Bug 2120546

Summary: [RFE] Add OpenFlow extension to allow more extensive filtering when flushing conntrack.
Product: Red Hat Enterprise Linux Fast Datapath Reporter: Dumitru Ceara <dceara>
Component: openvswitch3.1Assignee: Ales Musil <amusil>
Status: CLOSED CURRENTRELEASE QA Contact: Jiying Qiu <jiqiu>
Severity: high Docs Contact:
Priority: unspecified    
Version: FDP 22.ECC: amusil, ctrautma, jhsiao, jiqiu, ralongi
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openvswitch3.1-3.1.0-3.el8fdp Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 10:33:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1839103    

Description Dumitru Ceara 2022-08-23 08:35:41 UTC 
Description of problem:

OVS currently supports an OpenFlow extension (OFPRAW_NXT_CT_FLUSH_ZONE) to flush all conntrack entries in a given zone:

https://github.com/openvswitch/ovs/blob/ff55e8f3858ae153ef1996df3d52938f3df6d950/include/openvswitch/ofp-msgs.h#L515

/* NXT_CT_FLUSH_ZONE.
 *
 * Flushes the connection tracking table. */
struct nx_zone_id {
    uint8_t zero[6];            /* Must be zero. */
    ovs_be16 zone_id;           /* Connection tracking zone. */
}

It would be desirable to be able to flush a subset of the conntrack entries in a zone.  The subset could be defined by a (potentially partial) tuple of the form: IP, L4 proto, L4 port.

For example, OVN would use this feature to clear conntrack entries that correspond to a load balancer backend ("IP:PROTO:PORT") that was recently removed (bug 1839103).  This means that all conntrack records that use IP, PROTO and PORT either in the original or in the reply direction need to be flushed.

Note: OVS must be able to indicate to the controller whether this extension is supported or not, for example, via the vswitchd.Datapath.capabilities column in the local OVSDB.