ic: Add tag rules to filter the routes learned from a TS.

The "ic-route-filter-tag" option of a Logical_Router_Port connected to a
transit switch blocks the routes carrying a single route tag.  There is
no way to express a list of tags, nor the opposite rule - "learn only
the routes tagged with one of these tags" - which is useful when a
router port has to import the routes of a known set of VPCs and drop
everything else.

Add an "ic-route-learn-tag-rules" option that takes a comma-separated
list of route tags prefixed by the rule to apply to them:

  - "allow:<tags>": only the routes whose "ic-route-tag" is one of
    <tags> are learned.  Every other route, the untagged ones included,
    is not learned.

  - "block:<tags>": the routes whose "ic-route-tag" is one of <tags> are
    not learned.  Every other route, the untagged ones included, is
    learned.

As commas separate the tags, a route tag cannot contain a comma.  The
two forms are mutually exclusive, so only the leading prefix is honored
and everything after it is a tag name.  Values that use neither prefix,
as well as values with an empty tag list, are logged and ignored.

This new option supersedes "ic-route-filter-tag", which is now
deprecated and scheduled for removal in 28.09.  The deprecated option is
still honored on its own, but it is ignored whenever a valid
"ic-route-learn-tag-rules" value is configured on the same port.

Assisted-by: Claude Opus 5, Claude Code
Acked-by: Rosemarie O'Riorden <rosemarie@redhat.com>
Signed-off-by: Lucas Vargas Dias <lucas.vdias@magalu.cloud>
Signed-off-by: Dumitru Ceara <dceara@redhat.com>

Author: lucassdiass

NEWS

@@ -96,6 +96,10 @@ Post v26.03.0
      egress pipelines.
    - The support for co-hosting multiple controller instances is now
      considered stable.  Its "experimental" tag has been removed.
+   - Added the "ic-route-learn-tag-rules" option to Logical_Router_Port to
+     filter the routes learned through the port by route tag.  This supersedes
+     "ic-route-filter-tag", which is now deprecated and is ignored when
+     "ic-route-learn-tag-rules" is set.
 
 OVN v26.03.0 - xxx xx xxxx
 --------------------------

TODO.rst

@@ -224,6 +224,8 @@ when the feature/action will move from ``Deprecated`` to ``Removed``.
   * ``OVN_FEATURE_MAC_BINDING_TIMESTAMP`` feature, should be removed in 28.09.
   * ``OVN_FEATURE_FDB_TIMESTAMP`` feature, should be removed in 28.09.
   * ``OVN_FEATURE_LS_DPG_COLUMN`` feature, should be removed in 28.09.
+  * ``ic-route-filter-tag`` Logical_Router_Port option, superseded by
+    ``ic-route-learn-tag-rules``, should be removed in 28.09.
 
 * 26.03 Deprecated
 

ic/ovn-ic.c

@@ -2526,6 +2526,91 @@ lrp_is_ts_port(struct ic_context *ctx, struct ic_router_info *ic_lr,
     return false;
 }
 
