Uploaded image for project: 'Fast Datapath Product'
  1. Fast Datapath Product
  2. FDP-1154

Tiered ACLs are broken with allow-related ACLs.

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • FDP-25.A
    • None
    • ovn24.09
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • ovn24.09-24.09.2-23.el9fdp
    • rhel-9
    • None
    • rhel-net-ovn
    • ssg_networking
    • +

       Problem Description: Clearly explain the issue.

       

      After the commit [1], tiered ACLs are broken.

       

      To reproduce the issue, create a logical switch and add the below logical flows

       

      ovn-nbctl ls-add S0

      ovn-nbctl --id=3f507ce6-f6e6-4b18-829b-80a18a8143cd create ACL action=drop direction=from-lport match=tcp priority=1001 – add logical_switch S1 acls 3f507ce6-f6e6-4b18-829b-80a18a8143cd

      ovn-nbctl --id=554865ea-5712-4aac-a238-d6a933a88ff6 create ACL action=allow-related direction=from-lport match=tcp priority=2001 tier=1 – add logical_switch S1 acls 554865ea-5712-4aac-a238-d6a933a88ff6

       

      With the above ACLs, ideally all tcp traffic should be dropped, but it doesn't.

       

      The issue is seen with ovn main and branch-24.09.

       Impact Assessment: Describe the severity and impact (e.g., network down,availability of a workaround, etc.).

       

       Software Versions: Specify the exact versions in use (e.g.,openvswitch3.1-3.1.0-147.el8fdp).

       

        Issue Type: Indicate whether this is a new issue or a regression (if a regression, state the last known working version).

       

       Reproducibility: Confirm if the issue can be reproduced consistently. If not, describe how often it occurs.

       

       Reproduction Steps: Provide detailed steps or scripts to replicate the issue.

       

       Expected Behavior: Describe what should happen under normal circumstances.

       

       Observed Behavior: Explain what actually happens.

       

       Troubleshooting Actions: Outline the steps taken to diagnose or resolve the issue so far.

       

       Logs: If you collected logs please provide them (e.g. sos report, /var/log/openvswitch/* , testpmd console)

              ovnteam@redhat.com OVN Team
              numansidcan Numan Siddique (Inactive)
              Aniss Loughlam Aniss Loughlam
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: