Skip to content

Commit 054bf2e

Browse files
shyloushylou
committed
northd: Add option to enable conntrack for router port
By default, OVN skips the conntrack process for router type LSP within a LS. It seems unnecessary for the LSP whose peer is l3dgw_port. Therefore, we introduce a new option named 'lsp_skip_conntrack', which defaults to false and can be set true to enable conntrack for the LSP whose peer is l3dgw_port. And then we can implement l3 gateway stateful firewall, for example: prelude: R1-S1 is a l3dgw_port ovn-nbctl pg-add pg_dgw ovn-nbctl pg-set-ports pg_dgw S1-R1 ovn-nbctl acl-add pg_dgw from-lport 1002 "inport == @pg_dgw && ip4" allow-related ovn-nbctl acl-add pg_dgw to-lport 1003 "outport == @pg_dgw && ip4" allow-related ovn-nbctl lsp-set-options S1-R1 router-port=R1-S1 lsp_skip_conntrack=true NOTE: this option only works for the LSP whose peer is l3dgw_port. Signed-off-by: Xie Liu <[email protected]>
1 parent ae63212 commit 054bf2e

File tree

3 files changed

+94
-1
lines changed

3 files changed

+94
-1
lines changed

‎northd/northd.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1834,6 +1834,12 @@ localnet_can_learn_mac(const struct nbrec_logical_switch_port *nbsp)
18341834
return smap_get_bool(&nbsp->options, "localnet_learn_fdb", false);
18351835
}
18361836

1837+
static bool
1838+
lsp_skip_conntrack(const struct nbrec_logical_switch_port *nbsp)
1839+
{
1840+
return smap_get_bool(&nbsp->options, "lsp_skip_conntrack", false);
1841+
}
1842+
18371843
static bool
18381844
lsp_is_type_changed(const struct sbrec_port_binding *sb,
18391845
const struct nbrec_logical_switch_port *nbsp,
@@ -7198,7 +7204,12 @@ build_pre_acls(struct ovn_datapath *od,
71987204
* which handles defragmentation, in order to match L4 headers. */
71997205
if (od->has_stateful_acl) {
72007206
for (size_t i = 0; i < od->n_router_ports; i++) {
7201-
skip_port_from_conntrack(od, od->router_ports[i],
7207+
struct ovn_port *op = od->router_ports[i];
7208+
if (op->peer && is_l3dgw_port(op->peer) &&
7209+
lsp_skip_conntrack(op->nbsp)) {
7210+
continue;
7211+
}
7212+
skip_port_from_conntrack(od, op,
72027213
S_SWITCH_IN_PRE_ACL, S_SWITCH_OUT_PRE_ACL,
72037214
110, lflows);
72047215
}

‎ovn-nb.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1107,6 +1107,14 @@
11071107
should have a route to forward packets sent to configured proxy ARP
11081108
MAC/IPs to an appropriate destination.
11091109
</column>
1110+
1111+
<column name="options" key="lsp_skip_conntrack"
1112+
type='{"type": "boolean"}'>
1113+
Optional. Enable conntrack for the router port whose peer is
1114+
l3dgw_port if set to <code>true</code>. The default value is
1115+
<code>false</code>.
1116+
</column>
1117+
11101118
</group>
11111119

11121120
<group title="Options for localnet ports">

‎tests/ovn-northd.at

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10910,3 +10910,77 @@ CHECK_NO_CHANGE_AFTER_RECOMPUTE
1091010910

