controller: ACL correctly handles fragmented traffic.

At the current state, OVN can not handle fragmented traffic for ACLs
in the userspace datapath (DPDK). Just like in the case of LB
(commit 20a96b9), the kernel DP will try to reassemble the fragments
during CT lookup, however userspace won't reassemble them.

This patch allows OVN to handle fragmented traffic by defining a
translation table on southbound that leverages OpenFlow connection
tracking capabilities. When a stateful flow is created on NB, we add
a hint in the flow. This hint will be read in SB and if the
connection tracking is set to be used, SB will use the alternative
translation table that will use the connection tracking information.

This approach should not change the current behavior and it's only
enabled if acl_ct_translation is set:

ovn-nbctl set NB_Global . options:acl_ct_translation=true

Reported-at: https://issues.redhat.com/browse/FDP-1992
Signed-off-by: Erlon R. Cruz <erlon@canonical.com>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Ales Musil <amusil@redhat.com>

Author: sombrafam

NEWS

@@ -104,6 +104,11 @@ Post v25.09.0
    - Add support for special port_security prefix "VRRPv3". This prefix allows
      CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.
      See ovn-nb(5) man page for more details.
+   - Fixed support for fragmented traffic in the userspace datapath. Added the
+     "acl_ct_translation" NB_Global option to enable connection tracking
+     based L4 field translation for stateful ACLs. When enabled allows proper
+     handling of IP fragmentation in userspace datapaths. This option may break
+     hardware offloading and is disabled by default.
 
 OVN v25.09.0 - xxx xx xxxx
 --------------------------

controller/lflow.c

@@ -51,10 +51,19 @@ COVERAGE_DEFINE(consider_logical_flow);
 /* Contains "struct expr_symbol"s for fields supported by OVN lflows. */
 static struct shash symtab;
 
+/* Alternative symbol table for ACL CT translation.
+ * This symbol table maps L4 port fields (tcp/udp/sctp) to their connection
+ * tracking equivalents (ct_tp_src/ct_tp_dst with ct_proto predicates).
+ * This allows matching on all IP fragments (not just the first fragment)
+ * so that all fragments can be matched based on the connection tracking state.
+ */
+static struct shash acl_ct_symtab;
+
 void
 lflow_init(void)
 {
     ovn_init_symtab(&symtab);
+    ovn_init_acl_ct_symtab(&acl_ct_symtab);
 }
 
 struct lookup_port_aux {
@@ -1001,7 +1010,15 @@ convert_match_to_expr(const struct sbrec_logical_flow *lflow,
                      lflow->match);
         return NULL;
     }
-    struct expr *e = expr_parse_string(lex_str_get(&match_s), &symtab,
+
+    /* Check if this logical flow requires ACL CT translation.
+     * If the tags contains "acl_ct_translation"="true", we use the
+     * alternative symbol table that maps L4 fields (tcp/udp/sctp ports)
+     * to their CT equivalents. */
+    bool ct_trans = smap_get_bool(&lflow->tags, "acl_ct_translation", false);
+    struct shash *symtab_to_use = ct_trans ? &acl_ct_symtab : &symtab;
+
+    struct expr *e = expr_parse_string(lex_str_get(&match_s), symtab_to_use,
                                        addr_sets, port_groups, &addr_sets_ref,
                                        &port_groups_ref,
                                        ldp->datapath->tunnel_key,
@@ -1033,7 +1050,7 @@ convert_match_to_expr(const struct sbrec_logical_flow *lflow,
             e = expr_combine(EXPR_T_AND, e, *prereqs);
             *prereqs = NULL;
         }
-        e = expr_annotate(e, &symtab, &error);
+        e = expr_annotate(e, symtab_to_use, &error);
     }
     if (error) {
         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1);
@@ -2062,6 +2079,8 @@ lflow_destroy(void)
 {
     expr_symtab_destroy(&symtab);
     shash_destroy(&symtab);
+    expr_symtab_destroy(&acl_ct_symtab);
+    shash_destroy(&acl_ct_symtab);
 }
 
 bool

include/ovn/logical-fields.h

@@ -278,6 +278,8 @@ const char *event_to_string(enum ovn_controller_event event);
 int string_to_event(const char *s);
 const struct ovn_field *ovn_field_from_name(const char *name);
 
