[Bug 1967718] [NEW] Traffic sent to LRP port recirculate until TTL=0

[Frode Nordahl]

Public bug reported:

When TCP/UDP traffic is sent to the address of an LRP port and at the
same time is not part of any SNAT/DNAT conversation, it will keep
recirculating in the OVS data plane until TTL is 0.

When the packet eventually drops, you might get this message logged:

[   58.586597] openvswitch: ovs-system: deferred action limit reached,
drop recirc action

This behavior is problematic because it wastes resources and could also
trigger other potential problems in the data plane quite quickly [0].
For any internet connected system it is also highly likely to occur.

As mentioned above the LRP address is used for both SNAT return traffic
and DNAT forwarding, so we would need to allow that traffic to pass and
at the same time install flows to prevent this from happening.

0: https://mail.openvswitch.org/pipermail/ovs-
discuss/2022-March/051780.html

** Affects: ovn (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ovn in Ubuntu.
https://bugs.launchpad.net/bugs/1967718

Title:
  Traffic sent to LRP port recirculate until TTL=0

Status in ovn package in Ubuntu:
  New

Bug description:
  When TCP/UDP traffic is sent to the address of an LRP port and at the
  same time is not part of any SNAT/DNAT conversation, it will keep
  recirculating in the OVS data plane until TTL is 0.

  When the packet eventually drops, you might get this message logged:

  [   58.586597] openvswitch: ovs-system: deferred action limit reached,
  drop recirc action

  This behavior is problematic because it wastes resources and could
  also trigger other potential problems in the data plane quite quickly
  [0]. For any internet connected system it is also highly likely to
  occur.

  As mentioned above the LRP address is used for both SNAT return
  traffic and DNAT forwarding, so we would need to allow that traffic to
  pass and at the same time install flows to prevent this from
  happening.

  0: https://mail.openvswitch.org/pipermail/ovs-
  discuss/2022-March/051780.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1967718/+subscriptions