+#define IC_ROUTE_LEARN_TAG_RULES "ic-route-learn-tag-rules"
+#define IC_ROUTE_LEARN_TAG_ALLOW "allow:"
+#define IC_ROUTE_LEARN_TAG_BLOCK "block:"
+#define IC_ROUTE_FILTER_TAG "ic-route-filter-tag"
+
+/* Route tag rules of a TS LRP, as configured through its
+ * "ic-route-learn-tag-rules" option. */
+struct route_learn_tag_rules {
+    const char *config;     /* Option value, for logging purposes. */
+    bool configured;        /* False if the option is unset or invalid, in
+                             * which case no route is filtered. */
+    bool allow;             /* True: only routes tagged with one of 'tags' are
+                             * learned.  False: routes tagged with one of
+                             * 'tags' are not learned. */
+    struct sset tags;
+};
+
+/* Initializes 'rules' from the "ic-route-learn-tag-rules" option of 'lrp',
+ * which may be NULL.  The option value must be either
+ * "allow:<comma-separated-tags>" or "block:<comma-separated-tags>"; any other
+ * value is logged and ignored.  Route tags cannot contain commas. */
+static void
+route_learn_tag_rules_init(struct route_learn_tag_rules *rules,
+                           const struct nbrec_logical_router_port *lrp)
+{
+    static struct vlog_rate_limit bad_value_rl = VLOG_RATE_LIMIT_INIT(5, 1);
+    static struct vlog_rate_limit no_tag_rl = VLOG_RATE_LIMIT_INIT(5, 1);
+    const char *tags = "";
+
+    rules->config = lrp ? smap_get(&lrp->options, IC_ROUTE_LEARN_TAG_RULES)
+                        : NULL;
+    rules->configured = false;
+    rules->allow = false;
+
+    if (rules->config) {
+        if (!strncmp(rules->config, IC_ROUTE_LEARN_TAG_ALLOW,
+                     strlen(IC_ROUTE_LEARN_TAG_ALLOW))) {
+            tags = rules->config + strlen(IC_ROUTE_LEARN_TAG_ALLOW);
+            rules->allow = true;
+            rules->configured = true;
+        } else if (!strncmp(rules->config, IC_ROUTE_LEARN_TAG_BLOCK,
+                            strlen(IC_ROUTE_LEARN_TAG_BLOCK))) {
+            tags = rules->config + strlen(IC_ROUTE_LEARN_TAG_BLOCK);
+            rules->configured = true;
+        } else {
+            VLOG_WARN_RL(&bad_value_rl,
+                         "Ignoring invalid %s value [%s] of logical "
+                         "router port %s: expected \"%s<tags>\" or "
+                         "\"%s<tags>\".", IC_ROUTE_LEARN_TAG_RULES,
+                         rules->config, lrp->name,
+                         IC_ROUTE_LEARN_TAG_ALLOW, IC_ROUTE_LEARN_TAG_BLOCK);
+        }
+    }
+
+    sset_from_delimited_string(&rules->tags, tags, ",");
+
+    if (rules->configured && sset_is_empty(&rules->tags)) {
+        VLOG_WARN_RL(&no_tag_rl,
+                     "Ignoring %s value [%s] of logical router port %s: "
+                     "no route tag specified.", IC_ROUTE_LEARN_TAG_RULES,
+                     rules->config, lrp->name);
+        rules->configured = false;
+    }
+}
+
+static void
+route_learn_tag_rules_destroy(struct route_learn_tag_rules *rules)
+{
+    sset_destroy(&rules->tags);
+}
+
+/* Returns true if a route tagged with 'route_tag' (NULL if the route
+ * carries no tag) can be learned according to 'rules'. */
+static bool
+route_learn_tag_rules_allow(const struct route_learn_tag_rules *rules,
+                            const char *route_tag)
+{
+    if (!rules->configured) {
+        return true;
+    }
+
+    bool listed = route_tag && sset_contains(&rules->tags, route_tag);
+    return rules->allow ? listed : !listed;
+}
+
 static void
 sync_learned_routes(struct ic_context *ctx,
                     struct ic_router_info *ic_lr)
@@ -2549,12 +2634,30 @@ sync_learned_routes(struct ic_context *ctx,
         if (lrp) {
             ts_route_table = smap_get_def(&lrp->options, "route_table", "");
             route_filter_tag = smap_get_def(&lrp->options,
-                                            "ic-route-filter-tag", "");
+                                            IC_ROUTE_FILTER_TAG, "");
         } else {
             ts_route_table = "";
             route_filter_tag = "";
         }
 
+        struct route_learn_tag_rules learn_tag_rules;
+        route_learn_tag_rules_init(&learn_tag_rules, lrp);
+
+        if (route_filter_tag[0]) {
+            static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1);
+            if (learn_tag_rules.configured) {
+                VLOG_WARN_RL(&rl, "The deprecated %s option of logical router "
+                             "port %s is ignored as %s is also configured.",
+                             IC_ROUTE_FILTER_TAG, lrp->name,
+                             IC_ROUTE_LEARN_TAG_RULES);
+            } else {
+                VLOG_WARN_RL(&rl, "The %s option of logical router port %s is "
+                             "deprecated and will be removed in the 28.09 "
+                             "release; use %s instead.", IC_ROUTE_FILTER_TAG,
+                             lrp->name, IC_ROUTE_LEARN_TAG_RULES);
+            }
+        }
+
         isb_route_key = icsbrec_route_index_init_row(ctx->icsbrec_route_by_ts);
         icsbrec_route_index_set_transit_switch(isb_route_key,
                                                isb_pb->transit_switch);
@@ -2578,14 +2681,27 @@ sync_learned_routes(struct ic_context *ctx,
 