1091110911
AT_CLEANUP
1091210912
])
10913+
10914+
OVN_FOR_EACH_NORTHD_NO_HV([
10915+
AT_SETUP([Distributed gw port skip conntrack option])
10916+
ovn_start
10917+
10918+
ovn-sbctl chassis-add gw1 geneve 127.0.0.1
10919+
10920+
ovn-nbctl lr-add R1
10921+
ovn-nbctl lrp-add R1 R1-S1 02:ac:10:01:00:01 172.16.1.1/24
10922+
ovn-nbctl lrp-set-gateway-chassis R1-S1 gw1
10923+
10924+
ovn-nbctl ls-add S1
10925+
ovn-nbctl lsp-add S1 S1-R1
10926+
ovn-nbctl lsp-set-type S1-R1 router
10927+
ovn-nbctl lsp-set-addresses S1-R1 router
10928+
ovn-nbctl --wait=sb lsp-set-options S1-R1 router-port=R1-S1
10929+
AT_CHECK([test x`ovn-nbctl lsp-get-up S1-R1` = xup])
10930+
10931+
# Add the router gw port to one port_group which has stateful acls
10932+
ovn-nbctl --wait=sb pg-add pg_dgw
10933+
ovn-nbctl --wait=sb pg-set-ports pg_dgw S1-R1
10934+
ovn-nbctl acl-add pg_dgw from-lport 1002 "inport == @pg_dgw && ip4" allow-related
10935+
ovn-nbctl acl-add pg_dgw to-lport 1003 "outport == @pg_dgw && ip4" allow-related
10936+
10937+
# Check skip conntrack option with 'lsp_skip_conntrack' default (false)
10938+
AT_CHECK([ovn-sbctl dump-flows S1 | grep pre_acl | sed 's/table=./table=?/'], [0], [dnl
10939+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)
10940+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10941+
table=? (ls_in_pre_acl ), priority=110 , match=(ip && inport == "S1-R1"), action=(next;)
10942+
table=? (ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10943+
table=? (ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10944+
table=? (ls_in_pre_acl ), priority=0 , match=(1), action=(next;)
10945+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10946+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.src == $svc_monitor_mac), action=(next;)
10947+
table=? (ls_out_pre_acl ), priority=110 , match=(ip && outport == "S1-R1"), action=(next;)
10948+
table=? (ls_out_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10949+
table=? (ls_out_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10950+
table=? (ls_out_pre_acl ), priority=0 , match=(1), action=(next;)
10951+
])
10952+
10953+
# Enable 'lsp_skip_conntrack' and check the flows
10954+
AT_CHECK([ovn-nbctl --wait=sb lsp-set-options S1-R1 router-port=R1-S1 lsp_skip_conntrack=true])
10955+
AT_CHECK([ovn-sbctl dump-flows S1 | grep pre_acl | sed 's/table=./table=?/'], [0], [dnl
10956+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)
10957+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10958+
table=? (ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10959+
table=? (ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10960+
table=? (ls_in_pre_acl ), priority=0 , match=(1), action=(next;)
10961+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10962+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.src == $svc_monitor_mac), action=(next;)
10963+
table=? (ls_out_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10964+
table=? (ls_out_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10965+
table=? (ls_out_pre_acl ), priority=0 , match=(1), action=(next;)
10966+
])
10967+
10968+
# Disable 'lsp_skip_conntrack' and check the flows
10969+
AT_CHECK([ovn-nbctl --wait=sb lsp-set-options S1-R1 router-port=R1-S1 lsp_skip_conntrack=false])
10970+
AT_CHECK([ovn-sbctl dump-flows S1 | grep pre_acl | sed 's/table=./table=?/'], [0], [dnl
10971+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)
10972+
table=? (ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10973+
table=? (ls_in_pre_acl ), priority=110 , match=(ip && inport == "S1-R1"), action=(next;)
10974+
table=? (ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10975+
table=? (ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10976+
table=? (ls_in_pre_acl ), priority=0 , match=(1), action=(next;)
10977+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)
10978+
table=? (ls_out_pre_acl ), priority=110 , match=(eth.src == $svc_monitor_mac), action=(next;)
10979+
table=? (ls_out_pre_acl ), priority=110 , match=(ip && outport == "S1-R1"), action=(next;)
10980+
table=? (ls_out_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)
10981+
table=? (ls_out_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)
10982+
table=? (ls_out_pre_acl ), priority=0 , match=(1), action=(next;)
10983+
])
10984+
10985+
AT_CLEANUP
10986+
])

0 commit comments

Comments
 (0)