On Sat, Jul 11, 2026 at 8:38 AM Amir Aslan Aslani < [email protected]> wrote:
> Currently, priority-80 ls_in_l2_lkup ARP/ND response flows are > generated for all NAT entries except those associated with > unreachable LB IPs. In contrast, these flows are correctly > generated for unreachable non-LB NATs. > > Generate the missing ARP/ND response flows for unreachable LB NATs > as well, making their behavior consistent with other unreachable > NAT entries. > > Signed-off-by: Amir Aslan Aslani <[email protected]> > --- > northd/northd.c | 8 ++++---- > tests/ovn-northd.at | 11 ++++++++++- > 2 files changed, 14 insertions(+), 5 deletions(-) > > diff --git a/northd/northd.c b/northd/northd.c > index 3a4afa063..22108dd82 100644 > --- a/northd/northd.c > +++ b/northd/northd.c > @@ -9883,14 +9883,14 @@ build_lswitch_rport_arp_req_flows_for_lbnats( > * expect ARP requests/NS for the DNAT external_ip. > */ > if (nat_entry_is_v6(nat_entry)) { > - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6, > + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6_reachable, > nat->external_ip)) { > build_lswitch_rport_arp_req_flow( > nat->external_ip, AF_INET6, sw_op, sw_od, 80, lflows, > stage_hint, lflow_ref); > } > } else { > - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4, > + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4_reachable, > nat->external_ip)) { > build_lswitch_rport_arp_req_flow( > nat->external_ip, AF_INET, sw_op, sw_od, 80, lflows, > @@ -9927,14 +9927,14 @@ build_lswitch_rport_arp_req_flows_for_lbnats( > * expect ARP requests/NS for the SNAT external_ip. > */ > if (nat_entry_is_v6(nat_entry)) { > - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6, > + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v6_reachable, > nat->external_ip)) { > build_lswitch_rport_arp_req_flow( > nat->external_ip, AF_INET6, sw_op, sw_od, 80, lflows, > stage_hint, lflow_ref); > } > } else { > - if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4, > + if (!sset_contains(&lr_stateful_rec->lb_ips->ips_v4_reachable, > nat->external_ip)) { > build_lswitch_rport_arp_req_flow( > nat->external_ip, AF_INET, sw_op, sw_od, 80, lflows, > diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at > index 86cab3d5b..e19ead670 100644 > --- a/tests/ovn-northd.at > +++ b/tests/ovn-northd.at > @@ -6339,7 +6339,16 @@ AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | > ovn_strip_lflows], [0], [dnl > > > # Make sure that there is no flow for VIP 192.168.4.100 as it is > unreachable. > -AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" | grep > -v clone | grep "_MC_flood" -c], [1], [0 > +AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" -c], > [1], [0 > +]) > + > +AS_BOX([Adding an dnat_and_snat for LB unreachable VIP on ro1]) > +check ovn-nbctl --wait=sb lr-nat-add ro1 dnat_and_snat 192.168.4.100 > 192.168.1.100 > + > +ovn-sbctl lflow-list ls1 > ls1_lflows > +AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | grep "192.168.4.100" | > ovn_strip_lflows], [0], [dnl > + table=??(ls_in_l2_lkup ), priority=80 , match=(flags[[1]] == 0 > && eth.dst == ff:ff:ff:ff:ff:ff && arp.op == 1 && arp.tpa == > 192.168.4.100), action=(clone {outport = "ls1-ro1"; output; }; outport = > "_MC_unknown"; output;) > + table=??(ls_in_l2_lkup ), priority=90 , match=(flags[[1]] == 0 > && eth.dst == ff:ff:ff:ff:ff:ff && arp.op == 1 && arp.tpa == 192.168.4.100 > && arp.spa == 192.168.4.100), action=(outport = "_MC_flood_l2"; output;) > ]) > > OVN_CLEANUP_NORTHD > -- > 2.34.1 > > _______________________________________________ > dev mailing list > [email protected] > https://mail.openvswitch.org/mailman/listinfo/ovs-dev > > Thank you Amir, I added the missing Fixes tag, applied it to main and backported it down to 24.03. Regards, Ales _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
