OVN
OVN（Open Virtual Network）是一个支持逻辑网络的系统，有逻辑交换机，用来做二层转发,二到四层的 ACL做访问控制。分布式逻辑路由器用来做三层转发。支持多种隧道封装技术，有Geneve，STT 和 VXLAN。支持使用硬件TOR交换机连接物理网络和虚拟网络。
OVN的2种角色：
OVN中心节点：只有一台主机承担这个角色。运行着OVN 北向数据库和OVN南向数据库。
OVN计算节点：所有提供虚拟机的主机节点。运行着ovn-controller。
OVN架构
| CMS | 云管理系统，ovn的客户端 |
|---|---|
| OVN Plugin | 使用 OVSDB 协议来把用户的配置写在 NorthDB 里 |
| ovn north DB | 用于描述上层的逻辑网络组件，比如逻辑交换机、路由器、ACL、逻辑端口 |
| ovn-northd | 监听到 Northbound DB 配置发生改变把logical switch和logical router翻译成logical flow，flow分为ingress和egress |
| ovn south DB | 逻辑网络，物理网络，以及二者的对应关系，逻辑网络由ovn-northd写，物理网络和二者对应关系由ovn-controller写物理网络数据，比如VM的IP地址和隧道封装格式，逻辑网络数据，比如报文转发方式，物理网络和逻辑网络的绑定关系，比如逻辑端口关联到哪个 HV 上面。 |
| ovn-controller | 每个主机上运行一个，监控到SouthDB数据的发生变化之后下发ovs流表，下发成功后同步到SouthDB，每个ovn计算节点都会在ovn-controller启动之前创建一个br-int桥，VM直接连接到br-int桥上，ovn-controller还会在br-int上添加tunnel口用于和其他主机通信，如果要和物理网络打通，还需要单独创建一个bridge，bridge中绑定一个主机上的物理口，物理口连接外部物理网络，br-int bridge和这个bridge用patch port互连。 |
CMS
|
|
+-----------|-----------+
| | |
| OVN/CMS Plugin |
| | |
| | |
| OVN Northbound DB |
| | |
| | |
| ovn-northd |
| | |
+-----------|-----------+
|
|
+-------------------+
| OVN Southbound DB |
+-------------------+
|
|
+------------------+------------------+
| | |
HV 1 | | HV n |
+---------------|---------------+ . +---------------|---------------+
| | | . | | |
| ovn-controller | . | ovn-controller |
| | | | . | | | |
| | | | | | | |
| ovs-vswitchd ovsdb-server | | ovs-vswitchd ovsdb-server |
| | | |
+-------------------------------+ +-------------------------------+
OVN流程分析：
1、当CMS更新北向数据库配置时，作为事务的一部分
2、当北向数据库收到数据时同步南北向数据库时放在一个事务中，这样可以始终保持南北数据库内容一致，
3、当南向数据库写入后会更新状态到北向数据库，这样通过北向数据库可以实时看到南北数据库同步情况。
4、到ovn-controller收到南向数据库内容时，下发OpenvSwitch流表，下发成功后会同步到南向数据库更新配置信息。
5、ovn-northd监测到南向数据库记录后复制到北向数据库，这样CMS可以追踪南北向数据一致性。
Neutron：
Neutron是OpenStack项目中负责提供网络服务的组件，它基于sdn的思想，实现了网络虚拟化下的资源管理。
Neutron框架
| Neutron Server | 对外提供OpenStack网络API，接收请求，并调用Plugin处理请求。 |
|---|---|
| Plugin | 处理Neutron Server发来的请求，维护OpenStack逻辑网络的状态，并调用Agent处理请求。 |
| Agent | 处理Plugin的请求，负责在Network Provider上真正实现各种网络功能。 |
| Network Provider | 提供网络服务的虚拟或者物理网络设备，比如Linux Bridge，OpenVSwitch或者其他支持Neutron的物理交换机。 |
| Queue | Neutron Server，Plugin和Agent之间通过Messaging Queue通信和调用。 |
| Database | 存放OpenStack的网络状态信息，包括Network，Subnet，Port，Router等。 |
Neutron流程分析：
1、Neutron Server收到请求调用Plugin处理
2、Plugin收到请求后把网络数据保存到Database后，将数据发送到Queue里等待Agent消费
3、Agent读取Queue里的数据调用Network Provider实现具体功能
OVN VS Neutron
1、OVN 里面数据的读写都是通过OVSDB来做的，取代了 Neutron 的消息队列机制
2、Neutron 的三层功能是在网关节点做的，所有东西向跨网段的流量都需要经过网络节点做路由，这使得网关节点成为瓶颈。有了 DVR 之后，路由变成了分布式，每个计算节点上面都可以做路由，东西向流量直接通过计算节点路由而不需要经过网络节点，减轻了网关节点的负担
OVN演示
1、初始化时，北向数据库为空，南向数据库里记录物理网络数据，每个chassis对应一个node
ovn-nbctl show
ovn-sbctl show
Chassis "f07d9084-dd4e-4499-9605-314512a85c03"
hostname: ovn-worker
Encap geneve
ip: "172.18.0.4"
options: {csum="true"}
Chassis "8eec2547-ad18-49fc-9bac-f97e737b224b"
hostname: ovn-worker2
Encap geneve
ip: "172.18.0.3"
options: {csum="true"}
Chassis "62f3cdd0-1477-4d3a-a3c4-df8ba338e22c"
hostname: ovn-control-plane
Encap geneve
ip: "172.18.0.2"
options: {csum="true"}
2、ovn创建一个交换机abc、路由器lr和端口
ovn-nbctl ls-add abc
ovn-nbctl lsp-add abc abc-vm1
ovn-nbctl lsp-set-addresses abc-vm1 00:00:00:00:00:01
ovn-nbctl lsp-add abc abc-vm2
ovn-nbctl lsp-set-addresses abc-vm2 00:00:00:00:00:02
# 在交换机上创建patch port连接ls和lr
ovn-nbctl lsp-add abc ls-lr
ovn-nbctl lsp-set-addresses ls-lr "00:00:00:00:00:03"
ovn-nbctl lsp-set-type ls-lr router
ovn-nbctl lsp-set-options ls-lr router-port=lr-ls
