Problem Description: Clearly explain the issue.
After the commit [1], tiered ACLs are broken.
To reproduce the issue, create a logical switch and add the below logical flows
ovn-nbctl ls-add S0
ovn-nbctl --id=3f507ce6-f6e6-4b18-829b-80a18a8143cd create ACL action=drop direction=from-lport match=tcp priority=1001 – add logical_switch S1 acls 3f507ce6-f6e6-4b18-829b-80a18a8143cd
ovn-nbctl --id=554865ea-5712-4aac-a238-d6a933a88ff6 create ACL action=allow-related direction=from-lport match=tcp priority=2001 tier=1 – add logical_switch S1 acls 554865ea-5712-4aac-a238-d6a933a88ff6
With the above ACLs, ideally all tcp traffic should be dropped, but it doesn't.
The issue is seen with ovn main and branch-24.09.
Impact Assessment: Describe the severity and impact (e.g., network down,availability of a workaround, etc.).
Software Versions: Specify the exact versions in use (e.g.,openvswitch3.1-3.1.0-147.el8fdp).
Issue Type: Indicate whether this is a new issue or a regression (if a regression, state the last known working version).
Reproducibility: Confirm if the issue can be reproduced consistently. If not, describe how often it occurs.
Reproduction Steps: Provide detailed steps or scripts to replicate the issue.
Expected Behavior: Describe what should happen under normal circumstances.
Observed Behavior: Explain what actually happens.
Troubleshooting Actions: Outline the steps taken to diagnose or resolve the issue so far.
Logs: If you collected logs please provide them (e.g. sos report, /var/log/openvswitch/* , testpmd console)
- is cloned by
-
FDP-1196 CLONE [ovn25.03 fast-datapath-rhel-9] - Tiered ACLs are broken with allow-related ACLs.
-
- Closed
-
- links to
-
RHBA-2025:146415 ovn24.09 bug fix and enhancement update
- mentioned on