Linklocal services does not work if policy not enabled on interface

[Praveen]

We should always do route lookup after flow lookup changes VRF, with translated address if any.

This is not performance hit as this will happen only when we have NH policy bit set.

Regards
-Harshad

When policy is not enabled on the interface, we have a problem for link-local services. Here is what happens,

1. The proxy flag is not set in the VMI in vrouter
2. VM sends first TCP-SYN packet for link-local service
     1. Route lookup done in VRF for the interface
     2. Route points to next hop with policy
     3. Packet trapped to Vrouter for flow-setup
     4. Agent sets up flows with NAT action and VRF translation
     5. Post flow-setup, vrouter will do route lookup in translated VRF and sends packet on ethernet interface
3. The link-local server sends SYN-ACK
     1. SYN-ACK packet is sent to the VM
4. VM Sends ACK packet followed by data packets
      1. Interface does not have policy
      2. Route lookup for link-local service-ip will result in NH with policy
      3. Vrouter does flow lookup.
      4. Flow specifies NAT and hence vrouter does NAT the packet
      5. Looks like Vrouter does not do route lookup again since route-lookup is already done in (2)
      6. The NAT translated packet is forwarded according to NH found in (2)
      7. The packet is forwarded to VHOST and gets discarded. Link-local service does not work further

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/9382
Submitter: Divakar Dharanalakota (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/9386
Submitter: Divakar Dharanalakota (<email address hidden>)