diff --git a/ovn-21.06.0.patch b/ovn-21.06.0.patch new file mode 100644 index 0000000..df70d00 --- /dev/null +++ b/ovn-21.06.0.patch @@ -0,0 +1,1402 @@ +diff --git a/controller/binding.c b/controller/binding.c +index 7fde0fdbb..ba558efdb 100644 +--- a/controller/binding.c ++++ b/controller/binding.c +@@ -22,6 +22,7 @@ + #include "patch.h" + + #include "lib/bitmap.h" ++#include "lib/hmapx.h" + #include "openvswitch/poll-loop.h" + #include "lib/sset.h" + #include "lib/util.h" +@@ -108,6 +109,7 @@ add_local_datapath__(struct ovsdb_idl_index *sbrec_datapath_binding_by_key, + hmap_insert(local_datapaths, &ld->hmap_node, dp_key); + ld->datapath = datapath; + ld->localnet_port = NULL; ++ shash_init(&ld->external_ports); + ld->has_local_l3gateway = has_local_l3gateway; + + if (tracked_datapaths) { +@@ -474,6 +476,18 @@ is_network_plugged(const struct sbrec_port_binding *binding_rec, + return network ? !!shash_find_data(bridge_mappings, network) : false; + } + ++static void ++update_ld_external_ports(const struct sbrec_port_binding *binding_rec, ++ struct hmap *local_datapaths) ++{ ++ struct local_datapath *ld = get_local_datapath( ++ local_datapaths, binding_rec->datapath->tunnel_key); ++ if (ld) { ++ shash_replace(&ld->external_ports, binding_rec->logical_port, ++ binding_rec); ++ } ++} ++ + static void + update_ld_localnet_port(const struct sbrec_port_binding *binding_rec, + struct shash *bridge_mappings, +@@ -531,38 +545,41 @@ remove_local_lports(const char *iface_id, struct binding_ctx_out *b_ctx) + } + } + +-/* Add a port binding ID (of the form "dp-key"_"port-key") to the set of local +- * lport IDs. Also track if the set has changed. ++/* Add a port binding to the set of locally relevant lports. ++ * Also track if the set has changed. + */ + static void +-update_local_lport_ids(const struct sbrec_port_binding *pb, +- struct binding_ctx_out *b_ctx) ++update_related_lport(const struct sbrec_port_binding *pb, ++ struct binding_ctx_out *b_ctx) + { + char buf[16]; + get_unique_lport_key(pb->datapath->tunnel_key, pb->tunnel_key, + buf, sizeof(buf)); +- if (sset_add(b_ctx->local_lport_ids, buf) != NULL) { +- b_ctx->local_lport_ids_changed = true; ++ if (sset_add(&b_ctx->related_lports->lport_ids, buf) != NULL) { ++ b_ctx->related_lports_changed = true; + + if (b_ctx->tracked_dp_bindings) { + /* Add the 'pb' to the tracked_datapaths. */ + tracked_binding_datapath_lport_add(pb, b_ctx->tracked_dp_bindings); + } + } ++ sset_add(&b_ctx->related_lports->lport_names, pb->logical_port); + } + +-/* Remove a port binding id from the set of local lport IDs. Also track if +- * the set has changed. ++/* Remove a port binding id from the set of locally relevant lports. ++ * Also track if the set has changed. + */ + static void +-remove_local_lport_ids(const struct sbrec_port_binding *pb, +- struct binding_ctx_out *b_ctx) ++remove_related_lport(const struct sbrec_port_binding *pb, ++ struct binding_ctx_out *b_ctx) + { + char buf[16]; + get_unique_lport_key(pb->datapath->tunnel_key, pb->tunnel_key, + buf, sizeof(buf)); +- if (sset_find_and_delete(b_ctx->local_lport_ids, buf)) { +- b_ctx->local_lport_ids_changed = true; ++ sset_find_and_delete(&b_ctx->related_lports->lport_names, ++ pb->logical_port); ++ if (sset_find_and_delete(&b_ctx->related_lports->lport_ids, buf)) { ++ b_ctx->related_lports_changed = true; + + if (b_ctx->tracked_dp_bindings) { + /* Add the 'pb' to the tracked_datapaths. */ +@@ -678,6 +695,20 @@ static struct binding_lport *binding_lport_check_and_cleanup( + + static char *get_lport_type_str(enum en_lport_type lport_type); + ++void ++related_lports_init(struct related_lports *rp) ++{ ++ sset_init(&rp->lport_names); ++ sset_init(&rp->lport_ids); ++} ++ ++void ++related_lports_destroy(struct related_lports *rp) ++{ ++ sset_destroy(&rp->lport_names); ++ sset_destroy(&rp->lport_ids); ++} ++ + void + local_binding_data_init(struct local_binding_data *lbinding_data) + { +@@ -1172,7 +1203,7 @@ release_binding_lport(const struct sbrec_chassis *chassis_rec, + struct binding_ctx_out *b_ctx_out) + { + if (is_binding_lport_this_chassis(b_lport, chassis_rec)) { +- remove_local_lport_ids(b_lport->pb, b_ctx_out); ++ remove_related_lport(b_lport->pb, b_ctx_out); + if (!release_lport(b_lport->pb, sb_readonly, + b_ctx_out->tracked_dp_bindings, + b_ctx_out->if_mgr)) { +@@ -1214,7 +1245,7 @@ consider_vif_lport_(const struct sbrec_port_binding *pb, + pb->datapath, false, + b_ctx_out->local_datapaths, + b_ctx_out->tracked_dp_bindings); +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + update_local_lports(pb->logical_port, b_ctx_out); + if (b_lport->lbinding->iface && qos_map && b_ctx_in->ovs_idl_txn) { + get_qos_params(pb, qos_map); +@@ -1405,7 +1436,7 @@ consider_virtual_lport(const struct sbrec_port_binding *pb, + * its entry from the local_lport_ids if present. This is required + * when a virtual port moves from one chassis to other.*/ + if (!virtual_b_lport) { +- remove_local_lport_ids(pb, b_ctx_out); ++ remove_related_lport(pb, b_ctx_out); + } + + return true; +@@ -1430,7 +1461,7 @@ consider_nonvif_lport_(const struct sbrec_port_binding *pb, + b_ctx_out->local_datapaths, + b_ctx_out->tracked_dp_bindings); + +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + return claim_lport(pb, NULL, b_ctx_in->chassis_rec, NULL, + !b_ctx_in->ovnsb_idl_txn, false, + b_ctx_out->tracked_dp_bindings, +@@ -1482,7 +1513,7 @@ consider_localnet_lport(const struct sbrec_port_binding *pb, + get_qos_params(pb, qos_map); + } + +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + } + + static bool +@@ -1512,7 +1543,7 @@ consider_ha_lport(const struct sbrec_port_binding *pb, + pb->datapath, false, + b_ctx_out->local_datapaths, + b_ctx_out->tracked_dp_bindings); +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + } + + return consider_nonvif_lport_(pb, our_chassis, false, b_ctx_in, b_ctx_out); +@@ -1614,8 +1645,9 @@ binding_run(struct binding_ctx_in *b_ctx_in, struct binding_ctx_out *b_ctx_out) + !sset_is_empty(b_ctx_out->egress_ifaces) ? &qos_map : NULL; + + struct ovs_list localnet_lports = OVS_LIST_INITIALIZER(&localnet_lports); ++ struct ovs_list external_lports = OVS_LIST_INITIALIZER(&external_lports); + +- struct localnet_lport { ++ struct lport { + struct ovs_list list_node; + const struct sbrec_port_binding *pb; + }; +@@ -1634,7 +1666,7 @@ binding_run(struct binding_ctx_in *b_ctx_in, struct binding_ctx_out *b_ctx_out) + case LP_PATCH: + case LP_LOCALPORT: + case LP_VTEP: +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + break; + + case LP_VIF: +@@ -1663,11 +1695,14 @@ binding_run(struct binding_ctx_in *b_ctx_in, struct binding_ctx_out *b_ctx_out) + + case LP_EXTERNAL: + consider_external_lport(pb, b_ctx_in, b_ctx_out); ++ struct lport *ext_lport = xmalloc(sizeof *ext_lport); ++ ext_lport->pb = pb; ++ ovs_list_push_back(&external_lports, &ext_lport->list_node); + break; + + case LP_LOCALNET: { + consider_localnet_lport(pb, b_ctx_in, b_ctx_out, &qos_map); +- struct localnet_lport *lnet_lport = xmalloc(sizeof *lnet_lport); ++ struct lport *lnet_lport = xmalloc(sizeof *lnet_lport); + lnet_lport->pb = pb; + ovs_list_push_back(&localnet_lports, &lnet_lport->list_node); + break; +@@ -1694,7 +1729,7 @@ binding_run(struct binding_ctx_in *b_ctx_in, struct binding_ctx_out *b_ctx_out) + /* Run through each localnet lport list to see if it is a localnet port + * on local datapaths discovered from above loop, and update the + * corresponding local datapath accordingly. */ +- struct localnet_lport *lnet_lport; ++ struct lport *lnet_lport; + LIST_FOR_EACH_POP (lnet_lport, list_node, &localnet_lports) { + update_ld_localnet_port(lnet_lport->pb, &bridge_mappings, + b_ctx_out->egress_ifaces, +@@ -1702,6 +1737,15 @@ binding_run(struct binding_ctx_in *b_ctx_in, struct binding_ctx_out *b_ctx_out) + free(lnet_lport); + } + ++ /* Run through external lport list to see if these are external ports ++ * on local datapaths discovered from above loop, and update the ++ * corresponding local datapath accordingly. */ ++ struct lport *ext_lport; ++ LIST_FOR_EACH_POP (ext_lport, list_node, &external_lports) { ++ update_ld_external_ports(ext_lport->pb, b_ctx_out->local_datapaths); ++ free(ext_lport); ++ } ++ + shash_destroy(&bridge_mappings); + + if (!sset_is_empty(b_ctx_out->egress_ifaces) +@@ -1895,7 +1939,7 @@ remove_pb_from_local_datapath(const struct sbrec_port_binding *pb, + struct binding_ctx_out *b_ctx_out, + struct local_datapath *ld) + { +- remove_local_lport_ids(pb, b_ctx_out); ++ remove_related_lport(pb, b_ctx_out); + if (!strcmp(pb->type, "patch") || + !strcmp(pb->type, "l3gateway")) { + remove_local_datapath_peer_port(pb, ld, b_ctx_out->local_datapaths); +@@ -1904,6 +1948,8 @@ remove_pb_from_local_datapath(const struct sbrec_port_binding *pb, + pb->logical_port)) { + ld->localnet_port = NULL; + } ++ } else if (!strcmp(pb->type, "external")) { ++ shash_find_and_delete(&ld->external_ports, pb->logical_port); + } + + if (!strcmp(pb->type, "l3gateway")) { +@@ -2407,6 +2453,9 @@ binding_handle_port_binding_changes(struct binding_ctx_in *b_ctx_in, + shash_add(&deleted_virtual_pbs, pb->logical_port, pb); + } else { + shash_add(&deleted_other_pbs, pb->logical_port, pb); ++ if (lport_type == LP_EXTERNAL) { ++ hmapx_add(b_ctx_out->extport_updated_datapaths, pb->datapath); ++ } + } + } + +@@ -2502,7 +2551,7 @@ delete_done: + case LP_PATCH: + case LP_LOCALPORT: + case LP_VTEP: +- update_local_lport_ids(pb, b_ctx_out); ++ update_related_lport(pb, b_ctx_out); + if (lport_type == LP_PATCH) { + if (!ld) { + /* If 'ld' for this lport is not present, then check if +@@ -2561,6 +2610,8 @@ delete_done: + + case LP_EXTERNAL: + handled = consider_external_lport(pb, b_ctx_in, b_ctx_out); ++ update_ld_external_ports(pb, b_ctx_out->local_datapaths); ++ hmapx_add(b_ctx_out->extport_updated_datapaths, pb->datapath); + break; + + case LP_LOCALNET: { +@@ -2926,23 +2977,3 @@ cleanup: + + return b_lport; + } +- +-struct sset * +-binding_collect_local_binding_lports(struct local_binding_data *lbinding_data) +-{ +- struct sset *lports = xzalloc(sizeof *lports); +- sset_init(lports); +- struct shash_node *shash_node; +- SHASH_FOR_EACH (shash_node, &lbinding_data->lports) { +- struct binding_lport *b_lport = shash_node->data; +- sset_add(lports, b_lport->name); +- } +- return lports; +-} +- +-void +-binding_destroy_local_binding_lports(struct sset *lports) +-{ +- sset_destroy(lports); +- free(lports); +-} +diff --git a/controller/binding.h b/controller/binding.h +index 8f3289476..8fd54092e 100644 +--- a/controller/binding.h ++++ b/controller/binding.h +@@ -22,6 +22,7 @@ + #include "openvswitch/hmap.h" + #include "openvswitch/uuid.h" + #include "openvswitch/list.h" ++#include "sset.h" + + struct hmap; + struct ovsdb_idl; +@@ -56,6 +57,19 @@ struct binding_ctx_in { + const struct ovsrec_interface_table *iface_table; + }; + ++/* Locally relevant port bindings, e.g., VIFs that might be bound locally, ++ * patch ports. ++ */ ++struct related_lports { ++ struct sset lport_names; /* Set of port names. */ ++ struct sset lport_ids; /* Set of _ ++ * IDs for fast lookup. ++ */ ++}; ++ ++void related_lports_init(struct related_lports *); ++void related_lports_destroy(struct related_lports *); ++ + struct binding_ctx_out { + struct hmap *local_datapaths; + struct local_binding_data *lbinding_data; +@@ -65,11 +79,9 @@ struct binding_ctx_out { + /* Track if local_lports have been updated. */ + bool local_lports_changed; + +- /* sset of local lport ids in the format +- * _. */ +- struct sset *local_lport_ids; +- /* Track if local_lport_ids has been updated. */ +- bool local_lport_ids_changed; ++ /* Port bindings that are relevant to the local chassis. */ ++ struct related_lports *related_lports; ++ bool related_lports_changed; + + /* Track if non-vif port bindings (e.g., patch, external) have been + * added/deleted. +@@ -88,6 +100,8 @@ struct binding_ctx_out { + struct hmap *tracked_dp_bindings; + + struct if_status_mgr *if_mgr; ++ ++ struct hmapx *extport_updated_datapaths; + }; + + struct local_binding_data { +@@ -133,13 +147,4 @@ bool binding_handle_port_binding_changes(struct binding_ctx_in *, + void binding_tracked_dp_destroy(struct hmap *tracked_datapaths); + + void binding_dump_local_bindings(struct local_binding_data *, struct ds *); +- +-/* Generates a sset of lport names from local_binding_data. +- * Note: the caller is responsible for destroying and freeing the returned +- * sset, by