Hi, thanks for contributing your patch! Aside from the errors reported by checkpatch, Acked-by: Mark Michelson <[email protected]>
There is no need to submit a v2 of your patch. When this is merged, the committer will fix the checkpatch errors. On Thu, Jan 8, 2026 at 9:30 PM Jun Gu <[email protected]> wrote: > > From: "jun.gu" <[email protected]> > > When an ICMPv6 packet with icmp_type=128 and icmp_code=0 traverses > the OFTABLE_CHK_IN_PORT_SEC_ND table, the nd_target and nd_tll fields > will be included in the megaflow. This causes the revalidator to > invalidate the flow, which in turn triggers an upcall. The root cause > is that the final-stage map is included in the wildcards during > classifier rule lookup. > > By adding the missing nw_ttl field to the OpenFlow rule, the previous > three stage maps-metadata, L2, and L3-are only included in the > wildcards. As a result, the nd_target and nd_tll fields are excluded > from the megaflow, preventing unnecessary revalidation and upcalls. > > Fixes: 8cab00b ("ovn-controller: Add OF rules for port security.") > Reported-at: > https://mail.openvswitch.org/pipermail/ovs-discuss/2025-December/053889.html > Signed-off-by: Jun Gu <[email protected]> > --- > controller/lflow.c | 1 + > tests/ovn.at | 12 ++++++------ > 2 files changed, 7 insertions(+), 6 deletions(-) > > diff --git a/controller/lflow.c b/controller/lflow.c > index e84fb2486..784a0d2dd 100644 > --- a/controller/lflow.c > +++ b/controller/lflow.c > @@ -2773,6 +2773,7 @@ build_in_port_sec_nd_flows(const struct > sbrec_port_binding *pb, > match_set_dl_src(m, ps_addr->ea); > match_set_dl_type(m, htons(ETH_TYPE_IPV6)); > match_set_nw_proto(m, IPPROTO_ICMPV6); > + match_set_nw_ttl(m, 255); > match_set_icmp_type(m, 136); > match_set_icmp_code(m, 0); > match_set_arp_tha(m, eth_addr_zero); > diff --git a/tests/ovn.at b/tests/ovn.at > index 58127f0d3..2b3d893d0 100644 > --- a/tests/ovn.at > +++ b/tests/ovn.at > @@ -35687,12 +35687,12 @@ echo " table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=80,arp,reg14=0x$sw0p2_key,meta > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=10.0.0.4,arp_sha=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=20.0.0.4,arp_sha=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,arp,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,arp_spa=30.0.0.0/16,arp_sha=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > - table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:13 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=1000::4,nd_tll=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:04,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=2000::/64,nd_tll=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > + table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,dl_src=00:00:00:00:00:13,nw_ttl=255,icmp_type=136,icmp_code=0,nd_target=aef0::4,nd_tll=00:00:00:00:00:13 > actions=load:0->NXM_NX_REG10[[12]] > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:00 > actions=load:0->NXM_NX_REG10[[12]] > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:04 > actions=load:0->NXM_NX_REG10[[12]] > table=OFTABLE_CHK_IN_PORT_SEC_ND, > priority=90,icmp6,reg14=0x$sw0p2_key,metadata=0x1,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:13 > actions=load:0->NXM_NX_REG10[[12]] > -- > 2.34.1 > > _______________________________________________ > dev mailing list > [email protected] > https://mail.openvswitch.org/mailman/listinfo/ovs-dev > _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
