Fix flow table lookup after ct clear or switching zones
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux-bluefield (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Bodong Wang |
Bug Description
* Explain the bug
Flow table lookup is skipped if packet either went through ct clear action (which set the IP_CT_UNTRACKED flag on the packet),
or while switching zones and there is already a connection associated with the packet. This will result in no SW offload of the connection,
and the and connection not being removed from flow table with TCP teardown (fin/rst packet).
* How to test
Create OVS bridge with 2 veth pairs, put each veth peer device in a different namespace - ns0, ns1, and add
the other side veth devices (named ns[01]_veth below) to OVS bridge. Configure the namespace devices with
an ip, and bring all devices up.
Enable HW offload in ovs and configure connection tracking OpenFlow rules that pass via two zones (but drop the FIN packets on the reply side
or they will still teardown the connection in second zone from the reply side as it happens first):
ovs-ofctl add-flow br-ovs "arp actions=NORMAL"
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
ovs-ofctl add-flow br-ovs "ct_state=
Run TCP iperf from ns0 namespace to an iperf server on ns1 namepsace with the given ip.
After traffic ends, check
cat /proc/net/
If bug occurs, connections will remain offloaded till timeout, otherwise, they will be in
teardown state.
* What it could break.
NA
Changed in linux-bluefield (Ubuntu Focal): | |
status: | New → In Progress |
Changed in linux-bluefield (Ubuntu): | |
status: | New → Invalid |
Changed in linux-bluefield (Ubuntu Focal): | |
status: | In Progress → Fix Committed |
assignee: | nobody → Bodong Wang (bodong-wang) |
tags: |
added: verification-done-focal removed: verification-needed-focal |
This bug is awaiting verification that the linux-bluefield /5.4.0- 1033.36 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification- needed- focal' to 'verification- done-focal' . If the problem still exists, change the tag 'verification- needed- focal' to 'verification- failed- focal'.
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation how to enable and use -proposed. Thank you!