The LB health monitoring functionality has been extended to support NFs.
Network_Function_Group has a list of Network_Functions, each of which has a
reference to network_Function_Health_Check that has the monitoring config.
There is a corresponding SB service_monitor maintaining the online/offline
status. When status changes, northd picks one of the “online” NFs and sets in
network_function_active field of NFG. The redirection rule in LS uses the
ports from this NF.
Ovn-controller performs the health monitoring by sending ICMP echo request
with source IP and MAC from NB global options “svc_monitor_ip” and
“svc_monitor_mac”, and destination IP and MAC from NB global options
“svc_monitor_ip_dst” and “svc_monitor_mac_dst”. Apart from svc_monitor_mac,
other 3 options are new. The sequence number and id are randomly generated
and stored in service_mon. The NF forwards the same packet out of the other
port. When it comes out, ovn-controller matches the sequence number and id
with stored values and marks online if matched.
In SB Service_Monitor table three new fields have been added:
type: to indicate “load-balancer” or “network-function”
mac: the destination MAC address for the monitor packets
logical_input_port: The LSP to which the probe packet would be sent
(taken from inport of Network_Function)
In IC SB Service_Monitor table a new field has been added:
type: only allowed value is “load-balancer”
Co-authored-by: Naveen Yerramneni <[email protected]>
Co-authored-by: Karthik Chandrashekar <[email protected]>
Signed-off-by: Naveen Yerramneni <[email protected]>
Signed-off-by: Karthik Chandrashekar <[email protected]>
Signed-off-by: Sragdhara Datta Chaudhuri <[email protected]>
---
NEWS | 6 +-
controller/pinctrl.c | 337 ++++++++++++++++++++++++++++++++------
ic/ovn-ic.c | 10 ++
lib/ovn-util.h | 16 ++
northd/en-global-config.c | 67 ++++++++
northd/en-global-config.h | 12 +-
northd/en-northd.c | 4 +
northd/en-sync-sb.c | 16 +-
northd/northd.c | 294 +++++++++++++++++++++++++++++----
northd/northd.h | 5 +
ovn-ic-sb.ovsschema | 8 +-
ovn-ic-sb.xml | 4 +
ovn-nb.xml | 32 ++++
ovn-sb.ovsschema | 13 +-
ovn-sb.xml | 32 +++-
tests/client.py | 70 ++++++--
tests/ovn-northd.at | 190 +++++++++++++++++++++
tests/server.py | 81 ++++++++-
tests/system-ovn.at | 144 ++++++++++++++++
utilities/ovn-nbctl.c | 10 +-
20 files changed, 1226 insertions(+), 125 deletions(-)
diff --git a/NEWS b/NEWS
index 619d8f1e2..1d707b8f7 100644
--- a/NEWS
+++ b/NEWS
@@ -10,8 +10,10 @@ Post v25.09.0
* Network_Function_Health_Check: Configurable health monitoring with
interval, timeout, success_count and failure_count parameters.
Traffic matching ACLs can be redirected through inline network functions
- using the network_function_group column in ACL. A network function
- from the group gets automatically selected. Network functions operate in
+ using the network_function_group column in ACL. A healthy network function
+ from the group gets automatically selected based on ICMP forwarding probes
+ with failover to some other member of the group when currently active
+ network function becomes unavailable. Network functions operate in
"inline" mode, transparently processing packets without modifying headers,
and support both ingress (from-lport) and egress (to-lport) traffic flows.
Two new options have been added to Logical_Switch_Port which need to
diff --git a/controller/pinctrl.c b/controller/pinctrl.c
index bf8c94be0..25afa6411 100644
--- a/controller/pinctrl.c
+++ b/controller/pinctrl.c
@@ -6844,6 +6844,14 @@ enum svc_monitor_status {
enum svc_monitor_protocol {
SVC_MON_PROTO_TCP,
SVC_MON_PROTO_UDP,
+ SVC_MON_PROTO_ICMP,
+};
+
+enum svc_monitor_type {
+ /* load balancer */
+ SVC_MON_TYPE_LB,
+ /* network function */
+ SVC_MON_TYPE_NF,
};
/* Service monitor health checks. */
@@ -6858,6 +6866,7 @@ struct svc_monitor {
/* key */
struct in6_addr ip;
uint32_t dp_key;
+ uint32_t input_port_key;
uint32_t port_key;
uint32_t proto_port; /* tcp/udp port */
@@ -6890,6 +6899,7 @@ struct svc_monitor {
int n_failures;
enum svc_monitor_protocol protocol;
+ enum svc_monitor_type type;
enum svc_monitor_state state;
enum svc_monitor_status status;
struct dp_packet pkt;
@@ -6897,6 +6907,9 @@ struct svc_monitor {
uint32_t seq_no;
ovs_be16 tp_src;
+ ovs_be16 icmp_id;
+ ovs_be16 icmp_seq_no;
+
bool delete;
};
@@ -6962,9 +6975,27 @@ sync_svc_monitors(struct ovsdb_idl_txn *ovnsb_idl_txn,
const struct sbrec_service_monitor *sb_svc_mon;
SBREC_SERVICE_MONITOR_TABLE_FOR_EACH (sb_svc_mon, svc_mon_table) {
+ enum svc_monitor_type mon_type;
+ if (sb_svc_mon->type
+ && !strcmp(sb_svc_mon->type, "network-function")) {
+ mon_type = SVC_MON_TYPE_NF;
+ } else {
+ mon_type = SVC_MON_TYPE_LB;
+ }
+
+ enum svc_monitor_protocol protocol;
+ if (!strcmp(sb_svc_mon->protocol, "udp")) {
+ protocol = SVC_MON_PROTO_UDP;
+ } else if (!strcmp(sb_svc_mon->protocol, "icmp")) {
+ protocol = SVC_MON_PROTO_ICMP;
+ } else {
+ protocol = SVC_MON_PROTO_TCP;
+ }
+
const struct sbrec_port_binding *pb
= lport_lookup_by_name(sbrec_port_binding_by_name,
sb_svc_mon->logical_port);
+ const struct sbrec_port_binding *input_pb = NULL;
if (!pb || sb_svc_mon->remote) {
continue;
}
@@ -6973,50 +7004,85 @@ sync_svc_monitors(struct ovsdb_idl_txn *ovnsb_idl_txn,
continue;
}
- struct in6_addr ip_addr;
- ovs_be32 ip4;
+ struct in6_addr ip_addr_src, ip_addr;
+ ovs_be32 ip4_src, ip4;
+ bool is_src_ipv4 = ip_parse(sb_svc_mon->src_ip, &ip4_src);
bool is_ipv4 = ip_parse(sb_svc_mon->ip, &ip4);
+
+ /* Skip if source and destination IP address families do not match. */
+ if (is_src_ipv4 != is_ipv4) {
+ continue;
+ }
+
if (is_ipv4) {
+ ip_addr_src = in6_addr_mapped_ipv4(ip4_src);
ip_addr = in6_addr_mapped_ipv4(ip4);
- } else if (!ipv6_parse(sb_svc_mon->ip, &ip_addr)) {
+ } else if (!ipv6_parse(sb_svc_mon->ip, &ip_addr)
+ || !ipv6_parse(sb_svc_mon->src_ip, &ip_addr_src)) {
continue;
}
struct eth_addr ea;
bool mac_found = false;
- for (size_t i = 0; i < pb->n_mac && !mac_found; i++) {
- struct lport_addresses laddrs;
- if (!extract_lsp_addresses(pb->mac[i], &laddrs)) {
+ if (mon_type == SVC_MON_TYPE_NF) {
+ if (protocol != SVC_MON_PROTO_ICMP) {
+ continue;
+ }
+ input_pb = lport_lookup_by_name(sbrec_port_binding_by_name,
+ sb_svc_mon->logical_input_port);
+ if (!input_pb) {
+ continue;
+ }
+ if (input_pb->chassis != our_chassis) {
+ continue;
+ }
+ if (strcmp(sb_svc_mon->mac, "")) {
+ if (eth_addr_from_string(sb_svc_mon->mac, &ea)) {
+ mac_found = true;
+ }
+ }
+ } else {
+ if (protocol != SVC_MON_PROTO_TCP &&
+ protocol != SVC_MON_PROTO_UDP) {
continue;
}
- if (is_ipv4) {
- for (size_t j = 0; j < laddrs.n_ipv4_addrs; j++) {
- if (ip4 == laddrs.ipv4_addrs[j].addr) {
- ea = laddrs.ea;
- mac_found = true;
- break;
- }
+ for (size_t i = 0; i < pb->n_mac && !mac_found; i++) {
+ struct lport_addresses laddrs;
+
+ if (!extract_lsp_addresses(pb->mac[i], &laddrs)) {
+ continue;
}
- } else {
- for (size_t j = 0; j < laddrs.n_ipv6_addrs; j++) {
- if (IN6_ARE_ADDR_EQUAL(&ip_addr,
- &laddrs.ipv6_addrs[j].addr)) {
- ea = laddrs.ea;
- mac_found = true;
- break;
+
+ if (is_ipv4) {
+ for (size_t j = 0; j < laddrs.n_ipv4_addrs; j++) {
+ if (ip4 == laddrs.ipv4_addrs[j].addr) {
+ ea = laddrs.ea;
+ mac_found = true;
+ break;
+ }
+ }
+ } else {
+ for (size_t j = 0; j < laddrs.n_ipv6_addrs; j++) {
+ if (IN6_ARE_ADDR_EQUAL(&ip_addr,
+ &laddrs.ipv6_addrs[j].addr)) {
+ ea = laddrs.ea;
+ mac_found = true;
+ break;
+ }
}
}
- }
- if (!mac_found && !laddrs.n_ipv4_addrs && !laddrs.n_ipv6_addrs) {
- /* IP address(es) are not configured. Use the first mac. */
- ea = laddrs.ea;
- mac_found = true;
- }
+ if (!mac_found && !laddrs.n_ipv4_addrs &&
+ !laddrs.n_ipv6_addrs) {
+ /* IP address(es) are not configured. Use the first mac. */
+ ea = laddrs.ea;
+ mac_found = true;
+ }
- destroy_lport_addresses(&laddrs);
+ destroy_lport_addresses(&laddrs);
+ }
}
if (!mac_found) {
@@ -7025,30 +7091,27 @@ sync_svc_monitors(struct ovsdb_idl_txn *ovnsb_idl_txn,
uint32_t dp_key = pb->datapath->tunnel_key;
