[R2.20] Incorrect vrf translate when both snat/dnat on same flow

[amit surana]

VM1 (1.1.1.3) in VN1 pings FIP (7.1.1.10) of VM2(1.1.2.3) in VN2. The ICMP echo request goes via an SNAT instance (source gets translated to 7.1.1.13); the FIP for VM2 has been carved out of the GW n/w of the logical router doing the SNAT.

root@c4-fpc10:~# flow -l
Flow table(size 34078720, entries 532480)

Entries: Created 335 Added 333 Processed 335
(Created Flows/CPU: 39 8 31 34 13 8 23 20 37 18 12 12 15 10 8 15 2 7 0 0 0 3 0 2 2 2 4 1 2 1 2 4)(oflows 0)

Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop

 Index Source:Port Destination:Port Proto(V)
-------------------------------------------------------------------------
  9432 7.1.1.10:23553 1.1.1.3:0 1 (5->6)
 (K(nh):51, Action:F, S(nh):51, Statistics:0/0 UdpSrcPort 50768)

 66732<=>134756 1.1.2.3:23553 7.1.1.13:0 1 (3->4)
 (K(nh):26, Action:N(S), S(nh):26, Statistics:0/0 UdpSrcPort 56579)

134756<=>66732 7.1.1.13:23553 7.1.1.10:0 1 (4->7)
 (K(nh):58, Action:N(D), S(nh):58, Statistics:4/392 UdpSrcPort 58741)

515184 1.1.1.3:23553 7.1.1.10:0 1 (1)
 (K(nh):35, Action:F, S(nh):35, Statistics:4/392 UdpSrcPort 57048)

root@c4-fpc10:~#

packet entering the netns instance:

root@c4-fpc10:~# tcpdump -i veth279ff3d8-e
tcpdump: WARNING: veth279ff3d8-e: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on veth279ff3d8-e, link-type EN10MB (Ethernet), capture size 65535 bytes
08:19:22.539154 IP 1.1.1.3 > 7.1.1.10: ICMP echo request, id 23553, seq 112, length 64
08:19:23.539318 IP 1.1.1.3 > 7.1.1.10: ICMP echo request, id 23553, seq 113, length 64

packet exiting the netns instance (source IP is translated)

root@c4-fpc10:~# tcpdump -i veth39ce797e-2
tcpdump: WARNING: veth39ce797e-2: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on veth39ce797e-2, link-type EN10MB (Ethernet), capture size 65535 bytes
08:18:38.532298 IP 7.1.1.13 > 7.1.1.10: ICMP echo request, id 23553, seq 68, length 64
08:18:39.532453 IP 7.1.1.13 > 7.1.1.10: ICMP echo request, id 23553, seq 69, length 64

This packet is received in VRF 4, which has the stitched MAC entry for the destination:

7.1.1.10/32 32 PT - 26 2:2c:d0:8c:90:4f(124396)

root@c4-fpc10:~# nh --get 26
Id:26 Type:Encap Fmly: AF_INET Flags:Valid, Policy, Rid:0 Ref_cnt:6 Vrf:3
              EncapFmly:0806 Oif:4 Len:14 Data:02 2c d0 8c 90 4f 00 00 5e 00 01 00 08 00

However, instead of using this entry and routing to Vrf 3, the packet gets routed to Vrf 7 (as shown in flow table entry).

[amit surana (asurana-t)]

This bug occurs when the SNAT instance and the destination VM are on the same compute. In other words, if SNAT and DNAT both happen on the same compute, then the ping will fail.

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/11783
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/11818
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/11783
Committed: http://github.org/Juniper/contrail-controller/commit/bb3f317ee8a0b7b160273cd0b8b5941cb90c31d6
Submitter: Zuul
Branch: master

commit bb3f317ee8a0b7b160273cd0b8b5941cb90c31d6
Author: Naveen N <email address hidden>
Date: Thu Jun 18 17:00:51 2015 +0530

* Dont apply interface VRF assign rule when packet gets NATed

Interface VRF assign rules are ysed to steer traffic thru service
instances in service chain. If a packet gets NATed then destination
VRF should be set to native VRF of interface to which the floating
ip belong, and in this case there is no need to apply VRF translation
rule. Test case to verify the same.
Closes-bug:#1465728

Change-Id: I7c3b3062efb5cc8ad0e198ef6a099f02bed19f4e

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/12502
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/12502
Committed: http://github.org/Juniper/contrail-controller/commit/5ebca65e5f497b708675ef95d4df0fe1a02b9e24
Submitter: Zuul
Branch: R2.0

commit 5ebca65e5f497b708675ef95d4df0fe1a02b9e24
Author: Naveen N <email address hidden>
Date: Tue Jul 21 01:35:44 2015 -0700

* Dont apply interface VRF assign rule when packet gets NATed

Interface VRF assign rules are ysed to steer traffic thru service
instances in service chain. If a packet gets NATed then destination
VRF should be set to native VRF of interface to which the floating
ip belong, and in this case there is no need to apply VRF translation
rule. Test case to verify the same.
Closes-bug:#1465728

Change-Id: I0a0319d028d08fc4751fbf9fa5f986692f0e8ac8

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/11818
Committed: http://github.org/Juniper/contrail-controller/commit/111cec12cddc33949e6be6701201efb910a69836
Submitter: Zuul
Branch: R2.20

commit 111cec12cddc33949e6be6701201efb910a69836
Author: Naveen N <email address hidden>
Date: Fri Jun 19 11:41:14 2015 +0530

* Dont apply interface VRF assign rule when packet gets NATed

Interface VRF assign rules are ysed to steer traffic thru service
instances in service chain. If a packet gets NATed then destination
VRF should be set to native VRF of interface to which the floating
ip belong, and in this case there is no need to apply VRF translation
rule. Test case to verify the same.
Closes-bug:#1465728

Change-Id: I19ae3dda079269f7f7d041ebfd110c37c01f16c1

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/13927
Submitter: Vinay Vithal Mahuli (<email address hidden>)