Bug 2149021 - SNAT commits every packet to CT
Summary: SNAT commits every packet to CT
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux Fast Datapath
Classification: Red Hat
Component: ovn22.09
Version: FDP 22.E
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: OVN Team
QA Contact: Jianlin Shi
URL:
Whiteboard:
Depends On:
Blocks: 2172622
TreeView+ depends on / blocked
 
Reported: 2022-11-28 15:32 UTC by Ales Musil
Modified: 2023-07-28 18:24 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FD-2511 0 None None None 2022-11-28 16:07:23 UTC

Description Ales Musil 2022-11-28 15:32:12 UTC
Description of problem:
OVN commits every packet that goes through source nat.

We have an action in the router pipeline that deals with the SNAT:

table=3 (lr_out_snat        ), priority=161  , match=(ip && ip4.src == 192.168.10.10 && outport == "lr-ls1" && is_chassis_resident("cr-lr-ls1")), action=(ct_snat_in_czone(192.168.20.10);)

This action actually does not filter on ct_state so we don't know if the traffic
was commited already or not which results in commiting every packet. 

The resulting OvS flows are as follow:

recirc_id(0x1),in_port(3),ct_mark(0/0x2),eth(src=00:00:00:00:20:00,dst=00:00:00:00:20:10),eth_type(0x0800),ipv4(dst=192.168.20.16/255.255.255.240,frag=no), packets:4, bytes:270, used:0.005s, flags:FP., actions:ct_clear,4
 
recirc_id(0),in_port(3),ct_mark(0/0x2),eth(src=00:00:00:00:10:10,dst=00:00:00:00:10:00),eth_type(0x0800),ipv4(src=192.168.10.10,dst=192.168.20.20,ttl=64,frag=no), packets:4, bytes:270, used:0.005s, flags:FP., actions:set(eth(src=00:00:00:00:20:00,dst=00:00:00:00:20:10)),set(ipv4(ttl=63)),ct(commit,zone=4,nat(src=192.168.20.10)),recirc(0x1)



The problem is that this might not work very well with HWOL.


Note You need to log in before you can comment on or make changes to this bug.