# 在路由器上创建patch port连接ls和lr
ovn-nbctl lr-add lr
ovn-nbctl lrp-add lr lr-ls 00:00:00:00:00:03 10.10.10.3/24
ovn-nbctl set Logical_Router lr options:chassis=f07d9084-dd4e-4499-9605-314512a85c03
# 在北向数据库看到逻辑交换机和逻辑路由器，和连接交换机和路由器的patch port
ovn-nbctl show
switch eb3a549f-ecd9-4802-b691-a2b9dd342206 (abc)
port ls-lr
type: router
addresses: ["00:00:00:00:00:03"]
router-port: lr-ls
port abc-vm1
addresses: ["00:00:00:00:00:01"]
port abc-vm2
addresses: ["00:00:00:00:00:02"]
router cc8abc0d-c1ce-441d-a8c0-dcbdb3c192cf (lr)
port lr-ls
mac: "00:00:00:00:00:03"
networks: ["10.10.10.3/24"]
3、创建ns模拟vm连接到ovn端口abc-vm1
# 在ovn-worker主机:
ip netns add vm1
ovs-vsctl add-port br-int vm1 -- set interface vm1 type=internal
ip link set vm1 netns vm1
ip netns exec vm1 ip link set vm1 address 00:00:00:00:00:01
ip netns exec vm1 ip addr add 10.10.10.1/24 dev vm1
ip netns exec vm1 ip link set vm1 up
ovs-vsctl set Interface vm1 external_ids:iface-id=abc-vm1
# 在ovn-worker2主机上
ip netns add vm2
ovs-vsctl add-port br-int vm2 -- set interface vm2 type=internal
ip link set vm2 netns vm2
ip netns exec vm2 ip link set vm2 address 00:00:00:00:00:02
ip netns exec vm2 ip addr add 10.10.10.2/24 dev vm2
ip netns exec vm2 ip link set vm2 up
ovs-vsctl set Interface vm2 external_ids:iface-id=abc-vm2
# 查看南向数据库看到ovn-worker物理网络和逻辑网络的绑定关系
ovn-sbctl show
Chassis "f07d9084-dd4e-4499-9605-314512a85c03"
hostname: ovn-worker
Encap geneve
ip: "172.18.0.4"
options: {csum="true"}
Port_Binding abc-vm1
Chassis "8eec2547-ad18-49fc-9bac-f97e737b224b"
hostname: ovn-worker2
Encap geneve
ip: "172.18.0.3"
options: {csum="true"}
Port_Binding abc-vm2
Chassis "62f3cdd0-1477-4d3a-a3c4-df8ba338e22c"
hostname: ovn-control-plane
Encap geneve
ip: "172.18.0.2"
options: {csum="true"}
ovn-sbctl lflow-list abc
Datapath: "abc" (e7b55cb9-4ace-4fed-b1bf-798d2853a039) Pipeline: ingress
table=0 (ls_in_port_sec_l2 ), priority=100 , match=(eth.src[40]), action=(drop;)
table=0 (ls_in_port_sec_l2 ), priority=100 , match=(vlan.present), action=(drop;)
table=0 (ls_in_port_sec_l2 ), priority=50 , match=(inport == "abc-vm1" && eth.src == {00:00:00:00:00:01}), action=(next;)
table=0 (ls_in_port_sec_l2 ), priority=50 , match=(inport == "abc-vm2"), action=(next;)
table=1 (ls_in_port_sec_ip ), priority=0 , match=(1), action=(next;)
table=2 (ls_in_port_sec_nd ), priority=90 , match=(inport == "abc-vm1" && eth.src == 00:00:00:00:00:01 && arp.sha == 00:00:00:00:00:01), action=(next;)
table=2 (ls_in_port_sec_nd ), priority=90 , match=(inport == "abc-vm1" && eth.src == 00:00:00:00:00:01 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:01) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:01)))), action=(next;)
table=2 (ls_in_port_sec_nd ), priority=80 , match=(inport == "abc-vm1" && (arp || nd)), action=(drop;)
table=2 (ls_in_port_sec_nd ), priority=0 , match=(1), action=(next;)
table=3 (ls_in_lookup_fdb ), priority=0 , match=(1), action=(next;)
table=4 (ls_in_put_fdb ), priority=0 , match=(1), action=(next;)
table=5 (ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)
table=5 (ls_in_pre_acl ), priority=0 , match=(1), action=(next;)
table=6 (ls_in_pre_lb ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)
table=6 (ls_in_pre_lb ), priority=110 , match=(eth.mcast), action=(next;)
table=6 (ls_in_pre_lb ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;)
