On 4/15/26 4:10 PM, Ales Musil wrote: > On Wed, Apr 15, 2026 at 12:27 PM Dumitru Ceara <[email protected]> wrote: > >> When a logical switch has stateful ACLs (allow-related) or load >> balancers configured, all IP traffic is sent to conntrack in the >> PRE_ACL and PRE_LB pipeline stages. Traffic from/to remote VTEPs >> has no conntrack zone assigned, so conntrack lookups return >> ct_state=+trk+inv, causing the traffic to be dropped. >> >> Fix this by adding priority-110 flows that bypass conntrack for >> EVPN remote VTEP traffic, identified by the from_evpn_vtep and >> to_evpn_vtep predicates. These predicates check bit 31 of the >> logical inport/outport registers, which is always set for EVPN >> binding keys (OVN_MIN_EVPN_KEY = 1 << 31). >> >> The EVPN skip in PRE_ACL is only added when stateful ACLs are >> present (matching the existing pattern for localnet/router/switch >> ports). The EVPN skip in PRE_LB is unconditional, unlike localnet >> ports which are gated on !has_lb_vip -- remote VTEPs have no >> conntrack zones so conntrack would always fail regardless of LB >> configuration. >> >> Fixes: 9081afcf8698 ("controller: Create physical flows based on EVPN >> structures.") >> Reported-at: https://redhat.atlassian.net/browse/FDP-3462 >> Suggested-by: Ales Musil <[email protected]> >> Assisted-by: Claude, with model: claude-opus-4-6 >> Signed-off-by: Dumitru Ceara <[email protected]> >> --- >> > > Hi Dumitru, > > thank you for the v2. The Fixes seems to have wrong hash. >
Hi Ales, Sorry, my bad, I had used the has from a relatively random branch in my fork by accident. >> > I took care of the Fixes tag and applied it to main and 26.03. > I skipped 25.09 as there was a bunch of test conflicts and > in 25.09 EVPN was still experimental. > Thanks a lot! > Regards, > Ales > Regards, Dumitru _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
