On 7/10/26 12:57 AM, Mairtin O'Loingsigh via dev wrote: > Add a new "pass-related" action that behaves like "pass" for > verdict (no verdict bit is set, so evaluation continues to > the next tier) but follows the stateful path like > "allow-related": it matches on hint registers, commits the > connection via conntrack, and allows established/related > traffic flows.
I didn't read the code, so I'm not sure if ti is implemented this way, but it feels like the semantics as it is described is not what it supposed to be. If I see pass-related, I think that the related traffic will have pass semantics as well, i.e., will be passed through this ACL tier and be evaluated in the next tier. So, it will not just be automatically allowed. Does that make sense? Also, if the lower tier ACL allows the packet then what is the actual difference between the higher tier ACL being pass or pass-related? This feature needs a lot more documentation for how it works. IIRC, the original description in the ticket is not really correct and the way ACLs actually work wouldn't allow for what ovn-kubenetes wanted. I vaguely remember that we ended up with the thought that pass-related only makes sense for the same direction related traffic like FTP. But I don't remember details. Dumitru, do you remember more context? Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
