From patchwork Wed Apr 15 01:44:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ihar Hrachyshka X-Patchwork-Id: 1270819 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.137; helo=fraxinus.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=fgn1Pu36; dkim-atps=neutral Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4924sy1c8Qz9sSG for ; Wed, 15 Apr 2020 11:44:51 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 8890385F29; Wed, 15 Apr 2020 01:44:49 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1gZvqqkC5Mu2; Wed, 15 Apr 2020 01:44:46 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id E108185C92; Wed, 15 Apr 2020 01:44:46 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id C5F37C1D7D; Wed, 15 Apr 2020 01:44:46 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 0C8B5C0172 for ; Wed, 15 Apr 2020 01:44:45 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id DFCAC85C95 for ; Wed, 15 Apr 2020 01:44:44 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bpizDteTBvRW for ; Wed, 15 Apr 2020 01:44:42 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 5243B85C92 for ; Wed, 15 Apr 2020 01:44:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1586915081; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MLmKA+M4LgrIuqxHhvxVEuiNgnyjvOT8Qi0fZ+mEMpM=; b=fgn1Pu36EaNnz6mtpZ8t48vKzVw8fmkKSHGNRjLMo+oxMk1Xgba0KH2lV1SfXQxLOxg3Wg aYN8U6SkmdB/TMNbDdr1cxh7rWrrrKXHP4R+6f6o9qui6xoif1rj8ylD3kgijpPQWxHL+0 HQQqk3le6ZIi97/h7+XMGXxMlFWxc6M= Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-203-CzjeXaeHPHCr-cQC8USIww-1; Tue, 14 Apr 2020 21:44:32 -0400 X-MC-Unique: CzjeXaeHPHCr-cQC8USIww-1 Received: by mail-qt1-f199.google.com with SMTP id g55so14309463qtk.14 for ; Tue, 14 Apr 2020 18:44:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=A589bvVshBNFnnTIEwp3P1MAT3fLV+9aXOU7/Qxm5Rg=; b=hCF0AoEaKjzqpr6yEQMSL8kVuQ+8cWBnEGAfg/GkMQGUYHEELrnt0zsySYD86v2ZFw anb//TZBt9Q+8mlZu4Ku4WGLb4GWH96nf7gou/TAkNztf8B2HvxXpu+DiEkbTCTFuj6Y jidVXYkv8YCapcCg2k1xUEqQv4ynOe0BznXyUQGtvz3IvVOcEgubQzBPDmjXcJlW+cpH Qmnh063l+v921jyc9oauAsH5QTWqHFu65bAGOk2DDfBxXGhwMmrAkD+ZeuW1GCfqWSvQ 4Vn39/dlZigbGNnLlG8VEJcnGwPreOA668B7bN4Kv6uS5fIJoTzr+3xWeyfIBolJVTGJ 8evg== X-Gm-Message-State: AGi0PuZ2qOCmGO1lusymIxfCFs1jz0DQ+Vs7PYGWQnUdnd+Te4TgT1H2 pHISdW2Y1CHTyNF0WVmOM9lIu4nhoI9uf+SNTcVARTy98ixa0sfTXWGvdcDLkcjfwqbGQOBxgCC WdslEMbrHqniS X-Received: by 2002:a0c:fdc2:: with SMTP id g2mr2737558qvs.59.1586915070571; Tue, 14 Apr 2020 18:44:30 -0700 (PDT) X-Google-Smtp-Source: APiQypInKYQ5nF99QTlxZWF7pqGVXvQAolt6tM1x0zK3Rk8GCuouVjITCvlLdo45KB9OhrhUc+D1Uw== X-Received: by 2002:a0c:fdc2:: with SMTP id g2mr2737530qvs.59.1586915069452; Tue, 14 Apr 2020 18:44:29 -0700 (PDT) Received: from localhost.localdomain.com (cpe-172-73-180-250.carolina.res.rr.com. [172.73.180.250]) by smtp.googlemail.com with ESMTPSA id q6sm12303276qte.72.2020.04.14.18.44.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Apr 2020 18:44:28 -0700 (PDT) From: Ihar Hrachyshka To: dev@openvswitch.org Date: Tue, 14 Apr 2020 21:44:12 -0400 Message-Id: <20200415014412.449850-1-ihrachys@redhat.com> X-Mailer: git-send-email 2.25.2 MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Subject: [ovs-dev] [PATCH RFC ovn] Support logical switches with multiple localnet ports X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" Assuming only a single localnet port is actually plugged mapped on each chassis, this allows to maintain disjoint networks plugged to the same switch. This is useful to simplify resource management for OpenStack "routed provider networks" feature [1] where a single "network" (which traditionally maps to logical switches in OVN) is comprised of multiple L2 segments and assumes external L3 routing implemented between the segments. TODO: consider E-W routing between localnet vlan tagged LSs (ovn-chassis-mac-mappings). Note: the test requires [2] to actually validate packets. [1]: