Bug 2117896

Summary: OVS TC offload ignores ct_tuple keys in original flow
Product: Red Hat Enterprise Linux Fast Datapath Reporter: Ariel Levkovich <lariel>
Component: openvswitch2.17Assignee: Eelco Chaudron <echaudro>
Status: CLOSED INSUFFICIENT_DATA QA Contact: ovs-qe
Severity: medium Docs Contact:
Priority: unspecified    
Version: RHEL 8.0CC: ctrautma, fleitner, jhsiao, mleitner, ralongi
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-07-04 08:18:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2172622    

Description Ariel Levkovich 2022-08-12 14:12:17 UTC 
During the parsing of the OVS flow match masks and values to fill in the TC flower offload request, the logic ignores/skips the ct original tuple fields in the OVS original flow.

In case there was an actual mask on one of those fields it will not be included in the offloaded flow and the TC flow won't match the original OVS flow.

Parser should address all fields in the original flow when preparing for offload and abort the request in case unsupported fields have a mask.
Comment 1 Eelco Chaudron 2023-06-19 14:13:16 UTC 
Can you give an example of missing fields, including a datapath flow dump?
Comment 2 Eelco Chaudron 2023-06-19 14:18:12 UTC 
There was also the below patch (and some more tc related changes the last couple of months), so maybe the problem has been resolved?

commit a039636950c563a40abd042b84541107c225b05d
Author: Eelco Chaudron <echaudro>
Date:   Tue Feb 22 16:23:43 2022 +0100

    netdev-offload-tc: Always include conntrack information to tc.
    
    Regardless of the traffic type, if requested, the conntrack information
    should be included to keep the datapath and tc rules in sync.
    
    Signed-off-by: Eelco Chaudron <echaudro>
    Acked-by: Roi Dayan <roid>
    Signed-off-by: Ilya Maximets <i.maximets>

Can you let me know?
Comment 4 Marcelo Ricardo Leitner 2023-06-29 20:07:09 UTC 
I believe he referred to ct_tuple() match, and that when translating the datapath flow to tc flower, it is ignoring the fact that the wanted flow had ct_tuple() match and will install a tc flower without it.

But I seem to remember that ovs had a catch-all condition for matches that didn't get translated. I don't remember where that is on the code, so I couldn't find right now, but I believe it is handled.
Comment 5 Eelco Chaudron 2023-07-04 08:18:12 UTC 
From the OVS-TC perspective, we have no explicit ct_tuple, whatever is in the flow/mask for the tuple parameters we match on it. 

I guess for now we will close this BZ until we get a more detailed explanation of the problem.