uint32_t port_key = pb->tunnel_key;
+ uint32_t input_port_key = input_pb ? input_pb->tunnel_key : UINT32_MAX;
uint32_t hash =
hash_bytes(&ip_addr, sizeof ip_addr,
hash_3words(dp_key, port_key, sb_svc_mon->port));
- enum svc_monitor_protocol protocol;
- if (!sb_svc_mon->protocol || strcmp(sb_svc_mon->protocol, "udp")) {
- protocol = SVC_MON_PROTO_TCP;
- } else {
- protocol = SVC_MON_PROTO_UDP;
- }
-
svc_mon = pinctrl_find_svc_monitor(dp_key, port_key, &ip_addr,
sb_svc_mon->port, protocol, hash);
if (!svc_mon) {
svc_mon = xmalloc(sizeof *svc_mon);
svc_mon->dp_key = dp_key;
+ svc_mon->input_port_key = input_port_key;
svc_mon->port_key = port_key;
svc_mon->proto_port = sb_svc_mon->port;
svc_mon->ip = ip_addr;
+ svc_mon->src_ip = ip_addr_src;
svc_mon->is_ip6 = !is_ipv4;
svc_mon->state = SVC_MON_S_INIT;
svc_mon->status = SVC_MON_ST_UNKNOWN;
svc_mon->protocol = protocol;
+ svc_mon->type = mon_type;
smap_init(&svc_mon->options);
svc_mon->interval =
@@ -7063,7 +7126,6 @@ sync_svc_monitors(struct ovsdb_idl_txn *ovnsb_idl_txn,
svc_mon->n_failures = 0;
eth_addr_from_string(sb_svc_mon->src_mac, &svc_mon->src_mac);
- ip46_parse(sb_svc_mon->src_ip, &svc_mon->src_ip);
hmap_insert(&svc_monitors_map, &svc_mon->hmap_node, hash);
ovs_list_push_back(&svc_monitors, &svc_mon->list_node);
@@ -7940,11 +8002,89 @@ svc_monitor_send_udp_health_check(struct rconn *swconn,
ofpbuf_uninit(&ofpacts);
}
+static void
+svc_monitor_send_icmp_health_check__(struct rconn *swconn,
+ struct svc_monitor *svc_mon)
+{
+ uint64_t packet_stub[128 / 8];
+ struct dp_packet packet;
+ dp_packet_use_stub(&packet, packet_stub, sizeof packet_stub);
+
+ struct eth_addr eth_src;
+ eth_addr_from_string(svc_mon->sb_svc_mon->src_mac, ð_src);
+
+ if (!svc_mon->is_ip6) {
+ /* IPv4 ICMP health check */
+ ovs_be32 ip4_src;
+ ip_parse(svc_mon->sb_svc_mon->src_ip, &ip4_src);
+ pinctrl_compose_ipv4(&packet, eth_src, svc_mon->ea, ip4_src,
+ in6_addr_get_mapped_ipv4(&svc_mon->ip),
+ IPPROTO_ICMP, 255, ICMP_HEADER_LEN);
+
+ struct icmp_header *ih = dp_packet_l4(&packet);
+ ih->icmp_fields.echo.id = svc_mon->icmp_id;
+ ih->icmp_fields.echo.seq = svc_mon->icmp_seq_no;
+
+ uint8_t icmp_code = 0;
+ packet_set_icmp(&packet, ICMP4_ECHO_REQUEST, icmp_code);
+
+ ih->icmp_csum = 0;
+ ih->icmp_csum = csum(ih, sizeof *ih);
+ } else {
+ /* IPv6 ICMP health check */
+ pinctrl_compose_ipv6(&packet, eth_src, svc_mon->ea,
+ &svc_mon->src_ip, &svc_mon->ip,
+ IPPROTO_ICMPV6, 255, ICMP6_DATA_HEADER_LEN);
+
+ struct icmp6_data_header *ih6 = dp_packet_l4(&packet);
+ ih6->icmp6_base.icmp6_type = ICMP6_ECHO_REQUEST;
+ ih6->icmp6_base.icmp6_code = 0;
+ ih6->icmp6_base.icmp6_cksum = 0;
+
+ /* Set the echo ID and sequence number in the data section */
+ ih6->icmp6_data.be16[0] = svc_mon->icmp_id;
+ ih6->icmp6_data.be16[1] = svc_mon->icmp_seq_no;
+
+ /* Calculate checksum for ICMPv6 */
+ uint32_t icmpv6_csum = packet_csum_pseudoheader6(
+ dp_packet_l3(&packet));
+ ih6->icmp6_base.icmp6_cksum = csum_finish(csum_continue(icmpv6_csum,
+ ih6, ICMP6_DATA_HEADER_LEN));
+ }
+
+ uint64_t ofpacts_stub[4096 / 8];
+ struct ofpbuf ofpacts = OFPBUF_STUB_INITIALIZER(ofpacts_stub);
+ enum ofp_version version = rconn_get_version(swconn);
+ put_load(svc_mon->dp_key, MFF_LOG_DATAPATH, 0, 64, &ofpacts);
+ put_load(svc_mon->input_port_key, MFF_LOG_OUTPORT, 0, 32, &ofpacts);
+ put_load(1, MFF_LOG_FLAGS, MLF_LOCAL_ONLY, 1, &ofpacts);
+ struct ofpact_resubmit *resubmit = ofpact_put_RESUBMIT(&ofpacts);
+ resubmit->in_port = OFPP_CONTROLLER;
+ resubmit->table_id = OFTABLE_LOCAL_OUTPUT;
+
+ struct ofputil_packet_out po = {
+ .packet = dp_packet_data(&packet),
+ .packet_len = dp_packet_size(&packet),
+ .buffer_id = UINT32_MAX,
+ .ofpacts = ofpacts.data,
+ .ofpacts_len = ofpacts.size,
+ };
+ match_set_in_port(&po.flow_metadata, OFPP_CONTROLLER);
+ enum ofputil_protocol proto = ofputil_protocol_from_ofp_version(version);
+ queue_msg(swconn, ofputil_encode_packet_out(&po, proto));
+ dp_packet_uninit(&packet);
+ ofpbuf_uninit(&ofpacts);
+}
+
static void
svc_monitor_send_health_check(struct rconn *swconn,
struct svc_monitor *svc_mon)
{
- if (svc_mon->protocol == SVC_MON_PROTO_TCP) {
+ if (svc_mon->protocol == SVC_MON_PROTO_ICMP) {
+ svc_mon->icmp_id = (OVS_FORCE ovs_be16) random_uint16();
+ svc_mon->icmp_seq_no = (OVS_FORCE ovs_be16) random_uint16();
+ svc_monitor_send_icmp_health_check__(swconn, svc_mon);
+ } else if (svc_mon->protocol == SVC_MON_PROTO_TCP) {
svc_mon->seq_no = random_uint32();
svc_mon->tp_src = htons(get_random_src_port());
svc_monitor_send_tcp_health_check__(swconn, svc_mon,
@@ -7985,12 +8125,12 @@ svc_monitors_run(struct rconn *swconn,
case SVC_MON_S_WAITING:
if (current_time > svc_mon->wait_time) {
- if (svc_mon->protocol == SVC_MON_PROTO_TCP) {
- svc_mon->n_failures++;
- svc_mon->state = SVC_MON_S_OFFLINE;
- } else {
+ if (svc_mon->protocol == SVC_MON_PROTO_UDP) {
svc_mon->n_success++;
svc_mon->state = SVC_MON_S_ONLINE;
+ } else {
+ svc_mon->n_failures++;
+ svc_mon->state = SVC_MON_S_OFFLINE;
}
svc_mon->next_send_time = current_time + svc_mon->interval;
next_run_time = svc_mon->next_send_time;
@@ -8052,6 +8192,42 @@ svc_monitors_wait(long long int
svc_monitors_next_run_time)
}
}
+static void
+pinctrl_handle_icmp_svc_check(struct dp_packet *pkt_in,
+ struct svc_monitor *svc_mon)
+{
+ if (!svc_mon->is_ip6) {
+ /* IPv4 ICMP echo reply */
+ struct icmp_header *ih = dp_packet_l4(pkt_in);
+
+ if (!ih) {
+ return;
+ }
+
+ if ((ih->icmp_fields.echo.id != svc_mon->icmp_id) ||
+ (ih->icmp_fields.echo.seq != svc_mon->icmp_seq_no)) {
+ return;
+ }
+ } else {
+ /* IPv6 ICMP echo reply */
+ struct icmp6_data_header *ih6 = dp_packet_l4(pkt_in);
+
+ if (!ih6) {
+ return;
+ }
+
+ /* For ICMPv6 echo reply, check ID and sequence in the data section */
+ if ((ih6->icmp6_data.be16[0] != svc_mon->icmp_id) ||
+ (ih6->icmp6_data.be16[1] != svc_mon->icmp_seq_no)) {
+ return;
+ }
+ }
+
+ svc_mon->n_success++;
+ svc_mon->state = SVC_MON_S_ONLINE;
+ svc_mon->next_send_time = time_msec() + svc_mon->interval;
+}
+
static bool
pinctrl_handle_tcp_svc_check(struct rconn *swconn,
struct dp_packet *pkt_in,
@@ -8108,6 +8284,7 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
uint32_t dp_key = ntohll(md->flow.metadata);
uint32_t port_key = md->flow.regs[MFF_LOG_INPORT - MFF_REG0];
struct in6_addr ip_addr;
+ struct in6_addr dst_ip_addr;
struct eth_header *in_eth = dp_packet_data(pkt_in);
uint8_t ip_proto;
@@ -8123,10 +8300,12 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
}
ip_addr = in6_addr_mapped_ipv4(ip_flow->nw_src);
+ dst_ip_addr = in6_addr_mapped_ipv4(ip_flow->nw_dst);
ip_proto = in_ip->ip_proto;
} else {
struct ovs_16aligned_ip6_hdr *in_ip = dp_packet_l3(pkt_in);
ip_addr = ip_flow->ipv6_src;
+ dst_ip_addr = ip_flow->ipv6_dst;
ip_proto = in_ip->ip6_nxt;
}
@@ -8157,7 +8336,6 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
}
pinctrl_handle_tcp_svc_check(swconn, pkt_in, svc_mon);
} else {
- struct udp_header *orig_uh;
const char *end =
(char *)dp_packet_l4(pkt_in) + dp_packet_l4_size(pkt_in);
@@ -8168,17 +8346,64 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
return;
}
- const void *in_ip = dp_packet_get_icmp_payload(pkt_in);
- if (!in_ip) {
- static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
- VLOG_WARN_RL(&rl, "Original IP datagram not present in "
- "ICMP packet");
- return;
+ /* Handle ICMP ECHO REQUEST probes for Network Function services */
+ if (in_eth->eth_type == htons(ETH_TYPE_IP)) {
+ struct icmp_header *ih = l4h;
+ /* It's ICMP packet. */
+ if (ih->icmp_type == ICMP4_ECHO_REQUEST && ih->icmp_code == 0) {
+ uint32_t hash = hash_bytes(&dst_ip_addr, sizeof dst_ip_addr,
+ hash_3words(dp_key, port_key, 0));
+ struct svc_monitor *svc_mon =
+ pinctrl_find_svc_monitor(dp_key, port_key, &dst_ip_addr, 0,
+ SVC_MON_PROTO_ICMP, hash);
+ if (!svc_mon) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(
+ 1, 5);
+ VLOG_WARN_RL(&rl, "handle service check: Service monitor "
+ "not found for ICMP request");
+ return;