https://docs.openstack.org/ocata/networking-guide/config-routed-networks.html [2]: https://patchwork.ozlabs.org/project/openvswitch/list/?series=169291 Signed-off-by: Ihar Hrachyshka Tested-By: Maciej Jozefczyk --- controller/binding.c | 16 ++ controller/patch.c | 24 ++- northd/ovn-northd.c | 351 ++++++++++++++++++++++------------------- ovn-architecture.7.xml | 25 ++- ovn-nb.xml | 21 +-- ovn-sb.xml | 21 ++- tests/ovn.at | 112 +++++++++++++ 7 files changed, 373 insertions(+), 197 deletions(-) diff --git a/controller/binding.c b/controller/binding.c index 5ea12a8be..f4ae42806 100644 --- a/controller/binding.c +++ b/controller/binding.c @@ -680,12 +680,28 @@ add_localnet_egress_interface_mappings( } } +static bool +is_network_plugged(const struct sbrec_port_binding *binding_rec, + struct shash *bridge_mappings) +{ + const char *network = smap_get(&binding_rec->options, "network_name"); + if (!network) { + return false; + } + return shash_find_data(bridge_mappings, network); +} + static void consider_localnet_port(const struct sbrec_port_binding *binding_rec, struct shash *bridge_mappings, struct sset *egress_ifaces, struct hmap *local_datapaths) { + /* Ignore localnet ports for unplugged networks. */ + if (!is_network_plugged(binding_rec, bridge_mappings)) { + return; + } + add_localnet_egress_interface_mappings(binding_rec, bridge_mappings, egress_ifaces); diff --git a/controller/patch.c b/controller/patch.c index 349faae17..52255cc3a 100644 --- a/controller/patch.c +++ b/controller/patch.c @@ -198,9 +198,9 @@ add_bridge_mappings(struct ovsdb_idl_txn *ovs_idl_txn, continue; } - const char *patch_port_id; + bool is_localnet = false; if (!strcmp(binding->type, "localnet")) { - patch_port_id = "ovn-localnet-port"; + is_localnet = true; } else if (!strcmp(binding->type, "l2gateway")) { if (!binding->chassis || strcmp(chassis->name, binding->chassis->name)) { @@ -208,7 +208,6 @@ add_bridge_mappings(struct ovsdb_idl_txn *ovs_idl_txn, * so we should not create any patch ports for it. */ continue; } - patch_port_id = "ovn-l2gateway-port"; } else { /* not a localnet or L2 gateway port. */ continue; @@ -224,12 +223,25 @@ add_bridge_mappings(struct ovsdb_idl_txn *ovs_idl_txn, struct ovsrec_bridge *br_ln = shash_find_data(&bridge_mappings, network); if (!br_ln) { static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); - VLOG_ERR_RL(&rl, "bridge not found for %s port '%s' " - "with network name '%s'", - binding->type, binding->logical_port, network); + if (!is_localnet) { + VLOG_ERR_RL(&rl, "bridge not found for %s port '%s' " + "with network name '%s'", + binding->type, binding->logical_port, network); + } else { + VLOG_INFO_RL(&rl, "bridge not found for localnet port '%s' " + "with network name '%s'; skipping", + binding->logical_port, network); + } continue; } + const char *patch_port_id; + if (is_localnet) { + patch_port_id = "ovn-localnet-port"; + } else { + patch_port_id = "ovn-l2gateway-port"; + } + char *name1 = patch_port_name(br_int->name, binding->logical_port); char *name2 = patch_port_name(binding->logical_port, br_int->name); create_patch_port(ovs_idl_txn, patch_port_id, binding->logical_port, diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c index 076278197..91730f7f3 100644 --- a/northd/ovn-northd.c +++ b/northd/ovn-northd.c @@ -543,7 +543,9 @@ struct ovn_datapath { /* The "derived" OVN port representing the instance of l3dgw_port on * the "redirect-chassis". */ struct ovn_port *l3redirect_port; - struct ovn_port *localnet_port; + + struct ovn_port **localnet_ports; + size_t n_localnet_ports; struct ovs_list lr_list; /* In list of logical router datapaths. */ /* The logical router group to which this datapath belongs. @@ -611,6 +613,7 @@ ovn_datapath_destroy(struct hmap *datapaths, struct ovn_datapath *od) ovn_destroy_tnlids(&od->port_tnlids); bitmap_free(od->ipam_info.allocated_ipv4s); free(od->router_ports); + free(od->localnet_ports); ovn_ls_port_group_destroy(&od->nb_pgs); destroy_mcast_info_for_datapath(od); @@ -2053,7 +2056,11 @@ join_logical_ports(struct northd_context *ctx, } if (!strcmp(nbsp->type, "localnet")) { - od->localnet_port = op; + od->localnet_ports = xrealloc( + od->localnet_ports, + sizeof *od->localnet_ports * (od->n_localnet_ports + 1) + ); + od->localnet_ports[od->n_localnet_ports++] = op; } op->lsp_addrs @@ -2974,7 +2981,7 @@ ovn_port_update_sbrec(struct northd_context *ctx, "reside-on-redirect-chassis", false) || op->peer == op->peer->od->l3dgw_port)) { add_router_port_garp = true; - } else if (chassis && op->od->localnet_port) { + } else if (chassis && op->od->localnet_ports) { add_router_port_garp = true; } @@ -4662,23 +4669,25 @@ build_pre_acls(struct ovn_datapath *od, struct hmap *lflows) ds_destroy(&match_in); ds_destroy(&match_out); } - if (od->localnet_port) { - struct ds match_in = DS_EMPTY_INITIALIZER; - struct ds match_out = DS_EMPTY_INITIALIZER; + if (od->localnet_ports) { + for (size_t i = 0; i < od->n_localnet_ports; i++) { + struct ds match_in = DS_EMPTY_INITIALIZER; + struct ds match_out = DS_EMPTY_INITIALIZER; - ds_put_format(&match_in, "ip && inport == %s", - od->localnet_port->json_key); - ds_put_format(&match_out, "ip && outport == %s", - od->localnet_port->json_key); - ovn_lflow_add_with_hint(lflows, od, S_SWITCH_IN_PRE_ACL, 110, - ds_cstr(&match_in), "next;", - &od->localnet_port->nbsp->header_); - ovn_lflow_add_with_hint(lflows, od, S_SWITCH_OUT_PRE_ACL, 110, - ds_cstr(&match_out), "next;", - &od->localnet_port->nbsp->header_); + ds_put_format(&match_in, "ip && inport == %s", + od->localnet_ports[i]->json_key); + ds_put_format(&match_out, "ip && outport == %s", + od->localnet_ports[i]->json_key); + ovn_lflow_add_with_hint(lflows, od, S_SWITCH_IN_PRE_ACL, 110, + ds_cstr(&match_in), "next;", + &od->localnet_ports[i]->nbsp->header_); + ovn_lflow_add_with_hint(lflows, od, S_SWITCH_OUT_PRE_ACL, 110, + ds_cstr(&match_out), "next;", + &od->localnet_ports[i]->nbsp->header_); - ds_destroy(&match_in); - ds_destroy(&match_out); + ds_destroy(&match_in); + ds_destroy(&match_out); + } } /* Ingress and Egress Pre-ACL Table (Priority 110). @@ -5919,9 +5928,11 @@ build_lswitch_rport_arp_req_flow_for_ip(struct sset *ips, /* Send a the packet only to the router pipeline and skip flooding it * in the broadcast domain (except for the localnet port). */ - if (od->localnet_port) { - ds_put_format(&actions, "clone { outport = %s; output; }; ", - od->localnet_port->json_key); + if (od->localnet_ports) { + for (size_t i = 0; i < od->n_localnet_ports; i++) { + ds_put_format(&actions, "clone { outport = %s; output; }; ", + od->localnet_ports[i]->json_key); + } } ds_put_format(&actions, "outport = %s; output;", patch_op->json_key); ovn_lflow_add_with_hint(lflows, od, S_SWITCH_IN_L2_LKUP, priority, @@ -6323,9 +6334,9 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, } bool is_external = lsp_is_external(op->nbsp); - if (is_external && (!op->od->localnet_port || + if (is_external && (!op->od->localnet_ports || !op->nbsp->ha_chassis_group)) { - /* If it's an external port and there is no localnet port + /* If it's an external port and there are no localnet ports * and if it doesn't belong to an HA chassis group ignore it. */ continue; } @@ -6339,84 +6350,93 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, stage_hint = NULL; } - for (size_t j = 0; j < op->lsp_addrs[i].n_ipv4_addrs; j++) { - struct ds options_action = DS_EMPTY_INITIALIZER; - struct ds response_action = DS_EMPTY_INITIALIZER; - struct ds ipv4_addr_match = DS_EMPTY_INITIALIZER; - if (build_dhcpv4_action( - op, op->lsp_addrs[i].ipv4_addrs[j].addr, - &options_action, &response_action, &ipv4_addr_match)) { - ds_clear(&match); - ds_put_format( - &match, "inport == %s && eth.src == %s && " - "ip4.src == 0.0.0.0 && ip4.dst == 255.255.255.255 && " - "udp.src == 68 && udp.dst == 67", - is_external ? op->od->localnet_port->json_key : - op->json_key, - op->lsp_addrs[i].ea_s); - - if (is_external) { - ds_put_format(&match, " && is_chassis_resident(%s)", - op->json_key); - } + size_t jmax = is_external? op->od->n_localnet_ports: 1; + for (size_t j = 0; j < jmax; j++) { + for (size_t k = 0; k < op->lsp_addrs[i].n_ipv4_addrs; k++) { + struct ds options_action = DS_EMPTY_INITIALIZER; + struct ds response_action = DS_EMPTY_INITIALIZER; + struct ds ipv4_addr_match = DS_EMPTY_INITIALIZER; + if (build_dhcpv4_action( + op, op->lsp_addrs[i].ipv4_addrs[k].addr, + &options_action, &response_action, + &ipv4_addr_match)) { + ds_clear(&match); + ds_put_format( + &match, + "inport == %s && eth.src == %s && " + "ip4.src == 0.0.0.0 && " + "ip4.dst == 255.255.255.255 && " + "udp.src == 68 && udp.dst == 67", + is_external ? op->od->localnet_ports[j]->json_key : + op->json_key, + op->lsp_addrs[i].ea_s); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_DHCP_OPTIONS, 100, - ds_cstr(&match), - ds_cstr(&options_action), - stage_hint); - ds_clear(&match); - /* Allow ip4.src = OFFER_IP and - * ip4.dst = {SERVER_IP, 255.255.255.255} for the below - * cases - * - When the client wants to renew the IP by sending - * the DHCPREQUEST to the server ip. - * - When the client wants to renew the IP by - * broadcasting the DHCPREQUEST. - */ - ds_put_format( - &match, "inport == %s && eth.src == %s && " - "%s && udp.src == 68 && udp.dst == 67", - is_external ? op->od->localnet_port->json_key : - op->json_key, - op->lsp_addrs[i].ea_s, ds_cstr(&ipv4_addr_match)); + if (is_external) { + ds_put_format( + &match, " && is_chassis_resident(%s)", + op->json_key); + } - if (is_external) { - ds_put_format(&match, " && is_chassis_resident(%s)", - op->json_key); - } + ovn_lflow_add_with_hint(lflows, op->od, + S_SWITCH_IN_DHCP_OPTIONS, 100, + ds_cstr(&match), + ds_cstr(&options_action), + stage_hint); + ds_clear(&match); + /* Allow ip4.src = OFFER_IP and + * ip4.dst = {SERVER_IP, 255.255.255.255} for the below + * cases + * - When the client wants to renew the IP by sending + * the DHCPREQUEST to the server ip. + * - When the client wants to renew the IP by + * broadcasting the DHCPREQUEST. + */ + ds_put_format( + &match, "inport == %s && eth.src == %s && " + "%s && udp.src == 68 && udp.dst == 67", + is_external ? op->od->localnet_ports[j]->json_key : + op->json_key, + op->lsp_addrs[i].ea_s, ds_cstr(&ipv4_addr_match)); + + if (is_external) { + ds_put_format( + &match, " && is_chassis_resident(%s)", + op->json_key); + } - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_DHCP_OPTIONS, 100, - ds_cstr(&match), - ds_cstr(&options_action), - stage_hint); - ds_clear(&match); + ovn_lflow_add_with_hint(lflows, op->od, + S_SWITCH_IN_DHCP_OPTIONS, 100, + ds_cstr(&match), + ds_cstr(&options_action), + stage_hint); + ds_clear(&match); - /* If REGBIT_DHCP_OPTS_RESULT is set, it means the - * put_dhcp_opts action is successful. */ - ds_put_format( - &match, "inport == %s && eth.src == %s && " - "ip4 && udp.src == 68 && udp.dst == 67" - " && "REGBIT_DHCP_OPTS_RESULT, - is_external ? op->od->localnet_port->json_key : - op->json_key, - op->lsp_addrs[i].ea_s); - - if (is_external) { - ds_put_format(&match, " && is_chassis_resident(%s)", - op->json_key); - } + /* If REGBIT_DHCP_OPTS_RESULT is set, it means the + * put_dhcp_opts action is successful. */ + ds_put_format( + &match, "inport == %s && eth.src == %s && " + "ip4 && udp.src == 68 && udp.dst == 67" + " && "REGBIT_DHCP_OPTS_RESULT, + is_external ? op->od->localnet_ports[j]->json_key : + op->json_key, + op->lsp_addrs[i].ea_s); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_DHCP_RESPONSE, 100, - ds_cstr(&match), - ds_cstr(&response_action), - stage_hint); - ds_destroy(&options_action); - ds_destroy(&response_action); - ds_destroy(&ipv4_addr_match); - break; + if (is_external) { + ds_put_format( + &match, " && is_chassis_resident(%s)", + op->json_key); + } + + ovn_lflow_add_with_hint(lflows, op->od, + S_SWITCH_IN_DHCP_RESPONSE, 