calling binding_detroy_local_binding_lports(). */ +-struct sset *binding_collect_local_binding_lports(struct local_binding_data *); +- +-/* Destroy and free the lports sset returned by +- * binding_collect_local_binding_lports(). */ +-void binding_destroy_local_binding_lports(struct sset *lports); + #endif /* controller/binding.h */ +diff --git a/controller/lflow.c b/controller/lflow.c +index 680b8cca1..4270d0a33 100644 +--- a/controller/lflow.c ++++ b/controller/lflow.c +@@ -611,7 +611,7 @@ add_matches_to_flow_table(const struct sbrec_logical_flow *lflow, + get_unique_lport_key(dp_id, port_id, buf, sizeof(buf)); + lflow_resource_add(l_ctx_out->lfrr, REF_TYPE_PORTBINDING, buf, + &lflow->header_.uuid); +- if (!sset_contains(l_ctx_in->local_lport_ids, buf)) { ++ if (!sset_contains(l_ctx_in->related_lport_ids, buf)) { + VLOG_DBG("lflow "UUID_FMT + " port %s in match is not local, skip", + UUID_ARGS(&lflow->header_.uuid), +diff --git a/controller/lflow.h b/controller/lflow.h +index 3c929d8a6..076b05beb 100644 +--- a/controller/lflow.h ++++ b/controller/lflow.h +@@ -143,7 +143,7 @@ struct lflow_ctx_in { + const struct shash *addr_sets; + const struct shash *port_groups; + const struct sset *active_tunnels; +- const struct sset *local_lport_ids; ++ const struct sset *related_lport_ids; + }; + + struct lflow_ctx_out { +diff --git a/controller/ovn-controller.c b/controller/ovn-controller.c +index 07c6fcfd1..f9f83d37b 100644 +--- a/controller/ovn-controller.c ++++ b/controller/ovn-controller.c +@@ -970,9 +970,10 @@ struct ed_type_runtime_data { + * local hypervisor, and localnet ports. */ + struct sset local_lports; + +- /* Contains the same ports as local_lports, but in the format: +- * _ */ +- struct sset local_lport_ids; ++ /* Port bindings that are relevant to the local chassis (VIFs bound ++ * localy, patch ports). ++ */ ++ struct related_lports related_lports; + struct sset active_tunnels; + + /* runtime data engine private data. */ +@@ -986,6 +987,9 @@ struct ed_type_runtime_data { + + /* CT zone data. Contains datapaths that had updated CT zones */ + struct hmapx ct_updated_datapaths; ++ ++ /* Contains datapaths that had updated external ports. */ ++ struct hmapx extport_updated_datapaths; + }; + + /* struct ed_type_runtime_data has the below members for tracking the +@@ -1068,7 +1072,7 @@ en_runtime_data_init(struct engine_node *node OVS_UNUSED, + + hmap_init(&data->local_datapaths); + sset_init(&data->local_lports); +- sset_init(&data->local_lport_ids); ++ related_lports_init(&data->related_lports); + sset_init(&data->active_tunnels); + sset_init(&data->egress_ifaces); + smap_init(&data->local_iface_ids); +@@ -1078,6 +1082,7 @@ en_runtime_data_init(struct engine_node *node OVS_UNUSED, + hmap_init(&data->tracked_dp_bindings); + + hmapx_init(&data->ct_updated_datapaths); ++ hmapx_init(&data->extport_updated_datapaths); + + return data; + } +@@ -1088,7 +1093,7 @@ en_runtime_data_cleanup(void *data) + struct ed_type_runtime_data *rt_data = data; + + sset_destroy(&rt_data->local_lports); +- sset_destroy(&rt_data->local_lport_ids); ++ related_lports_destroy(&rt_data->related_lports); + sset_destroy(&rt_data->active_tunnels); + sset_destroy(&rt_data->egress_ifaces); + smap_destroy(&rt_data->local_iface_ids); +@@ -1096,12 +1101,14 @@ en_runtime_data_cleanup(void *data) + HMAP_FOR_EACH_SAFE (cur_node, next_node, hmap_node, + &rt_data->local_datapaths) { + free(cur_node->peer_ports); ++ shash_destroy(&cur_node->external_ports); + hmap_remove(&rt_data->local_datapaths, &cur_node->hmap_node); + free(cur_node); + } + hmap_destroy(&rt_data->local_datapaths); + local_binding_data_destroy(&rt_data->lbinding_data); + hmapx_destroy(&rt_data->ct_updated_datapaths); ++ hmapx_destroy(&rt_data->extport_updated_datapaths); + } + + static void +@@ -1181,14 +1188,15 @@ init_binding_ctx(struct engine_node *node, + b_ctx_out->local_datapaths = &rt_data->local_datapaths; + b_ctx_out->local_lports = &rt_data->local_lports; + b_ctx_out->local_lports_changed = false; +- b_ctx_out->local_lport_ids = &rt_data->local_lport_ids; +- b_ctx_out->local_lport_ids_changed = false; ++ b_ctx_out->related_lports = &rt_data->related_lports; ++ b_ctx_out->related_lports_changed = false; + b_ctx_out->non_vif_ports_changed = false; + b_ctx_out->egress_ifaces = &rt_data->egress_ifaces; + b_ctx_out->lbinding_data = &rt_data->lbinding_data; + b_ctx_out->local_iface_ids = &rt_data->local_iface_ids; + b_ctx_out->tracked_dp_bindings = NULL; + b_ctx_out->if_mgr = ctrl_ctx->if_mgr; ++ b_ctx_out->extport_updated_datapaths = &rt_data->extport_updated_datapaths; + } + + static void +@@ -1197,7 +1205,6 @@ en_runtime_data_run(struct engine_node *node, void *data) + struct ed_type_runtime_data *rt_data = data; + struct hmap *local_datapaths = &rt_data->local_datapaths; + struct sset *local_lports = &rt_data->local_lports; +- struct sset *local_lport_ids = &rt_data->local_lport_ids; + struct sset *active_tunnels = &rt_data->active_tunnels; + + static bool first_run = true; +@@ -1208,23 +1215,25 @@ en_runtime_data_run(struct engine_node *node, void *data) + struct local_datapath *cur_node, *next_node; + HMAP_FOR_EACH_SAFE (cur_node, next_node, hmap_node, local_datapaths) { + free(cur_node->peer_ports); ++ shash_destroy(&cur_node->external_ports); + hmap_remove(local_datapaths, &cur_node->hmap_node); + free(cur_node); + } + hmap_clear(local_datapaths); + local_binding_data_destroy(&rt_data->lbinding_data); + sset_destroy(local_lports); +- sset_destroy(local_lport_ids); ++ related_lports_destroy(&rt_data->related_lports); + sset_destroy(active_tunnels); + sset_destroy(&rt_data->egress_ifaces); + smap_destroy(&rt_data->local_iface_ids); + sset_init(local_lports); +- sset_init(local_lport_ids); ++ related_lports_init(&rt_data->related_lports); + sset_init(active_tunnels); + sset_init(&rt_data->egress_ifaces); + smap_init(&rt_data->local_iface_ids); + local_binding_data_init(&rt_data->lbinding_data); + hmapx_clear(&rt_data->ct_updated_datapaths); ++ hmapx_clear(&rt_data->extport_updated_datapaths); + } + + struct binding_ctx_in b_ctx_in; +@@ -1289,7 +1298,7 @@ runtime_data_sb_port_binding_handler(struct engine_node *node, void *data) + return false; + } + +- if (b_ctx_out.local_lport_ids_changed || ++ if (b_ctx_out.related_lports_changed || + b_ctx_out.non_vif_ports_changed || + !hmap_is_empty(b_ctx_out.tracked_dp_bindings)) { + engine_set_node_state(node, EN_UPDATED); +@@ -1599,11 +1608,8 @@ en_port_groups_run(struct engine_node *node, void *data) + struct ed_type_runtime_data *rt_data = + engine_get_input_data("runtime_data", node); + +- struct sset *local_b_lports = binding_collect_local_binding_lports( +- &rt_data->lbinding_data); +- port_groups_init(pg_table, local_b_lports, &pg->port_group_ssets, +- &pg->port_groups_cs_local); +- binding_destroy_local_binding_lports(local_b_lports); ++ port_groups_init(pg_table, &rt_data->related_lports.lport_names, ++ &pg->port_group_ssets, &pg->port_groups_cs_local); + + engine_set_node_state(node, EN_UPDATED); + } +@@ -1620,12 +1626,9 @@ port_groups_sb_port_group_handler(struct engine_node *node, void *data) + struct ed_type_runtime_data *rt_data = + engine_get_input_data("runtime_data", node); + +- struct sset *local_b_lports = binding_collect_local_binding_lports( +- &rt_data->lbinding_data); +- port_groups_update(pg_table, local_b_lports, &pg->port_group_ssets, +- &pg->port_groups_cs_local, &pg->new, &pg->deleted, +- &pg->updated); +- binding_destroy_local_binding_lports(local_b_lports); ++ port_groups_update(pg_table, &rt_data->related_lports.lport_names, ++ &pg->port_group_ssets, &pg->port_groups_cs_local, ++ &pg->new, &pg->deleted, &pg->updated); + + if (!sset_is_empty(&pg->new) || !sset_is_empty(&pg->deleted) || + !sset_is_empty(&pg->updated)) { +@@ -1658,9 +1661,6 @@ port_groups_runtime_data_handler(struct engine_node *node, void *data) + goto out; + } + +- struct sset *local_b_lports = binding_collect_local_binding_lports( +- &rt_data->lbinding_data); +- + const struct sbrec_port_group *pg_sb; + SBREC_PORT_GROUP_TABLE_FOR_EACH (pg_sb, pg_table) { + struct sset *pg_lports = shash_find_data(&pg->port_group_ssets, +@@ -1687,13 +1687,12 @@ port_groups_runtime_data_handler(struct engine_node *node, void *data) + if (need_update) { + expr_const_sets_add_strings(&pg->port_groups_cs_local, pg_sb->name, + (const char *const *) pg_sb->ports, +- pg_sb->n_ports, local_b_lports); ++ pg_sb->n_ports, ++ &rt_data->related_lports.lport_names); + sset_add(&pg->updated, pg_sb->name); + } + } + +- binding_destroy_local_binding_lports(local_b_lports); +- + out: + if (!sset_is_empty(&pg->new) || !sset_is_empty(&pg->deleted) || + !sset_is_empty(&pg->updated)) { +@@ -1973,6 +1972,7 @@ static void init_physical_ctx(struct engine_node *node, + p_ctx->mff_ovn_geneve = ed_mff_ovn_geneve->mff_ovn_geneve; + p_ctx->local_bindings = &rt_data->lbinding_data.bindings; + p_ctx->ct_updated_datapaths = &rt_data->ct_updated_datapaths; ++ p_ctx->extport_updated_datapaths = &rt_data->extport_updated_datapaths; + } + + static void init_lflow_ctx(struct engine_node *node, +@@ -2077,7 +2077,7 @@ static void init_lflow_ctx(struct engine_node *node, + l_ctx_in->addr_sets = addr_sets; + l_ctx_in->port_groups = port_groups; + l_ctx_in->active_tunnels = &rt_data->active_tunnels; +- l_ctx_in->local_lport_ids = &rt_data->local_lport_ids; ++ l_ctx_in->related_lport_ids = &rt_data->related_lports.lport_ids; + + l_ctx_out->flow_table = &fo->flow_table; + l_ctx_out->group_table = &fo->group_table; +@@ -2424,6 +2424,7 @@ flow_output_physical_flow_changes_handler(struct engine_node *node, void *data) + /* This indicates that we need to recompute the physical flows. */ + physical_clear_unassoc_flows_with_db(&fo->flow_table); + physical_clear_dp_flows(&p_ctx, &rt_data->ct_updated_datapaths, ++ &rt_data->extport_updated_datapaths, + &fo->flow_table); + physical_run(&p_ctx, &fo->flow_table); + return true; +diff --git a/controller/ovn-controller.h b/controller/ovn-controller.h +index 5d9466880..2bf1fecbf 100644 +--- a/controller/ovn-controller.h ++++ b/controller/ovn-controller.h +@@ -67,6 +67,8 @@ struct local_datapath { + + size_t n_peer_ports; + size_t n_allocated_peer_ports; ++ ++ struct shash external_ports; + }; + + struct local_datapath *get_local_datapath(const struct hmap *, +diff --git a/controller/physical.c b/controller/physical.c +index 018e09540..cfd68f835 100644 +--- a/controller/physical.c ++++ b/controller/physical.c +@@ -1272,6 +1272,52 @@ consider_port_binding(struct ovsdb_idl_index *sbrec_port_binding_by_name, + ofctrl_add_flow(flow_table, OFTABLE_CHECK_LOOPBACK, 160, + binding->header_.uuid.parts[0], &match, + ofpacts_p, &binding->header_.uuid); ++ ++ /* localport traffic directed to external is *not* local */ ++ struct shash_node *node; ++ SHASH_FOR_EACH (node, &ld->external_ports) { ++ const struct sbrec_port_binding *pb = node->data; ++ ++ /* skip ports that are not claimed by this chassis */ ++ if (!pb->chassis) { ++ continue; ++ } ++ if (strcmp(pb->chassis->name, chassis->name)) { ++ continue; ++ } ++ ++ ofpbuf_clear(ofpacts_p); ++ for (int i = 0; i < MFF_N_LOG_REGS; i++) { ++ put_load(0, MFF_REG0 + i, 0, 32, ofpacts_p); ++ } ++ put_resubmit(OFTABLE_LOG_EGRESS_PIPELINE, ofpacts_p); ++ ++ /* allow traffic directed to external MAC address */ ++ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); ++ for (int i = 0; i < pb->n_mac; i++) { ++ char *err_str; ++ struct eth_addr peer_mac; ++ if ((err_str = str_to_mac(pb->mac[i], &peer_mac))) { ++ VLOG_WARN_RL( ++ &rl, "Parsing MAC failed for external port: %s, " ++ "with error: %s", pb->logical_port, err_str); ++ free(err_str); ++ continue; ++ } ++ ++ match_init_catchall(&match); ++ match_set_metadata(&match, htonll(dp_key)); ++ match_set_reg(&match, MFF_LOG_OUTPORT - MFF_REG0, ++ port_key); ++ match_set_reg_masked(&match, MFF_LOG_FLAGS - MFF_REG0, ++ MLF_LOCALPORT, MLF_LOCALPORT); ++ match_set_dl_dst(&match, peer_mac); ++ ++ ofctrl_add_flow(flow_table, OFTABLE_CHECK_LOOPBACK, 170, ++ binding->header_.uuid.parts[0], &match, ++ ofpacts_p, &binding->header_.uuid); ++ } ++ } + } + + } else if (!tun && !is_ha_remote) { +@@ -1957,18 +2003,24 @@ physical_clear_unassoc_flows_with_db(struct ovn_desired_flow_table *flow_table) + void + physical_clear_dp_flows(struct physical_ctx *p_ctx, + struct hmapx *ct_updated_datapaths, ++ struct hmapx *extport_updated_datapaths, + struct ovn_desired_flow_table *flow_table) + { + const