OVS流表实现arp代答

物理拓扑

1、PC封包：源ip：10.1.1.2，目的ip：20.1.1.2，源mac：fe:fe:fe:fe:fe:aa，目的mac：不知道，此时数据层将这个不完整的包缓存，发arp报文,注意，主机内核会检测到是跨网段访问，arp请求的是网关ip对应的mac

2、ARP报文组成：数据层（源mac：fe:fe:fe:fe:fe:aa，目的mac：ff:ff:ff:ff:ff:ff）+ ARP头部（发送者ip：10.1.1.2，发送者mac：fe:fe:fe:fe:fe:aa，接收者ip：10.1.1.2（网关ip），接收者mac：00::00:00:00:00:00）

3、网关设备收到后将PC的ip和mac存到arp表，并单播回复arp包：数据层（源mac：fe:fe:fe:fe:fe:bb，目的mac：fe:fe:fe:fe:fe:aa）+ arp头（发送者ip：10.1.1.2，发送者mac：fe:fe:fe:fe:fe:bb，接收者ip：10.1.1.1，接收者mac：fe:fe:fe:fe:fe:aa）
4、PC收到网关的arp回包后，将20.1.1.2和fe:fe:fe:fe:fe:bb存到arp表

核心流表显示

cookie=0x1, duration=142927.790s, table=11, n_packets=0, n_bytes=0, priority=24576,arp,arp_tpa=10.1.0.5,arp_op=1 actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[],
set_field:fe:fe:fe:fe:fe:fc->eth_src,load:0x2->NXM_OF_ARP_OP[],move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[],set_field:fe:fe:fe:fe:fe:fc->arp_sha,
move:NXM_OF_ARP_SPA[]->NXM_OF_ARP_TPA[],set_field:10.1.0.5->arp_spa,load:0->NXM_OF_IN_PORT[],resubmit(,3)

匹配项：

arp：arp协议
arp_tpa：arp请求的目的ip
arp_op：ARP请求(值为1)、ARP应答(2)、RARP请求（3）、RARP应答（4）

执行项

NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[]：将源mac放入目的mac
set_field:fe:fe:fe:fe:fe:fc->eth_src：将fe:fe:fe:fe:fe:fc放入源mac
0x2->NXM_OF_ARP_OP[]：ARP应答(2)
NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[]：将arp request外层源mac放入arp reply的目的mac
set_field:fe:fe:fe:fe:fe:fc->arp_sha：将fe:fe:fe:fe:fe:fc放入arp reply头部的源mac
move:NXM_OF_ARP_SPA[]->NXM_OF_ARP_TPA[]：arp request的源ip放入arp reply目的ip
set_field:10.1.0.5->arp_spa：将已知10.1.0.5放入源ip
load:0->NXM_OF_IN_PORT[]：收到的arp包从进来时的接口转发回去

ip netns add ns1
ip l a veth0 type veth peer name ovs-veth0
ip l s veth0 netns ns1
ovs-vsctl add-br br-int
ovs-vsctl add-port br-int ovs-veth0
ip l s ovs-veth0 up
ip netns exec ns1 ip a a 10.0.0.2/24 dev veth0
ip netns exec ns1 ip l s veth0 up

 
ovs-ofctl add-flow br-int -O OpenFlow13 "table=0,priority=100,in_port="ovs-veth0" actions=resubmit(,1)"
ovs-ofctl add-flow br-int -O OpenFlow13 "table=1, priority=100,arp,arp_tpa=10.0.0.1,arp_op=1 actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[],set_field:fe:fe:fe:fe:fe:bb->eth_src,load:0x2->NXM_OF_ARP_OP[],move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[],set_field:fe:fe:fe:fe:fe:bb->arp_sha,move:NXM_OF_ARP_SPA[]->NXM_OF_ARP_TPA[],set_field:10.0.0.1->arp_spa,load:0->NXM_OF_IN_PORT[],resubmit(,2)"
ovs-ofctl add-flow br-int -O OpenFlow13 "table=2,priority=100,actions=output:ovs-veth0"

# 在ns口抓包：
tcpdump -i  ovs-veth0 -nn -vv -e
tcpdump: listening on ovs-veth0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:12:25.468785 96:6b:e3:9c:0c:46 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.0.0.1 tell 10.0.0.2, length 28
13:12:25.469056 fe:fe:fe:fe:fe:bb > 96:6b:e3:9c:0c:46, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.0.0.1 is-at fe:fe:fe:fe:fe:bb, length 28
13:12:25.469068 96:6b:e3:9c:0c:46 > fe:fe:fe:fe:fe:bb, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 27617, offset 0, flags [DF], proto ICMP (1), length 84)
    10.0.0.2 > 10.0.0.1: ICMP echo request, id 13743, seq 1, length 64
13:12:26.490380 96:6b:e3:9c:0c:46 > fe:fe:fe:fe:fe:bb, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 27619, offset 0, flags [DF], proto ICMP (1), length 84)

# 流表匹配
ovs-ofctl dump-flows br-int
 cookie=0x0, duration=356.942s, table=0, n_packets=152, n_bytes=14532, priority=100,in_port="ovs-veth0" actions=resubmit(,1)
 cookie=0x0, duration=364.603s, table=0, n_packets=7, n_bytes=586, priority=0 actions=NORMAL
 cookie=0x0, duration=276.668s, table=1, n_packets=4, n_bytes=168, priority=100,arp,arp_tpa=10.0.0.1,arp_op=1 actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[],mod_dl_src:fe:fe:fe:fe:fe:bb,load:0x2->NXM_OF_ARP_OP[],move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[],load:0xfefefefefebb->NXM_NX_ARP_SHA[],move:NXM_OF_ARP_SPA[]->NXM_OF_ARP_TPA[],load:0xa000001->NXM_OF_ARP_SPA[],load:0->NXM_OF_IN_PORT[],resubmit(,2)
 cookie=0x0, duration=269.513s, table=2, n_packets=4, n_bytes=168, priority=100 actions=output:"ovs-veth0"

# 查看ns学到的包
ip netns exec ns1 arp -a
? (10.0.0.1) at fe:fe:fe:fe