Skip to content

Commit db70722

Browse files
girishmggirishmg
authored
Merge pull request ovn-kubernetes#5053 from crnithya/gw_vlans_rel1
Update OVS bridge flows for supporting gateway VLANs
2 parents 548cfea + f059656 commit db70722

File tree

2 files changed

+75
-29
lines changed

2 files changed

+75
-29
lines changed

‎dist/images/ovnkube.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1828,6 +1828,14 @@ ovnkube-controller-with-node() {
18281828
fi
18291829
fi
18301830

1831+
if [[ ${ovnkube_node_mode} != "dpu-host" && ! ${ovn_gateway_opts} =~ "gateway-vlanid" ]]; then
1832+
# get the gateway vlanid
1833+
gw_vlanid=$(ovs-vsctl --if-exists get Open_vSwitch . external_ids:ovn-gw-vlanid | tr -d \")
1834+
if [[ -n ${gw_vlanid} ]]; then
1835+
ovn_gateway_opts+="--gateway-vlanid=${gw_vlanid}"
1836+
fi
1837+
fi
1838+
18311839
ovnkube_node_mgmt_port_netdev_flag=
18321840
if [[ ${ovnkube_node_mgmt_port_netdev} != "" ]]; then
18331841
ovnkube_node_mgmt_port_netdev_flag="--ovnkube-node-mgmt-port-netdev=${ovnkube_node_mgmt_port_netdev}"
@@ -2444,6 +2452,14 @@ ovn-node() {
24442452

24452453
fi
24462454

2455+
if [[ ${ovnkube_node_mode} != "dpu-host" && ! ${ovn_gateway_opts} =~ "gateway-vlanid" ]]; then
2456+
# get the gateway vlanid
2457+
gw_vlanid=$(ovs-vsctl --if-exists get Open_vSwitch . external_ids:ovn-gw-vlanid | tr -d \")
2458+
if [[ -n ${gw_vlanid} ]]; then
2459+
ovn_gateway_opts+="--gateway-vlanid=${gw_vlanid}"
2460+
fi
2461+
fi
2462+
24472463
local ovn_node_ssl_opts=""
24482464
if [[ ${ovnkube_node_mode} != "dpu-host" ]]; then
24492465
[[ "yes" == ${OVN_SSL_ENABLE} ]] && {

‎go-controller/pkg/node/gateway_shared_intf.go‎

Lines changed: 59 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -401,9 +401,18 @@ func (npw *nodePortWatcher) generateARPBypassFlow(ofPorts []string, ipAddr strin
401401
}
402402
arpPortsFiltered = append(arpPortsFiltered, port)
403403
}
404-
arpFlow = fmt.Sprintf("cookie=%s, priority=110, in_port=%s, %s, %s=%s, "+
405-
"actions=output:%s",
406-
cookie, npw.ofportPhys, addrResProto, addrResDst, ipAddr, strings.Join(arpPortsFiltered, ","))
404+
405+
// If vlan tagged traffic is received from physical interface, it has to be untagged before sending to access ports
406+
if config.Gateway.VLANID != 0 {
407+
match_vlan := fmt.Sprintf("dl_vlan=%d,", config.Gateway.VLANID)
408+
arpFlow = fmt.Sprintf("cookie=%s, priority=110, in_port=%s, %s, %s, %s=%s, "+
409+
"actions=strip_vlan,output:%s",
410+
cookie, npw.ofportPhys, match_vlan, addrResProto, addrResDst, ipAddr, strings.Join(arpPortsFiltered, ","))
411+
} else {
412+
arpFlow = fmt.Sprintf("cookie=%s, priority=110, in_port=%s, %s, %s=%s, "+
413+
"actions=output:%s",
414+
cookie, npw.ofportPhys, addrResProto, addrResDst, ipAddr, strings.Join(arpPortsFiltered, ","))
415+
}
407416
}
408417

409418
return arpFlow
@@ -1099,6 +1108,15 @@ func flowsForDefaultBridge(bridge *bridgeConfiguration, extraIPs []net.IP) ([]st
10991108
// 14 bytes of overhead for ethernet header (does not include VLAN)
11001109
maxPktLength := getMaxFrameLength()
11011110

1111+
strip_vlan := ""
1112+
mod_vlan_id := ""
1113+
match_vlan := ""
1114+
if config.Gateway.VLANID != 0 {
1115+
strip_vlan = "strip_vlan,"
1116+
match_vlan = fmt.Sprintf("dl_vlan=%d,", config.Gateway.VLANID)
1117+
mod_vlan_id = fmt.Sprintf("mod_vlan_vid:%d,", config.Gateway.VLANID)
1118+
}
1119+
11021120
if config.IPv4Mode {
11031121
// table0, Geneve packets coming from external. Skip conntrack and go directly to host
11041122
// if dest mac is the shared mac send directly to host.
@@ -1282,14 +1300,15 @@ func flowsForDefaultBridge(bridge *bridgeConfiguration, extraIPs []net.IP) ([]st
12821300

