On 7/10/26 6:07 PM, Mairtin O'Loingsigh wrote: > Add a new "pass-related" action that behaves like "pass" for > verdict (no verdict bit is set, so evaluation continues to > the next tier) but follows the stateful path like > "allow-related": it matches on hint registers, commits the > connection via conntrack, and allows established/related > traffic flows. > > Reported-at: https://redhat.atlassian.net/browse/FDP-3166 > Signed-off-by: Mairtin O'Loingsigh <[email protected]> > Signed-off-by: Dumitru Ceara <[email protected]> > --- > v1 -> v2: > - Align pass behavior with allow when a stateful ACL is present. > - Fix coding standard issues. > - Test updates. > > NEWS | 2 + > northd/en-acl-ids.c | 3 +- > northd/en-ls-stateful.c | 5 +- > northd/northd.c | 31 +++++----- > ovn-nb.ovsschema | 7 ++- > ovn-nb.xml | 31 ++++++++-- > tests/ovn-nbctl.at | 6 +- > tests/ovn-northd.at | 84 +++++++++++++++++++++++++++ > tests/ovn.at | 123 ++++++++++++++++++++++++++++++++++++++++ > tests/system-ovn.at | 120 +++++++++++++++++++++++++++++++++++++-- > utilities/ovn-nbctl.c | 33 ++++++----- > 11 files changed, 398 insertions(+), 47 deletions(-) >
Hi Mairtin, Thanks for the v2. Let's wait however until the discussion on the v1 is finalized, Ilya's points there make me wonder if we need this new behavior in the end: https://mail.openvswitch.org/pipermail/ovs-dev/2026-July/434210.html I delegated the v2 to myself in patchwork and will review it if we decide it's needed in the end. Regards, Dumitru _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