table=6 (ls_in_pre_lb ), priority=0 , match=(1), action=(next;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip4 && sctp), action=(reg1 = ip4.dst; reg2[0..15] = sctp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip4 && tcp), action=(reg1 = ip4.dst; reg2[0..15] = tcp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip4 && udp), action=(reg1 = ip4.dst; reg2[0..15] = udp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip6 && sctp), action=(xxreg1 = ip6.dst; reg2[0..15] = sctp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip6 && tcp), action=(xxreg1 = ip6.dst; reg2[0..15] = tcp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=120 , match=(reg0[2] == 1 && ip6 && udp), action=(xxreg1 = ip6.dst; reg2[0..15] = udp.dst; ct_lb;)
table=7 (ls_in_pre_stateful ), priority=110 , match=(reg0[2] == 1), action=(ct_lb;)
table=7 (ls_in_pre_stateful ), priority=100 , match=(reg0[0] == 1), action=(ct_next;)
table=7 (ls_in_pre_stateful ), priority=0 , match=(1), action=(next;)
table=8 (ls_in_acl_hint ), priority=65535, match=(1), action=(next;)
table=9 (ls_in_acl ), priority=65535, match=(1), action=(next;)
table=10(ls_in_qos_mark ), priority=0 , match=(1), action=(next;)
table=11(ls_in_qos_meter ), priority=0 , match=(1), action=(next;)
table=12(ls_in_lb ), priority=0 , match=(1), action=(next;)
table=13(ls_in_acl_after_lb ), priority=0 , match=(1), action=(next;)
table=14(ls_in_stateful ), priority=100 , match=(reg0[1] == 1 && reg0[13] == 0), action=(ct_commit { ct_label.blocked = 0; }; next;)
table=14(ls_in_stateful ), priority=100 , match=(reg0[1] == 1 && reg0[13] == 1), action=(ct_commit { ct_label.blocked = 0; ct_label.label = reg3; }; next;)
table=14(ls_in_stateful ), priority=0 , match=(1), action=(next;)
table=15(ls_in_pre_hairpin ), priority=0 , match=(1), action=(next;)
table=16(ls_in_nat_hairpin ), priority=0 , match=(1), action=(next;)
table=17(ls_in_hairpin ), priority=0 , match=(1), action=(next;)
table=18(ls_in_arp_rsp ), priority=0 , match=(1), action=(next;)
table=19(ls_in_dhcp_options ), priority=0 , match=(1), action=(next;)
table=20(ls_in_dhcp_response), priority=0 , match=(1), action=(next;)
table=21(ls_in_dns_lookup ), priority=0 , match=(1), action=(next;)
table=22(ls_in_dns_response ), priority=0 , match=(1), action=(next;)
table=23(ls_in_external_port), priority=0 , match=(1), action=(next;)
table=24(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(handle_svc_check(inport);)
table=24(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = "_MC_flood"; output;)
table=24(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(outport = "abc-vm1"; output;)
table=24(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "abc-vm2"; output;)
table=24(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)
table=25(ls_in_l2_unknown ), priority=50 , match=(outport == "none"), action=(drop;)
table=25(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;)
Datapath: "abc" (e7b55cb9-4ace-4fed-b1bf-798d2853a039) Pipeline: egress
table=0 (ls_out_pre_lb ), priority=110 , match=(eth.mcast), action=(next;)
table=0 (ls_out_pre_lb ), priority=110 , match=(eth.src == $svc_monitor_mac), action=(next;)
table=0 (ls_out_pre_lb ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;)
table=0 (ls_out_pre_lb ), priority=0 , match=(1), action=(next;)
table=1 (ls_out_pre_acl ), priority=110 , match=(eth.src == $svc_monitor_mac), action=(next;)
table=1 (ls_out_pre_acl ), priority=0 , match=(1), action=(next;)