+ }
+ if (svc_mon->type == SVC_MON_TYPE_NF) {
+ pinctrl_handle_icmp_svc_check(pkt_in, svc_mon);
+ }
+ return;
+ }
+ } else if (in_eth->eth_type == htons(ETH_TYPE_IPV6)) {
+ struct icmp6_data_header *ih6 = l4h;
+ /* It's ICMPv6 packet. */
+ if (ih6->icmp6_base.icmp6_type == ICMP6_ECHO_REQUEST &&
+ ih6->icmp6_base.icmp6_code == 0) {
+ uint32_t hash = hash_bytes(&dst_ip_addr, sizeof dst_ip_addr,
+ hash_3words(dp_key, port_key, 0));
+ struct svc_monitor *svc_mon =
+ pinctrl_find_svc_monitor(dp_key, port_key, &dst_ip_addr, 0,
+ SVC_MON_PROTO_ICMP, hash);
+ if (!svc_mon) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(
+ 1, 5);
+ VLOG_WARN_RL(&rl, "handle service check: Service monitor "
+ "not found for ICMPv6 request");
+ return;
+ }
+ if (svc_mon->type == SVC_MON_TYPE_NF) {
+ pinctrl_handle_icmp_svc_check(pkt_in, svc_mon);
+ }
+ return;
+ }
}
+ /* Handle ICMP errors for LB services */
+ struct udp_header *orig_uh = NULL;
if (in_eth->eth_type == htons(ETH_TYPE_IP)) {
struct icmp_header *ih = l4h;
- /* It's ICMP packet. */
+ const void *in_ip = dp_packet_get_icmp_payload(pkt_in);
+ if (!in_ip) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
+ VLOG_WARN_RL(&rl, "Original IP datagram not present in "
+ "ICMP packet");
+ return;
+ }
+
if (ih->icmp_type != ICMP4_DST_UNREACH || ih->icmp_code != 3) {
return;
}
@@ -8200,6 +8425,14 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
return;
}
} else {
+ const void *in_ip = dp_packet_get_icmp_payload(pkt_in);
+ if (!in_ip) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
+ VLOG_WARN_RL(&rl, "Original IP datagram not present in "
+ "ICMP packet");
+ return;
+ }
+
struct icmp6_header *ih6 = l4h;
if (ih6->icmp6_type != 1 || ih6->icmp6_code != 4) {
return;
@@ -8210,6 +8443,7 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
VLOG_WARN_RL(&rl, "Invalid original IP datagram length "
"present in ICMP packet");
+ return;
}
orig_uh = (struct udp_header *) (ip6_hdr + 1);
@@ -8221,6 +8455,13 @@ pinctrl_handle_svc_check(struct rconn *swconn, const
struct flow *ip_flow,
}
}
+ if (!orig_uh) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
+ VLOG_WARN_RL(&rl, "UDP header not found in the original "
+ "IP datagram");
+ return;
+ }
+
uint32_t hash =
hash_bytes(&ip_addr, sizeof ip_addr,
hash_3words(dp_key, port_key, ntohs(orig_uh->udp_dst)));
diff --git a/ic/ovn-ic.c b/ic/ovn-ic.c
index 1462b8043..a64662a1b 100644
--- a/ic/ovn-ic.c
+++ b/ic/ovn-ic.c
@@ -2446,6 +2446,9 @@ lookup_sb_svc_rec(struct ic_context *ctx,
SBREC_SERVICE_MONITOR_FOR_EACH_EQUAL (sb_rec, key,
ctx->sbrec_service_monitor_by_remote_type_logical_port) {
if (db_rec->port == sb_rec->port &&
+ ((db_rec->type && sb_rec->type &&
+ !strcmp(db_rec->type, sb_rec->type)) ||
+ (!db_rec->type && !sb_rec->type)) &&
!strcmp(db_rec->ip, sb_rec->ip) &&
!strcmp(db_rec->src_ip, sb_rec->src_ip) &&
!strcmp(db_rec->protocol, sb_rec->protocol)) {
@@ -2480,6 +2483,9 @@ lookup_icsb_svc_rec(struct ic_context *ctx,
ICSBREC_SERVICE_MONITOR_FOR_EACH_EQUAL (ic_rec, key,
ctx->icsbrec_service_monitor_by_target_az_logical_port) {
if (db_rec->port == ic_rec->port &&
+ ((db_rec->type && ic_rec->type &&
+ !strcmp(db_rec->type, ic_rec->type)) ||
+ (!db_rec->type && !ic_rec->type)) &&
!strcmp(db_rec->ip, ic_rec->ip) &&
!strcmp(db_rec->src_ip, ic_rec->src_ip) &&
!strcmp(db_rec->protocol, ic_rec->protocol) &&
@@ -2557,6 +2563,7 @@ sync_service_monitor(struct ic_context *ctx)
sbrec_service_monitor_set_status(db_rec, ic_rec->status);
} else {
ic_rec = icsbrec_service_monitor_insert(ctx->ovnisb_txn);
+ icsbrec_service_monitor_set_type(ic_rec, db_rec->type);
icsbrec_service_monitor_set_ip(ic_rec, db_rec->ip);
icsbrec_service_monitor_set_port(ic_rec, db_rec->port);
icsbrec_service_monitor_set_src_ip(ic_rec, db_rec->src_ip);
@@ -2587,6 +2594,7 @@ sync_service_monitor(struct ic_context *ctx)
sb_rec->status);
} else {
sb_rec = sbrec_service_monitor_insert(ctx->ovnsb_txn);
+ sbrec_service_monitor_set_type(sb_rec, db_rec->type);
sbrec_service_monitor_set_ip(sb_rec, db_rec->ip);
sbrec_service_monitor_set_port(sb_rec, db_rec->port);
sbrec_service_monitor_set_src_ip(sb_rec, db_rec->src_ip);
@@ -3055,6 +3063,8 @@ main(int argc, char *argv[])
&sbrec_service_monitor_col_chassis_name);
ovsdb_idl_add_column(ovnsb_idl_loop.idl,
&sbrec_service_monitor_col_external_ids);
+ ovsdb_idl_add_column(ovnsb_idl_loop.idl,
+ &sbrec_service_monitor_col_type);
ovsdb_idl_add_column(ovnsb_idl_loop.idl,
&sbrec_service_monitor_col_ip);
ovsdb_idl_add_column(ovnsb_idl_loop.idl,
diff --git a/lib/ovn-util.h b/lib/ovn-util.h
index 68c199687..82e9a4e77 100644
--- a/lib/ovn-util.h
+++ b/lib/ovn-util.h
@@ -473,6 +473,22 @@ sorted_array_from_sset(struct sset *s)
return sorted_array_create(sset_sort(s), sset_count(s), true);
}
+static inline int
+name_cmp(const void *s1_, const void *s2_)
+{
+ const char *s1 = *(char **) s1_;
+ const char *s2 = *(char **) s2_;
+ return strcmp(s1, s2);
+}
+
+static inline struct sorted_array
+sorted_array_from_unsorted(const char **unsorted_data, size_t n,
+ bool take_ownership)
+{
+ qsort(unsorted_data, n, sizeof *unsorted_data, name_cmp);
+ return sorted_array_create(unsorted_data, n, take_ownership);
+}
+
/* DB set columns are already sorted, just wrap them into a sorted array. */
#define sorted_array_from_dbrec(dbrec, column) \
sorted_array_create((const char **) (dbrec)->column, \
diff --git a/northd/en-global-config.c b/northd/en-global-config.c
index 76046c265..2556b2888 100644
--- a/northd/en-global-config.c
+++ b/northd/en-global-config.c
@@ -20,6 +20,7 @@
/* OVS includes */
#include "openvswitch/vlog.h"
+#include "socket-util.h"
/* OVN includes */
#include "debug.h"
@@ -74,6 +75,25 @@ get_ovn_max_dp_key_local(bool vxlan_mode, bool vxlan_ic_mode)
return vxlan_ic_mode ? OVN_MAX_DP_VXLAN_KEY_LOCAL : OVN_MAX_DP_KEY_LOCAL;
}
+static void
+update_svc_monitor_addr(const char *new_ip, char **old_ip_pptr)
+{
+ if (new_ip && *old_ip_pptr) {
+ if (!strcmp(new_ip, *old_ip_pptr)) {
+ return;
+ }
+ }
+ free(*old_ip_pptr);
+
+ /* Parse and set the new IP address if valid */
+ struct in6_addr svc_mon_addr;
+ if (new_ip && ip46_parse(new_ip, &svc_mon_addr)) {
+ *old_ip_pptr = xstrdup(new_ip);
+ } else {
+ *old_ip_pptr = NULL;
+ }
+}
+
enum engine_node_state
en_global_config_run(struct engine_node *node , void *data)
{
@@ -117,6 +137,27 @@ en_global_config_run(struct engine_node *node , void *data)
}
}
+ const char *dst_monitor_mac = smap_get(&nb->options,
+ "svc_monitor_mac_dst");
+ if (dst_monitor_mac) {
+ if (eth_addr_from_string(dst_monitor_mac,
+ &config_data->svc_monitor_mac_ea_dst)) {
+ snprintf(config_data->svc_monitor_mac_dst,
+ sizeof config_data->svc_monitor_mac_dst,
+ ETH_ADDR_FMT,
+ ETH_ADDR_ARGS(config_data->svc_monitor_mac_ea_dst));
+ } else {
+ dst_monitor_mac = NULL;
+ }
+ }
+
+ const char *monitor_ip = smap_get(&nb->options, "svc_monitor_ip");
+ update_svc_monitor_addr(monitor_ip, &config_data->svc_monitor_ip);
+
+ const char *monitor_ip_dst = smap_get(&nb->options, "svc_monitor_ip_dst");
+ update_svc_monitor_addr(monitor_ip_dst,
+ &config_data->svc_monitor_ip_dst);
+
struct smap *options = &config_data->nb_options;
smap_destroy(options);
smap_clone(options, &nb->options);
@@ -132,6 +173,15 @@ en_global_config_run(struct engine_node *node , void *data)
config_data->svc_monitor_mac);
}
+ if (!dst_monitor_mac) {
+ eth_addr_random(&config_data->svc_monitor_mac_ea_dst);
+ snprintf(config_data->svc_monitor_mac_dst,
+ sizeof config_data->svc_monitor_mac_dst, ETH_ADDR_FMT,
+ ETH_ADDR_ARGS(config_data->svc_monitor_mac_ea_dst));
+ smap_replace(options, "svc_monitor_mac_dst",
+ config_data->svc_monitor_mac_dst);
+ }
+
bool ic_vxlan_mode = false;
const struct nbrec_logical_switch *nbs;
NBREC_LOGICAL_SWITCH_TABLE_FOR_EACH (nbs, nbrec_ls_table) {
@@ -194,6 +244,8 @@ void en_global_config_cleanup(void *data OVS_UNUSED)
struct ed_type_global_config *config_data = data;
smap_destroy(&config_data->nb_options);
smap_destroy(&config_data->sb_options);
+ free(config_data->svc_monitor_ip);