struct sbrec_port_binding *binding; + SBREC_PORT_BINDING_TABLE_FOR_EACH (binding, p_ctx->port_binding_table) { +- if (!hmapx_find(ct_updated_datapaths, binding->datapath)) { +- continue; ++ if (hmapx_find(ct_updated_datapaths, binding->datapath)) { ++ const struct sbrec_port_binding *peer = ++ get_binding_peer(p_ctx->sbrec_port_binding_by_name, binding); ++ ofctrl_remove_flows(flow_table, &binding->header_.uuid); ++ if (peer) { ++ ofctrl_remove_flows(flow_table, &peer->header_.uuid); ++ } + } +- const struct sbrec_port_binding *peer = +- get_binding_peer(p_ctx->sbrec_port_binding_by_name, binding); +- ofctrl_remove_flows(flow_table, &binding->header_.uuid); +- if (peer) { +- ofctrl_remove_flows(flow_table, &peer->header_.uuid); ++ ++ if (hmapx_find(extport_updated_datapaths, binding->datapath)) { ++ if (!strcmp(binding->type, "localnet")) { ++ ofctrl_remove_flows(flow_table, &binding->header_.uuid); ++ } + } + } + } +diff --git a/controller/physical.h b/controller/physical.h +index 0bf13f268..f9cd883a7 100644 +--- a/controller/physical.h ++++ b/controller/physical.h +@@ -57,6 +57,7 @@ struct physical_ctx { + enum mf_field_id mff_ovn_geneve; + struct shash *local_bindings; + struct hmapx *ct_updated_datapaths; ++ struct hmapx *extport_updated_datapaths; + }; + + void physical_register_ovs_idl(struct ovsdb_idl *); +@@ -65,6 +66,7 @@ void physical_run(struct physical_ctx *, + void physical_clear_unassoc_flows_with_db(struct ovn_desired_flow_table *); + void physical_clear_dp_flows(struct physical_ctx *p_ctx, + struct hmapx *ct_updated_datapaths, ++ struct hmapx *extport_updated_datapaths, + struct ovn_desired_flow_table *flow_table); + void physical_handle_port_binding_changes(struct physical_ctx *, + struct ovn_desired_flow_table *); +diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml +index 407464602..21ae0ca60 100644 +--- a/northd/ovn-northd.8.xml ++++ b/northd/ovn-northd.8.xml +@@ -1072,8 +1072,10 @@ output; + localport ports) that are down (unless + ignore_lsp_down is configured as true in options + column of NB_Global table of the Northbound +- database), for logical ports of type virtual and for +- logical ports with 'unknown' address set. ++ database), for logical ports of type virtual, for ++ logical ports with 'unknown' address set and for logical ports of ++ a logical switch configured with ++ other_config:vlan-passthru=true. +

+ + +diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c +index 3dae7bb1c..315ec7b2f 100644 +--- a/northd/ovn-northd.c ++++ b/northd/ovn-northd.c +@@ -7007,6 +7007,10 @@ build_lswitch_arp_nd_responder_known_ips(struct ovn_port *op, + return; + } + ++ if (is_vlan_transparent(op->od)) { ++ return; ++ } ++ + for (size_t i = 0; i < op->n_lsp_addrs; i++) { + for (size_t j = 0; j < op->lsp_addrs[i].n_ipv4_addrs; j++) { + ds_clear(match); +@@ -7371,6 +7375,7 @@ build_lswitch_ip_mcast_igmp_mld(struct ovn_igmp_group *igmp_group, + + struct mcast_switch_info *mcast_sw_info = + &igmp_group->datapath->mcast_info.sw; ++ uint64_t table_size = mcast_sw_info->table_size; + + if (IN6_IS_ADDR_V4MAPPED(&igmp_group->address)) { + /* RFC 4541, section 2.1.2, item 2: Skip groups in the 224.0.0.X +@@ -7381,10 +7386,8 @@ build_lswitch_ip_mcast_igmp_mld(struct ovn_igmp_group *igmp_group, + if (ip_is_local_multicast(group_address)) { + return; + } +- + if (atomic_compare_exchange_strong( +- &mcast_sw_info->active_v4_flows, +- (uint64_t *) &mcast_sw_info->table_size, ++ &mcast_sw_info->active_v4_flows, &table_size, + mcast_sw_info->table_size)) { + return; + } +@@ -7399,8 +7402,7 @@ build_lswitch_ip_mcast_igmp_mld(struct ovn_igmp_group *igmp_group, + return; + } + if (atomic_compare_exchange_strong( +- &mcast_sw_info->active_v6_flows, +- (uint64_t *) &mcast_sw_info->table_size, ++ &mcast_sw_info->active_v6_flows, &table_size, + mcast_sw_info->table_size)) { + return; + } +@@ -11800,6 +11802,7 @@ build_lrouter_nat_defrag_and_lb(struct ovn_datapath *od, + ds_put_format(actions, + "clone { ct_clear; " + "inport = outport; outport = \"\"; " ++ "eth.dst <-> eth.src; " + "flags = 0; flags.loopback = 1; "); + for (int j = 0; j < MFF_N_LOG_REGS; j++) { + ds_put_format(actions, "reg%d = 0; ", j); +diff --git a/northd/ovn_northd.dl b/northd/ovn_northd.dl +index 3afa80a3b..eef171091 100644 +--- a/northd/ovn_northd.dl ++++ b/northd/ovn_northd.dl +@@ -3309,7 +3309,8 @@ for (CheckLspIsUp[check_lsp_is_up]) { + ((lsp_is_up(lsp) or not check_lsp_is_up) + or lsp.__type == "router" or lsp.__type == "localport") and + lsp.__type != "external" and lsp.__type != "virtual" and +- not lsp.addresses.contains("unknown")) ++ not lsp.addresses.contains("unknown") and ++ not sw.is_vlan_transparent) + { + var __match = "arp.tpa == ${addr.addr} && arp.op == 1" in + { +@@ -3359,7 +3360,8 @@ for (SwitchPortIPv6Address(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam + .ea = ea, .addr = addr) + if lsp.is_enabled() and + (lsp_is_up(lsp) or lsp.__type == "router" or lsp.__type == "localport") and +- lsp.__type != "external" and lsp.__type != "virtual") ++ lsp.__type != "external" and lsp.__type != "virtual" and ++ not sw.is_vlan_transparent) + { + var __match = "nd_ns && ip6.dst == {${addr.addr}, ${addr.solicited_node()}} && nd.target == ${addr.addr}" in + var actions = "${if (lsp.__type == \"router\") \"nd_na_router\" else \"nd_na\"} { " +@@ -5649,7 +5651,7 @@ for (r in &Router(._uuid = lr_uuid, + } in + if (nat.nat.__type == "dnat" or nat.nat.__type == "dnat_and_snat") { + None = l3dgw_port in +- var __match = "ip && ip4.dst == ${nat.nat.external_ip}" in ++ var __match = "ip && ${ipX}.dst == ${nat.nat.external_ip}" in + (var ext_ip_match, var ext_flow) = lrouter_nat_add_ext_ip_match( + r, nat, __match, ipX, true, mask) in + { +@@ -5925,6 +5927,7 @@ for (r in &Router(._uuid = lr_uuid, + var actions = + "clone { ct_clear; " + "inport = outport; outport = \"\"; " ++ "eth.dst <-> eth.src; " + "flags = 0; flags.loopback = 1; " ++ + regs.join("") ++ + "${rEGBIT_EGRESS_LOOPBACK()} = 1; " +diff --git a/tests/ovn.at b/tests/ovn.at +index aa80a7c48..515bcf7c7 100644 +--- a/tests/ovn.at ++++ b/tests/ovn.at +@@ -3169,6 +3169,118 @@ OVN_CLEANUP([hv-1],[hv-2]) + AT_CLEANUP + ]) + ++OVN_FOR_EACH_NORTHD([ ++AT_SETUP([ovn -- VLAN transparency, passthru=true, ARP responder disabled]) ++ovn_start ++ ++net_add net ++check ovs-vsctl add-br br-phys ++ovn_attach net br-phys 192.168.0.1 ++ ++check ovn-nbctl ls-add ls ++check ovn-nbctl --wait=sb add Logical-Switch ls other_config vlan-passthru=true ++ ++for i in 1 2; do ++ check ovn-nbctl lsp-add ls lsp$i ++ check ovn-nbctl lsp-set-addresses lsp$i "f0:00:00:00:00:0$i 10.0.0.