table=2 (ls_out_pre_stateful), priority=110 , match=(reg0[2] == 1), action=(ct_lb;)
table=2 (ls_out_pre_stateful), priority=100 , match=(reg0[0] == 1), action=(ct_next;)
table=2 (ls_out_pre_stateful), priority=0 , match=(1), action=(next;)
table=3 (ls_out_acl_hint ), priority=65535, match=(1), action=(next;)
table=4 (ls_out_acl ), priority=65535, match=(1), action=(next;)
table=5 (ls_out_qos_mark ), priority=0 , match=(1), action=(next;)
table=6 (ls_out_qos_meter ), priority=0 , match=(1), action=(next;)
table=7 (ls_out_stateful ), priority=100 , match=(reg0[1] == 1 && reg0[13] == 0), action=(ct_commit { ct_label.blocked = 0; }; next;)
table=7 (ls_out_stateful ), priority=100 , match=(reg0[1] == 1 && reg0[13] == 1), action=(ct_commit { ct_label.blocked = 0; ct_label.label = reg3; }; next;)
table=7 (ls_out_stateful ), priority=0 , match=(1), action=(next;)
table=8 (ls_out_port_sec_ip ), priority=0 , match=(1), action=(next;)
table=9 (ls_out_port_sec_l2 ), priority=100 , match=(eth.mcast), action=(output;)
table=9 (ls_out_port_sec_l2 ), priority=50 , match=(outport == "abc-vm1" && eth.dst == {00:00:00:00:00:01}), action=(output;)
table=9 (ls_out_port_sec_l2 ), priority=50 , match=(outport == "abc-vm2"), action=(output;)
# vm1 ping vm2 成功
root@ovn-worker:/# ip netns exec vm1 ping 10.10.10.2
PING 10.10.10.2 (10.10.10.2) 56(84) bytes of data.
64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=1.34 ms
64 bytes from 10.10.10.2: icmp_seq=2 ttl=64 time=0.116 ms
64 bytes from 10.10.10.2: icmp_seq=3 ttl=64 time=0.133 ms
# 给路由器配置静态路由指定下一跳
ovn-nbctl lr-route-add lr 20.20.0.0/24 10.10.10.3
# Logical Flow里可以看到table11里匹配目标网段将下一跳IP存入寄存器
ovn-sbctl lflow-list lr
Datapath: "lr" (9a391808-9458-4fcf-b0d7-d105991e2462) Pipeline: ingress
table=0 (lr_in_admission ), priority=100 , match=(vlan.present || eth.src[40]), action=(drop;)
table=0 (lr_in_admission ), priority=50 , match=(eth.dst == 00:00:00:00:00:03 && inport == "lr-ls"), action=(xreg0[0..47] = 00:00:00:00:00:03; next;)
table=0 (lr_in_admission ), priority=50 , match=(eth.mcast && inport == "lr-ls"), action=(xreg0[0..47] = 00:00:00:00:00:03; next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(arp.op == 2), action=(reg9[2] = lookup_arp(inport, arp.spa, arp.sha); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(inport == "lr-ls" && arp.spa == 10.10.10.0/24 && arp.op == 1), action=(reg9[2] = lookup_arp(inport, arp.spa, arp.sha); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(nd_na), action=(reg9[2] = lookup_nd(inport, nd.target, nd.tll); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(nd_ns), action=(reg9[2] = lookup_nd(inport, ip6.src, nd.sll); next;)
table=1 (lr_in_lookup_neighbor), priority=0 , match=(1), action=(reg9[2] = 1; next;)
table=2 (lr_in_learn_neighbor), priority=100 , match=(reg9[2] == 1), action=(next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(arp), action=(put_arp(inport, arp.spa, arp.sha); next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(nd_na), action=(put_nd(inport, nd.target, nd.tll); next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(nd_ns), action=(put_nd(inport, ip6.src, nd.sll); next;)
