commit 1045985c76dbea8851e6ced72d09a0f9bc58a59d
Author: LIU Yulong <email address hidden>
Date: Thu Jan 27 17:01:43 2022 +0800
Add a default goto table=94 for openvswitch fw
If enable explicitly_egress_direct=True and set port as
no security group and port_security=False, the ingress
flood will reappear. The pipleline is:
Ingress
table_0 -> table_60 -> NORMAL -> VM
Egress
table_0 -> ... -> table_94 -> output
Because ingress final action is normal, the br-int will learn the
source MAC, but egress final action is output. So VM's mac will
never be learnt by the br-int. Then ingress flood comes again.
This patch adds a default direct flow to table 94 during the
openflow security group init and explicitly_egress_direct=True, then
the pipleline will be:
Ingress
table_0 -> table_60 -> table_94 -> output VM
Egress
table_0 -> ... -> table_94 -> output
And this patch adds the flows coming from patch port which will
match local vlan then go to table 94 do the same direct actions.
Above flood issue will be addressed by these flows.
Closes-Bug: #2051351
Change-Id: Ia61784174ee610b338f26660b2954330abc131a1
(cherry picked from commit d6f56c5f96c42e1682f3d1723a65253429778c20)
(cherry picked from commit f94f8b63842099904ff88906e8221a366a809f99)
(cherry picked from commit fc7fa9cf308766cdbf29b8cf4d3aaad867738dc0)
Conflict with 02b12b09175 in neutron/plugins/ml2/drivers/openvswitch/agent/openflow/native/br_int.py
Reviewed: https:/ /review. opendev. org/c/openstack /neutron/ +/921942 /opendev. org/openstack/ neutron/ commit/ 1045985c76dbea8 851e6ced72d09a0 f9bc58a59d
Committed: https:/
Submitter: "Zuul (22348)"
Branch: stable/2023.1
commit 1045985c76dbea8 851e6ced72d09a0 f9bc58a59d
Author: LIU Yulong <email address hidden>
Date: Thu Jan 27 17:01:43 2022 +0800
Add a default goto table=94 for openvswitch fw
If enable explicitly_ egress_ direct= True and set port as False, the ingress
no security group and port_security=
flood will reappear. The pipleline is:
Ingress
table_0 -> table_60 -> NORMAL -> VM
Egress
table_0 -> ... -> table_94 -> output
Because ingress final action is normal, the br-int will learn the
source MAC, but egress final action is output. So VM's mac will
never be learnt by the br-int. Then ingress flood comes again.
This patch adds a default direct flow to table 94 during the egress_ direct= True, then
openflow security group init and explicitly_
the pipleline will be:
Ingress
table_0 -> table_60 -> table_94 -> output VM
Egress
table_0 -> ... -> table_94 -> output
And this patch adds the flows coming from patch port which will
match local vlan then go to table 94 do the same direct actions.
Above flood issue will be addressed by these flows.
Closes-Bug: #2051351 b338f26660b2954 330abc131a1 682f3d1723a6525 3429778c20) 04ff88906e8221a 366a809f99) dbf29b8cf4d3aaa d867738dc0) plugins/ ml2/drivers/ openvswitch/ agent/openflow/ native/ br_int. py
Change-Id: Ia61784174ee610
(cherry picked from commit d6f56c5f96c42e1
(cherry picked from commit f94f8b638420999
(cherry picked from commit fc7fa9cf308766c
Conflict with 02b12b09175 in neutron/