The packet is lost after a ct commit operation in netdev mode

[hongliangl]

Information about OVS

root@kind-worker:/# ovs-vsctl list bridge br-int
_uuid               : a04cee80-ddf9-4024-b496-913c648522f4
auto_attach         : []
controller          : []
datapath_id         : "000082ee4ca02440"
datapath_type       : netdev
datapath_version    : "<built-in>"
external_ids        : {roundNum="1"}
fail_mode           : []
flood_vlans         : []
flow_tables         : {}
ipfix               : []
mcast_snooping_enable: false
mirrors             : []
name                : br-int
netflow             : []
other_config        : {}
ports               : [04db10ed-d95b-4da7-a50e-481a02593a84, 0991e38f-e77e-49cc-b5d4-1d00c6558c56]
protocols           : [OpenFlow10, OpenFlow13]
rstp_enable         : false
rstp_status         : {}
sflow               : []
status              : {}
stp_enable          : false
root@kind-worker:/# ovs-vsctl --version
ovs-vsctl (Open vSwitch) 2.15.1
DB Schema 8.2.0

Pipeline:

cookie=0x1,  table=0, priority=200,arp actions=resubmit(,24)
cookie=0x2, table=0,  priority=200,ip actions=resubmit(,1)
 cookie=0x0, table=0, priority=0 actions=NORMAL

# Fork the packet from port 4 to table 98.
cookie=0x1030000000000,  table=1, priority=190,in_port=4,ip actions=ct(commit,table=98,zone=255),resubmit(,7)

# Zone 101 is for SNAT
cookie=0x1030000000000,  table=98, priority=190,in_port=4,ip actions=ct(table=99,zone=101, nat)

# Zone 100 is for DNAT
cookie=0x1030000000000,  table=99, priority=190,in_port=4,ip actions=ct(table=100,zone=100, nat)

# Commit the packet with SNAT in DNAT ct zone.
cookie=0x1030000000000, table=100,priority=190,ip, in_port=4 actions=ct(commit,table=101,zone=100,nat(dst=10.10.2.4:80),exec(load:0x1->NXM_NX_CT_MARK[10]))

# Commit the packet with loading CT_LABEL in DNAT ct zone.
cookie=0x1030000000000, table=101,priority=190,ip, in_port=4 actions=load:0x2->NXM_NX_REG5[],ct(commit,table=102,zone=100,exec(load:0x2->NXM_NX_CT_LABEL[32..63]))

# Commit the packet with loading CT_MARK in DNAT ct zone.
cookie=0x1030000000000, table=102,priority=190,ip, in_port=4 actions=load:0x3->NXM_NX_REG4[22..23],ct(commit,table=103,zone=100,exec(load:0x1->NXM_NX_CT_MARK[4]))

# Commit the packet with SNAT in SNAT ct zone. The forked packet should be sent to table 104.
cookie=0x1030000000000, table=103,priority=190,ip, in_port=4 actions=ct(commit,table=104,zone=101,nat(src=10.10.2.1),exec(load:0x3->NXM_NX_CT_MARK[4..5]))

# Table 104 will not receive any packets, as a result of the number of packet number doesn't change.
cookie=0x1030000000000, table=104,priority=190,ip, in_port=4 actions=in_port
cookie=0x1030000000000, table=104,priority=0 actions=drop

When a packet is from port 4, then it

• table 0
• table 1, a forked one goes to table 98
• table 98, pass SNAT ct zone without commit
• table 99, pass DNAT ct zone without commit,
• table 100, pass DNAT ct zone with commit, forked packet is sent to table 101.
• table 101, pass DNAT ct zone with commit, forked packet is sent to table 102.
• table 102, pass DNAT ct zone with commit, forked packet is sent to table 103.
• table 103, pass SNAT ct zone with commit, forked packet is sent to table 104.
• table 104, the packet counter doesn't change and the packet in table 103 is lost, it is supposed to be sent to table 104.