From patchwork Tue May 14 16:44:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 1935097 X-Patchwork-Delegate: dceara@redhat.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dzIRjpSX; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Vf2KC2GrFz20dM for ; Wed, 15 May 2024 02:45:19 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 550D560BA0; Tue, 14 May 2024 16:45:16 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 8ZqlCROlnwiq; Tue, 14 May 2024 16:45:15 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 18EAA606A8 Authentication-Results: smtp3.osuosl.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dzIRjpSX Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [IPv6:2605:bc80:3010:104::8cd3:938]) by smtp3.osuosl.org (Postfix) with ESMTPS id 18EAA606A8; Tue, 14 May 2024 16:45:15 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id EB73DC0077; Tue, 14 May 2024 16:45:14 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id EA03DC0037 for ; Tue, 14 May 2024 16:45:13 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id D2ADC405B8 for ; Tue, 14 May 2024 16:45:13 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id h3gdOBB1weC3 for ; Tue, 14 May 2024 16:45:12 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=170.10.129.124; helo=us-smtp-delivery-124.mimecast.com; envelope-from=lorenzo.bianconi@redhat.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp2.osuosl.org 9E52C400F5 Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=none dis=none) header.from=redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 9E52C400F5 Authentication-Results: smtp2.osuosl.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dzIRjpSX Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by smtp2.osuosl.org (Postfix) with ESMTPS id 9E52C400F5 for ; Tue, 14 May 2024 16:45:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1715705111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cfTp10iuF9qMI+y6zhqnA9JyI2R+zF/XcNVktNUu7H8=; b=dzIRjpSXczO2D2QUgE9zHwO0bMR5b1XaUm4xeo9ksmLW66M+i0oJh0UO2+fgBIhcEApTpg 03h1H9hnINiJ45MX4fFI9XSZanEgye5yraQD/EyOWAf6mCGGg0fGpVc+y+GcpTtcXdhZhb HHZlivUaXN4kH6UIq/Q7R849qIl92tA= Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-177-bjW1zVHJP-um7_COc_7aUg-1; Tue, 14 May 2024 12:45:09 -0400 X-MC-Unique: bjW1zVHJP-um7_COc_7aUg-1 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-41fc73366c9so31534045e9.1 for ; Tue, 14 May 2024 09:45:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715705108; x=1716309908; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=cfTp10iuF9qMI+y6zhqnA9JyI2R+zF/XcNVktNUu7H8=; b=MCn0OpAQKep3gEHK6zKoBQpW08n3XGyALDIIKJAWoOH0eL7NzshOuv4W+2QAThjUtm DdPjrBxnyb7NS08glLwaqCuEpAl9GXLqsxFnoXleZfxV8zv8cqp5jEscx4tO1UddbZrs ASS8d0jKZPI9PvNxRWF7hJzdhaW0wf3HWcBVVlSF/yXbbQUPP9SMSWfetBxTfark+dWn Rp1R3OrtrZgahO3cgdLU0PaNi29D8IqK4lXnbcjeKIthxydXb7peUiUMJErwvFpBYCV+ vDCO/ev4kncAOFJqniD8VF1pmTOqV9OSlpRg4Kz2BKI3OnTaHdBkaW/aEsyZoVuaDKyc xjrQ== X-Gm-Message-State: AOJu0Yy0R5J3BNSdUs6SHKbUJ48kZ/+YB+zJfyGOkXTpaoVC6VyWlfns +5AGg5lpECFwf5w6qH3A371zVdvuS2M6AZ9KOMSGiqISqZTy3+vJlTX8uQ0KFtq3g+5RVMd0W99 iqgT/XkRv5T3xzItNWKqJJrMYYdEDPK3Am/gyP/A7on3oquv8QAjVgCG0EopVX7fXB6yZgZkWF+ KfuIjcbOCG1VPNSEe9go+XIP4rIm0ZQ3dDy/kruWVixCQsZWZQeA== X-Received: by 2002:a05:600c:4fcd:b0:41f:e56c:ef81 with SMTP id 5b1f17b1804b1-41fea93186bmr95205745e9.1.1715705108161; Tue, 14 May 2024 09:45:08 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGWQo3SrUHp9RkmviyTPQNaJlcpqzx2LonGsnSEL/pKVNjd/Fx78nG5uzM4Olu2Nr8Bx/d1gA== X-Received: by 2002:a05:600c:4fcd:b0:41f:e56c:ef81 with SMTP id 5b1f17b1804b1-41fea93186bmr95205545e9.1.1715705107464; Tue, 14 May 2024 09:45:07 -0700 (PDT) Received: from localhost (net-93-151-202-124.cust.dsl.teletu.it. [93.151.202.124]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-41facbd295fsm219816015e9.36.2024.05.14.09.45.