$i" ++done ++ ++for i in 1 2; do ++ check ovs-vsctl add-port br-int vif$i -- set Interface vif$i external-ids:iface-id=lsp$i \ ++ options:tx_pcap=vif$i-tx.pcap \ ++ options:rxq_pcap=vif$i-rx.pcap \ ++ ofport-request=$i ++done ++ ++wait_for_ports_up ++ ++ovn-sbctl dump-flows ls > lsflows ++AT_CAPTURE_FILE([lsflows]) ++ ++AT_CHECK([grep -w "ls_in_arp_rsp" lsflows | sort], [0], [dnl ++ table=16(ls_in_arp_rsp ), priority=0 , match=(1), action=(next;) ++]) ++ ++test_arp() { ++ local inport=$1 outport=$2 sha=$3 spa=$4 tpa=$5 reply_ha=$6 ++ tag=8100fefe ++ local request=ffffffffffff${sha}${tag}08060001080006040001${sha}${spa}ffffffffffff${tpa} ++ ovs-appctl netdev-dummy/receive vif$inport $request ++ echo $request >> $outport.expected ++ ++ local reply=${sha}${reply_ha}${tag}08060001080006040002${reply_ha}${tpa}${sha}${spa} ++ ovs-appctl netdev-dummy/receive vif$outport $reply ++ echo $reply >> $inport.expected ++} ++ ++test_arp 1 2 f00000000001 0a000001 0a000002 f00000000002 ++test_arp 2 1 f00000000002 0a000002 0a000001 f00000000001 ++ ++for i in 1 2; do ++ OVN_CHECK_PACKETS([vif$i-tx.pcap], [$i.expected]) ++done ++ ++AT_CLEANUP ++]) ++ ++OVN_FOR_EACH_NORTHD([ ++AT_SETUP([ovn -- VLAN transparency, passthru=true, ND/NA responder disabled]) ++ovn_start ++ ++net_add net ++check ovs-vsctl add-br br-phys ++ovn_attach net br-phys 192.168.0.1 ++ ++check ovn-nbctl ls-add ls ++check ovn-nbctl --wait=sb add Logical-Switch ls other_config vlan-passthru=true ++ ++for i in 1 2; do ++ check ovn-nbctl lsp-add ls lsp$i ++ check ovn-nbctl lsp-set-addresses lsp$i "f0:00:00:00:00:0$i fe00::$i" ++done ++ ++for i in 1 2; do ++ check ovs-vsctl add-port br-int vif$i -- set Interface vif$i external-ids:iface-id=lsp$i \ ++ options:tx_pcap=vif$i-tx.pcap \ ++ options:rxq_pcap=vif$i-rx.pcap \ ++ ofport-request=$i ++done ++ ++wait_for_ports_up ++ ++ovn-sbctl dump-flows ls > lsflows ++AT_CAPTURE_FILE([lsflows]) ++ ++AT_CHECK([grep -w "ls_in_arp_rsp" lsflows | sort], [0], [dnl ++ table=16(ls_in_arp_rsp ), priority=0 , match=(1), action=(next;) ++]) ++ ++test_nd_na() { ++ local inport=$1 outport=$2 sha=$3 spa=$4 tpa=$5 reply_ha=$6 ++ tag=8100fefe ++ icmp_type=87 ++ local request=ffffffffffff${sha}${tag}86dd6000000000183aff${spa}ff0200000000000000000001ff${tpa: -6}${icmp_type}007ea100000000${tpa} ++ ovs-appctl netdev-dummy/receive vif$inport $request ++ echo $request >> $outport.expected ++ echo $request ++ ++ icmp_type=88 ++ local reply=${sha}${reply_ha}${tag}86dd6000000000183aff${tpa}${spa}${icmp_type}003da540000000${tpa} ++ ovs-appctl netdev-dummy/receive vif$outport $reply ++ echo $reply >> $inport.expected ++ echo $reply ++} ++ ++test_nd_na 1 2 f00000000001 fe000000000000000000000000000001 fe000000000000000000000000000002 f00000000002 ++test_nd_na 2 1 f00000000002 fe000000000000000000000000000002 fe000000000000000000000000000001 f00000000001 ++ ++for i in 1 2; do ++ OVN_CHECK_PACKETS([vif$i-tx.pcap], [$i.expected]) ++done ++ ++AT_CLEANUP ++]) ++ + OVN_FOR_EACH_NORTHD([ + AT_SETUP([ovn -- VLAN transparency, passthru=true, multiple hosts]) + ovn_start +@@ -11260,7 +11372,7 @@ ovn-nbctl lsp-add foo ln-foo + ovn-nbctl lsp-set-addresses ln-foo unknown + ovn-nbctl lsp-set-options ln-foo network_name=public + ovn-nbctl lsp-set-type ln-foo localnet +-AT_CHECK([ovn-nbctl set Logical_Switch_Port ln-foo tag=2]) ++check ovn-nbctl set Logical_Switch_Port ln-foo tag_request=2 + + # Create localnet port in alice + ovn-nbctl lsp-add alice ln-alice +@@ -12024,6 +12136,91 @@ OVN_CLEANUP([hv1]) + AT_CLEANUP + ]) + ++OVN_FOR_EACH_NORTHD([ ++AT_SETUP([localport doesn't suppress ARP directed to external port]) ++ ++ovn_start ++net_add n1 ++ ++check ovs-vsctl add-br br-phys ++check ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys:br-phys ++ovn_attach n1 br-phys 192.168.0.1 ++ ++check ovn-nbctl ls-add ls ++ ++# create topology to allow to talk from localport through localnet to external port ++check ovn-nbctl lsp-add ls lp ++check ovn-nbctl lsp-set-addresses lp "00:00:00:00:00:01 10.0.0.1" ++check ovn-nbctl lsp-set-type lp localport ++check ovs-vsctl add-port br-int lp -- set Interface lp external-ids:iface-id=lp ++ ++check ovn-nbctl --wait=sb ha-chassis-group-add hagrp ++check ovn-nbctl --wait=sb ha-chassis-group-add-chassis hagrp main 10 ++check ovn-nbctl lsp-add ls lext ++check ovn-nbctl lsp-set-addresses lext "00:00:00:00:00:02 10.0.0.2" ++check ovn-nbctl lsp-set-type lext external ++hagrp_uuid=`ovn-nbctl --bare --columns _uuid find ha_chassis_group name=hagrp` ++check ovn-nbctl set logical_switch_port lext ha_chassis_group=$hagrp_uuid ++ ++check ovn-nbctl lsp-add ls ln ++check ovn-nbctl lsp-set-addresses ln unknown ++check ovn-nbctl lsp-set-type ln localnet ++check ovn-nbctl lsp-set-options ln network_name=phys ++check ovn-nbctl --wait=hv sync ++ ++# also create second external port AFTER localnet to check that order is irrelevant ++check ovn-nbctl lsp-add ls lext2 ++check ovn-nbctl lsp-set-addresses lext2 "00:00:00:00:00:10 10.0.0.10" ++check ovn-nbctl lsp-set-type lext2 external ++check ovn-nbctl set logical_switch_port lext2 ha_chassis_group=$hagrp_uuid ++check ovn-nbctl --wait=hv sync ++ ++# create and immediately delete an external port to later check that flows for ++# deleted ports are not left over in flow table ++check ovn-nbctl lsp-add ls lext-deleted ++check ovn-nbctl lsp-set-addresses lext-deleted "00:00:00:00:00:03 10.0.0.3" ++check ovn-nbctl lsp-set-type lext-deleted external ++check ovn-nbctl set logical_switch_port lext-deleted ha_chassis_group=$hagrp_uuid ++check ovn-nbctl --wait=hv sync ++check ovn-nbctl lsp-del lext-deleted ++check ovn-nbctl --wait=hv sync ++ ++send_garp() { ++ local inport=$1 eth_src=$2 eth_dst=$3 spa=$4 tpa=$5 ++ local request=${eth_dst}${eth_src}08060001080006040001${eth_src}${spa}${eth_dst}${tpa} ++ ovs-appctl