table=3 (lr_in_ip_input ), priority=100 , match=(inport == "lr-ls" && ip4 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded / icmp4.code = 0; / TTL exceeded in transit / ip4.dst = ip4.src; ip4.src = 10.10.10.3 ; ip.ttl = 254; outport = "lr-ls"; flags.loopback = 1; output; };)table=3 (lr_in_ip_input ), priority=100 , match=(ip4.src == {10.10.10.3, 10.10.10.255} && reg9[0] == 0), action=(drop;)table=3 (lr_in_ip_input ), priority=100 , match=(ip4.src_mcast ||ip4.src == 255.255.255.255 || ip4.src == 127.0.0.0/8 || ip4.dst == 127.0.0.0/8 || ip4.src == 0.0.0.0/8 || ip4.dst == 0.0.0.0/8), action=(drop;)table=3 (lr_in_ip_input ), priority=100 , match=(ip6.dst == fe80::200:ff:fe00:3 && udp.src == 547 && udp.dst == 546), action=(reg0 = 0; handle_dhcpv6_reply;)table=3 (lr_in_ip_input ), priority=90 , match=(inport == "lr-ls" && arp.op == 1 && arp.tpa == 10.10.10.3 && arp.spa == 10.10.10.0/24), action=(eth.dst = eth.src; eth.src = xreg0[0..47]; arp.op = 2; / ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[0..47]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)
table=3 (lr_in_ip_input ), priority=90 , match=(inport == "lr-ls" && ip6.dst == {fe80::200:ff:fe00:3, ff02::1:ff00:3} && nd_ns && nd.target == fe80::200:ff:fe00:3), action=(nd_na_router { eth.src = xreg0[0..47]; ip6.src = nd.target; nd.tll = xreg0[0..47]; outport = inport; flags.loopback = 1; output; };)
table=3 (lr_in_ip_input ), priority=90 , match=(ip4.dst == 10.10.10.3 && icmp4.type == 8 && icmp4.code == 0), action=(ip4.dst <-> ip4.src; ip.ttl = 255; icmp4.type = 0; flags.loopback = 1; next; )
table=3 (lr_in_ip_input ), priority=90 , match=(ip6.dst == fe80::200:ff:fe00:3 && icmp6.type == 128 && icmp6.code == 0), action=(ip6.dst <-> ip6.src; ip.ttl = 255; icmp6.type = 129; flags.loopback = 1; next; )
table=3 (lr_in_ip_input ), priority=85 , match=(arp || nd), action=(drop;)
table=3 (lr_in_ip_input ), priority=84 , match=(nd_rs || nd_ra), action=(next;)
table=3 (lr_in_ip_input ), priority=83 , match=(ip6.mcast_rsvd), action=(drop;)
table=3 (lr_in_ip_input ), priority=82 , match=(ip4.mcast || ip6.mcast), action=(drop;)
table=3 (lr_in_ip_input ), priority=60 , match=(ip6.dst == {fe80::200:ff:fe00:3}), action=(drop;)
table=3 (lr_in_ip_input ), priority=50 , match=(eth.bcast), action=(drop;)
table=3 (lr_in_ip_input ), priority=30 , match=(ip4 && ip.ttl == {0, 1}), action=(drop;)
table=3 (lr_in_ip_input ), priority=0 , match=(1), action=(next;)
table=4 (lr_in_unsnat ), priority=0 , match=(1), action=(next;)
table=5 (lr_in_defrag ), priority=0 , match=(1), action=(next;)
table=6 (lr_in_dnat ), priority=0 , match=(1), action=(next;)
table=7 (lr_in_ecmp_stateful), priority=0 , match=(1), action=(next;)
table=8 (lr_in_nd_ra_options), priority=0 , match=(1), action=(next;)
table=9 (lr_in_nd_ra_response), priority=0 , match=(1), action=(next;)
table=10(lr_in_ip_routing_pre), priority=0 , match=(1), action=(reg7 = 0; next;)
table=11(lr_in_ip_routing ), priority=10550, match=(nd_rs || nd_ra), action=(drop;)
table=11(lr_in_ip_routing ), priority=194 , match=(inport == "lr-ls" && ip6.dst == fe80::/64), action=(ip.ttl--; reg8[0..15] = 0; xxreg0 = ip6.dst; xxreg1 = fe80::200:ff:fe00:3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=11(lr_in_ip_routing ), priority=74 , match=(ip4.dst == 10.10.10.0/24), action=(ip.ttl--; reg8[0..15] = 0; reg0 = ip4.dst; reg1 = 10.10.10.3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=11(lr_in_ip_routing ), priority=73 , match=(reg7 == 0 && ip4.dst == 20.20.0.0/24), action=(ip.ttl--; reg8[0..15] = 0; reg0 = 10.10.10.3; reg1 = 10.10.10.3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=12(lr_in_ip_routing_ecmp), priority=150 , match=(reg8[0..15] == 0), action=(next;)