12831301
// table 1, established and related connections in zone 64000 with ct_mark ctMarkHost go to host
12841302
dftFlows = append(dftFlows,
1285-
fmt.Sprintf("cookie=%s, priority=100, table=1, ip, ct_state=+trk+est, ct_mark=%s, "+
1286-
"actions=output:%s",
1287-
defaultOpenFlowCookie, ctMarkHost, ofPortHost))
1303+
fmt.Sprintf("cookie=%s, priority=100, table=1, %s ip, ct_state=+trk+est, ct_mark=%s, "+
1304+
"actions=%soutput:%s",
1305+
defaultOpenFlowCookie, match_vlan, ctMarkHost, strip_vlan, ofPortHost))
12881306

12891307
dftFlows = append(dftFlows,
1290-
fmt.Sprintf("cookie=%s, priority=100, table=1, ip, ct_state=+trk+rel, ct_mark=%s, "+
1291-
"actions=output:%s",
1292-
defaultOpenFlowCookie, ctMarkHost, ofPortHost))
1308+
fmt.Sprintf("cookie=%s, priority=100, table=1, %s ip, ct_state=+trk+rel, ct_mark=%s, "+
1309+
"actions=%soutput:%s",
1310+
defaultOpenFlowCookie, match_vlan, ctMarkHost, strip_vlan, ofPortHost))
1311+
12931312
}
12941313

12951314
if config.IPv6Mode {
@@ -1306,32 +1325,33 @@ func flowsForDefaultBridge(bridge *bridgeConfiguration, extraIPs []net.IP) ([]st
13061325

13071326
// table 1, established and related connections in zone 64000 with ct_mark ctMarkHost go to host
13081327
dftFlows = append(dftFlows,
1309-
fmt.Sprintf("cookie=%s, priority=100, table=1, ip6, ct_state=+trk+est, ct_mark=%s, "+
1310-
"actions=output:%s",
1311-
defaultOpenFlowCookie, ctMarkHost, ofPortHost))
1328+
fmt.Sprintf("cookie=%s, priority=100, table=1, %s ip6, ct_state=+trk+est, ct_mark=%s, "+
1329+
"actions=%soutput:%s",
1330+
defaultOpenFlowCookie, match_vlan, ctMarkHost, strip_vlan, ofPortHost))
13121331

13131332
dftFlows = append(dftFlows,
1314-
fmt.Sprintf("cookie=%s, priority=100, table=1, ip6, ct_state=+trk+rel, ct_mark=%s, "+
1315-
"actions=output:%s",
1316-
defaultOpenFlowCookie, ctMarkHost, ofPortHost))
1333+
fmt.Sprintf("cookie=%s, priority=100, table=1, %s ip6, ct_state=+trk+rel, ct_mark=%s, "+
1334+
"actions=%soutput:%s",
1335+
defaultOpenFlowCookie, match_vlan, ctMarkHost, strip_vlan, ofPortHost))
1336+
13171337
}
13181338

13191339
// table 1, we check to see if this dest mac is the shared mac, if so send to host
13201340
dftFlows = append(dftFlows,
1321-
fmt.Sprintf("cookie=%s, priority=10, table=1, dl_dst=%s, actions=output:%s",
1322-
defaultOpenFlowCookie, bridgeMacAddress, ofPortHost))
1341+
fmt.Sprintf("cookie=%s, priority=10, table=1, %s dl_dst=%s, actions=%soutput:%s",
1342+
defaultOpenFlowCookie, match_vlan, bridgeMacAddress, strip_vlan, ofPortHost))
13231343
}
13241344

13251345
// table 2, dispatch from Host -> OVN
13261346
dftFlows = append(dftFlows,
13271347
fmt.Sprintf("cookie=%s, table=2, "+
1328-
"actions=set_field:%s->eth_dst,output:%s", defaultOpenFlowCookie, bridgeMacAddress, ofPortPatch))
1348+
"actions=set_field:%s->eth_dst,%soutput:%s", defaultOpenFlowCookie, bridgeMacAddress, mod_vlan_id, ofPortPatch))
13291349

13301350
// table 3, dispatch from OVN -> Host
13311351
dftFlows = append(dftFlows,
1332-
fmt.Sprintf("cookie=%s, table=3, "+
1333-
"actions=move:NXM_OF_ETH_DST[]->NXM_OF_ETH_SRC[],set_field:%s->eth_dst,output:%s",
1334-
defaultOpenFlowCookie, bridgeMacAddress, ofPortHost))
1352+
fmt.Sprintf("cookie=%s, table=3, %s "+
1353+
"actions=move:NXM_OF_ETH_DST[]->NXM_OF_ETH_SRC[],set_field:%s->eth_dst,%soutput:%s",
1354+
defaultOpenFlowCookie, match_vlan, bridgeMacAddress, strip_vlan, ofPortHost))
13351355

