summaryrefslogtreecommitdiff
path: root/ovn
diff options
context:
space:
mode:
authorJustin Pettit <jpettit@ovn.org>2016-02-05 03:26:43 -0800
committerJustin Pettit <jpettit@ovn.org>2016-03-29 06:23:36 -0700
commit501f95e18d17798187b38381a6d9d249348c88e1 (patch)
tree5266599f6275b8bcba26bd3c49d8ca2596244231 /ovn
parent27955e9852ec3a58789195b1fe7b00355f2f16df (diff)
downloadopenvswitch-501f95e18d17798187b38381a6d9d249348c88e1.tar.gz
ovn-northd: Limit line length to under 80 columns.
Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
Diffstat (limited to 'ovn')
-rw-r--r--ovn/northd/ovn-northd.c34
1 files changed, 19 insertions, 15 deletions
diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c
index 4b1d61122..302cc1de3 100644
--- a/ovn/northd/ovn-northd.c
+++ b/ovn/northd/ovn-northd.c
@@ -1329,7 +1329,6 @@ build_acls(struct ovn_datapath *od, struct hmap *lflows, struct hmap *ports)
{
bool has_stateful = has_stateful_acl(od);
struct ovn_port *op;
- struct ds match_in, match_out;
/* Ingress and Egress Pre-ACL Table (Priority 0): Packets are
* allowed by default. */
@@ -1348,22 +1347,27 @@ build_acls(struct ovn_datapath *od, struct hmap *lflows, struct hmap *ports)
if (has_stateful) {
HMAP_FOR_EACH (op, key_node, ports) {
if (op->od == od && !strcmp(op->nbs->type, "router")) {
- /* Can't use ct() for router ports. Consider the following configuration:
- lp1(10.0.0.2) on hostA--ls1--lr0--ls2--lp2(10.0.1.2) on hostB,
- For a ping from lp1 to lp2, First, the response will go through ct()
- with a zone for lp2 in the ls2 ingress pipeline on hostB.
- That ct zone knows about this connection. Next, it goes through ct()
- with the zone for the router port in the egress pipeline of ls2 on hostB.
- This zone does not know about the connection, as the icmp request
- went through the logical router on hostA, not hostB. This would only work
- with distributed conntrack state across all chassis. */
-
- ds_init(&match_in);
- ds_init(&match_out);
+ /* Can't use ct() for router ports. Consider the
+ * following configuration: lp1(10.0.0.2) on
+ * hostA--ls1--lr0--ls2--lp2(10.0.1.2) on hostB, For a
+ * ping from lp1 to lp2, First, the response will go
+ * through ct() with a zone for lp2 in the ls2 ingress
+ * pipeline on hostB. That ct zone knows about this
+ * connection. Next, it goes through ct() with the zone
+ * for the router port in the egress pipeline of ls2 on
+ * hostB. This zone does not know about the connection,
+ * as the icmp request went through the logical router
+ * on hostA, not hostB. This would only work with
+ * distributed conntrack state across all chassis. */
+ struct ds match_in = DS_EMPTY_INITIALIZER;
+ struct ds match_out = DS_EMPTY_INITIALIZER;
+
ds_put_format(&match_in, "ip && inport == %s", op->json_key);
ds_put_format(&match_out, "ip && outport == %s", op->json_key);
- ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110, ds_cstr(&match_in), "next;");
- ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110, ds_cstr(&match_out), "next;");
+ ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110,
+ ds_cstr(&match_in), "next;");
+ ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110,
+ ds_cstr(&match_out), "next;");
ds_destroy(&match_in);
ds_destroy(&match_out);