+ free(config_data->svc_monitor_ip_dst);
destroy_debug_config();
}
@@ -254,6 +306,21 @@ global_config_nb_global_handler(struct engine_node *node,
void *data)
return EN_UNHANDLED;
}
+ if (config_out_of_sync(&nb->options, &config_data->nb_options,
+ "svc_monitor_mac_dst", true)) {
+ return EN_UNHANDLED;
+ }
+
+ if (config_out_of_sync(&nb->options, &config_data->nb_options,
+ "svc_monitor_ip", false)) {
+ return EN_UNHANDLED;
+ }
+
+ if (config_out_of_sync(&nb->options, &config_data->nb_options,
+ "svc_monitor_ip_dst", false)) {
+ return EN_UNHANDLED;
+ }
+
/* Check if max_tunid has changed or not. */
if (config_out_of_sync(&nb->options, &config_data->nb_options,
"max_tunid", true)) {
diff --git a/northd/en-global-config.h b/northd/en-global-config.h
index 55a1e420b..413cd3849 100644
--- a/northd/en-global-config.h
+++ b/northd/en-global-config.h
@@ -37,13 +37,19 @@ struct ed_type_global_config {
const struct nbrec_nb_global *nb_global;
const struct sbrec_sb_global *sb_global;
- /* MAC allocated for service monitor usage. Just one mac is allocated
+ /* MAC allocated for service monitor usage. Just one pair is allocated
* for this purpose and ovn-controller's on each chassis will make use
- * of this mac when sending out the packets to monitor the services
+ * of this pair when sending out the packets to monitor the services
* defined in Service_Monitor Southbound table. Since these packets
- * are locally handled, having just one mac is good enough. */
+ * are locally handled, having just one pair is good enough. */
char svc_monitor_mac[ETH_ADDR_STRLEN + 1];
struct eth_addr svc_monitor_mac_ea;
+ char svc_monitor_mac_dst[ETH_ADDR_STRLEN + 1];
+ struct eth_addr svc_monitor_mac_ea_dst;
+
+ /* IP addresses configured for NF service monitor usage. */
+ char *svc_monitor_ip;
+ char *svc_monitor_ip_dst;
struct chassis_features features;
diff --git a/northd/en-northd.c b/northd/en-northd.c
index 78a27b51c..861ee46fd 100644
--- a/northd/en-northd.c
+++ b/northd/en-northd.c
@@ -123,6 +123,10 @@ northd_get_input_data(struct engine_node *node,
input_data->sb_options = &global_config->sb_options;
input_data->svc_monitor_mac = global_config->svc_monitor_mac;
input_data->svc_monitor_mac_ea = global_config->svc_monitor_mac_ea;
+ input_data->svc_monitor_mac_dst = global_config->svc_monitor_mac_dst;
+ input_data->svc_monitor_mac_ea_dst = global_config->svc_monitor_mac_ea_dst;
+ input_data->svc_monitor_ip = global_config->svc_monitor_ip;
+ input_data->svc_monitor_ip_dst = global_config->svc_monitor_ip_dst;
input_data->features = &global_config->features;
input_data->vxlan_mode = global_config->vxlan_mode;
diff --git a/northd/en-sync-sb.c b/northd/en-sync-sb.c
index a92eb9612..e8ebba417 100644
--- a/northd/en-sync-sb.c
+++ b/northd/en-sync-sb.c
@@ -49,7 +49,8 @@ static void sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,
const struct sbrec_address_set_table *,
const struct lr_stateful_table *,
const struct ovn_datapaths *,
- const char *svc_monitor_macp);
+ const char *svc_monitor_macp,
+ const char *svc_monitor_macp_dst);
static const struct sbrec_address_set *sb_address_set_lookup_by_name(
struct ovsdb_idl_index *, const char *name);
static void update_sb_addr_set(struct sorted_array *,
@@ -104,7 +105,8 @@ en_sync_to_sb_addr_set_run(struct engine_node *node, void
*data OVS_UNUSED)
nb_port_group_table, sb_address_set_table,
&lr_stateful_data->table,
&northd_data->lr_datapaths,
- global_config->svc_monitor_mac);
+ global_config->svc_monitor_mac,
+ global_config->svc_monitor_mac_dst);
return EN_UPDATED;
}
@@ -464,7 +466,8 @@ sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,
const struct sbrec_address_set_table *sb_address_set_table,
const struct lr_stateful_table *lr_statefuls,
const struct ovn_datapaths *lr_datapaths,
- const char *svc_monitor_macp)
+ const char *svc_monitor_macp,
+ const char *svc_monitor_macp_dst)
{
struct shash sb_address_sets = SHASH_INITIALIZER(&sb_address_sets);
@@ -474,8 +477,11 @@ sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,
shash_add(&sb_address_sets, sb_address_set->name, sb_address_set);
}
- /* Service monitor MAC. */
- struct sorted_array svc = sorted_array_create(&svc_monitor_macp, 1, false);
+ /* Service monitor MACs. */
+ const char *svc_macs[] = {svc_monitor_macp, svc_monitor_macp_dst};
+ size_t n_macs = sizeof(svc_macs) / sizeof(svc_macs[0]);
+ struct sorted_array svc = sorted_array_from_unsorted(svc_macs, n_macs,
+ false);
sync_addr_set(ovnsb_txn, "svc_monitor_mac", &svc, &sb_address_sets);
sorted_array_destroy(&svc);
diff --git a/northd/northd.c b/northd/northd.c
index 1e177b8d2..3220ff708 100644
--- a/northd/northd.c
+++ b/northd/northd.c
@@ -3000,6 +3000,9 @@ get_service_mon(const struct hmap *local_svc_monitors_map,
const char *ip, const char *logical_port,
uint16_t service_port, const char *protocol)
{
+ if (!ip || !logical_port || !protocol) {
+ return NULL;
+ }
uint32_t hash = service_port;
hash = hash_string(ip, hash);
hash = hash_string(logical_port, hash);
@@ -3041,7 +3044,9 @@ static struct service_monitor_info *
create_or_get_service_mon(struct ovsdb_idl_txn *ovnsb_txn,
struct hmap *local_svc_monitors_map,
struct hmap *ic_learned_svc_monitors_map,
- const char *ip, const char *logical_port,
+ const char *type, const char *ip,
+ const char *logical_port,
+ const char *logical_input_port,
uint16_t service_port, const char *protocol,
const char *chassis_name, bool remote_backend)
{
@@ -3074,9 +3079,14 @@ create_or_get_service_mon(struct ovsdb_idl_txn
*ovnsb_txn,
struct sbrec_service_monitor *sbrec_mon =
sbrec_service_monitor_insert(ovnsb_txn);
+ sbrec_service_monitor_set_type(sbrec_mon, type);
sbrec_service_monitor_set_ip(sbrec_mon, ip);
sbrec_service_monitor_set_port(sbrec_mon, service_port);
sbrec_service_monitor_set_logical_port(sbrec_mon, logical_port);
+ if (logical_input_port) {
+ sbrec_service_monitor_set_logical_input_port(sbrec_mon,
+ logical_input_port);
+ }
sbrec_service_monitor_set_protocol(sbrec_mon, protocol);
sbrec_service_monitor_set_remote(sbrec_mon, remote_backend);
sbrec_service_monitor_set_ic_learned(sbrec_mon, false);
@@ -3089,6 +3099,103 @@ create_or_get_service_mon(struct ovsdb_idl_txn
*ovnsb_txn,
return mon_info;
}
+static void
+ovn_nf_svc_create(struct ovsdb_idl_txn *ovnsb_txn,
+ struct hmap *local_svc_monitors_map,
+ struct hmap *ic_learned_svc_monitors_map,
+ struct sset *svc_monitor_lsps,
+ struct hmap *ls_ports,
+ const char *mac_src, const char *mac_dst,
+ const char *ip_src, const char *ip_dst,
+ const char *logical_port, const char *logical_input_port,
+ const struct smap *health_check_options)
+{
+ if (!ip_src || !ip_dst || !mac_src || !mac_dst) {
+ static struct vlog_rate_limit rl =
+ VLOG_RATE_LIMIT_INIT(1, 1);
+ VLOG_ERR_RL(&rl, "NetworkFunction: invalid service monitor src_mac:%s "
+ "dst_mac:%s src_ip:%s dst_ip:%s\n",
+ mac_src, mac_dst, ip_src, ip_dst);
+ return;
+ }
+
+ const char *ports[] = {logical_port, logical_input_port};
+ size_t n_ports = sizeof(ports) / sizeof(ports[0]);
+ const char *chassis_name = NULL;
+ bool port_up = true;
+
+ for (size_t i = 0; i < n_ports; i++) {
+ const char *port = ports[i];
+ sset_add(svc_monitor_lsps, port);
+ struct ovn_port *op = ovn_port_find(ls_ports, port);
+ if (op == NULL) {
+ static struct vlog_rate_limit rl =
+ VLOG_RATE_LIMIT_INIT(1, 1);
+ VLOG_ERR_RL(&rl, "NetworkFunction: skip health check, port:%s "
+ "not found\n", port);
+ return;
+ }
+
+ if (op->sb && op->sb->chassis) {
+ if (chassis_name == NULL) {
+ chassis_name = op->sb->chassis->name;
+ } else if (strcmp(chassis_name, op->sb->chassis->name)) {
+ static struct vlog_rate_limit rl =
+ VLOG_RATE_LIMIT_INIT(1, 1);
+ VLOG_ERR_RL(&rl, "NetworkFunction: chassis mismatch "
+ " chassis:%s port:%s\n", op->sb->chassis->name, port);
+ }
+ }
+ port_up &= (op->sb->n_up && op->sb->up[0]);
+ }
+
+
+ struct service_monitor_info *mon_info =
+ create_or_get_service_mon(ovnsb_txn,
+ local_svc_monitors_map,
+ ic_learned_svc_monitors_map,
