This repository has been archived by the owner on Jun 20, 2024. It is now read-only.

Detect looping flows #2674

Merged

bboreham merged 4 commits into 1.8 from issues/2650-fix-looping-flows

Dec 8, 2016

Contributor

brb commented Nov 28, 2016 •

edited

Loading

This PR includes the following changes:

Detect loops in fastdp flows (see commit message for a meaning of loops in terms of fastdp).
Detect enabling of hairpin mode.
Logging of a case when own packet is received from a remote peer.

~~BLOCKERS: vishvananda/netlink#179 (I've temporarily changed the vendored netlink dep)~~. The PR has been merged.

Fixes #2650

brb changed the base branch from master to 1.8

November 28, 2016 10:58

brb added this to the 1.8.2 milestone

awh reviewed

View reviewed changes

router/fastdp.go

+              	for _, key := range flow.FlowKeys {
+              		switch k := key.(type) {
+              		case odp.InPortFlowKey:
+              			inVports[k.VportID()] = struct{}{}

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh reviewed

View reviewed changes

router/fastdp.go

+              // A checkFlowLoop checks whether the flow is free from the following loops:
+              // * in_port == out_port, where in_port is non-vxlan vport;
+              // * a packet is sent back to a vxlan tunnel it has been received from.
+              func (fastdp *FastDatapath) checkFlowLoop(flow *odp.FlowSpec) bool {

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh reviewed

View reviewed changes

router/fastdp.go

               		}
               	}
+              	if !fastdp.checkFlowLoop(&flow) {
+              		log.Error("ODP flow contains a loop ", flow)

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh self-assigned this

awh reviewed

View reviewed changes

router/fastdp.go

+              				}
+              			}
+              		case odp.SetTunnelAction:
+              			if inVxlan && a.TunnelAttrs.TunnelId == vxlanKey.TunnelId &&

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh reviewed

View reviewed changes

router/fastdp.go

+              	for _, action := range flow.Actions {
+              		switch a := action.(type) {
+              		case odp.OutputAction:
+              			if _, ok := inVports[a.VportID()]; ok {

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh reviewed

View reviewed changes

router/fastdp.go

+              	for _, action := range flow.Actions {
+              		switch a := action.(type) {
+              		case odp.OutputAction:

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

awh assigned brb and unassigned awh

brb force-pushed the issues/2650-fix-looping-flows branch 2 times, most recently from 846bc54 to af962f7 Compare

December 5, 2016 12:41


          Detect hairpin flows

0ae13a2

The introduced "isHairpinFlow" detects whether a flow has been
created due to enabled hairpin mode.

brb force-pushed the issues/2650-fix-looping-flows branch from af962f7 to f4f90b3 Compare

December 8, 2016 10:32


          Update vishvananda/netlink vendored dependency

ab1b99a

The updated version includes parsing of IFLA_PROTINFO
which is needed to get info about hairpin mode when
subscribing to link updates.

bboreham reviewed

View reviewed changes

net/bridge.go

+              		log.Errorf("Unable to subscribe to netlink updates: %s", err)
+              	}
+              	pi, err := netlink.LinkGetProtinfo(link)

This comment was marked as abuse.

Sign in to view

brb force-pushed the issues/2650-fix-looping-flows branch 2 times, most recently from 98d47c6 to aa9c032 Compare

December 8, 2016 11:37

Contributor Author

brb commented Dec 8, 2016

PTAL.


          Detect enabling of hairpin mode on vethwe-bridge

baa8f22

Enabled hairpin mode on vethwe-bridge was one of the root causes
for installing looping flows in the fastdp mode.

Also, it confused the weave custom L2 bridge, as the bridge treats
a bounced back packet, e.g. ARP brodcast request, as a local one
(the case for "Captured a packet associated with remote host").

brb assigned awh and unassigned brb


          Add sanity check to detect when receiving own packets

aa9c032

awh assigned bboreham and unassigned awh

bboreham merged commit 1d80a8d into 1.8

brb mentioned this pull request

Weave Net can create looping flow rules when hairpin is turned on on the bridge veth #2650

Closed

bboreham mentioned this pull request

"Sometimes containers cannot connect but they still respond to ping" #2433

Open

chrislovecnm mentioned this pull request

Weave errors AWS K8s TCP socket connection issues #2731

Closed

bboreham deleted the issues/2650-fix-looping-flows branch

March 10, 2017 11:17

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet