rule->value_action[j]); > + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > + ds_put_format(&ctx->output, " mark=%"PRId64"", > + qos_rule->value_action[j]); > } > } > ds_put_cstr(&ctx->output, "\n"); > @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > } > > static void > @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > const char *direction; > int64_t priority; > int64_t dscp = -1; > + int64_t mark = 0; > int64_t rate = 0; > int64_t burst = 0; > char *error; > @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > return; > } > } > + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < 0) { > + ctl_error(ctx, "%s: mark must be a positive integer", > + ctx->argv[i] + 5); > + return; > + } > + } > else if (!strncmp(ctx->argv[i], "rate=", 5)) { > if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > || rate < 1 || rate > UINT32_MAX) { > @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > } > } else { > ctl_error(ctx, "%s: supported arguments are \"dscp=\", \"rate=\", " > - "and \"burst=\"", ctx->argv[i]); > + "\"burst=\" and \"mark=\"", ctx->argv[i]); > return; > } > } > > /* Validate rate and dscp. */ > - if (-1 == dscp && !rate) { > - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be specified"); > + if (-1 == dscp && !rate && !mark) { > + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be " > + "specified"); > return; > } > > @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > nbrec_qos_set_priority(qos, priority); > nbrec_qos_set_direction(qos, direction); > nbrec_qos_set_match(qos, ctx->argv[4]); > + if (mark) { > + nbrec_qos_update_action_setkey(qos, "mark", mark); > + } > if (-1 != dscp) { > - const char *dscp_key = "dscp"; > - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > } > if (rate) { > const char *bandwidth_key[2] = {"rate", "burst"};
On 2/1/24 02:33, Mark Michelson wrote: >> static void >> build_qos(struct ovn_datapath *od, struct hmap *lflows) { >> struct ds action = DS_EMPTY_INITIALIZER; >> @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap >> *lflows) { >> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); >> ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); >> ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); >> + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", >> "next;"); >> + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", >> "next;"); >> for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { >> struct nbrec_qos *qos = od->nbs->qos_rules[i]; >> bool ingress = !strcmp(qos->direction, "from-lport") ? true >> :false; >> enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : >> S_SWITCH_OUT_QOS_MARK; >> + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); >> int64_t rate = 0; >> int64_t burst = 0; >> for (size_t j = 0; j < qos->n_action; j++) { >> if (!strcmp(qos->key_action[j], "dscp")) { >> + if (qos->value_action[j] > QOS_MAX_DSCP) { >> + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in >> qos " >> + UUID_FMT, qos->value_action[j], >> + UUID_ARGS(&qos->header_.uuid)); >> + continue; >> + } >> + > > This seems unrelated to packet marking. Should this be done in a > separate patch? Hi Mark, It's actually because we removed the "max" limitation for the QoS.action value in the NB schema. Prior to the patch we would reject values > 63, the only thing we can do now, I think, is log any misconfigurations. Regards, Dumitru
> Hi Lorenzo, > > I have just a few small comments below. Hi Mark, thx for the review. > > On 1/30/24 09:53, Lorenzo Bianconi wrote: > > Add the capbility to mark (through pkt.mark) incoming/outgoing packets > > in logical_switch datapath according to user configured QoS rule. > > > > Co-developed-by: Dumitru Ceara <dceara@redhat.com> > > Reported-at: https://issues.redhat.com/browse/FDP-42 > > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > > --- > > NEWS | 2 + > > controller/lflow.h | 15 +- > > lib/ovn-util.h | 2 +- > > northd/northd.c | 55 +++-- > > northd/ovn-northd.8.xml | 60 ++++-- > > ovn-nb.ovsschema | 9 +- > > ovn-nb.xml | 12 +- > > tests/ovn-controller.at | 308 +++++++++++++-------------- > > tests/ovn-nbctl.at | 8 +- > > tests/ovn-northd.at | 103 ++++++--- > > tests/ovn.at | 429 +++++++++++++++++++++++--------------- > > tests/system-ovn.at | 12 +- > > utilities/ovn-nbctl.8.xml | 3 + > > utilities/ovn-nbctl.c | 27 ++- > > 14 files changed, 627 insertions(+), 418 deletions(-) > > > > diff --git a/NEWS b/NEWS > > index 6553bd078..7300345f1 100644 > > --- a/NEWS > > +++ b/NEWS > > @@ -18,6 +18,8 @@ Post v23.09.0 > > - Support selecting encapsulation IP based on the source/destination VIF's > > settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more > > details. > > + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets > > s/capbility/capability/ ack, I will fix it. > > > + in the logical switch datapath according to user configured QoS rule. > > OVN v23.09.0 - 15 Sep 2023 > > -------------------------- > > diff --git a/controller/lflow.h b/controller/lflow.h > > index 9b7ffa19c..f7f6c7950 100644 > > --- a/controller/lflow.h > > +++ b/controller/lflow.h > > @@ -67,17 +67,20 @@ struct uuid; > > /* Start of LOG_PIPELINE_LEN tables. */ > > #define OFTABLE_LOG_INGRESS_PIPELINE 8 > > -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 > > -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 > > -#define OFTABLE_REMOTE_OUTPUT 39 > > -#define OFTABLE_LOCAL_OUTPUT 40 > > -#define OFTABLE_CHECK_LOOPBACK 41 > > +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 > > +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 > > +#define OFTABLE_REMOTE_OUTPUT 44 > > +#define OFTABLE_LOCAL_OUTPUT 45 > > +#define OFTABLE_CHECK_LOOPBACK 46 > > /* Start of the OUTPUT section of the pipeline. */ > > #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT [...] > > +OVN_FOR_EACH_NORTHD_NO_HV([ > > +AT_SETUP([check OVN QoS mark/meter logical flows]) > > +AT_KEYWORDS([OVN-QoS]) > > +ovn_start > > + > > +check ovn-nbctl ls-add ls > > +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 > > +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 > > +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 > > +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 > > + > > +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 > > +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 > > +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 > > +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 > > +check ovn-nbctl --wait=sb sync > > + > > +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl > > Remember how you had to adjust a bunch of tests because the table numbers > changed? It's probably a good idea to mask the table numbers in this test so > that nobody has to adjust this test the next time the table numbers change. ack, I will fix it. Regards, Lorenzo > > > + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) > > + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) > > + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) > > + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) > > + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) > > + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) > > + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) > > + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) > > + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) > > + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) > > + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) > > + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) > > + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) > > + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) > > + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) > > + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) > > +]) > > + > > +AT_CLEANUP > > +]) > > + > > AT_SETUP([Tiered ACL logical flows]) > > AT_KEYWORDS([acl]) > > @@ -9978,10 +10017,10 @@ acl_test() { > > } > > acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 > > -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 > > +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 > > acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 > > acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 > > -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 > > +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 > > acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 > > AT_CLEANUP > > diff --git a/tests/ovn.at b/tests/ovn.at > > index 28c6b6c34..9b158e79c 100644 > > --- a/tests/ovn.at > > +++ b/tests/ovn.at > > @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); > > next(pipeline=egress); > > formats as next(pipeline=egress, table=11); > > - encodes as resubmit(,53) > > + encodes as resubmit(,58) > > next(pipeline=egress, table=5); > > - encodes as resubmit(,47) > > + encodes as resubmit(,52) > > next(table=10); > > formats as next(10); > > @@ -9719,18 +9719,18 @@ as hv1 > > AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 external_ids:iface-id=localvif1]) > > # On hv1, check that there are no flows outputting bcast to tunnel > > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # On hv2, check that no flow outputs bcast to tunnel to hv1. > > as hv2 > > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # Now bind vif2 on hv2. > > AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 external_ids:iface-id=localvif2]) > > # At this point, the broadcast flow on vif2 should be deleted. > > -# because, there is now a localnet vif bound (table=37 programming logic) > > -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) > > +# because, there is now a localnet vif bound (table=42 programming logic) > > +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) > > # Verify that the local net patch port exists on hv2. > > OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port patch-br-int-to-ln_port" | wc -l` -eq 1]) > > @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov > > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > ]) > > test_ip_packet() > > @@ -11631,7 +11631,7 @@ AT_CHECK( > > ]) > > OVS_WAIT_UNTIL([ > > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > ]) > > test_ip_packet gw2 gw1 0 > > @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov > > hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) > > OVS_WAIT_UNTIL([ > > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") > > ]) > > test_ip_packet() > > @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ > > ]) > > OVS_WAIT_UNTIL([ > > - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") > > ]) > > test_ip_packet gw2 gw1 > > @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) > > AT_CHECK( > > [# Check that redirect mapping is programmed only on hv2 > > - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l > > - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l > > + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l > > + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l > > # Check that hv1 sends chassisredirect port traffic to hv2 > > - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > > - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l > > + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l > > + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l > > # Check that arp reply on distributed gateway port is only programmed on hv2 > > grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l > > @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int in_port=hv1-vif1 $packet > > sleep 2 > > AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ > > | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 > > ]]) > > @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport > > echo $hv2_gw2_ofport > > echo "--- hv1 ---" > > -as hv1 ovs-ofctl dump-flows br-int table=39 > > +as hv1 ovs-ofctl dump-flows br-int table=44 > > echo "--- hv2 ---" > > -as hv2 ovs-ofctl dump-flows br-int table=39 > > +as hv2 ovs-ofctl dump-flows br-int table=44 > > gw1_chassis=$(fetch_column Chassis _uuid name=gw1) > > gw2_chassis=$(fetch_column Chassis _uuid name=gw2) > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > | wc -l], [0], [1 > > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > | wc -l], [0], [1 > > ]) > > @@ -13566,15 +13566,15 @@ sleep 10 > > as gw1 ovs-ofctl dump-flows br-int > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too through ls_in_arp_rsp table > > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > > grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > > @@ -13598,12 +13598,12 @@ wait_for_ports_up > > check ovn-nbctl --wait=hv sync > > # we make sure that the hypervisors noticed, and inverted the slave ports > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > > | wc -l], [0], [1 > > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > > | wc -l], [0], [1 > > ]) > > @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], > > ]]) > > # make sure that flows for handling the outside router port reside on gw2 now > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port > > bfd_dump > > # make sure that flows for handling the outside router port reside on gw1 now > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside ha_chassis_group=$hagrp1_uuid > > wait_row_count HA_Chassis_Group 1 > > wait_row_count HA_Chassis 2 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > | wc -l], [0], [0 > > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > | wc -l], [0], [0 > > ]) > > @@ -13777,26 +13777,26 @@ done > > # Re-add gw2 > > as gw2 ovn_attach n1 br-phys 192.168.0.1 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ > > | wc -l], [0], [1 > > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ > > | wc -l], [0], [1 > > ]) > > # make sure that flows for handling the outside router port reside on gw1 > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > # make sure ARP responder flows for outside router port reside on gw1 too > > -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ > > +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ > > grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) > > # check that the chassis redirect port has been claimed by the gw1 chassis > > @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group ref_chassis > > # Increase the priority of gw2 > > ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 > > -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ > > | wc -l], [0], [1 > > ]) > > -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ > > +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ > > grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ > > | wc -l], [0], [1 > > ]) > > @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], > > ]]) > > # make sure that flows for handling the outside router port reside on gw2 now > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port > > bfd_dump > > # make sure that flows for handling the outside router port reside on gw2 now > > -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 > > ]]) > > -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ > > +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ > > grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 > > ]]) > > @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows > > AT_CAPTURE_FILE([sw0-flows]) > > AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed 's/table=../table=??