+ "network-function", ip_dst,
+ logical_port,
+ logical_input_port,
+ 0,
+ "icmp",
+ chassis_name,
+ false);
+ ovs_assert(mon_info);
+ sbrec_service_monitor_set_options(
+ mon_info->sbrec_mon, health_check_options);
+
+ if (!mon_info->sbrec_mon->src_mac ||
+ strcmp(mon_info->sbrec_mon->src_mac, mac_src)) {
+ sbrec_service_monitor_set_src_mac(mon_info->sbrec_mon,
+ mac_src);
+ }
+
+ if (!mon_info->sbrec_mon->mac ||
+ strcmp(mon_info->sbrec_mon->mac, mac_dst)) {
+ sbrec_service_monitor_set_mac(mon_info->sbrec_mon,
+ mac_dst);
+ }
+
+ if (!mon_info->sbrec_mon->src_ip ||
+ strcmp(mon_info->sbrec_mon->src_ip, ip_src)) {
+ sbrec_service_monitor_set_src_ip(mon_info->sbrec_mon, ip_src);
+ }
+
+ if (!mon_info->sbrec_mon->ip ||
+ strcmp(mon_info->sbrec_mon->ip, ip_dst)) {
+ sbrec_service_monitor_set_ip(mon_info->sbrec_mon, ip_dst);
+ }
+
+ if (!port_up
+ && mon_info->sbrec_mon->status
+ && !strcmp(mon_info->sbrec_mon->status, "online")) {
+ sbrec_service_monitor_set_status(mon_info->sbrec_mon,
+ "offline");
+ }
+ mon_info->required = true;
+}
+
static void
ovn_lb_svc_create(struct ovsdb_idl_txn *ovnsb_txn,
const struct ovn_northd_lb *lb,
@@ -3140,8 +3247,10 @@ ovn_lb_svc_create(struct ovsdb_idl_txn *ovnsb_txn,
create_or_get_service_mon(ovnsb_txn,
local_svc_monitors_map,
ic_learned_svc_monitors_map,
+ "load-balancer",
backend->ip_str,
backend_nb->logical_port,
+ NULL,
backend->port,
protocol,
chassis_name,
@@ -3387,12 +3496,16 @@ build_lb_datapaths(const struct hmap *lbs, const struct
hmap *lb_groups,
}
static void
-build_lb_svcs(
+build_svcs(
struct ovsdb_idl_txn *ovnsb_txn,
struct ovsdb_idl_index *sbrec_service_monitor_by_learned_type,
const char *svc_monitor_mac,
const struct eth_addr *svc_monitor_mac_ea,
+ const char *svc_monitor_mac_dst,
+ const char *svc_monitor_ip,
+ const char *svc_monitor_ip_dst,
struct hmap *ls_ports, struct hmap *lb_dps_map,
+ const struct nbrec_network_function_table *nbrec_network_function_table,
struct sset *svc_monitor_lsps,
struct hmap *local_svc_monitors_map,
struct hmap *ic_learned_svc_monitors_map)
@@ -3429,6 +3542,22 @@ build_lb_svcs(
ic_learned_svc_monitors_map);
}
+ const struct nbrec_network_function *nbrec_nf;
+ NBREC_NETWORK_FUNCTION_TABLE_FOR_EACH (nbrec_nf,
+ nbrec_network_function_table) {
+ if (nbrec_nf->health_check) {
+ ovn_nf_svc_create(ovnsb_txn,
+ local_svc_monitors_map,
+ ic_learned_svc_monitors_map,
+ svc_monitor_lsps,
+ ls_ports,
+ svc_monitor_mac, svc_monitor_mac_dst,
+ svc_monitor_ip, svc_monitor_ip_dst,
+ nbrec_nf->outport->name, nbrec_nf->inport->name,
+ &nbrec_nf->health_check->options);
+ }
+ }
+
struct service_monitor_info *mon_info;
HMAP_FOR_EACH_SAFE (mon_info, hmap_node, local_svc_monitors_map) {
if (!mon_info->required) {
@@ -3501,22 +3630,10 @@ build_lb_count_dps(struct hmap *lb_dps_map)
*/
static void
build_lb_port_related_data(
- struct ovsdb_idl_txn *ovnsb_txn,
- struct ovsdb_idl_index *sbrec_service_monitor_by_learned_type,
- const char *svc_monitor_mac,
- const struct eth_addr *svc_monitor_mac_ea,
struct ovn_datapaths *lr_datapaths,
struct ovn_datapaths *ls_datapaths,
- struct hmap *ls_ports,
- struct hmap *lb_dps_map, struct hmap *lb_group_dps_map,
- struct sset *svc_monitor_lsps,
- struct hmap *local_svc_monitors_map,
- struct hmap *ic_learned_svc_monitors_map)
+ struct hmap *lb_dps_map, struct hmap *lb_group_dps_map)
{
- build_lb_svcs(ovnsb_txn, sbrec_service_monitor_by_learned_type,
- svc_monitor_mac, svc_monitor_mac_ea, ls_ports,
- lb_dps_map, svc_monitor_lsps,
- local_svc_monitors_map, ic_learned_svc_monitors_map);
build_lswitch_lbs_from_lrouter(lr_datapaths, ls_datapaths, lb_dps_map,
lb_group_dps_map);
}
@@ -17786,13 +17903,6 @@ build_ls_stateful_flows(const struct
ls_stateful_record *ls_stateful_rec,
build_lb_hairpin(ls_stateful_rec, od, lflows, ls_stateful_rec->lflow_ref);
}
-static struct nbrec_network_function *
-network_function_get_active(const struct nbrec_network_function_group *nfg)
-{
- /* Another patch adds the healthmon support. This is temporary. */
- return nfg->n_network_function ? nfg->network_function[0] : NULL;
-}
-
/* For packets received on tunnel and egressing towards a network-function port
* commit the tunnel interface id in CT. This will be utilized when the packet
* comes out of the other network-function interface of the service VM. The
@@ -17835,6 +17945,120 @@ build_lswitch_stateful_nf(struct ovn_port *op,
ds_cstr(match), ds_cstr(actions), lflow_ref);
}
+static struct nbrec_network_function *
+network_function_get_active(const struct nbrec_network_function_group *nfg)
+{
+ return nfg->network_function_active;
+}
+
+static void
+network_function_update_active(const struct nbrec_network_function_group *nfg,
+ struct hmap *local_svc_monitors_map,
+ struct hmap *ic_learned_svc_monitors_map,
+ const char *svc_monitor_ip_dst)
+{
+ if (!nfg->n_network_function) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
+ VLOG_ERR_RL(&rl, "NetworkFunction: No network_function found in "
+ "network_function_group %s", nfg->name);
+ if (nfg->network_function_active) {
+ nbrec_network_function_group_set_network_function_active(nfg,
+ NULL);
+ }
+ return;
+ }
+ /* Array to store healthy network functions */
+ struct nbrec_network_function **healthy_nfs =
+ xmalloc(sizeof(struct nbrec_network_function *) \
+ * nfg->n_network_function);
+ struct nbrec_network_function *nf_active_prev = NULL;
+ if (nfg->network_function_active) {
+ nf_active_prev = nfg->network_function_active;
+ }
+
+ size_t n_healthy = 0;
+ /* Determine the set of healthy network functions */
+ for (size_t i = 0; i < nfg->n_network_function; i++) {
+ struct nbrec_network_function *nf = nfg->network_function[i];
+ bool is_healthy = false;
+
+ if (nf->health_check == NULL) {
+ VLOG_DBG("NetworkFunction: Health check is not configured for "
+ "network_function %s, considering it healthy", nf->name);
+ is_healthy = true;
+ } else {
+ struct service_monitor_info *mon_info =
+ get_service_mon(local_svc_monitors_map,
+ ic_learned_svc_monitors_map,
+ svc_monitor_ip_dst,
+ nf->outport->name, 0, "icmp");
+ if (mon_info == NULL) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
+ VLOG_ERR_RL(&rl, "NetworkFunction: Service_monitor is not "
+ "found for network_function:%s", nf->name);
+ is_healthy = false;
+ } else if (mon_info->sbrec_mon->status
+ && !strcmp(mon_info->sbrec_mon->status, "online")) {
+ is_healthy = true;
+ }
+ }
+
+ if (is_healthy) {
+ healthy_nfs[n_healthy++] = nf;
+ }
+ }
+
+ struct nbrec_network_function *nf_active = NULL;
+ /* Select active network function based on health status */
+ if (n_healthy > 0) {
+ nf_active = healthy_nfs[0];
+ /* Check if nf_active_prev is healthy, if so select it */
+ if (nf_active_prev) {
+ for (size_t i = 0; i < n_healthy; i++) {
+ if (healthy_nfs[i] == nf_active_prev) {
+ nf_active = nf_active_prev;
+ break;
+ }
+ }
+ }
+ } else {
+ /* No healthy NFs, keep nf_active_prev if set, else select first one */
+ nf_active = nf_active_prev ? nf_active_prev : nfg->network_function[0];
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
+ VLOG_WARN_RL(&rl, "NetworkFunction: No healthy network_function found "
+ "in network_function_group %s, "
+ "selected network_function %s as active", nfg->name,
+ nf_active->name);
+ }
+
+ free(healthy_nfs);
+
+ if (nf_active_prev != nf_active) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
+ VLOG_INFO_RL(&rl, "NetworkFunction: Update active network_function %s "
+ "in network_function_group %s",
+ nf_active->name, nfg->name);
+ nbrec_network_function_group_set_network_function_active(nfg,
+ nf_active);
+ }
+}
+
+static void build_network_function_active(
+ const struct nbrec_network_function_group_table *nbrec_nfg_table,
+ struct hmap *local_svc_monitors_map,
+ struct hmap *ic_learned_svc_monitors_map,
+ const char *svc_monitor_ip_dst)
+{
+ const struct nbrec_network_function_group *nbrec_nfg;
+ NBREC_NETWORK_FUNCTION_GROUP_TABLE_FOR_EACH (nbrec_nfg,
+ nbrec_nfg_table) {
+ network_function_update_active(nbrec_nfg,
+ local_svc_monitors_map,
+ ic_learned_svc_monitors_map,
+ svc_monitor_ip_dst);
+ }
+}
+
static void
consider_network_function(const struct ovn_datapath *od,
struct nbrec_network_function_group *nfg,
@@ -19785,14 +20009,26 @@ ovnnb_db_run(struct northd_input *input_data,
input_data->sbrec_ha_chassis_grp_by_name,
&data->ls_datapaths.datapaths, &data->lr_datapaths.datapaths,
&data->ls_ports, &data->lr_ports);
- build_lb_port_related_data(ovnsb_txn,
- input_data->sbrec_service_monitor_by_learned_type,
- input_data->svc_monitor_mac, &input_data->svc_monitor_mac_ea,
- &data->lr_datapaths, &data->ls_datapaths, &data->ls_ports,
- &data->lb_datapaths_map, &data->lb_group_datapaths_map,
- &data->svc_monitor_lsps, &data->local_svc_monitors_map,
- input_data->ic_learned_svc_monitors_map);
+ build_lb_port_related_data(&data->lr_datapaths, &data->ls_datapaths,
+ &data->lb_datapaths_map,
+ &data->lb_group_datapaths_map);
+ build_svcs(ovnsb_txn,
+ input_data->sbrec_service_monitor_by_learned_type,
+ input_data->svc_monitor_mac,
+ &input_data->svc_monitor_mac_ea,
+ input_data->svc_monitor_mac_dst,
+ input_data->svc_monitor_ip,
+ input_data->svc_monitor_ip_dst,
+ &data->ls_ports, &data->lb_datapaths_map,
+ input_data->nbrec_network_function_table,
+ &data->svc_monitor_lsps, &data->local_svc_monitors_map,
+ input_data->ic_learned_svc_monitors_map);
build_lb_count_dps(&data->lb_datapaths_map);
+ build_network_function_active(
+ input_data->nbrec_network_function_group_table,
+ &data->local_svc_monitors_map,
+ input_data->ic_learned_svc_monitors_map,
+ input_data->svc_monitor_ip_dst);
build_ipam(&data->ls_datapaths.datapaths);
build_lrouter_groups(&data->lr_ports, &data->lr_datapaths);
build_ip_mcast(ovnsb_txn, input_data->sbrec_ip_multicast_table,
diff --git a/northd/northd.h b/northd/northd.h
index 505742363..81711b060 100644
--- a/northd/northd.h
+++ b/northd/northd.h
@@ -67,6 +67,10 @@ struct northd_input {
const struct smap *sb_options;
const char *svc_monitor_mac;
struct eth_addr svc_monitor_mac_ea;
+ const char *svc_monitor_mac_dst;
+ struct eth_addr svc_monitor_mac_ea_dst;
+ char *svc_monitor_ip;
+ char *svc_monitor_ip_dst;
const struct chassis_features *features;
bool vxlan_mode;
@@ -272,6 +276,7 @@ struct lflow_input {
const struct sset *bfd_ports;
const struct chassis_features *features;
bool ovn_internal_version_changed;
+ const struct hmap *svc_monitor_map;
const char *svc_monitor_mac;
const struct sampling_app_table *sampling_apps;
struct group_ecmp_route_data *route_data;
diff --git a/ovn-ic-sb.ovsschema b/ovn-ic-sb.ovsschema
index 34b5457bb..967ae637f 100644
--- a/ovn-ic-sb.ovsschema
+++ b/ovn-ic-sb.ovsschema
@@ -1,7 +1,7 @@
{
"name": "OVN_IC_Southbound",
- "version": "2.2.0",
- "cksum": "2294868959 8438",
+ "version": "2.3.0",
+ "cksum": "4059944648 8639",
"tables": {
"IC_SB_Global": {
"columns": {
@@ -148,6 +148,10 @@
"maxRows": 1},
"Service_Monitor": {
"columns": {
+ "type": {"type": {"key": {
+ "type": "string",
+ "enum": ["set", ["load-balancer"]]},
+ "min": 0, "max": 1}},
"ip": {"type": "string"},
"protocol": {
"type": {"key": {"type": "string",
diff --git a/ovn-ic-sb.xml b/ovn-ic-sb.xml
index 35dc1f509..924aaac5f 100644
--- a/ovn-ic-sb.xml
+++ b/ovn-ic-sb.xml
@@ -692,6 +692,10 @@
</table>
<table name="Service_Monitor">
+ <column name="type">
+ The type of the service. Only the value "load-balancer" is supported.
+ </column>
+
<column name="ip">
IP of the service to be monitored. Copy from SBDB record.
</column>
diff --git a/ovn-nb.xml b/ovn-nb.xml
index dcb4ac635..542f8f735 100644
--- a/ovn-nb.xml
+++ b/ovn-nb.xml
@@ -441,6 +441,38 @@
</p>
</column>
+ <group title="Options for services health check confguration">
+ <p>
+ These options are used when health configuration is enabled for
+ <ref table="Load_Balancer" db="OVN_Northbound"/>
+ and <ref table="Network_Function" db="OVN_Northbound"/> services.
+ </p>
+
+ <column name="options" key="svc_monitor_mac">
+ MAC Address used as the Ethernet source in health check probes.
+ If unspecified, a MAC address is automatically generated.
+ </column>
+
+ <column name="options" key="svc_monitor_mac_dst">
+ MAC Address used as the Ethernet destination in health check probes.
+ If unspecified, a MAC address is automatically generated.
+ This applies only to Network Function health check probes deployed
+ in inline mode.
+ </column>
+
+ <column name="options" key="svc_monitor_ip">
+ IP Address (IPv4 or IPv6) used as the source in health check probes.
+ This applies only to Network Function health check probes deployed
+ in inline mode.
+ </column>
+
+ <column name="options" key="svc_monitor_ip_dst">
+ IP Address (IPv4 or IPv6) used as the destination in health check
+ probes. This applies only to Network Function health check probes
+ deployed in inline mode.
+ </column>
+ </group>
+
<group title="Options for configuring interconnection route
advertisement">
<p>
These options control how routes are advertised between OVN
diff --git a/ovn-sb.ovsschema b/ovn-sb.ovsschema
index 99d65d2e8..f22141489 100644
--- a/ovn-sb.ovsschema
+++ b/ovn-sb.ovsschema
@@ -1,7 +1,7 @@
{
"name": "OVN_Southbound",
- "version": "21.5.0",
- "cksum": "2304881328 35438",
+ "version": "21.6.0",
+ "cksum": "1200327755 35814",
"tables": {
"SB_Global": {
"columns": {
@@ -513,14 +513,21 @@
"isRoot": true},
"Service_Monitor": {
"columns": {
+ "type": {"type": {"key": {
+ "type": "string",
+ "enum": ["set", ["load-balancer",
+ "network-function"]]},
+ "min": 0, "max": 1}},
"ip": {"type": "string"},
+ "mac": {"type": "string"},
"protocol": {
"type": {"key": {"type": "string",
- "enum": ["set", ["tcp", "udp"]]},
+ "enum": ["set", ["tcp", "udp", "icmp"]]},
"min": 0, "max": 1}},
"port": {"type": {"key": {"type": "integer",
"minInteger": 0,
"maxInteger": 65535}}},
+ "logical_input_port": {"type": "string"},
"logical_port": {"type": "string"},
"src_mac": {"type": "string"},
"src_ip": {"type": "string"},
diff --git a/ovn-sb.xml b/ovn-sb.xml
index c5e86a87e..a781129b7 100644
--- a/ovn-sb.xml
+++ b/ovn-sb.xml
@@ -5003,22 +5003,50 @@ tcp.flags = RST;
service monitor.
</p>
+ <column name="type">
+ The type of the service. Supported values are "load-balancer" and
+ "network-function".
+ </column>
+
<column name="ip">
- IP of the service to be monitored.
+ Destination IP used in monitor packets. For load-balancer service this
+ is the IP of the service to be monitored. For network-function service
+ this IP is used to send probe packets through the associated
+ Network Function port pair.
+ </column>
+
+ <column name="mac">
+ Destination MAC address used in monitor packets. This is applicable
+ only for network-function services.
</column>
<column name="protocol">
The protocol of the service.
+ For <code>type</code> load-balancer, supported protocols are tcp and
+ udp. For <code>type</code> "network-function", supported protocol is
+ icmp, and the health probe is done by injecting an icmp echo request
+ packet into the <code>inport</code> of the Network_Function and then
+ montoring the same packet coming out of the <code>outport</code>.
</column>
<column name="port">
The TCP or UDP port of the service.
</column>
+ <column name="logical_input_port">
+ This is applicable only for network-function type. The VIF of the
+ logical port on which monitor packets have to be sent. The
+ <code>ovn-controller</code> that binds this <code>logical_port</code>
+ monitors the service by sending periodic monitor packets.
+ </column>
+
<column name="logical_port">
The VIF of the logical port on which the service is running. The
<code>ovn-controller</code> that binds this <code>logical_port</code>
- monitors the service by sending periodic monitor packets.
+ monitors the service by sending periodic monitor packets. For
+ load-balancer this is the port to which monitor packets are sent and
+ from which response packets are received. For network-function this
+ is the port from which the forwarded monitor packets are received.