100, + ds_cstr(&match), + ds_cstr(&response_action), + stage_hint); + ds_destroy(&options_action); + ds_destroy(&response_action); + ds_destroy(&ipv4_addr_match); + break; + } } } @@ -6426,43 +6446,46 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, stage_hint = NULL; } - for (size_t j = 0; j < op->lsp_addrs[i].n_ipv6_addrs; j++) { - struct ds options_action = DS_EMPTY_INITIALIZER; - struct ds response_action = DS_EMPTY_INITIALIZER; - if (build_dhcpv6_action( - op, &op->lsp_addrs[i].ipv6_addrs[j].addr, - &options_action, &response_action)) { - ds_clear(&match); - ds_put_format( - &match, "inport == %s && eth.src == %s" - " && ip6.dst == ff02::1:2 && udp.src == 546 &&" - " udp.dst == 547", - is_external ? op->od->localnet_port->json_key : - op->json_key, - op->lsp_addrs[i].ea_s); - - if (is_external) { - ds_put_format(&match, " && is_chassis_resident(%s)", - op->json_key); - } + for (size_t j = 0; j < jmax; j++) { + for (size_t k = 0; k < op->lsp_addrs[i].n_ipv6_addrs; k++) { + struct ds options_action = DS_EMPTY_INITIALIZER; + struct ds response_action = DS_EMPTY_INITIALIZER; + if (build_dhcpv6_action( + op, &op->lsp_addrs[i].ipv6_addrs[k].addr, + &options_action, &response_action)) { + ds_clear(&match); + ds_put_format( + &match, "inport == %s && eth.src == %s" + " && ip6.dst == ff02::1:2 && udp.src == 546 &&" + " udp.dst == 547", + is_external ? op->od->localnet_ports[j]->json_key : + op->json_key, + op->lsp_addrs[i].ea_s); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_DHCP_OPTIONS, 100, - ds_cstr(&match), - ds_cstr(&options_action), - stage_hint); + if (is_external) { + ds_put_format( + &match, " && is_chassis_resident(%s)", + op->json_key); + } - /* If REGBIT_DHCP_OPTS_RESULT is set to 1, it means the - * put_dhcpv6_opts action is successful */ - ds_put_cstr(&match, " && "REGBIT_DHCP_OPTS_RESULT); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_DHCP_RESPONSE, 100, - ds_cstr(&match), - ds_cstr(&response_action), - stage_hint); - ds_destroy(&options_action); - ds_destroy(&response_action); - break; + ovn_lflow_add_with_hint(lflows, op->od, + S_SWITCH_IN_DHCP_OPTIONS, 100, + ds_cstr(&match), + ds_cstr(&options_action), + stage_hint); + + /* If REGBIT_DHCP_OPTS_RESULT is set to 1, it means the + * put_dhcpv6_opts action is successful */ + ds_put_cstr(&match, " && "REGBIT_DHCP_OPTS_RESULT); + ovn_lflow_add_with_hint(lflows, op->od, + S_SWITCH_IN_DHCP_RESPONSE, 100, + ds_cstr(&match), + ds_cstr(&response_action), + stage_hint); + ds_destroy(&options_action); + ds_destroy(&response_action); + break; + } } } } @@ -6521,7 +6544,7 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, HMAP_FOR_EACH (op, key_node, ports) { if (!op->nbsp || !lsp_is_external(op->nbsp) || - !op->od->localnet_port) { + !op->od->localnet_ports) { continue; } @@ -6536,36 +6559,42 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, for (size_t k = 0; k < rp->n_lsp_addrs; k++) { for (size_t l = 0; l < rp->lsp_addrs[k].n_ipv4_addrs; l++) { - ds_clear(&match); - ds_put_format( - &match, "inport == %s && eth.src == %s" - " && !is_chassis_resident(%s)" - " && arp.tpa == %s && arp.op == 1", - op->od->localnet_port->json_key, - op->lsp_addrs[i].ea_s, op->json_key, - rp->lsp_addrs[k].ipv4_addrs[l].addr_s); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_EXTERNAL_PORT, - 100, ds_cstr(&match), "drop;", - &op->nbsp->header_); + for (size_t m = 0; m < op->od->n_localnet_ports; m++) { + ds_clear(&match); + ds_put_format( + &match, "inport == %s && eth.src == %s" + " && !is_chassis_resident(%s)" + " && arp.tpa == %s && arp.op == 1", + op->od->localnet_ports[m]->json_key, + op->lsp_addrs[i].ea_s, op->json_key, + rp->lsp_addrs[k].ipv4_addrs[l].addr_s); + ovn_lflow_add_with_hint( + lflows, op->od, + S_SWITCH_IN_EXTERNAL_PORT, 100, + ds_cstr(&match), "drop;", + &op->nbsp->header_); + } } for (size_t l = 0; l < rp->lsp_addrs[k].n_ipv6_addrs; l++) { - ds_clear(&match); - ds_put_format( - &match, "inport == %s && eth.src == %s" - " && !is_chassis_resident(%s)" - " && nd_ns && ip6.dst == {%s, %s} && " - "nd.target == %s", - op->od->localnet_port->json_key, - op->lsp_addrs[i].ea_s, op->json_key, - rp->lsp_addrs[k].ipv6_addrs[l].addr_s, - rp->lsp_addrs[k].ipv6_addrs[l].sn_addr_s, - rp->lsp_addrs[k].ipv6_addrs[l].addr_s); - ovn_lflow_add_with_hint(lflows, op->od, - S_SWITCH_IN_EXTERNAL_PORT, 100, - ds_cstr(&match), "drop;", - &op->nbsp->header_); + for (size_t m = 0; m < op->od->n_localnet_ports; m++) { + ds_clear(&match); + ds_put_format( + &match, "inport == %s && eth.src == %s" + " && !is_chassis_resident(%s)" + " && nd_ns && ip6.dst == {%s, %s} && " + "nd.target == %s", + op->od->localnet_ports[m]->json_key, + op->lsp_addrs[i].ea_s, op->json_key, + rp->lsp_addrs[k].ipv6_addrs[l].addr_s, + rp->lsp_addrs[k].ipv6_addrs[l].sn_addr_s, + rp->lsp_addrs[k].ipv6_addrs[l].addr_s); + ovn_lflow_add_with_hint( + lflows, op->od, + S_SWITCH_IN_EXTERNAL_PORT, 100, + ds_cstr(&match), "drop;", + &op->nbsp->header_); + } } } } @@ -6787,7 +6816,7 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports, ETH_ADDR_ARGS(mac)); if (op->peer->od->l3dgw_port && op->peer->od->l3redirect_port - && op->od->localnet_port) { + && op->od->localnet_ports) { bool add_chassis_resident_check = false; if (op->peer == op->peer->od->l3dgw_port) { /* The peer of this port represents a distributed @@ -8084,7 +8113,7 @@ build_lrouter_flows(struct hmap *datapaths, struct hmap *ports, op->lrp_networks.ipv4_addrs[i].addr_s); if (op->od->l3dgw_port && op->od->l3redirect_port && op->peer - && op->peer->od->localnet_port) { + && op->peer->od->localnet_ports) { bool add_chassis_resident_check = false; if (op == op->od->l3dgw_port) { /* Traffic with eth.src = l3dgw_port->lrp_networks.ea_s diff --git a/ovn-architecture.7.xml b/ovn-architecture.7.xml index 533ae716d..88edb6f32 100644 --- a/ovn-architecture.7.xml +++ b/ovn-architecture.7.xml @@ -441,9 +441,8 @@

A localnet logical switch port bridges a logical switch to a - physical VLAN. Any given logical switch should have no more than one - localnet port. Such a logical switch is used in two - scenarios: + physical VLAN. A logical switch may have one or more localnet + ports. Such a logical switch is used in two scenarios:

    @@ -1895,13 +1894,13 @@
    1. The packet first enters the ingress pipeline, and then egress pipeline of - the source localnet logical switch datapath and is sent out via the + the source localnet logical switch datapath and is sent out via a localnet port of the source localnet logical switch (instead of sending it to router pipeline).
    2. - The gateway chassis receives the packet via the localnet port of the + The gateway chassis receives the packet via a localnet port of the source localnet logical switch and sends it to the integration bridge. The packet then enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and enters the ingress @@ -1916,11 +1915,11 @@ From the router datapath, packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch datapath. It then goes out of the integration bridge to the provider bridge ( - belonging to the destination logical switch) via the localnet port. + belonging to the destination logical switch) via a localnet port.
    3. - The destination chassis receives the packet via the localnet port and + The destination chassis receives the packet via a localnet port and sends it to the integration bridge. The packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch and finally delivered to the destination VM port. @@ -1935,13 +1934,13 @@
      1. The packet first enters the ingress pipeline, and then egress pipeline of - the source localnet logical switch datapath and is sent out via the + the source localnet logical switch datapath and is sent out via a localnet port of the source localnet logical switch (instead of sending it to router pipeline).
