Currently, for non-LB NATs, northd generates ARP/ND response flows on every router port even when the NAT's "gateway_port" field is set.
When "gateway_port" field is specified on NAT record on NB, it could be considered as reachable only through that LRP, so generating response flows for other router ports is unnecessary. This patch skips flow generation for router ports that do not match the NAT's "gateway_port". Signed-off-by: Amir Aslan Aslani <[email protected]> --- northd/northd.c | 8 ++++++++ tests/ovn-northd.at | 28 ++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/northd/northd.c b/northd/northd.c index aecfb2ec6..432eeb97b 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -9830,6 +9830,10 @@ build_lswitch_rport_arp_req_flows_for_lbnats( continue; } + if (nat->gateway_port && nat->gateway_port != op->nbrp) { + continue; + } + /* Check if the ovn port has a network configured on which we could * expect ARP requests/NS for the DNAT external_ip. */ @@ -9870,6 +9874,10 @@ build_lswitch_rport_arp_req_flows_for_lbnats( const struct nbrec_nat *nat = nat_entry->nb; + if (nat->gateway_port && nat->gateway_port != op->nbrp) { + continue; + } + /* Check if the ovn port has a network configured on which we could * expect ARP requests/NS for the SNAT external_ip. */ diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at index 2973d1561..399acd99e 100644 --- a/tests/ovn-northd.at +++ b/tests/ovn-northd.at @@ -5971,6 +5971,34 @@ OVN_CLEANUP_NORTHD AT_CLEANUP ]) +OVN_FOR_EACH_NORTHD_NO_HV_PARALLELIZATION([ +AT_SETUP([ovn -- ARP flows for distributed gw ports with NAT]) +ovn_start + +check ovn-sbctl chassis-add gw1 geneve 127.0.0.1 +check ovn-nbctl ls-add sw +check ovn-nbctl lr-add ro1 + +check ovn-nbctl lrp-add ro1 ro1-lrp1 00:00:00:00:00:01 10.0.10.1/24 +check ovn-nbctl lsp-add-router-port sw sw-ro1 ro1-lrp1 +check ovn-nbctl lrp-set-gateway-chassis ro1-lrp1 gw1 + +check ovn-nbctl lrp-add ro1 ro1-lrp2 00:00:00:00:00:02 10.0.20.1/24 +check ovn-nbctl lsp-add-router-port sw sw-ro2 ro1-lrp2 +check ovn-nbctl lrp-set-gateway-chassis ro1-lrp2 gw1 + +check ovn-nbctl --gateway-port=ro1-lrp2 lr-nat-add ro1 dnat_and_snat 10.0.10.100 10.0.20.2 +check ovn-nbctl --wait=sb sync + +ovn-sbctl lflow-list sw > ls1_lflows +AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep 10.0.10.100 | ovn_strip_lflows], [0], [dnl + table=??(ls_in_l2_lkup ), priority=80 , match=(flags[[1]] == 0 && eth.dst == ff:ff:ff:ff:ff:ff && arp.op == 1 && arp.tpa == 10.0.10.100), action=(outport = "sw-ro2"; output;) +]) + +OVN_CLEANUP_NORTHD +AT_CLEANUP +]) + OVN_FOR_EACH_NORTHD_NO_HV_PARALLELIZATION([ AT_SETUP([ovn -- ARP flows for unreachable addresses - NAT and LB]) ovn_start -- 2.50.1 (Apple Git-155) _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
