ovs 隔离vlan packet

        转载请注明出处：http://blog.csdn.net/hliyuxin/article/details/52596745

OVS的一部分非vlan port,  会收到vlan port发出的广播包。OVS port 配置如下

Bridge br_t
        Port br_t
            Interface br_t
                type: internal
        Port "client-001"
            Interface "client-001"
                type: dpdkvhostuser
        Port "win-001"
            tag: 200
            Interface "win-001"
                type: dpdkvhostuser

win-001 port发出arp广播包， client-001会收到 

 在云环境中，导致本地port收到广播包多，性能受到影响。

跟踪OVS源码：

static void
xlate_normal_flood(struct xlate_ctx *ctx, struct xbundle *in_xbundle,
                   uint16_t vlan)
{
    struct xbundle *xbundle;

    LIST_FOR_EACH (xbundle, list_node, &ctx->xbridge->xbundles) {
        if (xbundle != in_xbundle
            && xbundle_includes_vlan(xbundle, vlan)
            && xbundle->floodable
            && !xbundle_mirror_out(ctx->xbridge, xbundle)) {
            output_normal(ctx, xbundle, vlan);
        }
    }
    ctx->nf_output_iface = NF_OUT_FLOOD;
}

static bool
xbundle_includes_vlan(const struct xbundle *xbundle, uint16_t vlan)
{
    return vlan == xbundle->vlan || xbundle_trunks_vlan(xbundle, vlan);
}

static bool
xbundle_trunks_vlan(const struct xbundle *bundle, uint16_t vlan)
{
    return (bundle->vlan_mode != PORT_VLAN_ACCESS
            && (!bundle->trunks || bitmap_is_set(bundle->trunks, vlan)));
}

GDB看到，普通port 是trunk类型，trunks=0x0，vlan包都能透传。

隔离修改方法，设置port为vlan_access类型，命令如下：

ovs-vsctl set port client-001 vlan_mode=access