/' | sort], [0], [dnl > > - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) > > + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) > > ]) > > @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst $ipv6_src $ipv6_dst > > # Get total number of ipv4 packets that received on ovs > > # sender side > > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) > > # Get total number of ipv6 packets that received on ovs > > # sender side > > -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > # receiver side > > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) > > OVN_CLEANUP([hv1], [hv2]) > > AT_CLEANUP > > @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow > > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | > > grep "priority=1003" | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > > @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' > > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the second less restrictive allow ACL should have been installed. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > > grep "priority=1003" | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > ]) > > # Remove the less restrictive allow ACL. > > @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1' > > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > > grep "priority=1003" | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > ]) > > # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. > > @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow > > check ovn-nbctl --wait=hv sync > > # Check OVS flows, the less restrictive flows should have been installed. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > > grep "priority=1003" | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > ]) > > # Add another ACL that overlaps with the existing less restrictive ones. > > @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync > > # with an additional conjunction action. > > # > > # New non-conjunctive flows should be added to match on 'udp'. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > > grep "priority=1003" | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() > > - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > - table=46, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > - table=46, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() > > + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() > > + table=51, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > + table=51, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > ]) > > OVN_CLEANUP([hv1]) > > @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 'outport == @pg1 && ip4.src == $as2' al > > wait_for_ports_up > > check ovn-nbctl --wait=hv sync > > -ovs-ofctl dump-flows br-int table=46 > > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 2]) > > +ovs-ofctl dump-flows br-int table=51 > > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 2]) > > echo ------- > > # Add another address in as1, so that the 1st ACL will now generate 2 conjunctions. > > ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" > > check ovn-nbctl --wait=hv sync > > -ovs-ofctl dump-flows br-int table=46 > > +ovs-ofctl dump-flows br-int table=51 > > # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd ACL) > > -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 3]) > > +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 3]) > > OVN_CLEANUP([hv1]) > > AT_CLEANUP > > @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 > > # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined > > # to router mac. > > AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ > > -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > > +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ > > grep -c "actions=drop"], [0], [1 > > ]) > > # Stop ovn-controllers on hv1 and hv3. > > @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy options:pkt_mark=100 > > check ovn-nbctl --wait=hv sync > > as hv2 > > # add a flow in egress pipeline to check pkt marking > > -ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,38)" > > +ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,43)" > > dst_ip=$(ip_to_hex 172 16 2 10) > > fip_ip=$(ip_to_hex 172 16 1 2) > > @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip $gw_router_ip) >> expected > > send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip > > echo "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" >> expected > > -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | grep pkt_mark=0x64 | grep -c n_packets=1`]) > > +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | grep pkt_mark=0x64 | grep -c n_packets=1`]) > > OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) > > @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { > > lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) > > lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding tunnel_key logical_port=lr0-public)) > > - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl > > - table=46, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) > > + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl > > + table=51, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) > > ]) > > AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ > > grep "priority=92" | grep 172.168.0.50], [0], [dnl > > - table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) > > + table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) > > ]) > > } > > check_virtual_offlows_not_present() { > > hv=$1 > > - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl > > + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl > > ]) > > AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ > > @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 logical_port=sw0-vir virtual_parent=sw0-p1 > > wait_for_ports_up sw0-vir > > check ovn-nbctl --wait=hv sync > > AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ > > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid > > check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 > > @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], > > OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], [vif-north.expected]) > > # Confirm that packets did not go out via tunnel port. > > - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > > + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 > > ]]) > > # Confirm that packet went out via localnet port > > @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) > > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') > > AT_CHECK([test ! -z $p2_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ > > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ > > reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo > > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xup]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > AT_CHECK([test ! -z $p1_zoneid]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) > > ovs-vsctl del-port hv1-vif2 > > OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) > > p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') > > @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) > > ovn-nbctl lsp-del sw0-p1 > > -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ > > +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ > > reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) > > p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') > > @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) > > check ovn-nbctl --wait=hv sync > > # Check OVS flows are installed properly. > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ > > grep "priority=2002" | grep conjunction | \ > > sed 's/conjunction([[^)]]*)/conjunction()/g' | \ > > sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() > > ]) > > OVN_CLEANUP([hv1]) > > @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=l > > ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 external_ids:iface-id=lsp0-1 > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 22]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 22]) > > # Save the current lflow_run counter > > lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > > @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) > > # 1. Remove half of the ports from pg1. The excepted conjunction flows should be: > > # 2 + 10 = 12 > > check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j in 0 1; do echo lsp${i}-${j}; done; done) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because the > > # port group const set should have only one member (lsp0-1). And the total > > @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l > > # 10. > > ovs-vsctl del-port br-int lsp0-0 > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 0]) > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc -l) == 10]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 0]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc -l) == 10]) > > # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. > > ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=lsp0-0 > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any change. > > ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 external_ids:iface-id=lsp9-0 > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) > > # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a different > > # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) > > ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 external_ids:iface-id=lsp1-0 > > ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 external_ids:iface-id=lsp1-1 > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) > > +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) > > # 6. Simulate a SB port-group "del and add" notification to ovn-controller in the > > # same IDL iteration. ovn-controller should still program the same flows. In > > @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do > > check ovn-nbctl --wait=hv sync > > # Finally check flow count is the same as before. > > - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) > > + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) > > done > > # Make sure all the above was performed with I-P (no recompute) > > @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'outport == "lp2" && ip4.src == 10.0. > > # The first ACL should be programmed, but the second one shouldn't. > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], [ignore]) > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) > > # Now create the lport lp2. > > check ovn-nbctl lsp-add lsw0 lp2 \ > > @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ > > check ovn-nbctl --wait=hv sync > > # Now the second ACL should be programmed. > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], [ignore]) > > # Remove the lport lp2 again, the OVS flow for the second ACL should be > > # removed. > > check ovn-nbctl --wait=hv lsp-del lp2 > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) > > # Test similar scenario but when the referenced lport is not bound locally. > > @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport == "lp4" && ip4.dst == 10.0.0 > > # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], [ignore]) > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], [ignore]) > > # Now create the lport lp4. > > check ovn-nbctl lsp-add lsw0 lp4 \ > > @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ > > # Now the ACL for lp4 should be programmed. > > check ovn-nbctl --wait=hv sync > > -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], [ignore]) > > +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], [ignore]) > > OVN_CLEANUP([hv1]) > > AT_CLEANUP > > @@ -33493,15 +33493,15 @@ done > > check ovn-nbctl --wait=hv sync > > # hv0 should see flows for lsp1 but not lsp2 > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [1]) > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [1]) > > # hv2 should see flows for lsp2 but not lsp1 > > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [0], [ignore]) > > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) > > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [0], [ignore]) > > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) > > # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 > > check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 > > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > > # Change it back, and trigger recompute to make sure extra flows are removed > > # from hv2 (recompute is needed because currently I-P adds