Bug 1550048

Description of problem:

In Open vSwitch we can track the network traffic for pod to pod communication using "ovs-appctl ofproto/trace"
The same command does not produce the desired output for ovs-networkpolicy even when the pods are able to communicate with each other.


How reproducible:

1.Cluster should have network plugin as network policy
2.No network policy defined on any namespace.


Steps to Reproduce:

Below are the steps carried out on test cluster  to check the traffic flow as per the article:- https://access.redhat.com/articles/3343171

#####################################################################
  PODS                               IP                     NODES
docker-registry-2-v82p5 ----> 10.129.0.26  ---->  vm252-23.gsslab.pnq2.redhat.com
apiserver-xt72c         ----> 10.128.0.171 ---->  vm253-114.gsslab.pnq2.redhat.com
######################################################################

[root@vm253-114 ~]# oc rsh apiserver-xt72c
sh-4.2$ ip a l | grep "eth0@if"
3: eth0@if224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP

 
[root@vm253-114 ~]# sudo ovs-ofctl -O OpenFlow13 show br0 | grep veth
19(veth5af26022): addr:12:e2:cb:d6:f2:79

[root@vm253-114 ~]# sudo  cat /sys/class/net/veth5af26022/ifindex
224

Actual results:

############################Result of the command#############################

[root@vm253-114 ~]# sudo ovs-appctl ofproto/trace br0 "in_port=19,ip,nw_src=10.128.0.171,nw_dst=10.129.0.26"
Flow: ip,in_port=19,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.171,nw_dst=10.129.0.26,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0

bridge("br0")
-------------
 0. ct_state=-trk,ip, priority 300
    ct(table=0)
    drop

Final flow: unchanged
Megaflow: recirc_id=0,ct_state=-trk,ip,in_port=19,nw_frag=no
Datapath actions: ct,recirc(0x9a66)

###########################################################################




Expected results:

###########################################################################

[admin@infra-0 ~]$ sudo ovs-appctl ofproto/trace br0 "in_port=10,ip,nw_src=10.128.0.9,nw_dst=10.128.0.7"
Flow: ip,in_port=10,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.9,nw_dst=10.128.0.7,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0

bridge("br0")
-------------
 0. ip, priority 100
    goto_table:20
20. ip,in_port=10,nw_src=10.128.0.9, priority 100
    load:0->NXM_NX_REG0[]
    goto_table:21
21. priority 0
    goto_table:30
30. ip,nw_dst=10.128.0.0/23, priority 200
    goto_table:70
70. ip,nw_dst=10.128.0.7, priority 100
    load:0->NXM_NX_REG1[]
    load:0x8->NXM_NX_REG2[]
    goto_table:80
80. priority 200
    output:NXM_NX_REG2[]
     -> output port is 8

Final flow: ip,reg2=0x8,in_port=10,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.9,nw_dst=10.128.0.7,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0
Megaflow: recirc_id=0,ip,in_port=10,nw_src=10.128.0.9,nw_dst=10.128.0.7,nw_frag=no
Datapath actions: 5
[admin@infra-0 ~]$ 

###########################################################################

Additional info:

These pods are from different nodes and were able to communicate with eachother and were tested when ping from within a pod to other pod's IP address.
The docker pod is in default project which has NETID as 0, hence globally accessible.