|
 |
ebb439 |
From 04a31bac15dec703643ed70c7bb42725bf5ed676 Mon Sep 17 00:00:00 2001
|
|
|
ebb439 |
From: Ihar Hrachyshka <ihrachys@redhat.com>
|
|
|
ebb439 |
Date: Mon, 9 Nov 2020 21:34:49 -0500
|
|
|
ebb439 |
Subject: [PATCH] Allow VLAN traffic when LS:vlan-passthru=true
|
|
|
ebb439 |
|
|
|
ebb439 |
A new other_config:vlan-passthru knob is added to Logical-Switches. When
|
|
|
ebb439 |
true, VLAN tagged incoming traffic is allowed. This option can be used
|
|
|
ebb439 |
to implement OpenStack Network VLAN transparency API extension [1].
|
|
|
ebb439 |
|
|
|
ebb439 |
[1] https://docs.openstack.org/api-ref/network/v2/index.html#vlan-transparency-extension
|
|
|
ebb439 |
|
|
|
ebb439 |
Signed-off-by: Ihar Hrachyshka <ihrachys@redhat.com>
|
|
|
ebb439 |
Signed-off-by: Numan Siddique <numans@ovn.org>
|
|
|
ebb439 |
(cherry picked from commit c29221d9322a34501cb74e255023827220c23a8b)
|
|
|
ebb439 |
---
|
|
|
ebb439 |
NEWS | 5 +++
|
|
|
ebb439 |
northd/ovn-northd.c | 14 +++++--
|
|
|
ebb439 |
ovn-nb.xml | 7 ++++
|
|
|
ebb439 |
tests/ovn.at | 92 +++++++++++++++++++++++++++++++++++++++++++++
|
|
|
ebb439 |
4 files changed, 115 insertions(+), 3 deletions(-)
|
|
|
ebb439 |
|
|
|
ebb439 |
diff --git a/NEWS b/NEWS
|
|
|
ebb439 |
index 0f4252347..46140208f 100644
|
|
|
ebb439 |
--- a/NEWS
|
|
|
ebb439 |
+++ b/NEWS
|
|
|
ebb439 |
@@ -1,3 +1,8 @@
|
|
|
ebb439 |
+Post-v20.09.0
|
|
|
ebb439 |
+---------------------
|
|
|
ebb439 |
+ - Support other_config:vlan-passthru=true to allow VLAN tagged incoming
|
|
|
ebb439 |
+ traffic.
|
|
|
ebb439 |
+
|
|
|
ebb439 |
OVN v20.09.0 - 28 Sep 2020
|
|
|
ebb439 |
--------------------------
|
|
|
ebb439 |
- Added packet marking support for traffic routed with
|
|
|
ebb439 |
diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
|
|
|
ebb439 |
index a158a73a7..d2540a315 100644
|
|
|
ebb439 |
--- a/northd/ovn-northd.c
|
|
|
ebb439 |
+++ b/northd/ovn-northd.c
|
|
|
ebb439 |
@@ -6781,6 +6781,12 @@ build_drop_arp_nd_flows_for_unbound_router_ports(struct ovn_port *op,
|
|
|
ebb439 |
ds_destroy(&match);
|
|
|
ebb439 |
}
|
|
|
ebb439 |
|
|
|
ebb439 |
+static bool
|
|
|
ebb439 |
+is_vlan_transparent(const struct ovn_datapath *od)
|
|
|
ebb439 |
+{
|
|
|
ebb439 |
+ return smap_get_bool(&od->nbs->other_config, "vlan-passthru", false);
|
|
|
ebb439 |
+}
|
|
|
ebb439 |
+
|
|
|
ebb439 |
static void
|
|
|
ebb439 |
build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
|
|
|
ebb439 |
struct hmap *port_groups, struct hmap *lflows,
|
|
|
ebb439 |
@@ -6828,9 +6834,11 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
|
|
|
ebb439 |
continue;
|
|
|
ebb439 |
}
|
|
|
ebb439 |
|
|
|
ebb439 |
- /* Logical VLANs not supported. */
|
|
|
ebb439 |
- ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_L2, 100, "vlan.present",
|
|
|
ebb439 |
- "drop;");
|
|
|
ebb439 |
+ if (!is_vlan_transparent(od)) {
|
|
|
ebb439 |
+ /* Block logical VLANs. */
|
|
|
ebb439 |
+ ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_L2, 100,
|
|
|
ebb439 |
+ "vlan.present", "drop;");
|
|
|
ebb439 |
+ }
|
|
|
ebb439 |
|
|
|
ebb439 |
/* Broadcast/multicast source address is invalid. */
|
|
|
ebb439 |
ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_L2, 100, "eth.src[40]",
|
|
|
ebb439 |
diff --git a/ovn-nb.xml b/ovn-nb.xml
|
|
|
ebb439 |
index 43694535e..451842588 100644
|
|
|
ebb439 |
--- a/ovn-nb.xml
|
|
|
ebb439 |
+++ b/ovn-nb.xml
|
|
|
ebb439 |
@@ -512,6 +512,13 @@
|
|
|
ebb439 |
</column>
|
|
|
ebb439 |
</group>
|
|
|
ebb439 |
|
|
|
ebb439 |
+ <group title="Other options">
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ type='{"type": "boolean"}'>
|
|
|
ebb439 |
+ Determines whether VLAN tagged incoming traffic should be allowed.
|
|
|
ebb439 |
+ </column>
|
|
|
ebb439 |
+ </group>
|
|
|
ebb439 |
+
|
|
|
ebb439 |
<group title="Common Columns">
|
|
|
ebb439 |
<column name="external_ids">
|
|
|
ebb439 |
See External IDs at the beginning of this document.
|
|
|
ebb439 |
diff --git a/tests/ovn.at b/tests/ovn.at
|
|
|
ebb439 |
index 180fb91e3..f6523a109 100644
|
|
|
ebb439 |
--- a/tests/ovn.at
|
|
|
ebb439 |
+++ b/tests/ovn.at
|
|
|
ebb439 |
@@ -3015,6 +3015,98 @@ OVN_CLEANUP([hv-1],[hv-2])
|
|
|
ebb439 |
|
|
|
ebb439 |
AT_CLEANUP
|
|
|
ebb439 |
|
|
|
ebb439 |
+AT_SETUP([ovn -- VLAN transparency, passthru=true])
|
|
|
ebb439 |
+ovn_start
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ovn-nbctl ls-add ls
|
|
|
ebb439 |
+ovn-nbctl --wait=sb add Logical-Switch ls other_config vlan-passthru=true
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ ovn-nbctl lsp-add ls lsp$i
|
|
|
ebb439 |
+ ovn-nbctl lsp-set-addresses lsp$i f0:00:00:00:00:0$i
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+net_add physnet
|
|
|
ebb439 |
+ovs-vsctl add-br br-phys
|
|
|
ebb439 |
+ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet:br-phys
|
|
|
ebb439 |
+ovn_attach physnet br-phys 192.168.0.1
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ ovs-vsctl add-port br-int vif$i -- set Interface vif$i external-ids:iface-id=lsp$i \
|
|
|
ebb439 |
+ options:tx_pcap=vif$i-tx.pcap \
|
|
|
ebb439 |
+ options:rxq_pcap=vif$i-rx.pcap \
|
|
|
ebb439 |
+ ofport-request=$i
|
|
|
ebb439 |
+ OVS_WAIT_UNTIL([test x`ovn-nbctl lsp-get-up lsp$i` = xup])
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+test_packet() {
|
|
|
ebb439 |
+ local inport=$1 dst=$2 src=$3 eth=$4 eout=$5 lout=$6
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ # First try tracing the packet.
|
|
|
ebb439 |
+ uflow="inport==\"lsp$inport\" && eth.dst==$dst && eth.src==$src && eth.type==0x$eth && vlan.present==1"
|
|
|
ebb439 |
+ echo "output(\"$lout\");" > expout
|
|
|
ebb439 |
+ AT_CAPTURE_FILE([trace])
|
|
|
ebb439 |
+ AT_CHECK([ovn-trace --all ls "$uflow" | tee trace | sed '1,/Minimal trace/d'], [0], [expout])
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ # Then actually send a packet, for an end-to-end test.
|
|
|
ebb439 |
+ local packet=$(echo $dst$src | sed 's/://g')${eth}fefefefe
|
|
|
ebb439 |
+ vif=vif$inport
|
|
|
ebb439 |
+ ovs-appctl netdev-dummy/receive $vif $packet
|
|
|
ebb439 |
+ echo $packet >> ${eout#lsp}.expected
|
|
|
ebb439 |
+}
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+test_packet 1 f0:00:00:00:00:02 f0:00:00:00:00:01 8100 lsp2 lsp2
|
|
|
ebb439 |
+test_packet 2 f0:00:00:00:00:01 f0:00:00:00:00:02 8100 lsp1 lsp1
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ OVN_CHECK_PACKETS_REMOVE_BROADCAST([vif$i-tx.pcap], [$i.expected])
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+AT_CLEANUP
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+AT_SETUP([ovn -- VLAN transparency, passthru=false])
|
|
|
ebb439 |
+ovn_start
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ovn-nbctl ls-add ls
|
|
|
ebb439 |
+ovn-nbctl --wait=sb add Logical-Switch ls other_config vlan-passthru=false
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ ovn-nbctl lsp-add ls lsp$i
|
|
|
ebb439 |
+ ovn-nbctl lsp-set-addresses lsp$i f0:00:00:00:00:0$i
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+net_add physnet
|
|
|
ebb439 |
+ovs-vsctl add-br br-phys
|
|
|
ebb439 |
+ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet:br-phys
|
|
|
ebb439 |
+ovn_attach physnet br-phys 192.168.0.1
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ ovs-vsctl add-port br-int vif$i -- set Interface vif$i external-ids:iface-id=lsp$i \
|
|
|
ebb439 |
+ options:tx_pcap=vif$i-tx.pcap \
|
|
|
ebb439 |
+ options:rxq_pcap=vif$i-rx.pcap \
|
|
|
ebb439 |
+ ofport-request=$i
|
|
|
ebb439 |
+ OVS_WAIT_UNTIL([test x`ovn-nbctl lsp-get-up lsp$i` = xup])
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ : > $i.expected
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+test_packet() {
|
|
|
ebb439 |
+ local inport=$1 dst=$2 src=$3 eth=$4 eout=$5 lout=$6
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ # First try tracing the packet.
|
|
|
ebb439 |
+ uflow="inport==\"lsp$inport\" && eth.dst==$dst && eth.src==$src && eth.type==0x$eth && vlan.present==1"
|
|
|
ebb439 |
+ AT_CHECK([ovn-trace --all ls "$uflow" | grep drop], [0], [ignore])
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+ # Then actually send a packet, for an end-to-end test.
|
|
|
ebb439 |
+ local packet=$(echo $dst$src | sed 's/://g')${eth}fefefefe
|
|
|
ebb439 |
+ ovs-appctl netdev-dummy/receive vif$inport $packet
|
|
|
ebb439 |
+}
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+test_packet 1 f0:00:00:00:00:02 f0:00:00:00:00:01 8100 lsp2 lsp2
|
|
|
ebb439 |
+test_packet 2 f0:00:00:00:00:01 f0:00:00:00:00:02 8100 lsp1 lsp1
|
|
|
ebb439 |
+for i in 1 2; do
|
|
|
ebb439 |
+ OVN_CHECK_PACKETS_REMOVE_BROADCAST([vif$i-tx.pcap], [$i.expected])
|
|
|
ebb439 |
+done
|
|
|
ebb439 |
+
|
|
|
ebb439 |
+AT_CLEANUP
|
|
|
ebb439 |
+
|
|
|
ebb439 |
AT_SETUP([ovn -- 2 HVs, 1 LS, no switching between multiple localnet ports with different tags])
|
|
|
ebb439 |
ovn_start
|
|
|
ebb439 |
|
|
|
ebb439 |
--
|
|
|
ebb439 |
2.28.0
|
|
|
ebb439 |
|