local datapaths but > > @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ig > > check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 > > as hv2 check ovn-appctl -t ovn-controller recompute > > ovn-nbctl --wait=hv sync > > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) > > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) > > # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. > > AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) > > -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) > > +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) > > OVN_CLEANUP([hv1],[hv2]) > > AT_CLEANUP > > @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync > > # Use constants so that if tables or registers change, this test can > > # be updated easily. > > DNAT_TABLE=15 > > -SNAT_TABLE=45 > > +SNAT_TABLE=50 > > DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" > > SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" > > @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync > > wait_for_ports_up > > OVN_POPULATE_ARP > > -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c controller], [0],[dnl > > +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c controller], [0],[dnl > > 9 > > ]) > > @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) > > send_garp 1 1 $eth_src $eth_dst $spa $tpa > > OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ > > -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) > > +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) > > sleep_controller hv1 > > @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ > > OVS_APP_EXIT_AND_WAIT([ovsdb-server]) > > AT_CLEANUP > > + > > +OVN_FOR_EACH_NORTHD([ > > +AT_SETUP([QoS packet marking]) > > +AT_KEYWORDS([ovn-qos-pkt-marking]) > > +AT_SKIP_IF([test $HAVE_SCAPY = no]) > > +ovn_start > > + > > +check ovn-nbctl lr-add lr0 > > +check ovn-nbctl ls-add ls0 > > +check ovn-nbctl ls-add ls1 > > + > > +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 > > +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ > > + set Logical_Switch_Port lrp-s0 type=router \ > > + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' > > +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 > > +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ > > + set Logical_Switch_Port lrp-s1 type=router \ > > + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' > > + > > +check ovn-nbctl --wait=sb lsp-add ls0 lp0 > > +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 > > +check ovn-nbctl --wait=sb lsp-add ls0 lp1 > > +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 > > + > > +check ovn-nbctl --wait=sb lsp-add ls1 lp2 > > +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 > > +check ovn-nbctl --wait=sb sync > > + > > +net_add n1 > > +sim_add hv > > + > > +as hv > > +check ovs-vsctl add-br br-phys > > +ovn_attach n1 br-phys 192.168.0.1 > > + > > +check ovs-vsctl add-port br-int vif0 -- \ > > + set Interface vif0 external-ids:iface-id=lp0 \ > > + options:tx_pcap=hv/vif0-tx.pcap \ > > + options:rxq_pcap=hv/vif0-rx.pcap \ > > + ofport-request=1 > > +check ovs-vsctl add-port br-int vif1 -- \ > > + set Interface vif1 external-ids:iface-id=lp1 \ > > + options:tx_pcap=hv/vif1-tx.pcap \ > > + options:rxq_pcap=hv/vif1-rx.pcap \ > > + ofport-request=2 > > +check ovs-vsctl add-port br-int vif2 -- \ > > + set Interface vif2 external-ids:iface-id=lp2 \ > > + options:tx_pcap=hv/vif2-tx.pcap \ > > + options:rxq_pcap=hv/vif2-rx.pcap \ > > + ofport-request=3 > > + > > +# Create QoS rules for packet marking. > > +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" mark=48 > > +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" mark=49 > > +check_row_count nb:QoS 2 > > + > > +# Create some flows to count pkt marking. > > +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark == 48" drop > > +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop > > +wait_for_ports_up > > +check ovn-nbctl --wait=hv sync > > + > > +send_udp_packet() { > > + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 > > + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ > > + IP(src='${ipv4_src}', dst='${ipv4_dst}', ttl=0x40)/ \ > > + UDP(sport=4242, dport=4343)") > > + as hv ovs-appctl netdev-dummy/receive vif$inport $packet > > +} > > + > > +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=ls0)) > > +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) > > + > > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 > > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) > > + > > +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 > > +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) > > + > > +OVN_CLEANUP([hv]) > > +AT_CLEANUP > > +]) > > diff --git a/tests/system-ovn.at b/tests/system-ovn.at > > index cb4124b70..1277f1057 100644 > > --- a/tests/system-ovn.at > > +++ b/tests/system-ovn.at > > @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > > ovn-sbctl dump-flows R2 > > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > > grep 'nat(src=20.0.0.2)']) > > check ovs-appctl dpctl/flush-conntrack > > @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 > > ovn-nbctl list load_balancer > > ovn-sbctl dump-flows R2 > > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ > > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ > > grep 'nat(src=20.0.0.2)']) > > rm -f wget*.log > > @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ > > ]) > > OVS_WAIT_UNTIL([ > > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > > grep controller | grep tp_dst=84 -c) > > test $n_pkt -eq 1 > > ]) > > @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ > > ]) > > OVS_WAIT_UNTIL([ > > - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ > > + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ > > grep controller | grep tp_dst=84 -c) > > test $n_pkt -eq 1 > > ]) > > @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast > > wait_igmp_flows_installed() > > { > > - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ > > + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ > > grep 'priority=90' | grep "nw_dst=$1"]) > > } > > @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:12345,192 > > ovn-nbctl list load_balancer > > ovn-sbctl dump-flows R2 > > -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep 'nat(src=20.0.0.2)']) > > +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep 'nat(src=20.0.0.2)']) > > dnl Test load-balancing that includes L4 ports in NAT. > > for i in `seq 1 20`; do > > diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml > > index 6f74bd557..f838393a6 100644 > > --- a/utilities/ovn-nbctl.8.xml > > +++ b/utilities/ovn-nbctl.8.xml > > @@ -482,6 +482,9 @@ > > <code>burst=</code><var>burst</var> specifies the burst rate > > limit in kilobits. <code>dscp</code> and/or <code>rate</code> > > are required arguments. > > + If <code>mark=</code><var>mark</var> is specified, then matching > > + packets will be marked (through <code>pkt.mark</code>). > > + <var>mark</var> must be a positive integer. > > </p> > > <p> > > diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c > > index 526369b68..0620d333a 100644 > > --- a/utilities/ovn-nbctl.c > > +++ b/utilities/ovn-nbctl.c > > @@ -283,7 +283,7 @@ ACL commands:\n\ > > print ACLs for SWITCH\n\ > > \n\ > > QoS commands:\n\ > > - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP]\n\ > > + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP] [mark=MARK]\n\ > > add an QoS rule to SWITCH\n\ > > qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ > > remove QoS rules from SWITCH\n\ > > @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) > > if (!strcmp(qos_rule->key_action[j], "dscp")) { > > ds_put_format(&ctx->output, " dscp=%"PRId64"", > > qos_rule->value_action[j]); > > + } else if (!strcmp(qos_rule->key_action[j], "mark")) { > > + ds_put_format(&ctx->output, " mark=%"PRId64"", > > + qos_rule->value_action[j]); > > } > > } > > ds_put_cstr(&ctx->output, "\n"); > > @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) > > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); > > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); > > ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); > > + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); > > } > > static void > > @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) > > const char *direction; > > int64_t priority; > > int64_t dscp = -1; > > + int64_t mark = 0; > > int64_t rate = 0; > > int64_t burst = 0; > > char *error; > > @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) > > return; > > } > > } > > + else if (!strncmp(ctx->argv[i], "mark=", 5)) { > > + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < 0) { > > + ctl_error(ctx, "%s: mark must be a positive integer", > > + ctx->argv[i] + 5); > > + return; > > + } > > + } > > else if (!strncmp(ctx->argv[i], "rate=", 5)) { > > if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) > > || rate < 1 || rate > UINT32_MAX) { > > @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) > > } > > } else { > > ctl_error(ctx, "%s: supported arguments are \"dscp=\", \"rate=\", " > > - "and \"burst=\"", ctx->argv[i]); > > + "\"burst=\" and \"mark=\"", ctx->argv[i]); > > return; > > } > > } > > /* Validate rate and dscp. */ > > - if (-1 == dscp && !rate) { > > - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be specified"); > > + if (-1 == dscp && !rate && !mark) { > > + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be " > > + "specified"); > > return; > > } > > @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) > > nbrec_qos_set_priority(qos, priority); > > nbrec_qos_set_direction(qos, direction); > > nbrec_qos_set_match(qos, ctx->argv[4]); > > + if (mark) { > > + nbrec_qos_update_action_setkey(qos, "mark", mark); > > + } > > if (-1 != dscp) { > > - const char *dscp_key = "dscp"; > > - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); > > + nbrec_qos_update_action_setkey(qos, "dscp", dscp); > > } > > if (rate) { > > const char *bandwidth_key[2] = {"rate", "burst"}; >
diff --git a/NEWS b/NEWS index 6553bd078..7300345f1 100644 --- a/NEWS +++ b/NEWS @@ -18,6 +18,8 @@ Post v23.09.0 - Support selecting encapsulation IP based on the source/destination VIF's settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more details. + - Add the capbility to mark (through pkt.mark) incoming/outgoing packets + in the logical switch datapath according to user configured QoS rule. OVN v23.09.0 - 15 Sep 2023 -------------------------- diff --git a/controller/lflow.h b/controller/lflow.h index 9b7ffa19c..f7f6c7950 100644 --- a/controller/lflow.h +++ b/controller/lflow.h @@ -67,17 +67,20 @@ struct uuid; /* Start of LOG_PIPELINE_LEN tables. */ #define OFTABLE_LOG_INGRESS_PIPELINE 8 -#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 37 -#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 38 -#define OFTABLE_REMOTE_OUTPUT 39 -#define OFTABLE_LOCAL_OUTPUT 40 -#define OFTABLE_CHECK_LOOPBACK 41 +#define OFTABLE_OUTPUT_LARGE_PKT_DETECT 42 +#define OFTABLE_OUTPUT_LARGE_PKT_PROCESS 43 +#define OFTABLE_REMOTE_OUTPUT 44 +#define OFTABLE_LOCAL_OUTPUT 45 +#define OFTABLE_CHECK_LOOPBACK 46 /* Start of the OUTPUT section of the pipeline. */ #define OFTABLE_OUTPUT_INIT OFTABLE_OUTPUT_LARGE_PKT_DETECT +BUILD_ASSERT_DECL( + OFTABLE_LOG_INGRESS_PIPELINE + LOG_PIPELINE_LEN < OFTABLE_OUTPUT_INIT +); /* Start of LOG_PIPELINE_LEN tables. */ -#define OFTABLE_LOG_EGRESS_PIPELINE 42 +#define OFTABLE_LOG_EGRESS_PIPELINE 47 #define OFTABLE_SAVE_INPORT 64 #define OFTABLE_LOG_TO_PHY 65 #define OFTABLE_MAC_BINDING 66 diff --git a/lib/ovn-util.h b/lib/ovn-util.h index 2afff0d07..3e1d68cf9 100644 --- a/lib/ovn-util.h +++ b/lib/ovn-util.h @@ -305,7 +305,7 @@ BUILD_ASSERT_DECL( #define SCTP_ABORT_CHUNK_FLAG_T (1 << 0) /* The number of tables for the ingress and egress pipelines. */ -#define LOG_PIPELINE_LEN 29 +#define LOG_PIPELINE_LEN 30 static inline uint32_t hash_add_in6_addr(uint32_t hash, const struct in6_addr *addr) diff --git a/northd/northd.c b/northd/northd.c index d2091d4bc..597d203ca 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -134,22 +134,23 @@ enum ovn_stage { PIPELINE_STAGE(SWITCH, IN, LB_AFF_CHECK, 12, "ls_in_lb_aff_check") \ PIPELINE_STAGE(SWITCH, IN, LB, 13, "ls_in_lb") \ PIPELINE_STAGE(SWITCH, IN, LB_AFF_LEARN, 14, "ls_in_lb_aff_learn") \ - PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 15, "ls_in_pre_hairpin") \ - PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 16, "ls_in_nat_hairpin") \ - PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 17, "ls_in_hairpin") \ - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 18, \ + PIPELINE_STAGE(SWITCH, IN, QOS_PKT_MARK, 15, "ls_in_qos_pkt_mark") \ + PIPELINE_STAGE(SWITCH, IN, PRE_HAIRPIN, 16, "ls_in_pre_hairpin") \ + PIPELINE_STAGE(SWITCH, IN, NAT_HAIRPIN, 17, "ls_in_nat_hairpin") \ + PIPELINE_STAGE(SWITCH, IN, HAIRPIN, 18, "ls_in_hairpin") \ + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_EVAL, 19, \ "ls_in_acl_after_lb_eval") \ - PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 19, \ + PIPELINE_STAGE(SWITCH, IN, ACL_AFTER_LB_ACTION, 20, \ "ls_in_acl_after_lb_action") \ - PIPELINE_STAGE(SWITCH, IN, STATEFUL, 20, "ls_in_stateful") \ - PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 21, "ls_in_arp_rsp") \ - PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 22, "ls_in_dhcp_options") \ - PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 23, "ls_in_dhcp_response") \ - PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 24, "ls_in_dns_lookup") \ - PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 25, "ls_in_dns_response") \ - PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 26, "ls_in_external_port") \ - PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 27, "ls_in_l2_lkup") \ - PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 28, "ls_in_l2_unknown") \ + PIPELINE_STAGE(SWITCH, IN, STATEFUL, 