[NETVIRT-292] ping6 is failing between VMS with OVS2.6 + DPDK Created: 24/Nov/16  Updated: 08/Jan/17  Resolved: 08/Jan/17

Status: Resolved
Project: netvirt
Component/s: General
Affects Version/s: Boron
Fix Version/s: None

Type: Bug
Reporter: mahesh loni Assignee: Sridhar Gaddam
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Operating System: All
Platform: All

External issue ID: 7229

 Description   

Followed the below steps on openstack controller to configure IPV6

1.Created the network
2.Created the subnet for ipv6 : 2001:db8:1234::/64 with slaac mode
3.Associated subnet to router
4.Launch the VM in dashboard
5.ping6 between same VMs and its failing

=======================================================

cookie=0x6900000, duration=1350.413s, table=40, n_packets=0, n_bytes=0, priority=61010,ipv6,dl_src=fa:16:3e:59:12:09,ipv6_src=2001:db8:1234:0:f816:3eff:fe59:1209 actions=ct(table=41,zone=6001)
cookie=0x6900000, duration=2315.477s, table=41, n_packets=0, n_bytes=0, priority=62020,ct_state=-new+est-rel-inv+trk actions=resubmit(,17)
cookie=0x6900000, duration=2315.475s, table=41, n_packets=0, n_bytes=0, priority=62020,ct_state=-new-est+rel-inv+trk actions=resubmit(,17)

cookie=0x6900000, duration=2315.476s, table=41, n_packets=390, n_bytes=33540, priority=62020,ct_state=+inv+trk actions=drop

cookie=0x6900000, duration=1367.535s, table=41, n_packets=0, n_bytes=0, priority=12802,ct_state=+new+trk,ip,metadata=0x33350000000000/0x1fffff0000000000 actions=ct(commit,zone=6001),resubmit(,17)
cookie=0x6900000, duration=1367.142s, table=41, n_packets=0, n_bytes=0, priority=12802,ct_state=+new+trk,ipv6,metadata=0x33350000000000/0x1fffff0000000000 actions=ct(commit,zone=6001),resubmit(,17)
cookie=0x6900000, duration=1349.804s, table=41, n_packets=0, n_bytes=0, priority=12802,ct_state=+new+trk,ip,metadata=0x33360000000000/0x1fffff0000000000 actions=ct(commit,zone=6001),resubmit(,17)
cookie=0x6900000, duration=1349.345s, table=41, n_packets=0, n_bytes=0, priority=12802,ct_state=+new+trk,ipv6,metadata=0x33360000000000/0x1fffff0000000000 actions=ct(commit,zone=6001),resubmit(,17)
cookie=0x6900000, duration=2315.476s, table=41, n_packets=0, n_bytes=0, priority=50,ct_state=+new+trk actions=drop
cookie=0x6900000, duration=2315.474s, table=41, n_packets=0, n_bytes=0, priority=0 actions=drop

 Comments   
Comment by Sridhar Gaddam [ 08/Dec/16 ]

According to OVS FAQ [1], "Connection tracking" in "Userspace" is marked as "PARTIAL". It is not clear what is supported and what is not supported from the FAQ.

So, it is possible that this issue could be a bug in OVS dpdk.

[1] https://github.com/openvswitch/ovs/blob/master/FAQ.rst

Comment by Sridhar Gaddam [ 08/Dec/16 ]

Does anyone have info about "IPv6 conntrack support in OVS-dpdk"?

Comment by Alon Kochba [ 11/Dec/16 ]

If indeed missing IPv6 conntrack support in OVS-DPDK 2.6 (very much possible as conntracking in userspace was only introduced in 2.6), we should probably recommend DPDK users interested in IPv6 support to use "learn" security groups instead of the default "stateful" mode.

Comment by mahesh loni [ 12/Dec/16 ]

Please find the latest analysis :
===================================================================

The datapath flows look like the following on DPDK datapath:

sudo ovs-appctl dpif/dump-flows br-int
ct_state(-new-est-rel+inv+trk),recirc_id(0x1),in_port(5),eth_type(0x86dd),ipv6(frag=no), packets:408, bytes:35088, used:0.804s, actions:drop
recirc_id(0),in_port(5),eth(src=fa:16:3e:6e:9f:b0,dst=33:33:ff:d0:37:61),eth_type(0x86dd),ipv6(src=2001:db8:1234:0:f816:3eff:fe6e:9fb0,proto=58,frag=no),icmpv6(type=135), packets:408, bytes:35088, used:0.804s, actions:ct(zone=5002),recirc(0x1)

So the first NDP packet coming on the node with DPDK datapath is dropped, because it has flags (-new-est-rel+inv+trk) and OVS drops it on flow:
cookie=0x6900000, duration=616.377s, table=41, n_packets=246, n_bytes=21156, priority=62020,ct_state=+inv+trk actions=drop

This is an issue with OVS and its dropping the icmp type=135 in case of userspace mode.

Comment by mahesh loni [ 12/Dec/16 ]

Please find the latest analysis :
===================================================================

The datapath flows look like the following on DPDK datapath:

sudo ovs-appctl dpif/dump-flows br-int
ct_state(-new-est-rel+inv+trk),recirc_id(0x1),in_port(5),eth_type(0x86dd),ipv6(frag=no), packets:408, bytes:35088, used:0.804s, actions:drop
recirc_id(0),in_port(5),eth(src=fa:16:3e:6e:9f:b0,dst=33:33:ff:d0:37:61),eth_type(0x86dd),ipv6(src=2001:db8:1234:0:f816:3eff:fe6e:9fb0,proto=58,frag=no),icmpv6(type=135), packets:408, bytes:35088, used:0.804s, actions:ct(zone=5002),recirc(0x1)

So the first NDP packet coming on the node with DPDK datapath is dropped, because it has flags (-new-est-rel+inv+trk) and OVS drops it on flow:
cookie=0x6900000, duration=616.377s, table=41, n_packets=246, n_bytes=21156, priority=62020,ct_state=+inv+trk actions=drop

This is an issue with OVS and its dropping the icmp type=135 in case of userspace mode.

Comment by Sridhar Gaddam [ 06/Jan/17 ]

Patch in Master branch (Merged): https://git.opendaylight.org/gerrit/#/c/49775/
Stable/Boron : https://git.opendaylight.org/gerrit/#/c/50082/

Generated at Wed Feb 07 20:21:12 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.