On Fri, Dec 3, 2021 at 12:35 PM Vladislav Odintsov <[email protected]> wrote: > > Hi, > > I’m playing with ACL rules to solve some specific use-case and found a > behaviour of ovn-controller, which seems strange to me. > Can somebody please clarify whether it’s a bug or I expect something that I > shouldn’t :) > > I’ve got next topology with two logical switches, two LSPs and 2 port-groups. > > lswitch1: > port1 (192.168.1.10/24) > > lswitch2: > port2 (10.0.0.10/24) > > > port_group1: > port1 > > port_group2: > port2 > > Simplified ACLs look like this: > > # ovn-nbctl acl-list port_group1 > from-lport 2000 (inport == @port_group2 && ip4) allow-related > to-lport 2000 (outport == @port_group2 && ip4) allow-related > > ovn-controller has next error: > > 2021-12-03T16:45:22.911Z|00048|lflow|WARN|error parsing match "reg0[7] == 1 > && (inport == @port_group2 && ip4)": Syntax error at `@port_group2' expecting > port group name. > > If I add a fake LSP to lswitch1 and add it to port-group2, this error doesn’t > appear. > It looks to me like the l_ctx_in->port_groups in consider_logical_flow__() is > filled with only port-groups from current datapath logical switch port... > > OVN main branch codebase.
I think this is as expected. If you run "ovn-sbctl list port_group" you'd see a port group in SB DB for each datapath. Also the first ACL (with from-lport) seems odd to me since in the ingress pipeline of lswitch1, there is no possibility of matching "inport" for the ports of lswitch2. Thanks Numan > > Regards, > Vladislav Odintsov > > _______________________________________________ > dev mailing list > [email protected] > https://mail.openvswitch.org/mailman/listinfo/ovs-dev _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
