-
Bug
-
Resolution: Done-Errata
-
Undefined
-
None
-
None
-
1
-
False
-
-
False
-
ovn25.03-25.03.0-beta.15.el9fdp
-
rhel-9
-
None
-
rhel-net-ovn
-
-
-
ssg_networking
-
+
Problem Description: Clearly explain the issue.
After the commit [1], tiered ACLs are broken.
To reproduce the issue, create a logical switch and add the below logical flows
ovn-nbctl ls-add S0
ovn-nbctl --id=3f507ce6-f6e6-4b18-829b-80a18a8143cd create ACL action=drop direction=from-lport match=tcp priority=1001 – add logical_switch S1 acls 3f507ce6-f6e6-4b18-829b-80a18a8143cd
ovn-nbctl --id=554865ea-5712-4aac-a238-d6a933a88ff6 create ACL action=allow-related direction=from-lport match=tcp priority=2001 tier=1 – add logical_switch S1 acls 554865ea-5712-4aac-a238-d6a933a88ff6
With the above ACLs, ideally all tcp traffic should be dropped, but it doesn't.
The issue is seen with ovn main and branch-24.09.
Impact Assessment: Describe the severity and impact (e.g., network down,availability of a workaround, etc.).
Software Versions: Specify the exact versions in use (e.g.,openvswitch3.1-3.1.0-147.el8fdp).
Issue Type: Indicate whether this is a new issue or a regression (if a regression, state the last known working version).
Reproducibility: Confirm if the issue can be reproduced consistently. If not, describe how often it occurs.
Reproduction Steps: Provide detailed steps or scripts to replicate the issue.
Expected Behavior: Describe what should happen under normal circumstances.
Observed Behavior: Explain what actually happens.
Troubleshooting Actions: Outline the steps taken to diagnose or resolve the issue so far.
Logs: If you collected logs please provide them (e.g. sos report, /var/log/openvswitch/* , testpmd console)
- clones
-
FDP-1154 Tiered ACLs are broken with allow-related ACLs.
-
- Closed
-
- links to
-
RHBA-2025:148464 ovn25.03 bug fix and enhancement update