table=13(lr_in_policy ), priority=0 , match=(1), action=(reg8[0..15] = 0; next;)
table=14(lr_in_policy_ecmp ), priority=150 , match=(reg8[0..15] == 0), action=(next;)
table=15(lr_in_arp_resolve ), priority=500 , match=(ip4.mcast || ip6.mcast), action=(next;)
table=15(lr_in_arp_resolve ), priority=0 , match=(ip4), action=(get_arp(outport, reg0); next;)
table=15(lr_in_arp_resolve ), priority=0 , match=(ip6), action=(get_nd(outport, xxreg0); next;)
table=16(lr_in_chk_pkt_len ), priority=0 , match=(1), action=(next;)
table=17(lr_in_larger_pkts ), priority=0 , match=(1), action=(next;)
table=18(lr_in_gw_redirect ), priority=0 , match=(1), action=(next;)
table=19(lr_in_arp_request ), priority=100 , match=(eth.dst == 00:00:00:00:00:00 && ip4), action=(arp { eth.dst = ff:ff:ff:ff:ff:ff; arp.spa = reg1; arp.tpa = reg0; arp.op = 1; output; };)
table=19(lr_in_arp_request ), priority=100 , match=(eth.dst == 00:00:00:00:00:00 && ip6), action=(nd_ns { nd.target = xxreg0; output; };)
table=19(lr_in_arp_request ), priority=0 , match=(1), action=(output;)
Datapath: "lr" (9a391808-9458-4fcf-b0d7-d105991e2462) Pipeline: egress
table=0 (lr_out_chk_dnat_local), priority=0 , match=(1), action=(reg9[4] = 0; next;)
table=1 (lr_out_undnat ), priority=0 , match=(1), action=(next;)
table=2 (lr_out_post_undnat ), priority=0 , match=(1), action=(next;)
table=3 (lr_out_snat ), priority=120 , match=(nd_ns), action=(next;)
table=3 (lr_out_snat ), priority=0 , match=(1), action=(next;)
table=4 (lr_out_post_snat ), priority=0 , match=(1), action=(next;)
table=5 (lr_out_egr_loop ), priority=0 , match=(1), action=(next;)
table=6 (lr_out_delivery ), priority=100 , match=(outport == "lr-ls"), action=(output;)
# ovn nat支持 snat、dnat、dnat_and_snat三种方式,其中snat 转换后IP 转换前IP/IP段，dnat 转换前IP 转换后IP
# 在table6看到dnat转换，table2看到undnat转换
# 在table3看到snat转换，table4看到unsnat转换
ovn-nbctl lr-nat-add lr snat 116.85.0.1 10.0.0.0/24
ovn-nbctl lr-nat-add lr dnat 20.0.0.2 117.85.0.1
ovn-sbctl lflow-list lr
Datapath: "lr" (9a391808-9458-4fcf-b0d7-d105991e2462) Pipeline: ingress
table=0 (lr_in_admission ), priority=100 , match=(vlan.present || eth.src[40]), action=(drop;)
table=0 (lr_in_admission ), priority=50 , match=(eth.dst == 00:00:00:00:00:03 && inport == "lr-ls"), action=(xreg0[0..47] = 00:00:00:00:00:03; next;)
table=0 (lr_in_admission ), priority=50 , match=(eth.mcast && inport == "lr-ls"), action=(xreg0[0..47] = 00:00:00:00:00:03; next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(arp.op == 2), action=(reg9[2] = lookup_arp(inport, arp.spa, arp.sha); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(inport == "lr-ls" && arp.spa == 10.10.10.0/24 && arp.op == 1), action=(reg9[2] = lookup_arp(inport, arp.spa, arp.sha); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(nd_na), action=(reg9[2] = lookup_nd(inport, nd.target, nd.tll); next;)
table=1 (lr_in_lookup_neighbor), priority=100 , match=(nd_ns), action=(reg9[2] = lookup_nd(inport, ip6.src, nd.sll); next;)
table=1 (lr_in_lookup_neighbor), priority=0 , match=(1), action=(reg9[2] = 1; next;)
table=2 (lr_in_learn_neighbor), priority=100 , match=(reg9[2] == 1), action=(next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(arp), action=(put_arp(inport, arp.spa, arp.sha); next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(nd_na), action=(put_nd(inport, nd.target, nd.tll); next;)
