diff --git a/debian/changelog b/debian/changelog index f908643..e3d3ef8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +neutron (2:16.4.1-0ubuntu3) focal; urgency=medium + + * Revert ovs offload patch (LP: #1931696) + - d/p/Revert-ovs-firewall-fix-mac-learning-on-the-ingress-.patch + + -- Edward Hope-Morley Tue, 12 Oct 2021 12:54:33 +0100 + neutron (2:16.4.1-0ubuntu2) focal; urgency=medium * d/p/lp1934912-set-arp-entries-only-for-single-ip.patch: Cherry-pick diff --git a/patches/Revert-ovs-firewall-fix-mac-learning-on-the-ingress-.patch b/patches/Revert-ovs-firewall-fix-mac-learning-on-the-ingress-.patch new file mode 100644 index 0000000..5b92e2e --- /dev/null +++ b/patches/Revert-ovs-firewall-fix-mac-learning-on-the-ingress-.patch @@ -0,0 +1,68 @@ +From d873e5fe79c6604a2b3c7e755c359fbfbdcca3cb Mon Sep 17 00:00:00 2001 +From: Edward Hope-Morley +Date: Mon, 11 Oct 2021 12:26:47 +0100 +Subject: [PATCH] Revert "ovs firewall: fix mac learning on the ingress rule + table when ovs offload enabled" + +This reverts commit 8fc80b7e132031d18c787b5be582c146d262de74. + +Change-Id: I6812ddd9da524653f2621807423b66d605522d1a +Related-Bug: #1931696 +--- + .../agent/linux/openvswitch_firewall/firewall.py | 14 +------------- + ...ning-in-case--ovs-offload-26193bf1638fd673.yaml | 11 ----------- + 2 files changed, 1 insertion(+), 24 deletions(-) + delete mode 100644 releasenotes/notes/fix-mac-learning-in-case--ovs-offload-26193bf1638fd673.yaml + +diff --git a/neutron/agent/linux/openvswitch_firewall/firewall.py b/neutron/agent/linux/openvswitch_firewall/firewall.py +index 2f1e219c8d..f11e460743 100644 +--- a/neutron/agent/linux/openvswitch_firewall/firewall.py ++++ b/neutron/agent/linux/openvswitch_firewall/firewall.py +@@ -1437,18 +1437,6 @@ class OVSFirewallDriver(firewall.FirewallDriver): + actions='resubmit(,%d)' % ovs_consts.DROPPED_TRAFFIC_TABLE + ) + +- # NOTE: The OUTPUT action is used instead of NORMAL action to reduce +- # cpu utilization, but it causes the datapath rule to be flood rule. +- # This is due to mac learning not happened on ingress traffic. +- # While this is ok for no offload case, in ovs offload flood rule +- # is not offloaded. Therefore, we change the action to be NORMAL in +- # offload case. In case the explicitly_egress_direct is used the +- # pipeline don't contain action NORMAL so we don't have flood rule +- # issue. +- actions = 'output:{:d}'.format(port.ofport) +- if (self.int_br.br.is_hw_offload_enabled and +- not cfg.CONF.AGENT.explicitly_egress_direct): +- actions = 'mod_vlan_vid:{:d},normal'.format(port.vlan_tag) + # Allow established and related connections + for state in (ovsfw_consts.OF_STATE_ESTABLISHED_REPLY, + ovsfw_consts.OF_STATE_RELATED): +@@ -1459,7 +1447,7 @@ class OVSFirewallDriver(firewall.FirewallDriver): + ct_state=state, + ct_mark=ovsfw_consts.CT_MARK_NORMAL, + ct_zone=port.vlan_tag, +- actions=actions ++ actions='output:{:d}'.format(port.ofport) + ) + self._add_flow( + table=ovs_consts.RULES_INGRESS_TABLE, +diff --git a/releasenotes/notes/fix-mac-learning-in-case--ovs-offload-26193bf1638fd673.yaml b/releasenotes/notes/fix-mac-learning-in-case--ovs-offload-26193bf1638fd673.yaml +deleted file mode 100644 +index 9610700b97..0000000000 +--- a/releasenotes/notes/fix-mac-learning-in-case--ovs-offload-26193bf1638fd673.yaml ++++ /dev/null +@@ -1,11 +0,0 @@ +---- +-fixes: +- - | +- Fixed a MAC learning issue when OVS offload is enabled. The OVS firewall +- reduces the usage of normal actions to reduce CPU utilization. This +- causes insertion of a flood rule because there is no MAC learning on +- ingress traffic. While this is okay for the non-offload case, when using +- OVS offload the flood rule is not being offloaded. This fixes the MAC +- learning in the offload case, so we avoid the flood rule. For more +- information, see bug +- `1897637 `_. +-- +2.17.1 + diff --git a/patches/series b/patches/series new file mode 100644 index 0000000..ba79e2f --- /dev/null +++ b/patches/series @@ -0,0 +1 @@ +Revert-ovs-firewall-fix-mac-learning-on-the-ingress-.patch