From e00d6083ad1ee972ec3705401dc9c8d43cd43f7d Mon Sep 17 00:00:00 2001

From: Ankur Sharma <ankur.sharma@nutanix.com>

Date: Wed, 28 Aug 2019 01:55:29 +0000

Subject: [PATCH 03/12] OVN: Vlan backed DVR N-S, avoid get_arp on non redirect

 chassis.

Background:

With 795d7f24ce0e ("OVN: Enable E-W Traffic, Vlan backed DVR"), we have added

support for E-W workflow for vlan backed DVRs.

This series enables N-S workflow for vlan backed DVRs.

Key difference between E-W and N-S traffic flow is that

N-S flow requires a gateway chassis. A gateway chassis

will be respondible for following:

a. Doing Network Address Translation (NAT).

b. Becoming entry and exit point for North->South

   and South->North traffic respectively.

OVN by default always uses overlay encapsulation to redirect

the packet to gateway chassis. This series will enable

the redirection to gateway chassis in the absence of encapsulation.

This patch:

a. Make sure that ARP request for endpoint behind the gateway

   router port is sent from gateway chassis only and not from

   host(compute) chassis.

b. This is achieved by adding a new logical flow in

   lr_in_arp_resolve at priority=50.

c. This flow run on non gateway chassis and sets the destination

   mac to router port mac, if outport is a gateway chassis attached

   router port and redirect-type is set as "bridged".

   Example logical flow:

   table=9 (lr_in_arp_resolve  ), priority=50   , match=(outport == "router-to-underlay" && !is_chassis_resident("cr-router-to-underlay")), action=(eth.dst = 00:00:01:01:02:04; next;)

d. This change is needed because other wise for non resolved ARPs,

   we will end up doing get_arp in host chassis. Doing so will

   have following issues:

   i. We want all the interation with North bound endpoints via

      gateway chassis only, doing so on host chassis will violate

      that.

  ii. With get_arp, ovn-controller will generate the ARP using router

      port's mac as source mac, which will lead us to the same issue,

      where router port mac will be going through continous mac moves

      in physical network. Worst, it would affect the redirection,

      since it uses router port mac as destination mac.

Signed-off-by: Ankur Sharma <ankur.sharma@nutanix.com>

Signed-off-by: Numan Siddique <nusiddiq@redhat.com>

---

 ovn/northd/ovn-northd.8.xml | 12 ++++++++++++

 ovn/northd/ovn-northd.c     | 22 ++++++++++++++++++++++

 2 files changed, 34 insertions(+)

diff --git a/ovn/northd/ovn-northd.8.xml b/ovn/northd/ovn-northd.8.xml

index dc5fdf471..83c90d680 100644

--- a/ovn/northd/ovn-northd.8.xml

+++ b/ovn/northd/ovn-northd.8.xml

@@ -2422,6 +2422,18 @@ next;

           get_nd(outport, xxreg0); next;.

+

+      

+        

+          For logical router port with redirect-chassis and redirect-type

+          being set as bridged, a priority-50 flow will match

+          outport == "ROUTER_PORT" and !is_chassis_resident

+          ("cr-ROUTER_PORT") has actions eth.dst = E;

+          next;, where E is the ethernet address of the

+          logical router port.

+        

+      

+

     
Ingress Table 11: Check packet length

diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c

index cd13f308e..27e90fcb2 100644

--- a/ovn/northd/ovn-northd.c

+++ b/ovn/northd/ovn-northd.c

@@ -8459,6 +8459,28 @@ build_lrouter_flows(struct hmap *datapaths, struct hmap *ports,

                                   100, ds_cstr(&match), ds_cstr(&actions));

                 }

             }

+

+            if (!op->derived && op->od->l3redirect_port) {

+                const char *redirect_type = smap_get(&op->nbrp->options,

+                                                     "redirect-type");

+                if (redirect_type && !strcasecmp(redirect_type, "bridged")) {

+                    /* Packet is on a non gateway chassis and

+                     * has an unresolved ARP on a network behind gateway

+                     * chassis attached router port. Since, redirect type

+                     * is set to vlan, hence instead of calling "get_arp"

+                     * on this node, we will redirect the packet to gateway

+                     * chassis, by setting destination mac router port mac.*/

+                    ds_clear(&match);

+                    ds_put_format(&match, "outport == %s && "

+                                  "!is_chassis_resident(%s)", op->json_key,

+                                  op->od->l3redirect_port->json_key);

+                    ds_clear(&actions);

+                    ds_put_format(&actions, "eth.dst = %s; next;",

+                                  op->lrp_networks.ea_s);

+                    ovn_lflow_add(lflows, op->od, S_ROUTER_IN_ARP_RESOLVE,

+                                  50, ds_cstr(&match), ds_cstr(&actions));

+                }

+            }

         } else if (op->od->n_router_ports && strcmp(op->nbsp->type, "router")

                    && strcmp(op->nbsp->type, "virtual")) {

             /* This is a logical switch port that backs a VM or a container.

-- 

2.23.0