13361356
// table 4, hairpinned pkts that need to go from OVN -> Host
13371357
// We need to SNAT and masquerade OVN GR IP, send to table 3 for dispatch to Host
@@ -1374,11 +1394,20 @@ func commonFlows(subnets []*net.IPNet, bridge *bridgeConfiguration) ([]string, e
13741394

13751395
var dftFlows []string
13761396

1397+
strip_vlan := ""
1398+
match_vlan := ""
1399+
mod_vlan_id := ""
1400+
if config.Gateway.VLANID != 0 {
1401+
strip_vlan = "strip_vlan,"
1402+
match_vlan = fmt.Sprintf("dl_vlan=%d,", config.Gateway.VLANID)
1403+
mod_vlan_id = fmt.Sprintf("mod_vlan_vid:%d,", config.Gateway.VLANID)
1404+
}
1405+
13771406
if ofPortPhys != "" {
13781407
// table 0, we check to see if this dest mac is the shared mac, if so flood to both ports
13791408
dftFlows = append(dftFlows,
1380-
fmt.Sprintf("cookie=%s, priority=10, table=0, in_port=%s, dl_dst=%s, actions=output:%s,output:%s",
1381-
defaultOpenFlowCookie, ofPortPhys, bridgeMacAddress, ofPortPatch, ofPortHost))
1409+
fmt.Sprintf("cookie=%s, priority=10, table=0, in_port=%s, %s dl_dst=%s, actions=output:%s,%soutput:%s",
1410+
defaultOpenFlowCookie, ofPortPhys, match_vlan, bridgeMacAddress, ofPortPatch, strip_vlan, ofPortHost))
13821411
}
13831412

13841413
// table 0, check packets coming from OVN have the correct mac address. Low priority flows that are a catch all
@@ -1419,8 +1448,8 @@ func commonFlows(subnets []*net.IPNet, bridge *bridgeConfiguration) ([]string, e
14191448
// so that reverse direction goes back to the host.
14201449
dftFlows = append(dftFlows,
14211450
fmt.Sprintf("cookie=%s, priority=100, in_port=%s, ip, "+
1422-
"actions=ct(commit, zone=%d, exec(set_field:%s->ct_mark)), output:%s",
1423-
defaultOpenFlowCookie, ofPortHost, config.Default.ConntrackZone, ctMarkHost, ofPortPhys))
1451+
"actions=ct(commit, zone=%d, exec(set_field:%s->ct_mark)), %soutput:%s",
1452+
defaultOpenFlowCookie, ofPortHost, config.Default.ConntrackZone, ctMarkHost, mod_vlan_id, ofPortPhys))
14241453
}
14251454
if config.Gateway.Mode == config.GatewayModeLocal {
14261455
// table 0, any packet coming from OVN send to host in LGW mode, host will take care of sending it outside if needed.
@@ -1481,8 +1510,9 @@ func commonFlows(subnets []*net.IPNet, bridge *bridgeConfiguration) ([]string, e
14811510
// so that reverse direction goes back to the host.
14821511
dftFlows = append(dftFlows,
14831512
fmt.Sprintf("cookie=%s, priority=100, in_port=%s, ipv6, "+
1484-
"actions=ct(commit, zone=%d, exec(set_field:%s->ct_mark)), output:%s",
1485-
defaultOpenFlowCookie, ofPortHost, config.Default.ConntrackZone, ctMarkHost, ofPortPhys))
1513+
"actions=ct(commit, zone=%d, exec(set_field:%s->ct_mark)), %soutput:%s",
1514+
defaultOpenFlowCookie, ofPortHost, config.Default.ConntrackZone, ctMarkHost, mod_vlan_id, ofPortPhys))
1515+
14861516
}
14871517
if config.Gateway.Mode == config.GatewayModeLocal {
14881518
// table 0, any packet coming from OVN send to host in LGW mode, host will take care of sending it outside if needed.
@@ -1569,8 +1599,8 @@ func commonFlows(subnets []*net.IPNet, bridge *bridgeConfiguration) ([]string, e
15691599

15701600
// table 1, we check to see if this dest mac is the shared mac, if so send to host
15711601
dftFlows = append(dftFlows,
1572-
fmt.Sprintf("cookie=%s, priority=10, table=1, dl_dst=%s, actions=output:%s",
1573-
defaultOpenFlowCookie, bridgeMacAddress, ofPortHost))
1602+
fmt.Sprintf("cookie=%s, priority=10, table=1, %s dl_dst=%s, actions=%soutput:%s",
1603+
defaultOpenFlowCookie, match_vlan, bridgeMacAddress, strip_vlan, ofPortHost))
15741604

15751605
if config.IPv6Mode {
15761606
// REMOVEME(trozet) when https://bugzilla.kernel.org/show_bug.cgi?id=11797 is resolved

0 commit comments

Comments
 (0)