21, "ls_in_stateful") \ + PIPELINE_STAGE(SWITCH, IN, ARP_ND_RSP, 22, "ls_in_arp_rsp") \ + PIPELINE_STAGE(SWITCH, IN, DHCP_OPTIONS, 23, "ls_in_dhcp_options") \ + PIPELINE_STAGE(SWITCH, IN, DHCP_RESPONSE, 24, "ls_in_dhcp_response") \ + PIPELINE_STAGE(SWITCH, IN, DNS_LOOKUP, 25, "ls_in_dns_lookup") \ + PIPELINE_STAGE(SWITCH, IN, DNS_RESPONSE, 26, "ls_in_dns_response") \ + PIPELINE_STAGE(SWITCH, IN, EXTERNAL_PORT, 27, "ls_in_external_port") \ + PIPELINE_STAGE(SWITCH, IN, L2_LKUP, 28, "ls_in_l2_lkup") \ + PIPELINE_STAGE(SWITCH, IN, L2_UNKNOWN, 29, "ls_in_l2_unknown") \ \ /* Logical switch egress stages. */ \ PIPELINE_STAGE(SWITCH, OUT, PRE_ACL, 0, "ls_out_pre_acl") \ @@ -161,8 +162,9 @@ enum ovn_stage { PIPELINE_STAGE(SWITCH, OUT, QOS_MARK, 6, "ls_out_qos_mark") \ PIPELINE_STAGE(SWITCH, OUT, QOS_METER, 7, "ls_out_qos_meter") \ PIPELINE_STAGE(SWITCH, OUT, STATEFUL, 8, "ls_out_stateful") \ - PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 9, "ls_out_check_port_sec") \ - PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 10, "ls_out_apply_port_sec") \ + PIPELINE_STAGE(SWITCH, OUT, QOS_PKT_MARK, 9, "ls_out_qos_pkt_mark") \ + PIPELINE_STAGE(SWITCH, OUT, CHECK_PORT_SEC, 10, "ls_out_check_port_sec") \ + PIPELINE_STAGE(SWITCH, OUT, APPLY_PORT_SEC, 11, "ls_out_apply_port_sec") \ \ /* Logical router ingress stages. */ \ PIPELINE_STAGE(ROUTER, IN, ADMISSION, 0, "lr_in_admission") \ @@ -8363,6 +8365,8 @@ build_acls(struct ovn_datapath *od, const struct chassis_features *features, ds_destroy(&actions); } +#define QOS_MAX_DSCP 63 + static void build_qos(struct ovn_datapath *od, struct hmap *lflows) { struct ds action = DS_EMPTY_INITIALIZER; @@ -8371,16 +8375,26 @@ build_qos(struct ovn_datapath *od, struct hmap *lflows) { ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_MARK, 0, "1", "next;"); ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_METER, 0, "1", "next;"); ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_METER, 0, "1", "next;"); + ovn_lflow_add(lflows, od, S_SWITCH_IN_QOS_PKT_MARK, 0, "1", "next;"); + ovn_lflow_add(lflows, od, S_SWITCH_OUT_QOS_PKT_MARK, 0, "1", "next;"); for (size_t i = 0; i < od->nbs->n_qos_rules; i++) { struct nbrec_qos *qos = od->nbs->qos_rules[i]; bool ingress = !strcmp(qos->direction, "from-lport") ? true :false; enum ovn_stage stage = ingress ? S_SWITCH_IN_QOS_MARK : S_SWITCH_OUT_QOS_MARK; + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); int64_t rate = 0; int64_t burst = 0; for (size_t j = 0; j < qos->n_action; j++) { if (!strcmp(qos->key_action[j], "dscp")) { + if (qos->value_action[j] > QOS_MAX_DSCP) { + VLOG_WARN_RL(&rl, "bad 'dscp' value %"PRId64" in qos " + UUID_FMT, qos->value_action[j], + UUID_ARGS(&qos->header_.uuid)); + continue; + } + ds_clear(&action); ds_put_format(&action, "ip.dscp = %"PRId64"; next;", qos->value_action[j]); @@ -8388,6 +8402,15 @@ build_qos(struct ovn_datapath *od, struct hmap *lflows) { qos->priority, qos->match, ds_cstr(&action), &qos->header_); + } else if (!strcmp(qos->key_action[j], "mark")) { + ds_clear(&action); + ds_put_format(&action, "pkt.mark = %"PRId64"; next;", + qos->value_action[j]); + ovn_lflow_add_with_hint(lflows, od, + ingress ? S_SWITCH_IN_QOS_PKT_MARK + : S_SWITCH_OUT_QOS_PKT_MARK, + qos->priority, qos->match, ds_cstr(&action), + &qos->header_); } } diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml index 068d47e1a..c1cd19947 100644 --- a/northd/ovn-northd.8.xml +++ b/northd/ovn-northd.8.xml @@ -1082,7 +1082,28 @@ </li> </ul> - <h3>Ingress Table 15: Pre-Hairpin</h3> + <h3>Ingress Table 15: <code>from-lport</code> QoS-Pkt-Mark</h3> + + <p> + Logical flows in this table closely reproduce those in the + <code>QoS</code> table with the <code>action</code> column set in + the <code>OVN_Northbound</code> database for the + <code>from-lport</code> direction. + </p> + + <ul> + <li> + For every qos_rules entry in a logical switch with packet marking + enabled, a flow will be added at the priority mentioned in the + QoS table. + </li> + + <li> + A priority-0 flow that simply moves traffic to the next table. + </li> + </ul> + + <h3>Ingress Table 16: Pre-Hairpin</h3> <ul> <li> If the logical switch has load balancer(s) configured, then a @@ -1100,7 +1121,7 @@ </li> </ul> - <h3>Ingress Table 16: Nat-Hairpin</h3> + <h3>Ingress Table 17: Nat-Hairpin</h3> <ul> <li> If the logical switch has load balancer(s) configured, then a @@ -1135,7 +1156,7 @@ </li> </ul> - <h3>Ingress Table 17: Hairpin</h3> + <h3>Ingress Table 18: Hairpin</h3> <ul> <li> <p> @@ -1173,7 +1194,7 @@ </li> </ul> - <h3>Ingress table 18: <code>from-lport</code> ACL evaluation after LB</h3> + <h3>Ingress table 19: <code>from-lport</code> ACL evaluation after LB</h3> <p> Logical flows in this table closely reproduce those in the @@ -1257,7 +1278,7 @@ </li> </ul> - <h3>Ingress Table 19: <code>from-lport</code> ACL action after LB</h3> + <h3>Ingress Table 20: <code>from-lport</code> ACL action after LB</h3> <p> Logical flows in this table decide how to proceed based on the values of @@ -1297,7 +1318,7 @@ </li> </ul> - <h3>Ingress Table 20: Stateful</h3> + <h3>Ingress Table 21: Stateful</h3> <ul> <li> @@ -1320,7 +1341,7 @@ </li> </ul> - <h3>Ingress Table 21: ARP/ND responder</h3> + <h3>Ingress Table 22: ARP/ND responder</h3> <p> This table implements ARP/ND responder in a logical switch for known @@ -1653,7 +1674,7 @@ output; </li> </ul> - <h3>Ingress Table 22: DHCP option processing</h3> + <h3>Ingress Table 23: DHCP option processing</h3> <p> This table adds the DHCPv4 options to a DHCPv4 packet from the @@ -1714,7 +1735,7 @@ next; </li> </ul> - <h3>Ingress Table 23: DHCP responses</h3> + <h3>Ingress Table 24: DHCP responses</h3> <p> This table implements DHCP responder for the DHCP replies generated by @@ -1795,7 +1816,7 @@ output; </li> </ul> - <h3>Ingress Table 24 DNS Lookup</h3> + <h3>Ingress Table 25 DNS Lookup</h3> <p> This table looks up and resolves the DNS names to the corresponding @@ -1824,7 +1845,7 @@ reg0[4] = dns_lookup(); next; </li> </ul> - <h3>Ingress Table 25 DNS Responses</h3> + <h3>Ingress Table 26 DNS Responses</h3> <p> This table implements DNS responder for the DNS replies generated by @@ -1859,7 +1880,7 @@ output; </li> </ul> - <h3>Ingress table 26 External ports</h3> + <h3>Ingress table 27 External ports</h3> <p> Traffic from the <code>external</code> logical ports enter the ingress @@ -1902,7 +1923,7 @@ output; </li> </ul> - <h3>Ingress Table 27 Destination Lookup</h3> + <h3>Ingress Table 28 Destination Lookup</h3> <p> This table implements switching behavior. It contains these logical @@ -2078,7 +2099,7 @@ output; </li> </ul> - <h3>Ingress Table 28 Destination unknown</h3> + <h3>Ingress Table 29 Destination unknown</h3> <p> This table handles the packets whose destination was not found or @@ -2312,7 +2333,14 @@ output; there are no rules added for load balancing new connections. </p> - <h3>Egress Table 9: Egress Port Security - check</h3> + <h3>Egress Table 9: <code>to-lport</code> QoS-Pkt-Mark</h3> + + <p> + This is similar to ingress table <code>QoS marking</code> except + they apply to <code>to-lport</code> QoS rules. + </p> + + <h3>Egress Table 10: Egress Port Security - check</h3> <p> This is similar to the port security logic in table @@ -2341,7 +2369,7 @@ output; </li> </ul> - <h3>Egress Table 10: Egress Port Security - Apply</h3> + <h3>Egress Table 11: Egress Port Security - Apply</h3> <p> This is similar to the ingress port security logic in ingress table diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema index b2e0993e0..7bb8f36c0 100644 --- a/ovn-nb.ovsschema +++ b/ovn-nb.ovsschema @@ -1,7 +1,7 @@ { "name": "OVN_Northbound", - "version": "7.2.0", - "cksum": "1069338687 34162", + "version": "7.3.0", + "cksum": "2786772995 34106", "tables": { "NB_Global": { "columns": { @@ -293,10 +293,9 @@ "enum": ["set", ["from-lport", "to-lport"]]}}}, "match": {"type": "string"}, "action": {"type": {"key": {"type": "string", - "enum": ["set", ["dscp"]]}, + "enum": ["set", ["dscp", "mark"]]}, "value": {"type": "integer", - "minInteger": 0, - "maxInteger": 63}, + "minInteger": 0}, "min": 0, "max": "unlimited"}}, "bandwidth": {"type": {"key": {"type": "string", "enum": ["set", ["rate", diff --git a/ovn-nb.xml b/ovn-nb.xml index 765ffcf2e..5b593f6a7 100644 --- a/ovn-nb.xml +++ b/ovn-nb.xml @@ -2808,12 +2808,22 @@ or </column> <column name="action"> - <p>When specified, matching flows will have DSCP marking applied.</p> + <p> + When <code>dscp</code> action is specified, matching flows will have + have DSCP marking applied. + When <code>mark</code> action is specified, matching flows will have + packet marking applied. + </p> + <ul> <li> <code>dscp</code>: The value of this action should be in the range of 0 to 63 (inclusive). </li> + <li> + <code>mark</code>: The value of this action should be a positive + integer. + </li> </ul> </column> diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at index b3d536471..5427d2d14 100644 --- a/tests/ovn-controller.at +++ b/tests/ovn-controller.at @@ -874,7 +874,7 @@ meta=$(ovn-sbctl get datapath ls1 tunnel_key) port=$(ovn-sbctl get port_binding ls1-rp tunnel_key) check ovn-nbctl lrp-add lr0 rp-ls1 00:00:01:01:02:03 192.168.1.254/24 -OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=40 | grep -q "reg15=0x${port},metadata=0x${meta}"]) +OVS_WAIT_UNTIL([as hv1 ovs-ofctl dump-flows br-int | grep table=45 | grep -q "reg15=0x${port},metadata=0x${meta}"]) OVN_CLEANUP([hv1]) AT_CLEANUP @@ -918,14 +918,14 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x1,metadata=0x1,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i ]) done @@ -940,15 +940,15 @@ for i in $(seq 10); do check ovn-nbctl remove address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 9; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}'], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - $i)) ]) fi done @@ -966,17 +966,17 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 2)) ]) done @@ -993,11 +993,11 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ remove address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1009,9 +1009,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ add address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], [0], [1 ]) reprocess_count_new=$(read_counter consider_logical_flow) @@ -1024,9 +1024,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ remove address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1038,12 +1038,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ remove address_set as1 addresses 10.0.0.9,10.0.0.8 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1091,24 +1091,24 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 1; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else # (1 conj_id flow + 3 tp_dst flows) = 4 extra flows - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i + 4)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i + 4)) ]) fi if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=conjunction,1/2) @@ -1130,17 +1130,17 @@ for i in $(seq 10); do check ovn-nbctl remove address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) elif test "$i" = 9; then # no conjunction left - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=111 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=222 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,tp_dst=333 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((14 - $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((14 - $i)) ]) fi done @@ -1156,11 +1156,11 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=conjunction,1/2) @@ -1172,7 +1172,7 @@ priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=222 actions=conjun priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,tp_dst=333 actions=conjunction,2/2) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 2 + 4)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 2 + 4)) ]) done @@ -1188,11 +1188,11 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ remove address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1204,9 +1204,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl remove address_set as1 addresses 10.0.0.21,10.0.0.22 -- \ add address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.21], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.22], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.10], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.21], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.22], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.10], [0], [1 ]) reprocess_count_new=$(read_counter consider_logical_flow) @@ -1219,9 +1219,9 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.21 -- \ remove address_set as1 addresses 10.0.0.10 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.21], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.21], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.10], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.10], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1233,12 +1233,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.22,10.0.0.23 -- \ remove address_set as1 addresses 10.0.0.9,10.0.0.8 check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.22], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.22], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c 10\.0\.0\.23], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c 10\.0\.0\.23], [0], [1 ]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.8], [1], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10\.0\.0\.9], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.8], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10\.0\.0\.9], [1], [ignore]) reprocess_count_new=$(read_counter consider_logical_flow) AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [0 @@ -1288,22 +1288,22 @@ for i in $(seq 10); do add address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 1; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) ]) fi