From 84d337ec6c4a15154de2e8dd7b53d3626814d7a9 Mon Sep 17 00:00:00 2001

Message-Id: <84d337ec6c4a15154de2e8dd7b53d3626814d7a9.1569932887.git.lorenzo.bianconi@redhat.com>

In-Reply-To: <9c04a4b62484895dc301875ad9da7c77c17a99c7.1569932887.git.lorenzo.bianconi@redhat.com>

References: <9c04a4b62484895dc301875ad9da7c77c17a99c7.1569932887.git.lorenzo.bianconi@redhat.com>

From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

Date: Tue, 24 Sep 2019 18:39:56 +0200

Subject: [PATCH ovn 3/3] northd: introduce logical flow for localnet egress

 shaping

Add set_queue() action for qos capable localnet port in

S_SWITCH_OUT_PORT_SEC_L2 stage of logical swith pipeline

Introduce build_lswitch_{input,outpur}_port_sec and refactor

lswitch_port_security code in order to remove duplicated code

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

Signed-off-by: Mark Michelson <mmichels@redhat.com>

Acked-by: Mark Michelson <mmichels@redhat.com>

---

 ovn/northd/ovn-northd.8.xml |   7 +-

 ovn/northd/ovn-northd.c     | 231 ++++++++++++++++++++++++----------------

 2 files changed, 143 insertions(+), 95 deletions(-)

--- a/ovn/northd/ovn-northd.8.xml

+++ b/ovn/northd/ovn-northd.8.xml

@@ -1120,10 +1120,15 @@ output;

       eth.dst are always accepted instead of being subject to the

       port security rules; this is implemented through a priority-100 flow that

       matches on eth.mcast with action output;.

-      Finally, to ensure that even broadcast and multicast packets are not

+      Moreover, to ensure that even broadcast and multicast packets are not

       delivered to disabled logical ports, a priority-150 flow for each

       disabled logical outport overrides the priority-100 flow

       with a drop; action.

+      Finally if egress qos has been enabled on a localnet port, the outgoing

+      queue id is set through set_queue action. Please remember to

+      mark the corresponding physical interface with

+      ovn-egress-iface set to true in 

+      table="Interface" db="Open_vSwitch"/>

     
Logical Router Datapaths

--- a/ovn/northd/ovn-northd.c

+++ b/ovn/northd/ovn-northd.c

@@ -3771,6 +3771,140 @@ has_stateful_acl(struct ovn_datapath *od

 }

 static void

+build_lswitch_input_port_sec(struct hmap *ports, struct hmap *datapaths,

+                             struct hmap *lflows)

+{

+    /* Logical switch ingress table 0: Ingress port security - L2

+     *  (priority 50).

+     *  Ingress table 1: Ingress port security - IP (priority 90 and 80)

+     *  Ingress table 2: Ingress port security - ND (priority 90 and 80)

+     */

+    struct ds actions = DS_EMPTY_INITIALIZER;

+    struct ds match = DS_EMPTY_INITIALIZER;

+    struct ovn_port *op;

+

+    HMAP_FOR_EACH (op, key_node, ports) {

+        if (!op->nbsp) {

+            continue;

+        }

+

+        if (!lsp_is_enabled(op->nbsp)) {

+            /* Drop packets from disabled logical ports (since logical flow

+             * tables are default-drop). */

+            continue;

+        }

+

+        if (lsp_is_external(op->nbsp)) {

+            continue;

+        }

+

+        ds_clear(&match);

+        ds_clear(&actions);

+        ds_put_format(&match, "inport == %s", op->json_key);

+        build_port_security_l2("eth.src", op->ps_addrs, op->n_ps_addrs,

+                               &match);

+

+        const char *queue_id = smap_get(&op->sb->options, "qdisc_queue_id");

+        if (queue_id) {

+            ds_put_format(&actions, "set_queue(%s); ", queue_id);

+        }

+        ds_put_cstr(&actions, "next;");

+        ovn_lflow_add(lflows, op->od, S_SWITCH_IN_PORT_SEC_L2, 50,

+                      ds_cstr(&match), ds_cstr(&actions));

+

+        if (op->nbsp->n_port_security) {

+            build_port_security_ip(P_IN, op, lflows);

+            build_port_security_nd(op, lflows);

+        }

+    }

+

+    /* Ingress table 1 and 2: Port security - IP and ND, by default

+     * goto next. (priority 0)

+     */

+    struct ovn_datapath *od;

+    HMAP_FOR_EACH (od, key_node, datapaths) {

+        if (!od->nbs) {

+            continue;

+        }

+

+        ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_ND, 0, "1", "next;");

+        ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_IP, 0, "1", "next;");

+    }

+

+    ds_destroy(&match);

+    ds_destroy(&actions);

+}

+

+static void

+build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,

+                              struct hmap *lflows)

+{

+    struct ds actions = DS_EMPTY_INITIALIZER;

+    struct ds match = DS_EMPTY_INITIALIZER;

+    struct ovn_port *op;

+

+    /* Egress table 8: Egress port security - IP (priorities 90 and 80)

+     * if port security enabled.

+     *

+     * Egress table 9: Egress port security - L2 (priorities 50 and 150).

+     *

+     * Priority 50 rules implement port security for enabled logical port.

+     *

+     * Priority 150 rules drop packets to disabled logical ports, so that

+     * they don't even receive multicast or broadcast packets.

+     */

+    HMAP_FOR_EACH (op, key_node, ports) {

+        if (!op->nbsp || lsp_is_external(op->nbsp)) {

+            continue;

+        }

+

+        ds_clear(&actions);

+        ds_clear(&match);

+

+        ds_put_format(&match, "outport == %s", op->json_key);

+        if (lsp_is_enabled(op->nbsp)) {

+            build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,

+                                   &match);

+

+            if (!strcmp(op->nbsp->type, "localnet")) {

+                const char *queue_id = smap_get(&op->sb->options,

+                                                "qdisc_queue_id");

+                if (queue_id) {

+                    ds_put_format(&actions, "set_queue(%s); ", queue_id);

+                }

+            }

+            ds_put_cstr(&actions, "output;");

+            ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 50,

+                              ds_cstr(&match), ds_cstr(&actions));

+        } else {

+            ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 150,

+                          ds_cstr(&match), "drop;");

+        }

+

+        if (op->nbsp->n_port_security) {

+            build_port_security_ip(P_OUT, op, lflows);

+        }

+    }

+

+    /* Egress tables 8: Egress port security - IP (priority 0)

+     * Egress table 9: Egress port security L2 - multicast/broadcast

+     *                 (priority 100). */

+    struct ovn_datapath *od;

+    HMAP_FOR_EACH (od, key_node, datapaths) {

+        if (!od->nbs) {

+            continue;

+        }

+

+        ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");

+        ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",

+                      "output;");

+    }

+

+    ds_destroy(&match);

+    ds_destroy(&actions);

+}

+

+static void

 build_pre_acls(struct ovn_datapath *od, struct hmap *lflows)

 {

     bool has_stateful = has_stateful_acl(od);

@@ -4841,61 +4975,12 @@ build_lswitch_flows(struct hmap *datapat

          * to the next table if packet source is acceptable. */

     }

-    /* Logical switch ingress table 0: Ingress port security - L2

-     *  (priority 50).

-     *  Ingress table 1: Ingress port security - IP (priority 90 and 80)

-     *  Ingress table 2: Ingress port security - ND (priority 90 and 80)

-     */

-    struct ovn_port *op;

-    HMAP_FOR_EACH (op, key_node, ports) {

-        if (!op->nbsp) {

-            continue;

-        }

-

-        if (!lsp_is_enabled(op->nbsp)) {

-            /* Drop packets from disabled logical ports (since logical flow

-             * tables are default-drop). */

-            continue;

-        }

-

-        if (lsp_is_external(op->nbsp)) {

-            continue;

-        }

-

-        ds_clear(&match);

-        ds_clear(&actions);

-        ds_put_format(&match, "inport == %s", op->json_key);

-        build_port_security_l2("eth.src", op->ps_addrs, op->n_ps_addrs,

-                               &match);

-

-        const char *queue_id = smap_get(&op->sb->options, "qdisc_queue_id");

-        if (queue_id) {

-            ds_put_format(&actions, "set_queue(%s); ", queue_id);

-        }

-        ds_put_cstr(&actions, "next;");

-        ovn_lflow_add(lflows, op->od, S_SWITCH_IN_PORT_SEC_L2, 50,

-                      ds_cstr(&match), ds_cstr(&actions));

-

-        if (op->nbsp->n_port_security) {

-            build_port_security_ip(P_IN, op, lflows);

-            build_port_security_nd(op, lflows);

-        }

-    }

-

-    /* Ingress table 1 and 2: Port security - IP and ND, by default goto next.

-     * (priority 0)*/

-    HMAP_FOR_EACH (od, key_node, datapaths) {

-        if (!od->nbs) {

-            continue;

-        }

-

-        ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_ND, 0, "1", "next;");

-        ovn_lflow_add(lflows, od, S_SWITCH_IN_PORT_SEC_IP, 0, "1", "next;");

-    }

+    build_lswitch_input_port_sec(ports, datapaths, lflows);

     /* Ingress table 11: ARP/ND responder, skip requests coming from localnet

      * and vtep ports. (priority 100); see ovn-northd.8.xml for the

      * rationale. */

+    struct ovn_port *op;

     HMAP_FOR_EACH (op, key_node, ports) {

         if (!op->nbsp) {

             continue;

@@ -5501,49 +5586,7 @@ build_lswitch_flows(struct hmap *datapat

         }

     }

-    /* Egress tables 8: Egress port security - IP (priority 0)

-     * Egress table 9: Egress port security L2 - multicast/broadcast

-     *                 (priority 100). */

-    HMAP_FOR_EACH (od, key_node, datapaths) {

-        if (!od->nbs) {

-            continue;

-        }

-

-        ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");

-        ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",

-                      "output;");

-    }

-

-    /* Egress table 8: Egress port security - IP (priorities 90 and 80)

-     * if port security enabled.

-     *

-     * Egress table 9: Egress port security - L2 (priorities 50 and 150).

-     *

-     * Priority 50 rules implement port security for enabled logical port.

-     *

-     * Priority 150 rules drop packets to disabled logical ports, so that they

-     * don't even receive multicast or broadcast packets. */

-    HMAP_FOR_EACH (op, key_node, ports) {

-        if (!op->nbsp || lsp_is_external(op->nbsp)) {

-            continue;

-        }

-

-        ds_clear(&match);

-        ds_put_format(&match, "outport == %s", op->json_key);

-        if (lsp_is_enabled(op->nbsp)) {

-            build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,

-                                   &match);

-            ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 50,

-                          ds_cstr(&match), "output;");

-        } else {

-            ovn_lflow_add(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2, 150,

-                          ds_cstr(&match), "drop;");

-        }

-

-        if (op->nbsp->n_port_security) {

-            build_port_security_ip(P_OUT, op, lflows);

-        }

-    }

+    build_lswitch_output_port_sec(ports, datapaths, lflows);

     ds_destroy(&match);

     ds_destroy(&actions);