netdev-dummy/receive $inport $request ++} ++ ++spa=$(ip_to_hex 10 0 0 1) ++tpa=$(ip_to_hex 10 0 0 2) ++send_garp lp 000000000001 000000000002 $spa $tpa ++ ++spa=$(ip_to_hex 10 0 0 1) ++tpa=$(ip_to_hex 10 0 0 10) ++send_garp lp 000000000001 000000000010 $spa $tpa ++ ++spa=$(ip_to_hex 10 0 0 1) ++tpa=$(ip_to_hex 10 0 0 3) ++send_garp lp 000000000001 000000000003 $spa $tpa ++ ++dnl external traffic from localport should be sent to localnet ++AT_CHECK([tcpdump -r main/br-phys_n1-tx.pcap arp[[24:4]]=0x0a000002 | wc -l],[0],[dnl ++1 ++],[ignore]) ++ ++#dnl ...regardless of localnet / external ports creation order ++AT_CHECK([tcpdump -r main/br-phys_n1-tx.pcap arp[[24:4]]=0x0a00000a | wc -l],[0],[dnl ++1 ++],[ignore]) ++ ++dnl traffic from localport should not be sent to deleted external port ++AT_CHECK([tcpdump -r main/br-phys_n1-tx.pcap arp[[24:4]]=0x0a000003 | wc -l],[0],[dnl ++0 ++],[ignore]) ++ ++AT_CLEANUP ++]) ++ + OVN_FOR_EACH_NORTHD([ + AT_SETUP([ovn -- 1 LR with HA distributed router gateway port]) + ovn_start +@@ -12668,7 +12865,7 @@ $PYTHON "$ovs_srcdir/utilities/ovs-pcap.in" hv2/br-phys_n1-tx.pcap | trim_zeros + AT_CHECK([grep $garp hv2_br_phys_tx | sort], [0], []) + + # change localnet port tag. +-AT_CHECK([ovn-nbctl set Logical_Switch_Port ln_port tag=2014]) ++check ovn-nbctl set Logical_Switch_Port ln_port tag_request=2014 + + # wait for earlier changes to take effect + OVS_WAIT_UNTIL([test 1 = `as hv2 ovs-ofctl dump-flows br-int table=65 | \ +@@ -17311,27 +17508,29 @@ logical_port=sw0-vir) = x]) + as hv1 + ovs-vsctl set interface hv1-vif3 external-ids:iface-id=sw0-vir + +-AT_CHECK([test x$(ovn-sbctl --bare --columns chassis find port_binding \ +-logical_port=sw0-vir) = x], [0], []) ++wait_column "" Port_Binding chassis logical_port=sw0-vir + + # Cleanup hv1-vif3. + as hv1 + ovs-vsctl del-port hv1-vif3 + +-AT_CHECK([test x$(ovn-sbctl --bare --columns chassis find port_binding \ +-logical_port=sw0-vir) = x], [0], []) ++wait_column "" Port_Binding chassis logical_port=sw0-vir + + check_virtual_offlows_present() { + hv=$1 + +- AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=44 | ofctl_strip_all | grep "priority=2000"], [0], [dnl +- table=44, priority=2000,ip,metadata=0x1 actions=resubmit(,45) +- table=44, priority=2000,ipv6,metadata=0x1 actions=resubmit(,45) ++ sw0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=sw0)) ++ lr0_dp_key=$(printf "%x" $(fetch_column Datapath_Binding tunnel_key external_ids:name=lr0)) ++ lr0_public_dp_key=$(printf "%x" $(fetch_column Port_Binding tunnel_key logical_port=lr0-public)) ++ ++ AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=44 | ofctl_strip_all | grep "priority=2000"], [0], [dnl ++ table=44, priority=2000,ip,metadata=0x$sw0_dp_key actions=resubmit(,45) ++ table=44, priority=2000,ipv6,metadata=0x$sw0_dp_key actions=resubmit(,45) + ]) + +- AT_CHECK([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ ++ AT_CHECK_UNQUOTED([as $hv ovs-ofctl dump-flows br-int table=11 | ofctl_strip_all | \ + grep "priority=92" | grep 172.168.0.50], [0], [dnl +- table=11, priority=92,arp,reg14=0x3,metadata=0x3,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) ++ table=11, priority=92,arp,reg14=0x$lr0_public_dp_key,metadata=0x$lr0_dp_key,arp_tpa=172.168.0.50,arp_op=1 actions=move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],mod_dl_src:10:54:00:00:00:10,load:0x2->NXM_OF_ARP_OP[[]],move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],load:0x105400000010->NXM_NX_ARP_SHA[[]],push:NXM_OF_ARP_SPA[[]],push:NXM_OF_ARP_TPA[[]],pop:NXM_OF_ARP_SPA[[]],pop:NXM_OF_ARP_TPA[[]],move:NXM_NX_REG14[[]]->NXM_NX_REG15[[]],load:0x1->NXM_NX_REG10[[0]],resubmit(,37) + ]) + } + +@@ -26688,6 +26887,50 @@ OVN_CLEANUP([hv1]) + AT_CLEANUP + ]) + ++# Tests that ACLs referencing port groups that include ports connected to ++# logical routers are correctly applied. ++OVN_FOR_EACH_NORTHD([ ++AT_SETUP([ovn -- ACL with Port Group including router ports]) ++ovn_start ++net_add n1 ++ ++sim_add hv1 ++as hv1 ++ovs-vsctl add-br br-phys ++ovn_attach n1 br-phys 192.168.0.1 ++ ++check ovn-nbctl \ ++ -- lr-add lr \ ++ -- ls-add ls \ ++ -- lrp-add lr lrp_ls 00:00:00:00:00:01 42.42.42.1/24 \ ++ -- lsp-add ls ls_lr \ ++ -- lsp-set-addresses ls_lr router \ ++ -- lsp-set-type ls_lr router \ ++ -- lsp-set-options ls_lr router-port=lr_ls \ ++ -- lsp-add ls vm1 ++ ++check ovn-nbctl pg-add pg ls_lr \ ++ -- acl-add pg from-lport 1 'inport == @pg && ip4.dst == 42.42.42.42' drop ++ ++check ovs-vsctl add-port br-int vm1 \ ++ -- set interface vm1 external_ids:iface-id=vm1 ++ ++wait_for_ports_up ++check ovn-nbctl --wait=hv sync ++ ++dp_key=$(fetch_column Datapath_Binding tunnel_key external_ids:name=ls) ++rtr_port_key=$(fetch_column Port_Binding tunnel_key logical_port=ls_lr) ++ ++# Check that ovn-controller adds a flow to drop packets with dest IP ++# 42.42.42.42 coming from the router port. ++AT_CHECK([ovs-ofctl dump-flows br-int table=17 | grep "reg14=0x${rtr_port_key},metadata=0x${dp_key},nw_dst=42.42.42.42 actions=drop" -c], [0], [dnl ++1 ++]) ++ ++OVN_CLEANUP([hv1]) ++AT_CLEANUP ++]) ++ + OVN_FOR_EACH_NORTHD([ + AT_SETUP([ovn -- Static route with discard nexthop]) + ovn_start +diff --git a/tests/system-ovn.at b/tests/system-ovn.at +index 310bd3d5a..1f9b90eb6 100644 +--- a/tests/system-ovn.at ++++ b/tests/system-ovn.at +@@ -1348,7 +1348,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -3121,7 +3121,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -4577,7 +4577,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -4663,7 +4663,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -4903,7 +4903,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -5287,7 +5287,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -5527,7 +5527,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -5689,7 +5689,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -5738,7 +5738,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d +@@ -5831,7 +5831,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/.*error receiving.*/d +@@ -5893,7 +5893,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/.*error receiving.