if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=conjunction,1/2) @@ -1327,15 +1327,15 @@ for i in $(seq 10); do remove address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) elif test "$i" = 9; then # no conjunction left - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.15 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((21 - $i*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((21 - $i*2)) ]) fi done @@ -1356,14 +1356,14 @@ for i in $(seq 2 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i ]) done @@ -1382,16 +1382,16 @@ for i in $(seq 10); do check ovn-nbctl remove address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 9; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}'], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) elif test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) else # 2 dst + (10 - i) src + 1 conj_id - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - $i + 3)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - $i + 3)) ]) fi done @@ -1445,27 +1445,27 @@ for i in $(seq 10); do add address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 1; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2)) ]) fi if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi done @@ -1483,9 +1483,9 @@ for i in $(seq 10); do remove address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((20 - $i*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((20 - $i*2)) ]) fi done @@ -1541,30 +1541,30 @@ for i in $(seq 10); do add address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 1; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) elif test "$i" -lt 6; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2)) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 + $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 + $i)) ]) fi if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,/conj_id=,/' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.6 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.7 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.8 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi done @@ -1582,12 +1582,12 @@ for i in $(seq 10); do remove address_set as2 addresses 10.0.0.$j check ovn-nbctl --wait=hv sync if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) elif test "$i" -lt 6; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((15 - $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((15 - $i)) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((10 - ($i - 5)*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((10 - ($i - 5)*2)) ]) fi done @@ -1639,22 +1639,22 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 1; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.1,nw_dst=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else # (1 conj_id + nw_src * i + nw_dst * i) = 1 + i*2 flows - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i*2 + 1)) ]) fi if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) @@ -1676,15 +1676,15 @@ for i in $(seq 10); do check ovn-nbctl remove address_set as1 addresses 10.0.0.$i check ovn-nbctl --wait=hv sync if test "$i" = 10; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) elif test "$i" = 9; then # no conjunction left - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.10,nw_dst=10.0.0.10 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((21 - $i*2)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((21 - $i*2)) ]) fi done @@ -1700,11 +1700,11 @@ for i in $(seq 10); do check ovn-nbctl add address_set as1 addresses 10.0.0.$i,10.0.1.$i check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) @@ -1719,7 +1719,7 @@ priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.2 actions=co priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.1.3 actions=conjunction,2/2) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$(($i * 4 + 1)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$(($i * 4 + 1)) ]) done @@ -1740,11 +1740,11 @@ check ovn-nbctl --wait=hv sync reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.4,10.0.0.5 check ovn-nbctl --wait=hv sync -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) @@ -1764,11 +1764,11 @@ AT_CHECK([echo $(($reprocess_count_new - $reprocess_count_old))], [0], [1 # Delete 2 IPs reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl --wait=hv remove address_set as1 addresses 10.0.0.4,10.0.0.5 -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.*,/conjunction,/' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.1 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.2 actions=conjunction,1/2) priority=1100,ip,reg15=0x$port_key,metadata=0x$dp_key,nw_dst=10.0.0.3 actions=conjunction,1/2) @@ -1822,12 +1822,12 @@ check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as2 && tcp && tcp.dst == {201, 202}' drop check ovn-nbctl --wait=hv sync -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) @@ -1847,12 +1847,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl add address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ add address_set as2 addresses 10.0.0.24,10.0.0.33 check ovn-nbctl --wait=hv sync -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) @@ -1878,12 +1878,12 @@ reprocess_count_old=$(read_counter consider_logical_flow) check ovn-nbctl remove address_set as1 addresses 10.0.0.14,10.0.0.33 -- \ remove address_set as2 addresses 10.0.0.24,10.0.0.33 check ovn-nbctl --wait=hv sync -AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ +AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | \ sed -r 's/conjunction.[[0-9]]*,/conjunction,/g' | \ sed -r 's/conj_id=.*,metadata/conj_id=,metadata/' | sort], [0], [dnl -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,conj_id=,metadata=0x$dp_key actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.11 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.12 actions=conjunction,1/2) priority=1100,tcp,reg15=0x$port_key,metadata=0x$dp_key,nw_src=10.0.0.13 actions=conjunction,1/2) @@ -1943,14 +1943,14 @@ for i in $(seq 5); do check ovn-nbctl add address_set as1 addresses "aa\:aa\:aa\:aa\:aa\:0$i" check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:01 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:02 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:03 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i ]) done @@ -1964,17 +1964,17 @@ reprocess_count_old=$(read_counter consider_logical_flow) for i in $(seq 5); do check ovn-nbctl remove address_set as1 addresses "aa\:aa\:aa\:aa\:aa\:0$i" check ovn-nbctl --wait=hv sync - ovs-ofctl dump-flows br-int table=46 | grep "priority=1100" + ovs-ofctl dump-flows br-int table=51 | grep "priority=1100" if test "$i" = 4; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}'], [0], [dnl -priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,reg15=0x$port_key,metadata=0x$dp_key,dl_src=aa:aa:aa:aa:aa:05 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi if test "$i" = 5; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 - $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 - $i)) ]) fi done @@ -2024,14 +2024,14 @@ for i in $(seq 5); do check ovn-nbctl add address_set as1 addresses "ff\:\:0$i" check ovn-nbctl --wait=hv sync if test "$i" = 3; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}' | sort], [0], [dnl -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::1 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::2 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::3 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$i + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$i ]) done @@ -2046,15 +2046,15 @@ for i in $(seq 5); do check ovn-nbctl remove address_set as1 addresses "ff\:\:0$i" check ovn-nbctl --wait=hv sync if test "$i" = 4; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46,reg15=0x$port_key | \ + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51,reg15=0x$port_key | \ grep -v reply | awk '{print $7, $8}'], [0], [dnl -priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,47) +priority=1100,ipv6,reg15=0x$port_key,metadata=0x$dp_key,ipv6_src=ff::5 actions=load:0x1->OXM_OF_PKT_REG4[[49]],resubmit(,52) ]) fi if test "$i" = 5; then - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep "priority=1100"], [1], [ignore]) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep "priority=1100"], [1], [ignore]) else - AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [$((5 - $i)) + AT_CHECK_UNQUOTED([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [$((5 - $i)) ]) fi done @@ -2089,7 +2089,7 @@ ovn-appctl -t ovn-controller vlog/set file:dbg ovn-nbctl create address_set name=as1 addresses=8.8.8.8 check ovn-nbctl acl-add ls1 to-lport 100 'outport == "ls1-lp1" && ip4.src == $as1' drop check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100"], [0], [1 +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100"], [0], [1 ]) # pause ovn-northd @@ -2104,13 +2104,13 @@ check as northd ovn-appctl -t ovn-northd pause # undefined. This test runs the scenario ten times to make sure different # orders are covered and handled properly. -flow_count=$(ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100") +flow_count=$(ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100") for i in $(seq 10); do # Delete and recreate the SB address set with same name and an extra IP. addrs_=$(fetch_column address_set addresses name=as1) addrs=${addrs_// /,} AT_CHECK([ovn-sbctl destroy address_set as1 -- create address_set name=as1 addresses=$addrs,1.1.1.$i], [0], [ignore]) - OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=46 | grep -c "priority=1100") = "$(($i + 1))"]) + OVS_WAIT_UNTIL([test $(as hv1 ovs-ofctl dump-flows br-int table=51 | grep -c "priority=1100") = "$(($i + 1))"]) done OVN_CLEANUP([hv1]) @@ -2698,7 +2698,7 @@ done wait_for_ports_up ovn-nbctl --wait=hv sync -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=40 | grep reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], [0],[dnl +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=45 | grep reg15=0x8000,metadata=0x1 | grep -c "controller(userdata=00.00.00.1b"], [0],[dnl 3 ]) @@ -2707,7 +2707,7 @@ for i in $(seq 1 280); do done ovn-nbctl --wait=hv sync -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q controller], [1]) +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -q controller], [1]) OVN_CLEANUP([hv1]) AT_CLEANUP diff --git a/tests/ovn-nbctl.at b/tests/ovn-nbctl.at index 7f37d7716..b11e4ec6b 100644 --- a/tests/ovn-nbctl.at +++ b/tests/ovn-nbctl.at @@ -316,6 +316,8 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 400 tcp dscp=0 rate=300 burst=3000]) AT_CHECK([ovn-nbctl qos-add ls0 to-lport 300 tcp dscp=48]) AT_CHECK([ovn-nbctl qos-add ls0 to-lport 200 ip rate=101]) AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=13 rate=301 burst=30000]) +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 101 ip4 mark=15]) +AT_CHECK([ovn-nbctl qos-add ls0 to-lport 102 ip4 dscp=16 mark=17]) dnl Add duplicated qos AT_CHECK([ovn-nbctl qos-add ls0 to-lport 100 ip4 dscp=11 rate=302 burst=30002], [1], [], [stderr]) @@ -328,6 +330,8 @@ from-lport 500 (udp) rate=100 burst=1000 from-lport 400 (tcp) rate=300 burst=3000 dscp=0 to-lport 300 (tcp) dscp=48 to-lport 200 (ip) rate=101 + to-lport 102 (ip4) dscp=16 mark=17 + to-lport 101 (ip4) mark=15 to-lport 100 (ip4) rate=301 burst=30000 dscp=13 ]) @@ -371,11 +375,11 @@ AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscp=-1], [1], [], ]) AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip dscpa=-1], [1], [], -[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", and "burst=" +[ovn-nbctl: dscpa=-1: supported arguments are "dscp=", "rate=", "burst=" and "mark=" ]) AT_CHECK([ovn-nbctl qos-add ls0 from-lport 600 ip burst=123], [1], [], -[ovn-nbctl: Either "rate" and/or "dscp" must be specified +[ovn-nbctl: Either "mark", "rate" and/or "dscp" must be specified ])]) dnl --------------------------------------------------------------------- diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at index 67e81ddba..6a27b7dcf 100644 --- a/tests/ovn-northd.at +++ b/tests/ovn-northd.at @@ -2621,9 +2621,9 @@ check ovn-nbctl --wait=sb \ -- ls-lb-add ls lb AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e ls_in_acl_after_lb_eval | sort], [0], [dnl - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == 1), action=(reg8[[16]] = 1; next;) + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(reg0[[17]] == 1), action=(reg8[[16]] = 1; next;) table=3 (ls_out_acl_hint ), priority=0 , match=(1), action=(next;) table=3 (ls_out_acl_hint ), priority=1 , match=(ct.est && ct_mark.blocked == 0), action=(reg0[[10]] = 1; next;) table=3 (ls_out_acl_hint ), priority=2 , match=(ct.est && ct_mark.blocked == 1), action=(reg0[[9]] = 1; next;) @@ -2666,8 +2666,8 @@ ovn-nbctl --wait=sb clear logical_switch ls acls ovn-nbctl --wait=sb clear logical_switch ls load_balancer AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e ls_in_acl_eval -e ls_out_acl_eval -e ls_in_acl_after_lb_eval | sort], [0], [dnl - table=18(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) - table=18(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) + table=19(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;) + table=19(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;) table=4 (ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) table=4 (ls_out_acl_eval ), priority=65535, match=(1), action=(next;) @@ -7714,7 +7714,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -7751,7 +7751,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -7788,7 +7788,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -7842,7 +7842,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) @@ -7898,7 +7898,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -7935,7 +7935,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -7972,7 +7972,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;) @@ -8026,7 +8026,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) @@ -8081,7 +8081,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) @@ -8118,7 +8118,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) @@ -8155,7 +8155,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) table=??