table=2 (lr_in_learn_neighbor), priority=90 , match=(nd_ns), action=(put_nd(inport, ip6.src, nd.sll); next;)
table=3 (lr_in_ip_input ), priority=100 , match=(inport == "lr-ls" && ip4 && ip.ttl == {0, 1} && !ip.later_frag), action=(icmp4 {eth.dst <-> eth.src; icmp4.type = 11; /* Time exceeded / icmp4.code = 0; / TTL exceeded in transit / ip4.dst = ip4.src; ip4.src = 10.10.10.3 ; ip.ttl = 254; outport = "lr-ls"; flags.loopback = 1; output; };)table=3 (lr_in_ip_input ), priority=100 , match=(ip4.src == {10.10.10.3, 10.10.10.255} && reg9[0] == 0), action=(drop;)table=3 (lr_in_ip_input ), priority=100 , match=(ip4.src_mcast ||ip4.src == 255.255.255.255 || ip4.src == 127.0.0.0/8 || ip4.dst == 127.0.0.0/8 || ip4.src == 0.0.0.0/8 || ip4.dst == 0.0.0.0/8), action=(drop;)table=3 (lr_in_ip_input ), priority=100 , match=(ip6.dst == fe80::200:ff:fe00:3 && udp.src == 547 && udp.dst == 546), action=(reg0 = 0; handle_dhcpv6_reply;)table=3 (lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 116.85.0.1), action=(eth.dst = eth.src; eth.src = xreg0[0..47]; arp.op = 2; / ARP reply / arp.tha = arp.sha; arp.sha = xreg0[0..47]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)table=3 (lr_in_ip_input ), priority=90 , match=(arp.op == 1 && arp.tpa == 20.0.0.2), action=(eth.dst = eth.src; eth.src = xreg0[0..47]; arp.op = 2; / ARP reply / arp.tha = arp.sha; arp.sha = xreg0[0..47]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)table=3 (lr_in_ip_input ), priority=90 , match=(inport == "lr-ls" && arp.op == 1 && arp.tpa == 10.10.10.3 && arp.spa == 10.10.10.0/24), action=(eth.dst = eth.src; eth.src = xreg0[0..47]; arp.op = 2; / ARP reply */ arp.tha = arp.sha; arp.sha = xreg0[0..47]; arp.tpa <-> arp.spa; outport = inport; flags.loopback = 1; output;)
table=3 (lr_in_ip_input ), priority=90 , match=(inport == "lr-ls" && ip6.dst == {fe80::200:ff:fe00:3, ff02::1:ff00:3} && nd_ns && nd.target == fe80::200:ff:fe00:3), action=(nd_na_router { eth.src = xreg0[0..47]; ip6.src = nd.target; nd.tll = xreg0[0..47]; outport = inport; flags.loopback = 1; output; };)
table=3 (lr_in_ip_input ), priority=90 , match=(ip4.dst == 10.10.10.3 && icmp4.type == 8 && icmp4.code == 0), action=(ip4.dst <-> ip4.src; ip.ttl = 255; icmp4.type = 0; flags.loopback = 1; next; )
table=3 (lr_in_ip_input ), priority=90 , match=(ip6.dst == fe80::200:ff:fe00:3 && icmp6.type == 128 && icmp6.code == 0), action=(ip6.dst <-> ip6.src; ip.ttl = 255; icmp6.type = 129; flags.loopback = 1; next; )
table=3 (lr_in_ip_input ), priority=85 , match=(arp || nd), action=(drop;)
table=3 (lr_in_ip_input ), priority=84 , match=(nd_rs || nd_ra), action=(next;)
table=3 (lr_in_ip_input ), priority=83 , match=(ip6.mcast_rsvd), action=(drop;)
table=3 (lr_in_ip_input ), priority=82 , match=(ip4.mcast || ip6.mcast), action=(drop;)
table=3 (lr_in_ip_input ), priority=60 , match=(ip4.dst == {10.10.10.3}), action=(drop;)
table=3 (lr_in_ip_input ), priority=60 , match=(ip6.dst == {fe80::200:ff:fe00:3}), action=(drop;)
table=3 (lr_in_ip_input ), priority=50 , match=(eth.bcast), action=(drop;)
table=3 (lr_in_ip_input ), priority=30 , match=(ip4 && ip.ttl == {0, 1}), action=(drop;)
table=3 (lr_in_ip_input ), priority=0 , match=(1), action=(next;)
table=4 (lr_in_unsnat ), priority=90 , match=(ip && ip4.dst == 116.85.0.1), action=(ct_snat;)
table=4 (lr_in_unsnat ), priority=0 , match=(1), action=(next;)