      2. - The gateway chassis receives the packet via the localnet port of the + The gateway chassis receives the packet via a localnet port of the source localnet logical switch and sends it to the integration bridge. The packet then enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and enters the ingress @@ -1957,7 +1956,7 @@ egress pipeline of the localnet logical switch datapath which provides external connectivity. It then goes out of the integration bridge to the provider bridge (belonging to the logical switch which provides external - connectivity) via the localnet port. + connectivity) via a localnet port.
      @@ -1967,7 +1966,7 @@
      1. - The gateway chassis receives the packet from the localnet port of + The gateway chassis receives the packet from a localnet port of the logical switch which provides external connectivity. The packet then enters the ingress pipeline and then egress pipeline of the localnet logical switch (which provides external connectivity). The packet then @@ -1978,12 +1977,12 @@ The ingress pipeline of the logical router datapath applies the unNATting rules. The packet then enters the ingress pipeline and then egress pipeline of the source localnet logical switch. Since the source VM - doesn't reside in the gateway chassis, the packet is sent out via the + doesn't reside in the gateway chassis, the packet is sent out via a localnet port of the source logical switch.
      2. - The source chassis receives the packet via the localnet port and + The source chassis receives the packet via a localnet port and sends it to the integration bridge. The packet enters the ingress pipeline and then egress pipeline of the source localnet logical switch and finally gets delivered to the source VM port. diff --git a/ovn-nb.xml b/ovn-nb.xml index 541ec20c1..6f84c427c 100644 --- a/ovn-nb.xml +++ b/ovn-nb.xml @@ -244,14 +244,14 @@

        There are two kinds of logical switches, that is, ones that fully virtualize the network (overlay logical switches) and ones that provide - simple connectivity to a physical network (bridged logical switches). + simple connectivity to physical networks (bridged logical switches). They work in the same way when providing connectivity between logical - ports on same chasis, but differently when connecting remote logical + ports on same chassis, but differently when connecting remote logical ports. Overlay logical switches connect remote logical ports by tunnels, while bridged logical switches provide connectivity to remote ports by - bridging the packets to directly connected physical L2 segment with the + bridging the packets to directly connected physical L2 segments with the help of localnet ports. Each bridged logical switch has - one and only one localnet port, which has only one special + one or more localnet ports, which have only one special address unknown.

        @@ -527,10 +527,13 @@
        localnet
        - A connection to a locally accessible network from each - ovn-controller instance. A logical switch can only - have a single localnet port attached. This is used - to model direct connectivity to an existing network. + A connection to a locally accessible network from + ovn-controller instances that have corresponding + bridge mapping. A logical switch can have multiple + localnet ports attached, as long as each + ovn-controller is plugged to a single local network + only. In this case, each hypervisor implements part of switch + external network connectivity.
        localport
        @@ -721,7 +724,7 @@ Required. The name of the network to which the localnet port is connected. Each hypervisor, via ovn-controller, uses its local configuration to determine exactly how to connect to - this locally accessible network. + this locally accessible network, if at all. diff --git a/ovn-sb.xml b/ovn-sb.xml index 3ae9d4f92..2d2d08027 100644 --- a/ovn-sb.xml +++ b/ovn-sb.xml @@ -2606,10 +2606,13 @@ tcp.flags = RST;
        localnet
        - A connection to a locally accessible network from each - ovn-controller instance. A logical switch can only - have a single localnet port attached. This is used - to model direct connectivity to an existing network. + A connection to a locally accessible network from some or all + ovn-controller instances. This is used + to model direct connectivity to existing networks. A logical + switch can have multiple localnet ports attached, as + long as each ovn-controller is plugged to a single + local network only. In this case, each hypervisor implements part + of switch external network connectivity.
        localport
        @@ -2754,10 +2757,12 @@ tcp.flags = RST;

        When a logical switch has a localnet port attached, every chassis that may have a local vif attached to that logical - switch must have a bridge mapping configured to reach that - localnet. Traffic that arrives on a - localnet port is never forwarded over a tunnel to - another chassis. + switch that needs this external connectivity must have a bridge + mapping configured to reach that localnet. If the + mapping is missing, the vif won't be plugged to this network. It may + still reach the other network if routing is implemented by fabric. + Traffic that arrives on a localnet port is never + forwarded over a tunnel to another chassis.