(ls_out_acl_eval ), priority=34000, match=(eth.src == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) @@ -8208,7 +8208,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/ table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;) table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) table=??(ls_out_acl_eval ), priority=0 , match=(1), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;) table=??(ls_out_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) @@ -8372,6 +8372,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) @@ -8379,8 +8381,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) check ovn-nbctl lsp-add sw0 sw0p1 -- lsp-set-addresses sw0p1 "00:00:00:00:00:01" @@ -8398,6 +8398,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) @@ -8407,8 +8409,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) check ovn-nbctl lsp-set-port-security sw0p1 "00:00:00:00:00:01 10.0.0.3 1000::3" @@ -8425,6 +8425,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) @@ -8434,8 +8436,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) # Disable sw0p1 @@ -8453,6 +8453,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;) @@ -8463,8 +8465,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "sw0p1"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) check ovn-nbctl --wait=sb lsp-set-options sw0p2 qdisc_queue_id=10 @@ -8481,6 +8481,8 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=110 , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) @@ -8492,8 +8494,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "sw0p1"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) check ovn-nbctl set logical_switch_port sw0p1 enabled=true @@ -8509,10 +8509,12 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_check_port_sec), priority=110 , match=(((ip4 && icmp4.type == 3 && icmp4.code == 4) || (ip6 && icmp6.type == 2 && icmp6.code == 0)) && flags.tunnel_rx == 1), action=(drop;) table=??(ls_in_check_port_sec), priority=50 , match=(1), action=(reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_check_port_sec), priority=70 , match=(inport == "localnetport"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) - table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=17);) + table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p1"), action=(reg0[[14]] = 1; next(pipeline=ingress, table=18);) table=??(ls_in_check_port_sec), priority=70 , match=(inport == "sw0p2"), action=(set_queue(10); reg0[[15]] = check_in_port_sec(); next;) table=??(ls_in_apply_port_sec), priority=0 , match=(1), action=(next;) table=??(ls_in_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;) + table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) + table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;) table=??(ls_out_apply_port_sec), priority=100 , match=(outport == "localnetport"), action=(set_queue(10); output;) table=??(ls_out_apply_port_sec), priority=110 , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;) @@ -8524,8 +8526,6 @@ sort | sed 's/table=../table=??/' ], [0], [dnl table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;) table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;) table=??(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;) - table=??(ls_out_check_port_sec), priority=0 , match=(1), action=(reg0[[15]] = check_out_port_sec(); next;) - table=??(ls_out_check_port_sec), priority=100 , match=(eth.mcast), action=(reg0[[15]] = 0; next;) ]) AT_CLEANUP @@ -9860,6 +9860,45 @@ AT_CHECK([fetch_column sb:Port_Binding options logical_port=public |grep -q 'qos AT_CLEANUP ]) +OVN_FOR_EACH_NORTHD_NO_HV([ +AT_SETUP([check OVN QoS mark/meter logical flows]) +AT_KEYWORDS([OVN-QoS]) +ovn_start + +check ovn-nbctl ls-add ls +check ovn-nbctl qos-add ls from-lport 100 ip4 rate=100 burst=1000 +check ovn-nbctl qos-add ls from-lport 101 ip4 mark=15 +check ovn-nbctl qos-add ls from-lport 102 ip4 dscp=16 +check ovn-nbctl qos-add ls from-lport 103 ip4 dscp=17 mark=18 + +check ovn-nbctl qos-add ls to-lport 100 ip4 rate=100 burst=1000 +check ovn-nbctl qos-add ls to-lport 101 ip4 mark=15 +check ovn-nbctl qos-add ls to-lport 102 ip4 dscp=16 +check ovn-nbctl qos-add ls to-lport 103 ip4 dscp=17 mark=18 +check ovn-nbctl --wait=sb sync + +AT_CHECK([ovn-sbctl lflow-list ls | grep qos | sort], [0], [dnl + table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;) + table=10(ls_in_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) + table=10(ls_in_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) + table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;) + table=11(ls_in_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) + table=15(ls_in_qos_pkt_mark ), priority=0 , match=(1), action=(next;) + table=15(ls_in_qos_pkt_mark ), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) + table=15(ls_in_qos_pkt_mark ), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) + table=6 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;) + table=6 (ls_out_qos_mark ), priority=102 , match=(ip4), action=(ip.dscp = 16; next;) + table=6 (ls_out_qos_mark ), priority=103 , match=(ip4), action=(ip.dscp = 17; next;) + table=7 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;) + table=7 (ls_out_qos_meter ), priority=100 , match=(ip4), action=(set_meter(100, 1000); next;) + table=9 (ls_out_qos_pkt_mark), priority=0 , match=(1), action=(next;) + table=9 (ls_out_qos_pkt_mark), priority=101 , match=(ip4), action=(pkt.mark = 15; next;) + table=9 (ls_out_qos_pkt_mark), priority=103 , match=(ip4), action=(pkt.mark = 18; next;) +]) + +AT_CLEANUP +]) + AT_SETUP([Tiered ACL logical flows]) AT_KEYWORDS([acl]) @@ -9978,10 +10017,10 @@ acl_test() { } acl_test from-lport "" ls ls_in_acl_eval ls_in_acl_action 8 -acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 +acl_test from-lport "--apply-after-lb" ls ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 acl_test to-lport "" ls ls_out_acl_eval ls_out_acl_action 4 acl_test from-lport "" pg ls_in_acl_eval ls_in_acl_action 8 -acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 18 +acl_test from-lport "--apply-after-lb" pg ls_in_acl_after_lb_eval ls_in_acl_after_lb_action 19 acl_test to-lport "" pg ls_out_acl_eval ls_out_acl_action 4 AT_CLEANUP diff --git a/tests/ovn.at b/tests/ovn.at index 28c6b6c34..9b158e79c 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -1025,10 +1025,10 @@ next(pipeline=ingress, table=11); next(pipeline=egress); formats as next(pipeline=egress, table=11); - encodes as resubmit(,53) + encodes as resubmit(,58) next(pipeline=egress, table=5); - encodes as resubmit(,47) + encodes as resubmit(,52) next(table=10); formats as next(10); @@ -9719,18 +9719,18 @@ as hv1 AT_CHECK([ovs-vsctl add-port br-int localvif1 -- set Interface localvif1 external_ids:iface-id=localvif1]) # On hv1, check that there are no flows outputting bcast to tunnel -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) # On hv2, check that no flow outputs bcast to tunnel to hv1. as hv2 -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) # Now bind vif2 on hv2. AT_CHECK([ovs-vsctl add-port br-int localvif2 -- set Interface localvif2 external_ids:iface-id=localvif2]) # At this point, the broadcast flow on vif2 should be deleted. -# because, there is now a localnet vif bound (table=37 programming logic) -OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=37 | ofctl_strip | grep output | wc -l` -eq 0]) +# because, there is now a localnet vif bound (table=42 programming logic) +OVS_WAIT_UNTIL([test `ovs-ofctl dump-flows br-int table=42 | ofctl_strip | grep output | wc -l` -eq 0]) # Verify that the local net patch port exists on hv2. OVS_WAIT_UNTIL([test `ovs-vsctl show | grep "Port patch-br-int-to-ln_port" | wc -l` -eq 1]) @@ -11544,7 +11544,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) OVS_WAIT_UNTIL([ - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") ]) test_ip_packet() @@ -11631,7 +11631,7 @@ AT_CHECK( ]) OVS_WAIT_UNTIL([ - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") ]) test_ip_packet gw2 gw1 0 @@ -11810,7 +11810,7 @@ hv1_gw1_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ov hv1_gw2_ofport=$(as hv1 ovs-vsctl --bare --columns ofport find Interface name=ovn-gw2-0) OVS_WAIT_UNTIL([ - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw1_ofport,$hv1_gw2_ofport") ]) test_ip_packet() @@ -11890,7 +11890,7 @@ AT_CHECK([ovn-nbctl --wait=hv \ ]) OVS_WAIT_UNTIL([ - test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=39 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") + test 1 = $(as hv1 ovs-ofctl dump-flows br-int table=44 | grep -c "active_backup,ofport,members:$hv1_gw2_ofport,$hv1_gw1_ofport") ]) test_ip_packet gw2 gw1 @@ -12056,12 +12056,12 @@ AT_CAPTURE_FILE([hv2flows]) AT_CHECK( [# Check that redirect mapping is programmed only on hv2 - grep table=40 hv1flows | grep =0x3,metadata=0x1 | wc -l - grep table=40 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l + grep table=45 hv1flows | grep =0x3,metadata=0x1 | wc -l + grep table=45 hv2flows | grep =0x3,metadata=0x1 | grep load:0x2- | wc -l # Check that hv1 sends chassisredirect port traffic to hv2 - grep table=39 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l - grep table=39 hv2flows | grep =0x3,metadata=0x1 | wc -l + grep table=44 hv1flows | grep =0x3,metadata=0x1 | grep output | wc -l + grep table=44 hv2flows | grep =0x3,metadata=0x1 | wc -l # Check that arp reply on distributed gateway port is only programmed on hv2 grep arp hv1flows | grep load:0x2- | grep =0x2,metadata=0x1 | wc -l @@ -12578,7 +12578,7 @@ as hv1 ovs-appctl ofproto/trace br-int in_port=hv1-vif1 $packet sleep 2 AS_BOX([On hv1, table 40 check that no packet goes via the tunnel port]) -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 \ | grep "NXM_NX_TUN_ID" | grep -v n_packets=0 | wc -l], [0], [[0 ]]) @@ -13542,20 +13542,20 @@ echo $hv2_gw1_ofport echo $hv2_gw2_ofport echo "--- hv1 ---" -as hv1 ovs-ofctl dump-flows br-int table=39 +as hv1 ovs-ofctl dump-flows br-int table=44 echo "--- hv2 ---" -as hv2 ovs-ofctl dump-flows br-int table=39 +as hv2 ovs-ofctl dump-flows br-int table=44 gw1_chassis=$(fetch_column Chassis _uuid name=gw1) gw2_chassis=$(fetch_column Chassis _uuid name=gw2) -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ | wc -l], [0], [1 ]) -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ | wc -l], [0], [1 ]) @@ -13566,15 +13566,15 @@ sleep 10 as gw1 ovs-ofctl dump-flows br-int -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 ]]) # make sure ARP responder flows for outside router port reside on gw1 too through ls_in_arp_rsp table -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ grep arp_tpa=192.168.0.101 | wc -l` -ge 1]) # check that the chassis redirect port has been claimed by the gw1 chassis @@ -13598,12 +13598,12 @@ wait_for_ports_up check ovn-nbctl --wait=hv sync # we make sure that the hypervisors noticed, and inverted the slave ports -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ | wc -l], [0], [1 ]) -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ | wc -l], [0], [1 ]) @@ -13656,10 +13656,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], ]]) # make sure that flows for handling the outside router port reside on gw2 now -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 ]]) @@ -13671,10 +13671,10 @@ as main ovs-vsctl del-port n1 $port bfd_dump # make sure that flows for handling the outside router port reside on gw1 now -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 ]]) @@ -13754,12 +13754,12 @@ ovn-nbctl set Logical_Router_Port outside ha_chassis_group=$hagrp1_uuid wait_row_count HA_Chassis_Group 1 wait_row_count HA_Chassis 2 -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ | wc -l], [0], [0 ]) -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ | wc -l], [0], [0 ]) @@ -13777,26 +13777,26 @@ done # Re-add gw2 as gw2 ovn_attach n1 br-phys 192.168.0.1 -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv1_gw1_ofport,$hv1_gw2_ofport \ | wc -l], [0], [1 ]) -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv2_gw1_ofport,$hv2_gw2_ofport \ | wc -l], [0], [1 ]) # make sure that flows for handling the outside router port reside on gw1 -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst:00:00:02:01:02:04" | wc -l], [0], [[0 ]]) # make sure ARP responder flows for outside router port reside on gw1 too -OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=29 | \ +OVS_WAIT_UNTIL([test `as gw1 ovs-ofctl dump-flows br-int table=30 | \ grep arp_tpa=192.168.0.101 | wc -l` -ge 1 ]) # check that the chassis redirect port has been claimed by the gw1 chassis @@ -13810,12 +13810,12 @@ wait_column "$exp_ref_ch_list" HA_Chassis_Group ref_chassis # Increase the priority of gw2 ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp1 gw2 40 -OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv1 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv1_gw2_ofport,$hv1_gw1_ofport \ | wc -l], [0], [1 ]) -OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=39 | \ +OVS_WAIT_FOR_OUTPUT([as hv2 ovs-ofctl dump-flows br-int table=44 | \ grep active_backup | grep members:$hv2_gw2_ofport,$hv2_gw1_ofport \ | wc -l], [0], [1 ]) @@ -13860,10 +13860,10 @@ AT_CHECK([ovs-vsctl --bare --columns bfd find Interface name=ovn-hv1-0],[0], ]]) # make sure that flows for handling the outside router port reside on gw2 now -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 ]]) @@ -13875,10 +13875,10 @@ as main ovs-vsctl del-port n1 $port bfd_dump # make sure that flows for handling the outside router port reside on gw2 now -OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw1 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[1 ]]) -OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=35 | \ +OVS_WAIT_FOR_OUTPUT([as gw2 ovs-ofctl dump-flows br-int table=36 | \ grep "dl_dst=00:00:02:01:02:04" | wc -l], [0], [[0 ]]) @@ -16990,7 +16990,7 @@ ovn-sbctl dump-flows sw0 > sw0-flows AT_CAPTURE_FILE([sw0-flows]) AT_CHECK([grep -E 'ls_out_acl' sw0-flows | grep reject | sed 's/table=../table=??