             const char *isb_route_tag = smap_get(&isb_route->external_ids,
                                                  "ic-route-tag");
-            if (isb_route_tag  && !strcmp(isb_route_tag, route_filter_tag)) {
+            /* The deprecated filter tag is honored only when the route learn
+             * tag rules are not in effect. */
+            if (!learn_tag_rules.configured && isb_route_tag &&
+                !strcmp(isb_route_tag, route_filter_tag)) {
                 VLOG_DBG("Skip learning route %s -> %s as its route tag "
-                         "[%s] is filtered by the filter tag [%s] of TS LRP ",
+                         "[%s] is filtered by the filter tag [%s] of TS LRP",
                          isb_route->ip_prefix, isb_route->nexthop,
                          isb_route_tag, route_filter_tag);
                 continue;
             }
 
+            if (!route_learn_tag_rules_allow(&learn_tag_rules,
+                                             isb_route_tag)) {
+                VLOG_DBG("Skip learning route %s -> %s as its route tag "
+                         "[%s] is filtered by the %s [%s] of TS LRP",
+                         isb_route->ip_prefix, isb_route->nexthop,
+                         isb_route_tag ? isb_route_tag : "",
+                         IC_ROUTE_LEARN_TAG_RULES, learn_tag_rules.config);
+                continue;
+            }
+
             if (isb_route->route_table[0] &&
                 strcmp(isb_route->route_table, ts_route_table)) {
                 if (VLOG_IS_DBG_ENABLED()) {
@@ -2650,6 +2766,7 @@ sync_learned_routes(struct ic_context *ctx,
             }
         }
         icsbrec_route_index_destroy_row(isb_route_key);
+        route_learn_tag_rules_destroy(&learn_tag_rules);
     }
 
     /* Delete extra learned routes. */

ovn-nb.xml

@@ -4697,6 +4697,67 @@ or
           <ref db="OVN_IC_Southbound"/> database, will be filtered and not
           learned by the <code>ovn-ic</code> daemon.
         </p>
+
+        <p>
+          This option is deprecated and will be removed in the 28.09
+          release.  Use
+          <ref column="options" key="ic-route-learn-tag-rules"/> instead,
+          which supports more than one route tag and which, when set, causes
+          this option to be ignored.
+        </p>
+      </column>
+
+      <column name="options" key="ic-route-learn-tag-rules"
+              type='{"type": "string"}'>
+        <p>
+          This option controls, based on route tags, which routes the
+          <code>ovn-ic</code> daemon learns through this Logical Router Port.
+          It expects a value in one of the following two forms, where
+          <code>tags</code> is a comma-separated list of route-tag names, for
+          example <code>allow:vpc1,vpc2</code>:
+        </p>
+
+        <ul>
+          <li>
+            <code>allow:tags</code> - only routes whose
+            <code>ic-route-tag</code> matches one of the listed tags are
+            learned.  Every other route, including routes that carry no
+            <code>ic-route-tag</code> at all, is not learned.
+          </li>
+
+          <li>
+            <code>block:tags</code> - routes whose <code>ic-route-tag</code>
+            matches one of the listed tags are not learned.  Every other
+            route, including routes that carry no <code>ic-route-tag</code> at
+            all, is learned.
+          </li>
+        </ul>
+
+        <p>
+          The <code>ic-route-tag</code> of a route is the one present in the
+          <code>external_ids</code> register of the advertised route entry in
+          the <ref table="Route" db="OVN_IC_Southbound"/> table of the
+          <ref db="OVN_IC_Southbound"/> database.  As commas separate the
+          tags, a route tag cannot contain a comma.  Values that use neither
+          the <code>allow:</code> nor the <code>block:</code> prefix, as well
+          as values with an empty tag list, are invalid and are ignored (no
+          route is filtered by this option).
+        </p>
+
+        <p>
+          The two forms are mutually exclusive: only the leading prefix is
+          honored and everything after it is a route tag name.  In
+          <code>allow:vpc1,block:vpc2</code>, for example, the allowed tags
+          are <code>vpc1</code> and <code>block:vpc2</code>.
+        </p>
+
+        <p>
+          This option supersedes the deprecated
+          <ref column="options" key="ic-route-filter-tag"/> option: whenever a
+          valid value is set here, the route tags to learn are the ones
+          defined by this option only and
+          <ref column="options" key="ic-route-filter-tag"/> is ignored.
+        </p>
       </column>
 
       <column name="options" key="requested-chassis">