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 May 2024 09:45:07 -0700 (PDT) From: Lorenzo Bianconi To: ovs-dev@openvswitch.org Date: Tue, 14 May 2024 18:44:55 +0200 Message-ID: X-Mailer: git-send-email 2.45.0 MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: jlibosva@redhat.com, dceara@redhat.com Subject: [ovs-dev] [PATCH ovn] northd: Skip arp-proxy flows if the lsp is a router port. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" Skip proxy-arp logical flows for traffic that is entering the logical switch pipeline from a lsp of type router. This patch will avoid recirculating back the traffic entering by the logical router pipeline if proxy-arp hasn been configured by the CMS. Reported-at: https://issues.redhat.com/browse/FDP-96 Signed-off-by: Lorenzo Bianconi Tested-by: --- northd/northd.c | 15 +++++++++++++-- tests/ovn.at | 8 ++++---- tests/system-ovn.at | 22 +++++++++++++++++++++- 3 files changed, 38 insertions(+), 7 deletions(-) diff --git a/northd/northd.c b/northd/northd.c index 0cabda7ea..29dc58ef4 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -118,6 +118,7 @@ static bool default_acl_drop; #define REGBIT_PORT_SEC_DROP "reg0[15]" #define REGBIT_ACL_STATELESS "reg0[16]" #define REGBIT_ACL_HINT_ALLOW_REL "reg0[17]" +#define REGBIT_FROM_ROUTER_PORT "reg0[18]" #define REG_ORIG_DIP_IPV4 "reg1" #define REG_ORIG_DIP_IPV6 "xxreg1" @@ -5785,6 +5786,13 @@ build_lswitch_port_sec_op(struct ovn_port *op, struct lflow_table *lflows, &op->od->localnet_ports[0]->nbsp->header_, op->lflow_ref); } + } else if (lsp_is_router(op->nbsp)) { + ds_put_format(actions, REGBIT_FROM_ROUTER_PORT" = 1; next;"); + ovn_lflow_add_with_lport_and_hint(lflows, op->od, + S_SWITCH_IN_CHECK_PORT_SEC, 70, + ds_cstr(match), ds_cstr(actions), + op->key, &op->nbsp->header_, + op->lflow_ref); } } @@ -9051,7 +9059,9 @@ build_lswitch_arp_nd_responder_known_ips(struct ovn_port *op, if (op->proxy_arp_addrs.n_ipv4_addrs) { /* Match rule on all proxy ARP IPs. */ ds_clear(match); - ds_put_cstr(match, "arp.op == 1 && arp.tpa == {"); + ds_put_cstr(match, + REGBIT_FROM_ROUTER_PORT" == 0 " + "&& arp.op == 1 && arp.tpa == {"); for (i = 0; i < op->proxy_arp_addrs.n_ipv4_addrs; i++) { ds_put_format(match, "%s/%u,", @@ -9105,7 +9115,8 @@ build_lswitch_arp_nd_responder_known_ips(struct ovn_port *op, ds_truncate(&nd_target_match, nd_target_match.length - 2); ds_clear(match); ds_put_format(match, - "nd_ns " + REGBIT_FROM_ROUTER_PORT" == 0 " + "&& nd_ns " "&& ip6.dst == { %s } " "&& nd.target == { %s }", ds_cstr(&ip6_dst_match), diff --git a/tests/ovn.at b/tests/ovn.at index 486680649..e419516a7 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -32640,7 +32640,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep ls_in_arp_rsp | grep "${arp_proxy_ls1[[1]]}" | ovn_strip_lflows], [0], [dnl - table=??(ls_in_arp_rsp ), priority=30 , match=(arp.op == 1 && dnl + table=??(ls_in_arp_rsp ), priority=30 , match=(reg0[[18]] == 0 && arp.op == 1 && dnl arp.tpa == {169.254.238.0/24,169.254.239.2/32}), dnl action=(eth.dst = eth.src; eth.src = 00:00:00:01:02:f1; arp.op = 2; dnl /* ARP reply */ arp.tha = arp.sha; arp.sha = 00:00:00:01:02:f1; dnl @@ -32653,7 +32653,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep "${arp_proxy_ls1[[3]]}" | ovn_strip_lflows], [0], [dnl table=??