-
Feature Request
-
Resolution: Done
-
Undefined
-
None
-
None
-
None
-
False
-
-
False
-
-
OVS currently supports filtered conntrack flushing. The filter may consist of a combination of zone-id and/or original/reply tuple:
/* NXT_CT_FLUSH_ZONE. * * Flushes the connection tracking table. */ struct nx_zone_id { uint8_t zero[6]; /* Must be zero. */ ovs_be16 zone_id; /* Connection tracking zone. */ }; OFP_ASSERT(sizeof(struct nx_zone_id) == 8);/* CT flush available TLVs. */ enum nx_ct_flush_tlv_type { /* Outer types. */ NXT_CT_ORIG_TUPLE = 0, /* Outer type for original tuple TLV. * Nested TLVs are specified * by 'enum nx_ct_flush_tuple_tlv_type'. */ NXT_CT_REPLY_TUPLE = 1, /* Outer type for reply tuple TLV. * * Nested TLVs are specified * by 'enum nx_ct_flush_tuple_tlv_type'*/ /* Primitive types. */ NXT_CT_ZONE_ID = 2, /* be16 zone id. */ };/* CT flush nested TLVs. */ enum nx_ct_flush_tuple_tlv_type { NXT_CT_TUPLE_SRC = 0, /* IPv6 or mapped IPv4 address. */ NXT_CT_TUPLE_DST = 1, /* IPv6 or mapped IPv4 address. */ NXT_CT_TUPLE_SRC_PORT = 2, /* be16 source port. */ NXT_CT_TUPLE_DST_PORT = 3, /* be16 destination port. */ NXT_CT_TUPLE_ICMP_ID = 4, /* be16 ICMP id. */ NXT_CT_TUPLE_ICMP_TYPE = 5, /* u8 ICMP type. */ NXT_CT_TUPLE_ICMP_CODE = 6, /* u8 ICMP code. */ };/* NXT_CT_FLUSH. * * Flushes the connection tracking entries specified by 5-tuple. * The struct should be followed by TLVs specifying the matching parameters. * Currently there is a limitation for ICMP, in order to partially match on * ICMP parameters the tuple should include at least SRC/DST. */ struct nx_ct_flush { uint8_t ip_proto; /* IP protocol. */ uint8_t pad[7]; /* Align to 64 bits (must be zero). */ /* Followed by optional TLVs of type 'enum nx_ct_flush_tlv_type'. */ }; OFP_ASSERT(sizeof(struct nx_ct_flush) == 8);
In some cases, controllers (e.g., ovn-controller), might want to filter on other conntrack record fields: label and mark.
Use case:
OVN's ecmp-symmetric-reply feature for example stores the reply traffic overriding next-hop mac address and egress port into a conntrack entry label/mark for that session. When a next-hop goes away, ovn-controller will have to clear all conntrack entries (in a given zone) that use that next-hop's mac address in the label/mark.
Today that's not possible without first dumping all current conntrack entries that exist in the system.
- blocks
-
FDP-56 [RFE] Track ECMP (symmetric reply) next-hops in ovn-controller
-
- Verified
-