Bug 1832176
Summary: | tcp reset packet is not sent after acl reject is added in special environment | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux Fast Datapath | Reporter: | Jianlin Shi <jishi> | ||||||
Component: | ovn2.13 | Assignee: | Numan Siddique <nusiddiq> | ||||||
Status: | CLOSED ERRATA | QA Contact: | Jianlin Shi <jishi> | ||||||
Severity: | medium | Docs Contact: | |||||||
Priority: | medium | ||||||||
Version: | FDP 20.D | CC: | ctrautma, dcbw, jishi, nusiddiq, ralongi | ||||||
Target Milestone: | --- | Keywords: | Regression | ||||||
Target Release: | --- | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Whiteboard: | |||||||||
Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
Doc Text: | Story Points: | --- | |||||||
Clone Of: | Environment: | ||||||||
Last Closed: | 2020-07-15 13:00:54 UTC | Type: | Bug | ||||||
Regression: | --- | Mount Type: | --- | ||||||
Documentation: | --- | CRM: | |||||||
Verified Versions: | Category: | --- | |||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||
Embargoed: | |||||||||
Attachments: |
|
Description
Jianlin Shi
2020-05-06 09:31:12 UTC
the issue doesn't exist on ovn2.13.0-11, set regression Created attachment 1685619 [details]
ovnnb_db.db
Created attachment 1685620 [details]
ovnsb_db.db
In this case the first tcp pkt goes from ls2p1 -> ls2 -> lr1 -> ls1 -> ovn-controller (and it generates the tcp rst) and this tcp rst goes from ovn-controller -> ls1 (ingress pipeline) > lr1 -> ls2 -> and the pkt gets dropped in table 42. table=42, priority=100,ip,reg0=0x1/0x1,metadata=0x3 actions=ct(table=43,zone=NXM_NX_REG13[0..15]) We see the below warning logs in ovs-vswitchd 2020-05-06T10:29:05.084Z|00025|ofproto_dpif_upcall(handler1)|INFO|received packet on unassociated datapath port 4294967295 2020-05-06T10:29:05.251Z|00080|ofproto_dpif_upcall(revalidator37)|WARN|Failed to acquire udpif_key corresponding to unexpected flow (Invalid argument): ufid:0daac824-bda7-44d8-ad38-cdd9c5f0fc97 2020-05-06T10:29:06.127Z|00001|ofproto_dpif_upcall(handler12)|INFO|received packet on unassociated datapath port 4294967295 2020-05-06T10:29:06.253Z|00081|ofproto_dpif_upcall(revalidator37)|WARN|Failed to acquire udpif_key corresponding to unexpected flow (Invalid argument): ufid:e8e88f04-c1bd-4f64-87e6-9698b78c195f Earlier, it worked because we were by passing the tcp rst packets from conntrack. I'll debug further to see why the pkt is getting dropped by ovs-vswitchd during upcall. Verified on ovn2.13-2.13.0-37.el8fdp.x86_64: [root@dell-per740-12 bz1832176]# rpm -qa | grep -E "openvswitch|ovn" openvswitch2.13-2.13.0-40.el8fdb.x86_64 ovn2.13-2.13.0-37.el8fdp.x86_64 openvswitch-selinux-extra-policy-1.0-23.el8fdp.noarch ovn2.13-central-2.13.0-37.el8fdp.x86_64 ovn2.13-host-2.13.0-37.el8fdp.x86_64 [root@dell-per740-12 bz1832176]# ip netns exec server2 nc 192.168.1.1 22 <<< h Ncat: Connection refused. <=== tcp reset sent [root@dell-per740-12 bz1832176]# ip netns exec server2 nc 192.168.1.2 22 <<< h Ncat: Connection refused. Verified on ovn2.13-2.13.0-37.el7fdp.x86_64: [root@dell-per740-42 bz1832176]# rpm -qa | grep -E "openvswitch|ovn" ovn2.13-central-2.13.0-37.el7fdp.x86_64 openvswitch2.13-2.13.0-30.el7fdp.x86_64 ovn2.13-host-2.13.0-37.el7fdp.x86_64 ovn2.13-2.13.0-37.el7fdp.x86_64 openvswitch-selinux-extra-policy-1.0-15.el7fdp.noarch [root@dell-per740-42 bz1832176]# ip netns exec server2 nc 192.168.1.1 22 <<< h Ncat: Connection refused. <=== tcp reset sent [root@dell-per740-42 bz1832176]# ip netns exec server2 nc 192.168.1.2 22 <<< h Ncat: Connection refused. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2941 |