(ls_in_arp_rsp ), priority=30 , dnl -match=(nd_ns && ip6.dst == { fd7b:6b4d:7b25:d22d::/64, ff02::1:ff00:0/64, dnl +match=(reg0[[18]] == 0 && nd_ns && ip6.dst == { fd7b:6b4d:7b25:d22d::/64, ff02::1:ff00:0/64, dnl fd7b:6b4d:7b25:d22f::1/128, ff02::1:ff00:1/128 } && dnl nd.target == { fd7b:6b4d:7b25:d22d::/64, fd7b:6b4d:7b25:d22f::1/128 }), dnl action=(nd_na_router { eth.src = 00:00:00:01:02:f1; ip6.src = nd.target; dnl @@ -32667,7 +32667,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep "${arp_proxy_ls2[[2]]}" | ovn_strip_lflows], [0], [dnl table=??(ls_in_arp_rsp ), priority=30 , dnl -match=(arp.op == 1 && arp.tpa == {169.254.236.0/24,169.254.237.2/32}), dnl +match=(reg0[[18]] == 0 && arp.op == 1 && arp.tpa == {169.254.236.0/24,169.254.237.2/32}), dnl action=(eth.dst = eth.src; eth.src = 00:00:00:02:02:f1; arp.op = 2; dnl /* ARP reply */ arp.tha = arp.sha; arp.sha = 00:00:00:02:02:f1; dnl arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;) @@ -32679,7 +32679,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep "${arp_proxy_ls2[[4]]}" | ovn_strip_lflows], [0], [dnl table=??(ls_in_arp_rsp ), priority=30 , dnl -match=(nd_ns && ip6.dst == { fd7b:6b4d:7b25:d22b::/64, ff02::1:ff00:0/64, dnl +match=(reg0[[18]] == 0 && nd_ns && ip6.dst == { fd7b:6b4d:7b25:d22b::/64, ff02::1:ff00:0/64, dnl fd7b:6b4d:7b25:d22c::1/128, ff02::1:ff00:1/128 } && dnl nd.target == { fd7b:6b4d:7b25:d22b::/64, fd7b:6b4d:7b25:d22c::1/128 }), dnl action=(nd_na_router { eth.src = 00:00:00:02:02:f1; ip6.src = nd.target; dnl diff --git a/tests/system-ovn.at b/tests/system-ovn.at index 86fd240d2..e6cfb07f6 100644 --- a/tests/system-ovn.at +++ b/tests/system-ovn.at @@ -10756,7 +10756,7 @@ check ovn-nbctl ls-add bar # Connect foo to R1 check ovn-nbctl lrp-add R1 foo 00:00:01:01:02:03 192.168.1.1/24 check ovn-nbctl lsp-add foo rp-foo -- set Logical_Switch_Port rp-foo \ - type=router options:arp_proxy="0a:58:a9:fe:01:01 169.254.239.254 169.254.239.2 169.254.238.0/24 192.168.1.100" options:router-port=foo addresses='"router"' + type=router options:arp_proxy="0a:58:a9:fe:01:01 169.254.239.254 169.254.239.2 169.254.238.0/24 192.168.1.100 192.168.1.200" options:router-port=foo addresses='"router"' # Connect bar to R1 check ovn-nbctl lrp-add R1 bar 00:00:01:01:02:04 192.168.2.1/24 @@ -10785,6 +10785,12 @@ ADD_VETH(foo3, foo3, br-int, "192.168.1.4/24", "f0:00:00:01:02:05", \ check ovn-nbctl lsp-add foo foo3 \ -- lsp-set-addresses foo3 "f0:00:00:01:02:05 192.168.1.4" +ADD_NAMESPACES(foo4) +ADD_VETH(foo4, foo4, br-int, "192.168.1.6/24", "f0:00:00:01:02:11", \ + "192.168.1.1") +check ovn-nbctl lsp-add foo foo4 \ +-- lsp-set-addresses foo4 "f0:00:00:01:02:11 192.168.1.6" + # Logical port 'ext1' in switch 'foo' ADD_NAMESPACES(ext1) ADD_VETH(ext1, ext1, br-ext, "192.168.1.5/24", "f0:00:00:01:02:06", \ @@ -10800,6 +10806,12 @@ ADD_VETH(bar1, bar1, br-int, "192.168.2.2/24", "f0:00:00:01:02:07", \ check ovn-nbctl lsp-add bar bar1 \ -- lsp-set-addresses bar1 "f0:00:00:01:02:07 192.168.2.2" +ADD_NAMESPACES(bar2) +ADD_VETH(bar2, bar2, br-int, "192.168.2.3/24", "f0:00:00:01:02:10", \ +"192.168.2.1") +check ovn-nbctl lsp-add bar bar2 \ +-- lsp-set-addresses bar2 "f0:00:00:01:10:10 192.168.2.3" + # wait for ovn-controller to catch up. check ovn-nbctl --wait=hv sync @@ -10851,6 +10863,14 @@ OVS_WAIT_UNTIL([ test "${total_pkts}" = "3" ]) +check ovn-nbctl lr-route-add R1 169.254.240.0/24 192.168.1.200 +NETNS_START_TCPDUMP([foo4], [-nn -c 4 -e -i foo4 arp[[24:4]]=0xc0a801c8], [foo4-arp]) + +NS_CHECK_EXEC([bar2], [ping -q -c 5 -i 0.3 -w 2 169.254.240.10],[ignore],[ignore]) +OVS_WAIT_UNTIL([ + total_pkts=$(cat foo4-arp.tcpdump| wc -l) + test "${total_pkts}" = "4" +]) OVS_APP_EXIT_AND_WAIT([ovn-controller])