Add time exceeded flow for fip #230
Conversation
ts170710
force-pushed
the
add_flow_for_fip
branch
6 times, most recently
from
3dff464 to
0228d0d
Compare
ts170710
force-pushed
the
add_flow_for_fip
branch
4 times, most recently
from
73e6781 to
2868a16
Compare
Add "ip4.src == <external_ip>" to match for distinguish between external router gateway and floatingIP to handle time exceeded packet. Signed-off-by: Huanghailun <hailun.huang@easystack.cn>
ts170710
force-pushed
the
add_flow_for_fip
branch
from
2868a16 to
bc8fec9
Compare
There was a problem hiding this comment.
@ts170710 Thanks for your PR!
I guess I'm not sure I understand how this is supposed to be useful. We already have flows in IP_INPUT stage that check for ip.ttl == {0, 1} && !ip.later_frag packets and reply with Time Exceeded for those. Why isn't that enough?
@ts170710 just in case you missed my question above. Thanks, |
@dceara Thank you for your comment! |
There was a problem hiding this comment.
Please add a new system test for the scenarios you're fixing now.
Also, your change seems to break existing system tests, e.g.:
https://github.com/ovn-org/ovn/actions/runs/7346305995/job/20000851003?pr=230#step:7:4323
41: system-ovn.at:3597 DNAT and SNAT on distributed router - N/S - IPv6 -- ovn-northd -- parallelization=yes -- ovn_monitor_all=yes
ovnnat
42: system-ovn.at:3597 DNAT and SNAT on distributed router - N/S - IPv6 -- ovn-northd -- parallelization=yes -- ovn_monitor_all=no
ovnnat
45: system-ovn.at:3941 DNAT and SNAT on distributed router - E/W - IPv6 -- ovn-northd -- parallelization=yes -- ovn_monitor_all=yes
ovnnat
46: system-ovn.at:3941 DNAT and SNAT on distributed router - E/W - IPv6 -- ovn-northd -- parallelization=yes -- ovn_monitor_all=no
ovnnat
| ds_clear(ip_ds); | ||
| struct ovn_nat *nat_entry = &op->od->nat_entries[i]; | ||
| if (!strcmp(nat_entry->nb->type, "dnat_and_snat")) { | ||
| ds_put_format(match, "ip4.src == %s && ", nat_entry->nb->external_ip); |
There was a problem hiding this comment.
What about IPv6? Why only on l3dgw ports? Why not on gw routers too?
#211 #211 Add "ip4.src == <external_ip>" to match for distinguish between external router gateway and floatingIP to handle time exceeded packet.