*/d +@@ -6044,7 +6044,7 @@ as ovn-nb + OVS_APP_EXIT_AND_WAIT([ovsdb-server]) + + as northd +-OVS_APP_EXIT_AND_WAIT([ovn-northd]) ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + + as + OVS_TRAFFIC_VSWITCHD_STOP(["/.*error receiving.*/d +@@ -6091,7 +6091,6 @@ check ovn-nbctl pg-add pg1 sw1-p1 + check ovn-nbctl acl-add pg1 from-lport 1002 "ip" allow-related + check ovn-nbctl acl-add pg1 to-lport 1002 "ip" allow-related + +- + OVN_POPULATE_ARP + ovn-nbctl --wait=hv sync + +@@ -6179,5 +6178,117 @@ OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) + as + OVS_TRAFFIC_VSWITCHD_STOP(["/failed to query port patch-.*/d + /connection dropped.*/d"]) ++ ++AT_CLEANUP ++]) ++ ++OVN_FOR_EACH_NORTHD([ ++AT_SETUP(ovn -- DNAT LR hairpin IPv4) ++AT_KEYWORDS(hairpin) ++ ++ovn_start ++ ++OVS_TRAFFIC_VSWITCHD_START() ++ADD_BR([br-int]) ++ ++# Set external-ids in br-int needed for ovn-controller ++ovs-vsctl \ ++ -- set Open_vSwitch . external-ids:system-id=hv1 \ ++ -- set Open_vSwitch . external-ids:ovn-remote=unix:$ovs_base/ovn-sb/ovn-sb.sock \ ++ -- set Open_vSwitch . external-ids:ovn-encap-type=geneve \ ++ -- set Open_vSwitch . external-ids:ovn-encap-ip=169.0.0.1 \ ++ -- set bridge br-int fail-mode=secure other-config:disable-in-band=true ++ ++start_daemon ovn-controller ++ ++# Logical network: ++# Two VMs ++# * VM1 with IP address 192.168.100.5 ++# * VM2 with IP address 192.168.100.6 ++# The VMs connect to logical switch ls1. ++# ++# An external router with IP address 172.18.1.2. We simulate this with a network namespace. ++# There will be no traffic going here in this test. ++# The external router connects to logical switch ls-pub ++# ++# One logical router (lr1) connects to ls1 and ls-pub. The router port connected to ls-pub is ++# a gateway port. ++# * The subnet connected to ls1 is 192.168.100.0/24. The Router IP address is 192.168.100.1 ++# * The subnet connected to ls-pub is 172.18.1.0/24. The Router IP address is 172.168.1.1 ++# lr1 has the following attributes: ++# * It has a "default" static route that sends traffic out the gateway router port. ++# * It has a DNAT rule that translates 172.18.2.10 to 192.168.100.6 (VM2) ++# ++# In this test, we want to ensure that a ping from VM1 to IP address 172.18.2.10 reaches VM2. ++ ++ovn-nbctl ls-add ls1 ++ovn-nbctl lsp-add ls1 vm1 -- lsp-set-addresses vm1 "00:00:00:00:00:05 192.168.100.5" ++ovn-nbctl lsp-add ls1 vm2 -- lsp-set-addresses vm2 "00:00:00:00:00:06 192.168.100.6" ++ ++ovn-nbctl ls-add ls-pub ++ovn-nbctl lsp-add ls-pub ext-router -- lsp-set-addresses ext-router "00:00:00:00:01:02 172.18.1.2" ++ ++ovn-nbctl lr-add lr1 ++ovn-nbctl lrp-add lr1 lr1-ls1 00:00:00:00:00:01 192.168.100.1/24 ++ovn-nbctl lsp-add ls1 ls1-lr1 \ ++ -- lsp-set-type ls1-lr1 router \ ++ -- lsp-set-addresses ls1-lr1 00:00:00:00:00:01 \ ++ -- lsp-set-options ls1-lr1 router-port=lr1-ls1 ++ ++ovn-nbctl lrp-add lr1 lr1-ls-pub 00:00:00:00:01:01 172.18.1.1/24 ++ovn-nbctl lrp-set-gateway-chassis lr1-ls-pub hv1 ++ovn-nbctl lsp-add ls-pub ls-pub-lr1 \ ++ -- lsp-set-type ls-pub-lr1 router \ ++ -- lsp-set-addresses ls-pub-lr1 00:00:00:00:01:01 \ ++ -- lsp-set-options ls-pub-lr1 router-port=lr1-ls-pub ++ ++ovn-nbctl lr-nat-add lr1 snat 172.18.1.1 192.168.100.0/24 ++ovn-nbctl lr-nat-add lr1 dnat_and_snat 172.18.2.10 192.168.100.6 ++ovn-nbctl lr-route-add lr1 0.0.0.0/0 172.18.1.2 ++ ++#ls1_uuid=$(fetch_column Port_Binding datapath logical_port=vm1) ++#ovn-sbctl create MAC_Binding ip=172.18.2.10 datapath=$ls1_uuid logical_port=vm2 mac="00:00:00:00:00:06" ++ ++OVN_POPULATE_ARP ++ovn-nbctl --wait=hv sync ++ ++ADD_NAMESPACES(vm1) ++ADD_VETH(vm1, vm1, br-int, "192.168.100.5/24", "00:00:00:00:00:05", \ ++ "192.168.100.1") ++ ++ADD_NAMESPACES(vm2) ++ADD_VETH(vm2, vm2, br-int, "192.168.100.6/24", "00:00:00:00:00:06", \ ++ "192.168.100.1") ++ ++ADD_NAMESPACES(ext-router) ++ADD_VETH(ext-router, ext-router, br-int, "172.18.1.2/24", "00:00:00:00:01:02", \ ++ "172.18.1.1") ++ ++# Let's take a quick look at the logical flows ++ovn-sbctl lflow-list ++ ++# Let's check what ovn-trace says... ++ovn-trace ls1 'inport == "vm1" && eth.src == 00:00:00:00:00:05 && ip4.src == 192.168.100.5 && eth.dst == 00:00:00:00:00:01 && ip4.dst == 172.18.2.10 && ip.ttl == 32' ++ ++# A ping from vm1 should hairpin in lr1 and successfully DNAT to vm2 ++NS_CHECK_EXEC([vm1], [ping -q -c 3 -i 0.3 -w 2 172.18.2.10 | FORMAT_PING], \ ++[0], [dnl ++3 packets transmitted, 3 received, 0% packet loss, time 0ms ++]) ++kill $(pidof ovn-controller) ++ ++as ovn-sb ++OVS_APP_EXIT_AND_WAIT([ovsdb-server]) ++ ++as ovn-nb ++OVS_APP_EXIT_AND_WAIT([ovsdb-server]) ++ ++as northd ++OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE]) ++ ++as ++OVS_TRAFFIC_VSWITCHD_STOP(["/.*error receiving.*/d ++/.*terminating with signal 15.*/d"]) ++ + AT_CLEANUP + ]) diff --git a/ovn.spec b/ovn.spec index b89f591..2477d0f 100644 --- a/ovn.spec +++ b/ovn.spec @@ -43,7 +43,7 @@ Name: ovn Summary: Open Virtual Network support URL: http://www.openvswitch.org/ Version: 21.06.0 -Release: 1%{?commit0:.%{date}git%{shortcommit0}}%{?dist} +Release: 12%{?commit0:.%{date}git%{shortcommit0}}%{?dist} Obsoletes: openvswitch-ovn-common < %{?epoch_ovs:%{epoch_ovs}:}2.11.0-8 Provides: openvswitch-ovn-common = %{?epoch:%{epoch}:}%{version}-%{release} @@ -72,6 +72,7 @@ Source: https://www.openvswitch.org/releases/ovn-%{version}.tar.gz Source10: https://openvswitch.org/releases/openvswitch-%{ovsver}.tar.gz # ovn-patches +Patch001: ovn-21.06.0.patch # OpenvSwitch backports (400-) if required. # Address crpto policy for fedora @@ -439,6 +440,18 @@ fi %{_unitdir}/ovn-controller-vtep.service %changelog +* Fri Jul 16 2021 Numan Siddique - 21.06.0-12 +- Backported the following fixes: +- Don't suppress localport traffic directed to external port (#1974062) +- northd: Fix multicast table full comparison. (#1979870) +- northd-ddlog: Fix IP family match for DNAT flows. +- Disable ARP/NA responders for vlan-passthru switches +- tests: Fix "vlan traffic for external network with distributed..." +- ovn-controller: Fix port group I-P when they contain non-vif ports. +- system-tests: Fix the test file. +- northd: Swap src and dst eth addresses in router egress loop. +- ovn.at: Fix test "virtual ports -- ovn-northd-ddlog". + * Fri Jun 25 2021 Numan Siddique - 21.06.0-1 - Synced with the upstream release v21.06.0