This series fixes a MAC flap / potential L2 loop scenario triggered by inline
Network Functions (NFs) when the destination MAC of a redirected IP
packet is not yet known to the FDB.
Problem
=======
Traffic entering through a port configured with an "unknown" address
(that is, a member of the MC_UNKNOWN group) can be redirected through an
inline Network Function (NF) VM. After NF processing, the packet may be
flooded again if the destination MAC is not yet learned in the FDB. In
that case, a copy can be sent back out through the original ingress port.
- VLAN switch: the copy egresses through the shared localnet port,
causing the ToR to observe the source MAC moving between chassis
(MAC flap). If multiple NF-protected VMs are configured with
"unknown" addresses, packets can bounce continuously between
chassis through the ToR, creating a potential underlay L2 loop.
- Overlay switch: the copy is reflected back to the source port,
so the originating VM receives its own transmitted packet.
Fix
===
The fix stores the original inport before NF processing and
checks it on the post-NF return path so copies that would be sent back out
the same port are dropped, preventing MAC flaps and potential loops.
V2:
==
- Add fixes tag
- Minor test and comment cleanups
V3:
==
- Rebase on top of main.
V4:
==
- Fixed UT.
V5:
==
- Address review comments from Dumitru.
- Updated new actions name.
- Rebase on top of latest main.
V6:
==
- Address review comments from Dumitru.
Naveen Yerramneni (2):
actions: Add nf_learn/nf_lookup_orig_inport actions.
northd: Drop post-NF flood copies causing MAC flaps.
Documentation/ref/ovn-logical-flows.7.rst | 74 ++++---
TODO.rst | 10 +
controller/lflow.h | 1 +
include/ovn/actions.h | 14 ++
include/ovn/logical-fields.h | 4 +
lib/actions.c | 190 ++++++++++++++++++
lib/ovn-util.c | 4 +-
northd/northd.c | 115 +++++++++--
ovn-nb.xml | 13 ++
ovn-sb.xml | 57 ++++++
tests/ovn-macros.at | 1 +
tests/ovn-northd.at | 233 ++++++++++++++++++++--
tests/ovn.at | 124 ++++++++++++
utilities/ovn-trace.c | 18 ++
14 files changed, 796 insertions(+), 62 deletions(-)
--
2.43.5
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