</column>
<column name="src_mac">
diff --git a/tests/client.py b/tests/client.py
index 22fb7f126..97d7c5e4e 100755
--- a/tests/client.py
+++ b/tests/client.py
@@ -3,24 +3,62 @@
import socket
import time
import argparse
+import datetime
+import os
-def send_data_from_fifo_to_server(
- fifo_path='/tmp/myfifo', host='127.0.0.1', port=10000
-):
- # Open the FIFO for reading (blocking mode)
- with open(fifo_path, 'r') as fifo_file:
- with socket.socket(
- socket.AF_INET, socket.SOCK_STREAM
- ) as client_socket:
- client_socket.connect((host, port))
- # Continuously read from the FIFO and send to the server
- while True:
- data = fifo_file.readline()
- if data:
- client_socket.sendall(data.encode())
- else:
- time.sleep(0.1)
+def log_error(message):
+ """Log error messages to <script_name>.log file"""
+ timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ log_message = f"[{timestamp}] CLIENT ERROR: {message}\n"
+
+ try:
+ script_name = os.path.basename(__file__)
+ log = f"{script_name}.log"
+ with open(log, "a") as log_file:
+ log_file.write(log_message)
+ except:
+ pass
+
+
+def get_socket_family(host):
+ """Determine socket family based on IP address format"""
+ try:
+ # Try to parse as IPv4
+ socket.inet_aton(host)
+ return socket.AF_INET
+ except socket.error:
+ try:
+ # Try to parse as IPv6
+ socket.inet_pton(socket.AF_INET6, host)
+ return socket.AF_INET6
+ except socket.error:
+ raise
+
+
+def send_data_from_fifo_to_server(fifo_path='/tmp/myfifo',
+ host='127.0.0.1', port=10000):
+ # Determine socket family based on host address
+ family = get_socket_family(host)
+
+ try:
+ # Open the FIFO for reading (blocking mode)
+ with open(fifo_path, 'r') as fifo_file:
+ with socket.socket(family, socket.SOCK_STREAM) as client_socket:
+ client_socket.connect((host, port))
+ while True:
+ data = fifo_file.readline()
+ if data:
+ client_socket.sendall(data.encode())
+ else:
+ time.sleep(0.1)
+
+ except FileNotFoundError as e:
+ log_error(f"FIFO file not found: {fifo_path} - {e}")
+ raise
+ except Exception as e:
+ log_error(f"Unexpected error in client: {e}")
+ raise
if __name__ == "__main__":
diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
index a3f258173..160948445 100644
--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
@@ -18438,3 +18438,193 @@ ct_next(ct_state=new|trk) {
AT_CLEANUP
])
+
+OVN_FOR_EACH_NORTHD([
+AT_SETUP([Network function health check])
+AT_KEYWORDS([ovn])
+ovn_start
+
+check ovn-nbctl set nb_global . options:svc_monitor_ip=169.254.100.10
+check ovn-nbctl set nb_global . options:svc_monitor_ip_dst=169.254.100.11
+sw="sw0"
+check ovn-nbctl ls-add $sw
+for i in 1 2; do
+ port=$sw-p$i
+ check ovn-nbctl lsp-add $sw $port
+ check ovn-nbctl lsp-set-addresses $port "52:54:00:00:00:0$i"
+done
+
+nfsw="nf-sw"
+check ovn-nbctl ls-add $nfsw
+for i in {1..4}; do
+ port=$nfsw-p$i
+ check ovn-nbctl lsp-add $nfsw $port
+ check ovn-sbctl set port_binding $port up=true
+ check ovn-nbctl lsp-add $sw child-$i $port 100
+done
+check ovn-nbctl set logical_switch_port $nfsw-p1 \
+ options:receive_multicast=false options:lsp_learn_fdb=false \
+ options:is-nf=true options:nf-linked-port=$nfsw-p2
+check ovn-nbctl set logical_switch_port $nfsw-p2 \
+ options:receive_multicast=false options:lsp_learn_fdb=false \
+ options:is-nf=true options:nf-linked-port=$nfsw-p1
+check ovn-nbctl set logical_switch_port $nfsw-p3 \
+ options:receive_multicast=false options:lsp_learn_fdb=false \
+ options:is-nf=true options:nf-linked-port=$nfsw-p4
+check ovn-nbctl set logical_switch_port $nfsw-p4 \
+ options:receive_multicast=false options:lsp_learn_fdb=false \
+ options:is-nf=true options:nf-linked-port=$nfsw-p3
+
+check ovn-nbctl nf-add nf0 $nfsw-p1 $nfsw-p2
+check ovn-nbctl nf-add nf1 $nfsw-p3 $nfsw-p4
+nf0_uuid=$(fetch_column nb:network_function _uuid name=nf0)
+nf1_uuid=$(fetch_column nb:network_function _uuid name=nf1)
+AT_CHECK(
+ [ovn-nbctl --wait=sb \
+ -- --id=@hc create network_function_health_check name=nf_health_cfg \
+ options:interval=5 options:timeout=1 options:success_count=3
options:failure_count=3 \
+ -- add network_function $nf0_uuid health_check @hc | uuidfilt], [0],
[<0>
+])
+nf_health_uuid=$(fetch_column nb:network_function_health_check _uuid
name=nf_health_cfg)
+check ovn-nbctl set network_function $nf1_uuid health_check=$nf_health_uuid
+check ovn-nbctl nfg-add nfg0 1 inline nf0 nf1
+
+check ovn-nbctl pg-add pg0 $sw-p1
+check ovn-nbctl acl-add pg0 from-lport 1001 "inport == @pg0 && ip4.dst ==
192.168.2.10" allow-related nfg0
+check ovn-nbctl acl-add pg0 to-lport 1002 "outport == @pg0 && ip4.src ==
192.168.1.10" allow-related nfg0
+check ovn-nbctl --wait=sb sync
+
+# Set the service monitor for nf0 to online and nf1 to online
+# and verify nf0 is considered active.
+
+AS_BOX([Set the service monitor for nf0 to online and nf1 to offline])
+check ovn-sbctl set service_monitor $nfsw-p2 status=online
+check ovn-sbctl set service_monitor $nfsw-p4 status=offline
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p2 status=online
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p4 status=offline
+check ovn-nbctl --wait=sb sync
+
+ovn-sbctl dump-flows $sw > lflows
+AT_CAPTURE_FILE([lflows])
+
+AT_CHECK(
+ [grep -E 'ls_(in|out)_acl_eval' lflows | ovn_strip_lflows | grep pg0 |
sort], [0], [dnl
+ table=??(ls_in_acl_eval ), priority=2001 , match=(reg0[[7]] == 1 &&
(inport == @pg0 && ip4.dst == 192.168.2.10)), action=(reg8[[16]] = 1;
reg8[[21]] = 1; reg8[[22]] = 1; reg0[[22..29]] = 1; next;)
+ table=??(ls_in_acl_eval ), priority=2001 , match=(reg0[[8]] == 1 &&
(inport == @pg0 && ip4.dst == 192.168.2.10)), action=(reg8[[16]] = 1; reg0[[1]]
= 1; reg8[[21]] = 1; reg8[[22]] = 1; reg0[[22..29]] = 1; next;)
+ table=??(ls_out_acl_eval ), priority=2002 , match=(reg0[[7]] == 1 &&
(outport == @pg0 && ip4.src == 192.168.1.10)), action=(reg8[[16]] = 1;
reg8[[21]] = 1; reg8[[22]] = 1; reg0[[22..29]] = 1; next;)
+ table=??(ls_out_acl_eval ), priority=2002 , match=(reg0[[8]] == 1 &&
(outport == @pg0 && ip4.src == 192.168.1.10)), action=(reg8[[16]] = 1;
reg0[[1]] = 1; reg8[[21]] = 1; reg8[[22]] = 1; reg0[[22..29]] = 1; next;)
+])
+
+AT_CHECK(
+ [grep -E 'ls_(in|out)_network_function' lflows | ovn_strip_lflows | sort],
[0], [dnl
+ table=??(ls_in_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_in_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-1"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-2"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-1"; output;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-1"; output;)
+ table=??(ls_out_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_out_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-1"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-2"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-2"; reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-2";
reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+])
+
+# Set the service monitor for nf0 to online and nf1 to online
+# and verify nf0 is still the active.
+
+AS_BOX([Set the service monitor for nf0 to online and nf1 to online])
+check ovn-sbctl set service_monitor $nfsw-p2 status=online
+check ovn-sbctl set service_monitor $nfsw-p4 status=online
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p2 status=online
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p4 status=online
+check ovn-nbctl --wait=sb sync
+
+ovn-sbctl dump-flows $sw > lflows
+AT_CAPTURE_FILE([lflows])
+
+AT_CHECK(
+ [grep -E 'ls_(in|out)_network_function' lflows | ovn_strip_lflows | sort],
[0], [dnl
+ table=??(ls_in_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_in_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-1"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-2"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-1"; output;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-1"; output;)
+ table=??(ls_out_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_out_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-1"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-2"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-2"; reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-2";
reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+])
+
+# Set the service monitor for nf0 to offline and nf1 to online
+# and verify nf1 is the active.
+
+AS_BOX([Set the service monitor for nf0 to offline and nf1 to online])
+check ovn-sbctl set service_monitor $nfsw-p2 status=offline
+check ovn-sbctl set service_monitor $nfsw-p4 status=online
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p2 status=offline
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p4 status=online
+check ovn-nbctl --wait=sb sync
+
+ovn-sbctl dump-flows $sw > lflows
+AT_CAPTURE_FILE([lflows])
+
+AT_CHECK(
+ [grep -E 'ls_(in|out)_network_function' lflows | ovn_strip_lflows | sort],
[0], [dnl
+ table=??(ls_in_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_in_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-3"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-4"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-3"; output;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-3"; output;)
+ table=??(ls_out_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_out_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-3"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-4"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-4"; reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-4";
reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+])
+
+# Set the service monitor for nf0 to offline and nf1 to offline
+# and verify nf1 is still the active.