table=5 (lr_in_defrag ), priority=0 , match=(1), action=(next;)
table=6 (lr_in_dnat ), priority=100 , match=(ip && ip4.dst == 20.0.0.2), action=(flags.loopback = 1; ct_dnat(117.85.0.1);)
table=6 (lr_in_dnat ), priority=0 , match=(1), action=(next;)
table=7 (lr_in_ecmp_stateful), priority=0 , match=(1), action=(next;)
table=8 (lr_in_nd_ra_options), priority=0 , match=(1), action=(next;)
table=9 (lr_in_nd_ra_response), priority=0 , match=(1), action=(next;)
table=10(lr_in_ip_routing_pre), priority=0 , match=(1), action=(reg7 = 0; next;)
table=11(lr_in_ip_routing ), priority=10550, match=(nd_rs || nd_ra), action=(drop;)
table=11(lr_in_ip_routing ), priority=194 , match=(inport == "lr-ls" && ip6.dst == fe80::/64), action=(ip.ttl--; reg8[0..15] = 0; xxreg0 = ip6.dst; xxreg1 = fe80::200:ff:fe00:3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=11(lr_in_ip_routing ), priority=74 , match=(ip4.dst == 10.10.10.0/24), action=(ip.ttl--; reg8[0..15] = 0; reg0 = ip4.dst; reg1 = 10.10.10.3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=11(lr_in_ip_routing ), priority=73 , match=(reg7 == 0 && ip4.dst == 20.20.0.0/24), action=(ip.ttl--; reg8[0..15] = 0; reg0 = 10.10.10.3; reg1 = 10.10.10.3; eth.src = 00:00:00:00:00:03; outport = "lr-ls"; flags.loopback = 1; next;)
table=12(lr_in_ip_routing_ecmp), priority=150 , match=(reg8[0..15] == 0), action=(next;)
table=13(lr_in_policy ), priority=0 , match=(1), action=(reg8[0..15] = 0; next;)
table=14(lr_in_policy_ecmp ), priority=150 , match=(reg8[0..15] == 0), action=(next;)
table=15(lr_in_arp_resolve ), priority=500 , match=(ip4.mcast || ip6.mcast), action=(next;)
table=15(lr_in_arp_resolve ), priority=0 , match=(ip4), action=(get_arp(outport, reg0); next;)
table=15(lr_in_arp_resolve ), priority=0 , match=(ip6), action=(get_nd(outport, xxreg0); next;)
table=16(lr_in_chk_pkt_len ), priority=0 , match=(1), action=(next;)
table=17(lr_in_larger_pkts ), priority=0 , match=(1), action=(next;)
table=18(lr_in_gw_redirect ), priority=0 , match=(1), action=(next;)
table=19(lr_in_arp_request ), priority=100 , match=(eth.dst == 00:00:00:00:00:00 && ip4), action=(arp { eth.dst = ff:ff:ff:ff:ff:ff; arp.spa = reg1; arp.tpa = reg0; arp.op = 1; output; };)
table=19(lr_in_arp_request ), priority=100 , match=(eth.dst == 00:00:00:00:00:00 && ip6), action=(nd_ns { nd.target = xxreg0; output; };)
table=19(lr_in_arp_request ), priority=0 , match=(1), action=(output;)
Datapath: "lr" (9a391808-9458-4fcf-b0d7-d105991e2462) Pipeline: egress
table=0 (lr_out_chk_dnat_local), priority=0 , match=(1), action=(reg9[4] = 0; next;)
table=1 (lr_out_undnat ), priority=50 , match=(ip), action=(flags.loopback = 1; ct_dnat;)
table=1 (lr_out_undnat ), priority=0 , match=(1), action=(next;)
table=2 (lr_out_post_undnat ), priority=50 , match=(ip && ct.new), action=(ct_commit { } ; next; )
table=2 (lr_out_post_undnat ), priority=0 , match=(1), action=(next;)
table=3 (lr_out_snat ), priority=120 , match=(nd_ns), action=(next;)
table=3 (lr_out_snat ), priority=25 , match=(ip && ip4.src == 10.0.0.0/24), action=(ct_snat(116.85.0.1);)
table=3 (lr_out_snat ), priority=0 , match=(1), action=(next;)
table=4 (lr_out_post_snat ), priority=0 , match=(1), action=(next;)
table=5 (lr_out_egr_loop ), priority=0 , match=(1), action=(next;)
table=6 (lr_out_delivery ), priority=100 , match=(outport == "lr-ls"), action=(output;)
扫一扫
2569
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