/' | sort], [0], [dnl - table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=27); };) + table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[18]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=28); };) ]) @@ -17007,18 +17007,18 @@ send_icmp6_packet 1 1 $eth_src $eth_dst $ipv6_src $ipv6_dst # Get total number of ipv4 packets that received on ovs # sender side -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) # receiver side -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ip,metadata=0x1 | grep -c n_packets=1`]) # Get total number of ipv6 packets that received on ovs # sender side -OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) +OVS_WAIT_UNTIL([test 1 = `as hv1 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) # receiver side -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=46 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=51 | grep priority=2002 | grep ipv6,metadata=0x1 | grep -c n_packets=1`]) OVN_CLEANUP([hv1], [hv2]) AT_CLEANUP @@ -18702,17 +18702,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow check ovn-nbctl --wait=hv sync # Check OVS flows, the less restrictive flows should have been installed. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | grep "priority=1003" | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() ]) # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. @@ -18747,17 +18747,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1 || ip4.src==10.0.0.1' check ovn-nbctl --wait=hv sync # Check OVS flows, the second less restrictive allow ACL should have been installed. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ grep "priority=1003" | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() ]) # Remove the less restrictive allow ACL. @@ -18765,17 +18765,17 @@ check ovn-nbctl acl-del ls1 to-lport 3 'ip4.src==10.0.0.1' check ovn-nbctl --wait=hv sync # Check OVS flows, the 10.0.0.1 conjunction should have been reinstalled. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ grep "priority=1003" | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() ]) # Traffic 10.0.0.1, 10.0.0.2 -> 10.0.0.3, 10.0.0.4 should be allowed. @@ -18805,17 +18805,17 @@ check ovn-nbctl acl-add ls1 to-lport 3 'ip4.src==10.0.0.1' allow check ovn-nbctl --wait=hv sync # Check OVS flows, the less restrictive flows should have been installed. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ grep "priority=1003" | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() ]) # Add another ACL that overlaps with the existing less restrictive ones. @@ -18826,20 +18826,20 @@ check ovn-nbctl --wait=hv sync # with an additional conjunction action. # # New non-conjunctive flows should be added to match on 'udp'. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ grep "priority=1003" | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/conj_id=[[0-9]]*,/conj_id=xxx,/g' | sort], [0], [dnl - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() - table=46, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() - table=46, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) - table=46, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,conj_id=xxx,ip,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.3 actions=conjunction(),conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_dst=10.0.0.4 actions=conjunction(),conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.2 actions=conjunction(),conjunction() + table=51, priority=1003,ip,metadata=0x1,nw_src=10.0.0.42 actions=conjunction() + table=51, priority=1003,udp,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) + table=51, priority=1003,udp6,metadata=0x1 actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) ]) OVN_CLEANUP([hv1]) @@ -18894,17 +18894,17 @@ check ovn-nbctl acl-add pg1 to-lport 100 'outport == @pg1 && ip4.src == $as2' al wait_for_ports_up check ovn-nbctl --wait=hv sync -ovs-ofctl dump-flows br-int table=46 -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 2]) +ovs-ofctl dump-flows br-int table=51 +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 2]) echo ------- # Add another address in as1, so that the 1st ACL will now generate 2 conjunctions. ovn-nbctl set address_set as1 addresses="10.0.0.1,10.0.0.2" check ovn-nbctl --wait=hv sync -ovs-ofctl dump-flows br-int table=46 +ovs-ofctl dump-flows br-int table=51 # There should be 3 conjunctions in total (2 from 1st ACL + 1 from 2nd ACL) -AT_CHECK([test `ovs-ofctl dump-flows br-int table=46 | grep -c conj_id` = 3]) +AT_CHECK([test `ovs-ofctl dump-flows br-int table=51 | grep -c conj_id` = 3]) OVN_CLEANUP([hv1]) AT_CLEANUP @@ -20220,7 +20220,7 @@ wait_for_ports_up ls1-lp_ext1 # There should be a flow in hv2 to drop traffic from ls1-lp_ext1 destined # to router mac. AT_CHECK([as hv2 ovs-ofctl dump-flows br-int \ -table=34,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ +table=35,dl_src=f0:00:00:00:00:03,dl_dst=a0:10:00:00:00:01 | \ grep -c "actions=drop"], [0], [1 ]) # Stop ovn-controllers on hv1 and hv3. @@ -21078,7 +21078,7 @@ check ovn-nbctl set logical_router_policy $policy options:pkt_mark=100 check ovn-nbctl --wait=hv sync as hv2 # add a flow in egress pipeline to check pkt marking -ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=37,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,38)" +ovs-ofctl --protocols=OpenFlow13 add-flow br-int "table=42,priority=200,ip,nw_src=172.16.1.2,pkt_mark=0x64 actions=resubmit(,43)" dst_ip=$(ip_to_hex 172 16 2 10) fip_ip=$(ip_to_hex 172 16 1 2) @@ -21090,7 +21090,7 @@ echo $(get_arp_req f00000010204 $fip_ip $gw_router_ip) >> expected send_arp_reply 2 1 $gw_router_mac f00000010204 $gw_router_ip $fip_ip echo "${gw_router_mac}f0000001020408004500001c00004000fe0121b4${fip_ip}${dst_ip}${data}" >> expected -OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=37 | grep pkt_mark=0x64 | grep -c n_packets=1`]) +OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=42 | grep pkt_mark=0x64 | grep -c n_packets=1`]) OVN_CHECK_PACKETS([hv2/vif1-tx.pcap], [expected]) @@ -21845,19 +21845,19 @@ check_virtual_offlows_present() { lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding tunnel_key logical_port=lr0-public)) - AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl - table=46, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,47) + AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [0], [dnl + table=51, priority=2000,ip,metadata=0x$sw0_dp_key actions=load:0x1->OXM_OF_PKT_REG4[[48]],resubmit(,52) ]) AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ grep "priority=92" | grep 172.168.0.50], [0], [dnl - table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) + table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,42) ]) } check_virtual_offlows_not_present() { hv=$1 - AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=46,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl + AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=51,ip | ofctl_strip_all | grep "priority=2000"], [1], [dnl ]) AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ @@ -21884,7 +21884,7 @@ check_row_count Port_Binding 1 logical_port=sw0-vir virtual_parent=sw0-p1 wait_for_ports_up sw0-vir check ovn-nbctl --wait=hv sync AT_CHECK([test 2 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) wait_row_count Port_Binding 1 logical_port=sw0-vir6 chassis=$hv1_ch_uuid check_row_count Port_Binding 1 logical_port=sw0-vir6 virtual_parent=sw0-p1 @@ -24424,7 +24424,7 @@ m4_define([DVR_N_S_PING], OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv4/vif-north-tx.pcap], [vif-north.expected]) # Confirm that packets did not go out via tunnel port. - AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=39 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 + AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep table=44 | grep NXM_NX_TUN_METADATA0 | grep n_packets=0 | wc -l], [0], [[0 ]]) # Confirm that packet went out via localnet port @@ -28817,22 +28817,22 @@ AT_CHECK([test ! -z $p1_zoneid]) p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') AT_CHECK([test ! -z $p2_zoneid]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 1]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw1_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw1_dpkey},\ reg15=0x${p2_dpkey} | grep "load:0x${p2_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) ovs-vsctl set interface hv1-vif1 external_ids:iface-id=foo OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xdown]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') @@ -28844,16 +28844,16 @@ OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p1) = xup]) p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') AT_CHECK([test ! -z $p1_zoneid]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 1]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep "load:0x${p1_zoneid}->NXM_NX_REG13" | wc -l) -eq 1]) ovs-vsctl del-port hv1-vif2 OVS_WAIT_UNTIL([test x$(ovn-nbctl lsp-get-up sw0-p2) = xdown]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p2_dpkey} | grep REG13 | wc -l) -eq 0]) p2_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p2 | sed 's/"//g') @@ -28861,7 +28861,7 @@ AT_CHECK([test -z $p2_zoneid]) ovn-nbctl lsp-del sw0-p1 -OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=40,metadata=${sw0_dpkey},\ +OVS_WAIT_UNTIL([test $(ovs-ofctl dump-flows br-int table=45,metadata=${sw0_dpkey},\ reg15=0x${p1_dpkey} | grep REG13 | wc -l) -eq 0]) p1_zoneid=$(as hv1 ovs-vsctl get bridge br-int external_ids:ct-zone-sw0-p1 | sed 's/"//g') @@ -31410,46 +31410,46 @@ AT_CHECK([kill -0 $(cat hv1/ovn-controller.pid)]) check ovn-nbctl --wait=hv sync # Check OVS flows are installed properly. -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=46 | ofctl_strip_all | \ +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=51 | ofctl_strip_all | \ grep "priority=2002" | grep conjunction | \ sed 's/conjunction([[^)]]*)/conjunction()/g' | \ sed 's/reg15=0x[[1-9]]/reg15=0xN/g' | sort], [0], [dnl - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() - table=46, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() - table=46, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() + table=51, priority=2002,udp,reg0=0x100/0x100,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x10/0xfff0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x100/0xff00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x1000/0xf000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2/0xfffe actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x20/0xffe0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x200/0xfe00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x2000/0xe000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4/0xfffc actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x40/0xffc0 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x400/0xfc00 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x4000/0xc000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8/0xfff8 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x80/0xff80 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x800/0xf800 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=0x8000/0x8000 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,metadata=0x1,nw_src=192.168.47.4,tp_dst=1 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() + table=51, priority=2002,udp,reg0=0x80/0x80,reg15=0xN,metadata=0x1,nw_src=192.168.47.4 actions=conjunction() ]) OVN_CLEANUP([hv1]) @@ -32624,7 +32624,7 @@ ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=l ovs-vsctl add-port br-int lsp0-1 -- set interface lsp0-1 external_ids:iface-id=lsp0-1 check ovn-nbctl --wait=hv sync -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 22]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 22]) # Save the current lflow_run counter lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) @@ -32634,7 +32634,7 @@ lflow_run=$(ovn-appctl -t ovn-controller coverage/read-counter lflow_run) # 1. Remove half of the ports from pg1. The excepted conjunction flows should be: # 2 + 10 = 12 check ovn-nbctl --wait=hv pg-set-ports pg1 $(for i in 0 1 2 3 4; do for j in 0 1; do echo lsp${i}-${j}; done; done) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) # 2. Unbind lsp0-0. The there shouldn't be any conjunction flows because the # port group const set should have only one member (lsp0-1). And the total @@ -32642,25 +32642,25 @@ AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l # 10. ovs-vsctl del-port br-int lsp0-0 check ovn-nbctl --wait=hv sync -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 0]) -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep 192.168 | wc -l) == 10]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 0]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep 192.168 | wc -l) == 10]) # 3. Rebind lsp0-0. The expected conjunction flows are back to 12. ovs-vsctl add-port br-int lsp0-0 -- set interface lsp0-0 external_ids:iface-id=lsp0-0 check ovn-nbctl --wait=hv sync -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) # 4. Bind a lsp (lsp9-0) that doesn't belong to pg1, should not see any change. ovs-vsctl add-port br-int lsp9-0 -- set interface lsp9-0 external_ids:iface-id=lsp9-0 check ovn-nbctl --wait=hv sync -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 12]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 12]) # 5. Bind another 2 lsps (lsp1-0 lsp1-1) that belong to pg1 and on a different # LS (ls1), should see conjunction flows doubled (12 x 2 = 24) ovs-vsctl add-port br-int lsp1-0 -- set interface lsp1-0 external_ids:iface-id=lsp1-0 ovs-vsctl add-port br-int lsp1-1 -- set interface lsp1-1 external_ids:iface-id=lsp1-1 check ovn-nbctl --wait=hv sync -AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) +AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) # 6. Simulate a SB port-group "del and add" notification to ovn-controller in the # same IDL iteration. ovn-controller should still program the same flows. In @@ -32685,7 +32685,7 @@ for i in $(seq 1 10); do check ovn-nbctl --wait=hv sync # Finally check flow count is the same as before. - AT_CHECK([test $(ovs-ofctl dump-flows br-int table=46 | grep conjunction | wc -l) == 24]) + AT_CHECK([test $(ovs-ofctl dump-flows br-int table=51 | grep conjunction | wc -l) == 24]) done # Make sure all the above was performed with I-P (no recompute) @@ -33093,8 +33093,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'outport == "lp2" && ip4.src == 10.0. # The first ACL should be programmed, but the second one shouldn't. check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.111], [0], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.111], [0], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) # Now create the lport lp2. check ovn-nbctl lsp-add lsw0 lp2 \ @@ -33102,12 +33102,12 @@ check ovn-nbctl lsp-add lsw0 lp2 \ check ovn-nbctl --wait=hv sync # Now the second ACL should be programmed. -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [0], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [0], [ignore]) # Remove the lport lp2 again, the OVS flow for the second ACL should be # removed. check ovn-nbctl --wait=hv lsp-del lp2 -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.122], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.122], [1], [ignore]) # Test similar scenario but when the referenced lport is not bound locally. @@ -33121,8 +33121,8 @@ check ovn-nbctl acl-add lsw0 to-lport 1002 'inport == "lp4" && ip4.dst == 10.0.0 # The ACL for lp3 should be programmed, but the one for lp4 shouldn't. check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.133], [0], [ignore]) -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [1], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.133], [0], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [1], [ignore]) # Now create the lport lp4. check ovn-nbctl lsp-add lsw0 lp4 \ @@ -33130,7 +33130,7 @@ check ovn-nbctl lsp-add lsw0 lp4 \ # Now the ACL for lp4 should be programmed. check ovn-nbctl --wait=hv sync -AT_CHECK([ovs-ofctl dump-flows br-int table=46 | grep 10.0.0.144], [0], [ignore]) +AT_CHECK([ovs-ofctl dump-flows br-int table=51 | grep 10.0.0.144], [0], [ignore]) OVN_CLEANUP([hv1]) AT_CLEANUP @@ -33493,15 +33493,15 @@ done check ovn-nbctl --wait=hv sync # hv0 should see flows for lsp1 but not lsp2 -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [1]) +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [1]) # hv2 should see flows for lsp2 but not lsp1 -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.2.2], [0], [ignore]) -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.2.2], [0], [ignore]) +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) # Change lrp_lr_ls1 to a regular lrp, hv2 should see flows for lsp1 check ovn-nbctl --wait=hv lrp-del-gateway-chassis lrp_lr_ls1 hv1 -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) # Change it back, and trigger recompute to make sure extra flows are removed # from hv2 (recompute is needed because currently I-P adds local datapaths but @@ -33509,11 +33509,11 @@ AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ig check ovn-nbctl --wait=hv lrp-set-gateway-chassis lrp_lr_ls1 hv1 1 as hv2 check ovn-appctl -t ovn-controller recompute ovn-nbctl --wait=hv sync -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [1]) +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [1]) # Enable dnat_and_snat on lr, and now hv2 should see flows for lsp1. AT_CHECK([ovn-nbctl --wait=hv --gateway-port=lrp_lr_ls1 lr-nat-add lr dnat_and_snat 192.168.0.1 10.0.1.3 lsp1 f0:00:00:00:00:03]) -AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=29 | grep 10.0.1.2], [0], [ignore]) +AT_CHECK([as hv2 ovs-ofctl dump-flows br-int table=30 | grep 10.0.1.2], [0], [ignore]) OVN_CLEANUP([hv1],[hv2]) AT_CLEANUP @@ -34570,7 +34570,7 @@ check ovn-nbctl --wait=hv sync # Use constants so that if tables or registers change, this test can # be updated easily. DNAT_TABLE=15 -SNAT_TABLE=45 +SNAT_TABLE=50 DNAT_ZONE_REG="NXM_NX_REG11[[0..15]]" SNAT_ZONE_REG="NXM_NX_REG12[[0..15]]" @@ -37179,7 +37179,7 @@ check ovn-nbctl --wait=hv sync wait_for_ports_up OVN_POPULATE_ARP -AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -c controller], [0],[dnl +AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=45 | grep -c controller], [0],[dnl 9 ]) @@ -37275,7 +37275,7 @@ tpa=$(ip_to_hex 10 0 0 10) send_garp 1 1 $eth_src $eth_dst $spa $tpa OVS_WAIT_UNTIL([test 1 = `cat hv1/ovn-controller.log | grep "pinctrl received packet-in" | \ -grep opcode=BIND_VPORT | grep OF_Table_ID=29 | wc -l`]) +grep opcode=BIND_VPORT | grep OF_Table_ID=30 | wc -l`]) sleep_controller hv1 @@ -37929,3 +37929,86 @@ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ OVS_APP_EXIT_AND_WAIT([ovsdb-server]) AT_CLEANUP + +OVN_FOR_EACH_NORTHD([ +AT_SETUP([QoS packet marking]) +AT_KEYWORDS([ovn-qos-pkt-marking]) +AT_SKIP_IF([test $HAVE_SCAPY = no]) +ovn_start + +check ovn-nbctl lr-add lr0 +check ovn-nbctl ls-add ls0 +check ovn-nbctl ls-add ls1 + +check ovn-nbctl lrp-add lr0 lrp0 f0:00:00:00:00:10 10.0.0.254/24 +check ovn-nbctl lsp-add ls0 lrp-s0 -- \ + set Logical_Switch_Port lrp-s0 type=router \ + options:router-port=lrp0 addresses='"f0:00:00:00:00:10"' +check ovn-nbctl lrp-add lr0 lrp1 f0:00:00:00:00:20 20.0.0.254/24 +check ovn-nbctl lsp-add ls1 lrp-s1 -- \ + set Logical_Switch_Port lrp-s1 type=router \ + options:router-port=lrp1 addresses='"f0:00:00:00:00:20"' + +check ovn-nbctl --wait=sb lsp-add ls0 lp0 +check ovn-nbctl lsp-set-addresses lp0 f0:00:00:00:00:01 +check ovn-nbctl --wait=sb lsp-add ls0 lp1 +check ovn-nbctl lsp-set-addresses lp1 f0:00:00:00:00:02 + +check ovn-nbctl --wait=sb lsp-add ls1 lp2 +check ovn-nbctl lsp-set-addresses lp2 f0:00:00:00:00:11 +check ovn-nbctl --wait=sb sync + +net_add n1 +sim_add hv + +as hv +check ovs-vsctl add-br br-phys +ovn_attach n1 br-phys 192.168.0.1 + +check ovs-vsctl add-port br-int vif0 -- \ + set Interface vif0 external-ids:iface-id=lp0 \ + options:tx_pcap=hv/vif0-tx.pcap \ + options:rxq_pcap=hv/vif0-rx.pcap \ + ofport-request=1 +check ovs-vsctl add-port br-int vif1 -- \ + set Interface vif1 external-ids:iface-id=lp1 \ + options:tx_pcap=hv/vif1-tx.pcap \ + options:rxq_pcap=hv/vif1-rx.pcap \ + ofport-request=2 +check ovs-vsctl add-port br-int vif2 -- \ + set Interface vif2 external-ids:iface-id=lp2 \ + options:tx_pcap=hv/vif2-tx.pcap \ + options:rxq_pcap=hv/vif2-rx.pcap \ + ofport-request=3 + +# Create QoS rules for packet marking. +check ovn-nbctl qos-add ls0 from-lport 100 "inport==\"lp0\" && udp" mark=48 +check ovn-nbctl qos-add ls0 to-lport 100 "outport==\"lrp-s0\" && udp" mark=49 +check_row_count nb:QoS 2 + +# Create some flows to count pkt marking. +check ovn-nbctl acl-add ls0 to-lport 1002 "outport==\"lp1\" && pkt.mark == 48" drop +check ovn-nbctl lr-policy-add lr0 200 "pkt.mark == 49" drop +wait_for_ports_up +check ovn-nbctl --wait=hv sync + +send_udp_packet() { + local inport=$1 eth_src=$2 eth_dst=$3 ipv4_src=$4 ipv4_dst=$5 + local packet=$(fmt_pkt "Ether(dst='${eth_dst}', src='${eth_src}')/ \ + IP(src='${ipv4_src}', dst='${ipv4_dst}', ttl=0x40)/ \ + UDP(sport=4242, dport=4343)") + as hv ovs-appctl netdev-dummy/receive vif$inport $packet +} + +ls0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=ls0)) +lr0_dp_key=$(printf "0x%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) + +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:02 10.0.0.1 10.0.0.2 +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x30.*metadata=$ls0_dp_key" | grep -c n_packets=1)]) + +send_udp_packet 0 f0:00:00:00:00:01 f0:00:00:00:00:10 10.0.0.1 10.0.0.10 +OVS_WAIT_UNTIL([test 1 = $(as hv ovs-ofctl dump-flows br-int | grep -E "pkt_mark=0x31.*metadata=$lr0_dp_key" | grep -c n_packets=1)]) + +OVN_CLEANUP([hv]) +AT_CLEANUP +]) diff --git a/tests/system-ovn.at b/tests/system-ovn.at index cb4124b70..1277f1057 100644 --- a/tests/system-ovn.at +++ b/tests/system-ovn.at @@ -2230,7 +2230,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 ovn-nbctl list load_balancer ovn-sbctl dump-flows R2 -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ grep 'nat(src=20.0.0.2)']) check ovs-appctl dpctl/flush-conntrack @@ -2269,7 +2269,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:80,192.16 ovn-nbctl list load_balancer ovn-sbctl dump-flows R2 -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | \ +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | \ grep 'nat(src=20.0.0.2)']) rm -f wget*.log @@ -5055,7 +5055,7 @@ OVS_WAIT_UNTIL([ ]) OVS_WAIT_UNTIL([ - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ grep controller | grep tp_dst=84 -c) test $n_pkt -eq 1 ]) @@ -5302,7 +5302,7 @@ OVS_WAIT_UNTIL([ ]) OVS_WAIT_UNTIL([ - n_pkt=$(ovs-ofctl dump-flows br-int table=46 | grep -v n_packets=0 | \ + n_pkt=$(ovs-ofctl dump-flows br-int table=51 | grep -v n_packets=0 | \ grep controller | grep tp_dst=84 -c) test $n_pkt -eq 1 ]) @@ -8756,7 +8756,7 @@ ovn-sbctl list ip_multicast wait_igmp_flows_installed() { - OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=35 | \ + OVS_WAIT_UNTIL([ovs-ofctl dump-flows br-int table=36 | \ grep 'priority=90' | grep "nw_dst=$1"]) } @@ -11993,7 +11993,7 @@ ovn-nbctl set load_balancer $uuid vips:'"30.0.0.2:8000"'='"192.168.1.2:12345,192 ovn-nbctl list load_balancer ovn-sbctl dump-flows R2 -OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=45 | grep 'nat(src=20.0.0.2)']) +OVS_WAIT_UNTIL([ovs-ofctl -O OpenFlow13 dump-flows br-int table=50 | grep 'nat(src=20.0.0.2)']) dnl Test load-balancing that includes L4 ports in NAT. for i in `seq 1 20`; do diff --git a/utilities/ovn-nbctl.8.xml b/utilities/ovn-nbctl.8.xml index 6f74bd557..f838393a6 100644 --- a/utilities/ovn-nbctl.8.xml +++ b/utilities/ovn-nbctl.8.xml @@ -482,6 +482,9 @@ <code>burst=</code><var>burst</var> specifies the burst rate limit in kilobits. <code>dscp</code> and/or <code>rate</code> are required arguments. + If <code>mark=</code><var>mark</var> is specified, then matching + packets will be marked (through <code>pkt.mark</code>). + <var>mark</var> must be a positive integer. </p> <p> diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c index 526369b68..0620d333a 100644 --- a/utilities/ovn-nbctl.c +++ b/utilities/ovn-nbctl.c @@ -283,7 +283,7 @@ ACL commands:\n\ print ACLs for SWITCH\n\ \n\ QoS commands:\n\ - qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP]\n\ + qos-add SWITCH DIRECTION PRIORITY MATCH [rate=RATE [burst=BURST]] [dscp=DSCP] [mark=MARK]\n\ add an QoS rule to SWITCH\n\ qos-del SWITCH [{DIRECTION | UUID} [PRIORITY MATCH]]\n\ remove QoS rules from SWITCH\n\ @@ -2614,6 +2614,9 @@ nbctl_qos_list(struct ctl_context *ctx) if (!strcmp(qos_rule->key_action[j], "dscp")) { ds_put_format(&ctx->output, " dscp=%"PRId64"", qos_rule->value_action[j]); + } else if (!strcmp(qos_rule->key_action[j], "mark")) { + ds_put_format(&ctx->output, " mark=%"PRId64"", + qos_rule->value_action[j]); } } ds_put_cstr(&ctx->output, "\n"); @@ -2631,6 +2634,7 @@ nbctl_pre_qos_add(struct ctl_context *ctx) ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_direction); ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_priority); ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_match); + ovsdb_idl_add_column(ctx->idl, &nbrec_qos_col_action); } static void @@ -2640,6 +2644,7 @@ nbctl_qos_add(struct ctl_context *ctx) const char *direction; int64_t priority; int64_t dscp = -1; + int64_t mark = 0; int64_t rate = 0; int64_t burst = 0; char *error; @@ -2669,6 +2674,13 @@ nbctl_qos_add(struct ctl_context *ctx) return; } } + else if (!strncmp(ctx->argv[i], "mark=", 5)) { + if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &mark) || mark < 0) { + ctl_error(ctx, "%s: mark must be a positive integer", + ctx->argv[i] + 5); + return; + } + } else if (!strncmp(ctx->argv[i], "rate=", 5)) { if (!ovs_scan(ctx->argv[i] + 5, "%"SCNd64, &rate) || rate < 1 || rate > UINT32_MAX) { @@ -2686,14 +2698,15 @@ nbctl_qos_add(struct ctl_context *ctx) } } else { ctl_error(ctx, "%s: supported arguments are \"dscp=\", \"rate=\", " - "and \"burst=\"", ctx->argv[i]); + "\"burst=\" and \"mark=\"", ctx->argv[i]); return; } } /* Validate rate and dscp. */ - if (-1 == dscp && !rate) { - ctl_error(ctx, "Either \"rate\" and/or \"dscp\" must be specified"); + if (-1 == dscp && !rate && !mark) { + ctl_error(ctx, "Either \"mark\", \"rate\" and/or \"dscp\" must be " + "specified"); return; } @@ -2702,9 +2715,11 @@ nbctl_qos_add(struct ctl_context *ctx) nbrec_qos_set_priority(qos, priority); nbrec_qos_set_direction(qos, direction); nbrec_qos_set_match(qos, ctx->argv[4]); + if (mark) { + nbrec_qos_update_action_setkey(qos, "mark", mark); + } if (-1 != dscp) { - const char *dscp_key = "dscp"; - nbrec_qos_set_action(qos, &dscp_key, &dscp, 1); + nbrec_qos_update_action_setkey(qos, "dscp", dscp); } if (rate) { const char *bandwidth_key[2] = {"rate", "burst"};
Add the capbility to mark (through pkt.mark) incoming/outgoing packets in logical_switch datapath according to user configured QoS rule. Co-developed-by: Dumitru Ceara <dceara@redhat.com> Reported-at: https://issues.redhat.com/browse/FDP-42 Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> --- NEWS | 2 + controller/lflow.h | 15 +- lib/ovn-util.h | 2 +- northd/northd.c | 55 +++-- northd/ovn-northd.8.xml | 60 ++++-- ovn-nb.ovsschema | 9 +- ovn-nb.xml | 12 +- tests/ovn-controller.at | 308 +++++++++++++-------------- tests/ovn-nbctl.at | 8 +- tests/ovn-northd.at | 103 ++++++--- tests/ovn.at | 429 +++++++++++++++++++++++--------------- tests/system-ovn.at | 12 +- utilities/ovn-nbctl.8.xml | 3 + utilities/ovn-nbctl.c | 27 ++- 14 files changed, 627 insertions(+), 418 deletions(-)