        diff --git a/tests/ovn.at b/tests/ovn.at index 013583826..42089763a 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -2438,6 +2438,118 @@ OVN_CLEANUP([hv1],[hv2]) AT_CLEANUP +AT_SETUP([ovn -- 2 HVs, multiple localnet ports]) +ovn_start + +# In this test case we create a single switch connected to two physical +# networks via multiple localnet ports. Then we create two hypervisors, with 2 +# ports on each. Each pair of adjecent ports belong to the same network segment +# and assume interconnectivity. There is no direct interconnectivity between +# ports located on chassis attached to different segments. (It is assumed that +# in real life external fabric L3 routing will deliver packets between the +# segments as needed.) +ovn-nbctl ls-add ls1 +for tag in 10 20; do + ln_port_name=ln-$tag + ovn-nbctl lsp-add ls1 $ln_port_name "" $tag + ovn-nbctl lsp-set-addresses $ln_port_name unknown + ovn-nbctl lsp-set-type $ln_port_name localnet + ovn-nbctl lsp-set-options $ln_port_name network_name=phys-$tag +done + +for tag in 10 20; do + net_add n-$tag +done + +for tag in 10 20; do + for i in 1 2; do + sim_add hv-$tag-$i + as hv-$tag-$i + ovs-vsctl add-br br-phys + ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys-$tag:br-phys + ovn_attach n-$tag br-phys 192.168.$i.$tag + + ovs-vsctl add-port br-int vif-$tag-$i -- \ + set Interface vif-$tag-$i external-ids:iface-id=lp-$tag-$i \ + options:tx_pcap=hv-$tag-$i/vif-$tag-$i-tx.pcap \ + options:rxq_pcap=hv-$tag-$i/vif-$tag-$i-rx.pcap \ + ofport-request=$tag$i + + lsp_name=lp-$tag-$i + ovn-nbctl lsp-add ls1 $lsp_name + ovn-nbctl lsp-set-addresses $lsp_name f0:00:00:00:0$i:$tag + ovn-nbctl lsp-set-port-security $lsp_name f0:00:00:00:0$i:$tag + + OVS_WAIT_UNTIL([test x`ovn-nbctl lsp-get-up $lsp_name` = xup]) + done +done +ovn-nbctl --wait=sb sync +ovn-sbctl dump-flows + +for tag in 10 20; do + for i in 1 2; do + : > $tag-$i.expected + done +done + +vif_to_hv() { + echo hv-$1 +} + +test_packet() { + local inport=$1 dst=$2 src=$3 eth=$4 eout=$5 lout=$6 + + # First try tracing the packet. + uflow="inport==\"lp-$inport\" && eth.dst==$dst && eth.src==$src && eth.type==0x$eth" + echo "output(\"$lout\");" > expout + AT_CAPTURE_FILE([trace]) + AT_CHECK([ovn-trace --all ls1 "$uflow" | tee trace | sed '1,/Minimal trace/d'], [0], [expout]) + + # Then actually send a packet, for an end-to-end test. + local packet=$(echo $dst$src | sed 's/://g')${eth} + hv=`vif_to_hv $inport` + vif=vif-$inport + as $hv ovs-appctl netdev-dummy/receive $vif $packet + if test $eth = 1002 -o $eth = 2002; then + echo $packet >> ${eout#lp-}.expected + fi +} + +# should fail +test_packet 10-1 f0:00:00:00:01:20 f0:00:00:00:01:10 1001 lp-20-1 lp-20-1 +test_packet 20-1 f0:00:00:00:01:10 f0:00:00:00:01:20 2001 lp-10-1 lp-10-1 + +# should pass +test_packet 10-1 f0:00:00:00:02:10 f0:00:00:00:01:10 1002 lp-10-2 lp-10-2 +test_packet 20-1 f0:00:00:00:02:20 f0:00:00:00:01:20 2002 lp-20-2 lp-20-2 + +# Dump a bunch of info helpful for debugging if there's a failure. + +echo "------ OVN dump ------" +ovn-nbctl show +ovn-sbctl show + +for tag in 10 20; do + for i in 1 2; do + hv=hv-$tag-$i + echo "------ $hv dump ------" + as $hv ovs-vsctl show + as $hv ovs-ofctl -O OpenFlow13 dump-flows br-int + done +done + +# Now check the packets actually received against the ones expected. +for tag in 10 20; do + for i in 1 2; do + echo "hv = $tag-$i" + OVN_CHECK_PACKETS_REMOVE_BROADCAST([hv-$tag-$i/vif-$tag-$i-tx.pcap], [$tag-$i.expected]) + done +done + +OVN_CLEANUP([hv-10-1],[hv-10-2],[hv-20-1],[hv-20-2]) + +AT_CLEANUP + AT_SETUP([ovn -- vtep: 3 HVs, 1 VIFs/HV, 1 GW, 1 LS]) AT_KEYWORDS([vtep]) ovn_start