+
+AS_BOX([Set the service monitor for nf0 to offline and nf1 to offline])
+check ovn-sbctl set service_monitor $nfsw-p2 status=offline
+check ovn-sbctl set service_monitor $nfsw-p4 status=offline
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p2 status=offline
+wait_row_count Service_Monitor 1 logical_port=$nfsw-p4 status=offline
+check ovn-nbctl --wait=sb sync
+
+ovn-sbctl dump-flows $sw > lflows
+AT_CAPTURE_FILE([lflows])
+
+AT_CHECK(
+ [grep -E 'ls_(in|out)_network_function' lflows | ovn_strip_lflows | sort],
[0], [dnl
+ table=??(ls_in_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_in_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-3"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(inport ==
"child-4"), action=(reg5[[16..31]] = ct_label.tun_if_id; next;)
+ table=??(ls_in_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-3"; output;)
+ table=??(ls_in_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-3"; output;)
+ table=??(ls_out_network_function), priority=0 , match=(1), action=(next;)
+ table=??(ls_out_network_function), priority=1 , match=(reg8[[21]] == 1),
action=(drop;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-3"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(outport ==
"child-4"), action=(next;)
+ table=??(ls_out_network_function), priority=100 , match=(reg8[[21]] == 1 &&
eth.mcast), action=(next;)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 0 && ct_label.network_function_group_id == 1), action=(outport =
"child-4"; reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+ table=??(ls_out_network_function), priority=99 , match=(reg8[[21]] == 1 &&
reg8[[22]] == 1 && reg0[[22..29]] == 1), action=(outport = "child-4";
reg8[[23]] = 1; next(pipeline=ingress, table=??);)
+])
+
+AT_CLEANUP
+])
diff --git a/tests/server.py b/tests/server.py
index ac0321f20..b4aa4b188 100755
--- a/tests/server.py
+++ b/tests/server.py
@@ -2,15 +2,84 @@
import socket
import argparse
+import datetime
+import os
+
+
+def log_error(message):
+ """Log error messages to <script_name>.log file"""
+ timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ log_message = f"[{timestamp}] SERVER ERROR: {message}\n"
+
+ try:
+ script_name = os.path.basename(__file__)
+ log = f"{script_name}.log"
+ with open(log, "a") as log_file:
+ log_file.write(log_message)
+ except:
+ pass
+
+
+def get_socket_family(host):
+ """Determine socket family based on IP address format"""
+ try:
+ # Try to parse as IPv4
+ socket.inet_aton(host)
+ return socket.AF_INET
+ except socket.error:
+ try:
+ # Try to parse as IPv6
+ socket.inet_pton(socket.AF_INET6, host)
+ return socket.AF_INET6
+ except socket.error:
+ raise
def start_server(host='127.0.0.1', port=10000):
- # Create a TCP/IP socket
- with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server_socket:
- server_socket.bind((host, port))
- server_socket.listen()
- with open("output.txt", "a") as f:
- f.write("Server Ready\n")
+ # Determine socket family based on host address
+ family = get_socket_family(host)
+
+ # Create a TCP socket with appropriate family
+ with socket.socket(family, socket.SOCK_STREAM) as server_socket:
+ if family == socket.AF_INET6:
+ # For IPv6, disable dual-stack to avoid conflicts
+ server_socket.setsockopt(socket.IPPROTO_IPV6,
+ socket.IPV6_V6ONLY, 1)
+ # Allow address reuse for IPv6
+ server_socket.setsockopt(socket.SOL_SOCKET,
+ socket.SO_REUSEADDR, 1)
+ else:
+ # Allow address reuse for IPv4
+ server_socket.setsockopt(socket.SOL_SOCKET,
+ socket.SO_REUSEADDR, 1)
+
+ try:
+ # Try standard binding first
+ server_socket.bind((host, port))
+ except OSError as e:
+ # Cannot assign requested address
+ if family == socket.AF_INET6 and e.errno == 99:
+ # For IPv6, try fallback to all interfaces
+ log_error(f"Standard IPv6 binding failed for "
+ f"{host}:{port} - {e}. "
+ f"Trying fallback to all IPv6 interfaces")
+ try:
+ server_socket.bind(('::', port))
+ except OSError as e2:
+ log_error(f"Fallback binding also failed: {e2}")
+ raise
+ else:
+ log_error(f"Socket binding failed for {host}:{port} - {e}")
+ raise
+
+ try:
+ server_socket.listen()
+ with open("output.txt", "a") as f:
+ f.write("Server Ready\n")
+ except Exception as e:
+ log_error(f"Server listen/setup failed: {e}")
+ raise
+
while True:
client_socket, client_address = server_socket.accept()
with client_socket:
diff --git a/tests/system-ovn.at b/tests/system-ovn.at
index 6aef8ec80..790bc67bf 100644
--- a/tests/system-ovn.at
+++ b/tests/system-ovn.at
@@ -18631,6 +18631,150 @@ validate_single_nf_no_health_check "client" "server"
"192.168.1.20" "Inbound"
AS_BOX([Verify outbound traffic forwarding through NF without health check])
validate_single_nf_no_health_check "server" "client" "192.168.1.10" "Outbound"
+AS_BOX([Test-2: Two NFs with health check config enabled])
+
+# Add second NF
+check ovn-nbctl nf-add nf1 nf-p3 nf-p4
+nf1_uuid=$(fetch_column nb:network_function _uuid name=nf1)
+
+# Add bridge for nf1
+NS_CHECK_EXEC([nf], [ip link add name br1 type bridge])
+NS_CHECK_EXEC([nf], [ip link set dev nf-p3 master br1])
+NS_CHECK_EXEC([nf], [ip link set dev nf-p4 master br1])
+
+# Set monitor IPs for health check
+check ovn-nbctl set nb_global . options:svc_monitor_ip=169.254.100.10
+check ovn-nbctl set nb_global . options:svc_monitor_ip_dst=169.254.100.11
+
+# Create health check configuration and assign to both NFs
+AT_CHECK(
+ [ovn-nbctl --wait=sb \
+ -- --id=@hc create network_function_health_check name=nf_health_cfg \
+ options:interval=1 options:timeout=1 options:success_count=2
options:failure_count=2 \
+ -- add network_function $nf0_uuid health_check @hc | uuidfilt], [0],
[<0>
+])
+nf_health_uuid=$(fetch_column nb:network_function_health_check _uuid
name=nf_health_cfg)
+check ovn-nbctl set network_function $nf1_uuid health_check=$nf_health_uuid
+
+# Update NFG to include both NFs
+check ovn-nbctl nfg-add-nf nfg0 nf1
+
+check ovn-nbctl --wait=hv sync
+
+validate_nf_with_traffic() {
+ client_ns=$1; server_ns=$2; sip=$3; direction=$4
+
+ # Start a TCP server
+ NETNS_DAEMONIZE($server_ns, [server.py -i $sip -p 10000], [server.pid])
+ on_exit 'kill $(cat server.pid)'
+
+ # Ensure TCP server is ready for connections
+ OVS_WAIT_FOR_OUTPUT([cat output.txt], [0], [dnl
+Server Ready
+])
+ : > output.txt
+
+ # Make a FIFO and send its output to a server
+ mkfifo /tmp/nffifo
+ on_exit 'rm -rf /tmp/nffifo'
+
+ NETNS_DAEMONIZE($client_ns, [client.py -f "/tmp/nffifo" -i $sip -p 10000],
[client.pid])
+ on_exit 'kill $(cat client.pid)'
+
+ AS_BOX([$direction: Verify traffic forwarding through NF when nf0 is
active])
+ NS_CHECK_EXEC([nf], [ip link set dev br0 up])
+ NS_CHECK_EXEC([nf], [ip link set dev br1 down])
+
+ NS_CHECK_EXEC([nf], [tcpdump -l -nvv -i nf-p1 tcp > pkt.pcap 2>tcpdump_err
&])
+ OVS_WAIT_UNTIL([grep "listening" tcpdump_err])
+ on_exit 'kill $(pidof tcpdump)'
+
+ # sleep to allow service_monitor to detect the state
+ sleep 5
+
+ ovn-sbctl dump-flows sw0 > lflows_nf0_active
+ ovn-sbctl list service_monitor
+
+ validate_traffic "test" "test" 5
+
+ AS_BOX([$direction: Verify traffic forwarding through NF when nf1 is
active])
+
+ kill $(pidof tcpdump)
+ NS_CHECK_EXEC([nf], [tcpdump -l -nvv -i nf-p3 tcp > pkt.pcap 2>tcpdump_err
&])
+ OVS_WAIT_UNTIL([grep "listening" tcpdump_err])
+ on_exit 'kill $(pidof tcpdump)'
+
+ # Bring nf0 down and nf1 up
+ NS_CHECK_EXEC([nf], [ip link set dev br0 down])
+ NS_CHECK_EXEC([nf], [ip link set dev br1 up])
+ # sleep to allow service_monitor to detect the state
+ sleep 5
+
+ ovn-sbctl dump-flows sw0 > lflows_nf1_active
+ ovn-sbctl list service_monitor
+
+ validate_traffic "test" "test" 2
+
+ AS_BOX([$direction: Verify traffic forwarding through NF when nf0 and nf1
are down])
+
+ kill $(pidof tcpdump)
+ NS_CHECK_EXEC([nf], [tcpdump -l -nvv -i nf-p3 tcp > pkt.pcap 2>tcpdump_err
&])
+ OVS_WAIT_UNTIL([grep "listening" tcpdump_err])
+ on_exit 'kill $(pidof tcpdump)'
+
+ # Bring nf0 down and nf1 up
+ NS_CHECK_EXEC([nf], [ip link set dev br1 down])
+ # sleep to allow service_monitor to detect the state
+ sleep 5
+
+ ovn-sbctl dump-flows sw0 > lflows_nf1_active
+ ovn-sbctl list service_monitor
+
+ validate_traffic "test" "" 0
+
+ kill $(cat client.pid)
+ kill $(cat server.pid)
+ rm -f client.pid
+ rm -f server.pid
+ rm -f /tmp/nffifo
+}
+
+AS_BOX([IPv4 Testing with Health Checks])
+AS_BOX([Verify inbound traffic forwarding through NF when nf0 is active])
+validate_nf_with_traffic "client" "server" "192.168.1.20" "Inbound"
+
+AS_BOX([Verify outbound traffic forwarding through NF when nf0 is active])
+validate_nf_with_traffic "server" "client" "192.168.1.10" "Outbound"
+
+AS_BOX([IPv6 Testing - Setup])
+# Remove IPv4 addresses from namespaces
+ip netns exec client ip addr del 192.168.1.10/24 dev client
+ip netns exec server ip addr del 192.168.1.20/24 dev server
+
+# Add IPv6 addresses to client and server
+ip netns exec client ip -6 addr add fd00:192:168:1::10/64 dev client
+ip netns exec server ip -6 addr add fd00:192:168:1::20/64 dev server
+
+# Update service monitor IPs to IPv6
+check ovn-nbctl set nb_global . options:svc_monitor_ip=fd00:169:254:100::10
+check ovn-nbctl set nb_global . options:svc_monitor_ip_dst=fd00:169:254:100::11
+
+# Configure IPv6-only addresses on logical ports (remove IPv4)
+check ovn-nbctl lsp-set-addresses client "f0:00:00:01:02:10 fd00:192:168:1::10"
+check ovn-nbctl lsp-set-addresses server "f0:00:00:01:02:20 fd00:192:168:1::20"
+
+# Add IPv6 ACLs
+check ovn-nbctl acl-add pg0 from-lport 1003 "inport == @pg0 && ip6.dst ==
fd00:192:168:1::10" allow-related nfg0
+check ovn-nbctl acl-add pg0 to-lport 1004 "outport == @pg0 && ip6.src ==
fd00:192:168:1::10" allow-related nfg0
+
+check ovn-nbctl --wait=hv sync
+
+AS_BOX([IPv6 Testing with Health Checks - Verify inbound traffic forwarding
through NF when nf0 is active])
+validate_nf_with_traffic "client" "server" "fd00:192:168:1::20" "IPv6 Inbound"
+
+AS_BOX([IPv6 Testing with Health Checks - Verify outbound traffic forwarding
through NF when nf0 is active])
+validate_nf_with_traffic "server" "client" "fd00:192:168:1::10" "IPv6 Outbound"
+
OVN_CLEANUP_CONTROLLER([hv1])
as ovn-sb
diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c
index 2d9c2f9b9..0bdf9f9cc 100644
--- a/utilities/ovn-nbctl.c
+++ b/utilities/ovn-nbctl.c
@@ -8005,14 +8005,6 @@ cmd_pg_del(struct ctl_context *ctx)
nbrec_port_group_delete(pg);
}
-static int
-port_name_cmp(const void *s1_, const void *s2_)
-{
- const char *s1 = *(char **) s1_;
- const char *s2 = *(char **) s2_;
- return strcmp(s1, s2);
-}
-
static void
cmd_pg_get_ports(struct ctl_context *ctx)
{
@@ -8033,7 +8025,7 @@ cmd_pg_get_ports(struct ctl_context *ctx)
port_names[i] = pg->ports[i]->name;
}
- qsort(port_names, pg->n_ports, sizeof *port_names, port_name_cmp);
+ qsort(port_names, pg->n_ports, sizeof *port_names, name_cmp);
ds_put_format(&ctx->output, "%s", port_names[0]);
for (size_t i = 1; i < pg->n_ports; i++) {
--
2.39.3
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
