[#NETVIRT-430] Ping responder on tenant network and FIP-FIP traffic between vm in same n/w in same compute is not working in stateful SG mode.

[NETVIRT-430] Ping responder on tenant network and FIP-FIP traffic between vm in same n/w in same compute is not working in stateful SG mode. Created: 16/Jan/17 Updated: 03/May/18 Resolved: 06/Apr/18
Status:	Resolved
Project:	netvirt
Component/s:	General
Affects Version/s:	Oxygen, Fluorine
Fix Version/s:	Fluorine

Type:

Bug

Priority:

Highest

Reporter:

Sridhar Gaddam

Assignee:

Aswin Suryanarayanan

Resolution:

Done

Votes:

Labels:

patch_merged

Remaining Estimate:

Not Specified

Time Spent:

Not Specified

Original Estimate:

Not Specified

Environment:

Operating System: All
Platform: All

External issue ID:

7545

Description

On the tenant network, Netvirt supports ping to router interface address using OVS flows.
This is achieved by programming the necessary flows [1] in Table21 (FIB_TABLE) to auto-respond to ping.

However, when using "Stateful SG mode", this feature is broken and ACL service is dropping [2] the packets in Table252.
This feature works fine in "SG transparent mode", when port-security is disabled on the port (obviously isn't it and when we explicitly add an ACL ingress rule to allow this traffic.

[1] table=21, n_packets=6, n_bytes=588, priority=42,icmp,metadata=0x222e0/0xfffffffe,nw_dst=10.0.0.1,icmp_type=8,icmp_code=0 actions=move:NXM_OF_ETH_SRC[]~~>NXM_OF_ETH_DST[],set_field:fa:16:3e:87:0b:fc~~>eth_src,move:NXM_OF_IP_SRC[]~~>NXM_OF_IP_DST[],set_field:10.0.0.1~~>ip_src,set_field:0->icmp_type,load:0->NXM_OF_IN_PORT[],resubmit(,21)
[2] table=252, n_packets=78, n_bytes=7644, priority=50,ct_state=+new+trk actions=drop

Comments

Comment by Vivekanandan Narasimhan [ 03/Apr/17 ]

Hi Aswin,

Since you were driving ACLService, am parking this temporararily with you now.

Please feel free to work with Somashekhar and Raja Shashidhar to sort this out.

Vivek

Comment by Aswin Suryanarayanan [ 20/Jun/17 ]

https://mail.openvswitch.org/pipermail/ovs-discuss/2017-June/044613.html

Comment by Aswin Suryanarayanan [ 01/Aug/17 ]

https://git.opendaylight.org/gerrit/#/c/60991/

Comment by Sridhar Gaddam [ 07/Aug/17 ]

@Aswin, does the patch also support IPv6 use-case (i.e., ping6)?

Comment by Aswin Suryanarayanan [ 12/Mar/18 ]

OpenFlow Plugin
https://git.opendaylight.org/gerrit/#/c/69033/

Genius
https://git.opendaylight.org/gerrit/#/c/69033/

Netvirt
https://git.opendaylight.org/gerrit/#/c/69302/

Comment by Daniel Farrell [ 12/Mar/18 ]

aswins - The Genius link is a dup of the OpenFlow Plugin one. I don't see one to Genius searching quickly.

jluhrsen - Is going to work on getting a multipatch run of this, with all patches, to verify.

Comment by Aswin Suryanarayanan [ 12/Mar/18 ]

Sorry that was oversight while I pasted the link

This is the genius patch.

[1]https://git.opendaylight.org/gerrit/#/c/69081/

Comment by Aswin Suryanarayanan [ 12/Mar/18 ]

This patch requires ovs2.9 with kernel module installed.

Comment by Daniel Farrell [ 12/Mar/18 ]

aswins - Do we not have that in CSIT? Are you asking for us to do something?

Comment by Aswin Suryanarayanan [ 13/Mar/18 ]

We don't have that in CSIT right now as OVS queens is yet to move to 2.9 But this should not result in any CSIT failure as these changes will not affect any existing test cases.