+void ovn_init_acl_ct_symtab(struct shash *symtab);
+
 /* OVN CT label values
  * ===================
  * These are specific ct.label bit values OVN uses to track different types

lib/logical-fields.c

@@ -451,3 +451,70 @@ ovn_field_from_name(const char *name)
 
     return shash_find_data(&ovnfield_by_name, name);
 }
+
+/* Removes the symbol with 'name' from 'symtab', freeing its memory. */
+static void
+expr_symtab_remove(struct shash *symtab, const char *name)
+{
+    struct expr_symbol *symbol = shash_find_and_delete(symtab, name);
+    if (symbol) {
+        free(symbol->name);
+        free(symbol->prereqs);
+        free(symbol->predicate);
+        free(symbol);
+    }
+}
+
+/* Initialize a symbol table for ACL CT translation.
+ * This creates an alternative symbol table that maps L4 port fields
+ * (tcp/udp/sctp) to their connection tracking equivalents. This allows
+ * matching on all IP fragments (not just the first) by using CT state
+ * which is available for all fragments. */
+void
+ovn_init_acl_ct_symtab(struct shash *acl_symtab)
+{
+    /* Initialize with the standard symbol table. */
+    ovn_init_symtab(acl_symtab);
+
+    /* Remove the original tcp/udp/sctp symbols that we will override. */
+    expr_symtab_remove(acl_symtab, "tcp.src");
+    expr_symtab_remove(acl_symtab, "tcp.dst");
+    expr_symtab_remove(acl_symtab, "tcp");
+    expr_symtab_remove(acl_symtab, "udp.src");
+    expr_symtab_remove(acl_symtab, "udp.dst");
+    expr_symtab_remove(acl_symtab, "udp");
+    expr_symtab_remove(acl_symtab, "sctp.src");
+    expr_symtab_remove(acl_symtab, "sctp.dst");
+    expr_symtab_remove(acl_symtab, "sctp");
+
+    /* Add ct_proto field - CT original direction protocol. Used in the
+     * tcp/udp/sctp predicate expansions below. */
+    expr_symtab_add_field(acl_symtab, "ct_proto", MFF_CT_NW_PROTO,
+                          "ct.trk", false);
+
+    /* Override TCP protocol and port fields to use CT equivalents.
+     * When "tcp" is used as a predicate, it expands to "ct_proto == 6"
+     * instead of "ip.proto == 6". */
+    expr_symtab_add_predicate(acl_symtab, "tcp",
+                              "ct.trk && !ct.inv && ct_proto == 6");
+    expr_symtab_add_field(acl_symtab, "tcp.src", MFF_CT_TP_SRC,
+                          "tcp", false);
+    expr_symtab_add_field(acl_symtab, "tcp.dst", MFF_CT_TP_DST,
+                          "tcp", false);
+
+    /* Override UDP protocol and port fields */
+    expr_symtab_add_predicate(acl_symtab, "udp",
+                              "ct.trk && !ct.inv && ct_proto == 17");
+    expr_symtab_add_field(acl_symtab, "udp.src", MFF_CT_TP_SRC,
+                          "udp", false);
+    expr_symtab_add_field(acl_symtab, "udp.dst", MFF_CT_TP_DST,
+                          "udp", false);
+
+    /* Override SCTP protocol and port fields */
+    expr_symtab_add_predicate(acl_symtab, "sctp",
+                              "ct.trk && !ct.inv && ct_proto == 132");
+    expr_symtab_add_field(acl_symtab, "sctp.src", MFF_CT_TP_SRC,
+                          "sctp", false);
+    expr_symtab_add_field(acl_symtab, "sctp.dst", MFF_CT_TP_DST,
+                          "sctp", false);
+}

lib/ovn-util.c

@@ -698,19 +698,23 @@ ovn_pipeline_from_name(const char *pipeline)
 uint32_t
 sbrec_logical_flow_hash(const struct sbrec_logical_flow *lf)
 {
+    bool acl_ct_translation = smap_get_bool(&lf->tags,
+                                            "acl_ct_translation", false);
     return ovn_logical_flow_hash(lf->table_id,
                                  ovn_pipeline_from_name(lf->pipeline),
                                  lf->priority, lf->match,
-                                 lf->actions);
+                                 lf->actions, acl_ct_translation);
 }
 
 uint32_t
 ovn_logical_flow_hash(uint8_t table_id, enum ovn_pipeline pipeline,
                       uint16_t priority,
-                      const char *match, const char *actions)
+                      const char *match, const char *actions,
+                      bool acl_ct_translation)
 {
     size_t hash = hash_2words((table_id << 16) | priority, pipeline);
     hash = hash_string(match, hash);
+    hash = hash_boolean(acl_ct_translation, hash);
     return hash_string(actions, hash);
 }
 

lib/ovn-util.h

@@ -155,7 +155,8 @@ enum ovn_pipeline {
 uint32_t sbrec_logical_flow_hash(const struct sbrec_logical_flow *);
 uint32_t ovn_logical_flow_hash(uint8_t table_id, enum ovn_pipeline pipeline,
                                uint16_t priority,
-                               const char *match, const char *actions);
+                               const char *match, const char *actions,
+                               bool acl_ct_translation);
 void ovn_conn_show(struct unixctl_conn *conn, int argc OVS_UNUSED,
                    const char *argv[] OVS_UNUSED, void *idl_);
 

northd/en-global-config.c

@@ -717,6 +717,11 @@ check_nb_options_out_of_sync(
         return true;
     }
 
+    if (config_out_of_sync(&nb->options, &config_data->nb_options,
+                           "acl_ct_translation", false)) {
+        return true;
+    }
+
     return false;
 }