From: Justin Pettit Date: Fri, 5 Feb 2016 11:26:43 +0000 (-0800) Subject: ovn-northd: Limit line length to under 80 columns. X-Git-Url: http://git.cascardo.info/?a=commitdiff_plain;h=501f95e18d17798187b38381a6d9d249348c88e1;p=cascardo%2Fovs.git ovn-northd: Limit line length to under 80 columns. Signed-off-by: Justin Pettit Acked-by: Russell Bryant --- diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c index 4b1d61122..302cc1de3 100644 --- a/ovn/northd/ovn-northd.c +++ b/ovn/northd/ovn-northd.c @@ -1329,7 +1329,6 @@ build_acls(struct ovn_datapath *od, struct hmap *lflows, struct hmap *ports) { bool has_stateful = has_stateful_acl(od); struct ovn_port *op; - struct ds match_in, match_out; /* Ingress and Egress Pre-ACL Table (Priority 0): Packets are * allowed by default. */ @@ -1348,22 +1347,27 @@ build_acls(struct ovn_datapath *od, struct hmap *lflows, struct hmap *ports) if (has_stateful) { HMAP_FOR_EACH (op, key_node, ports) { if (op->od == od && !strcmp(op->nbs->type, "router")) { - /* Can't use ct() for router ports. Consider the following configuration: - lp1(10.0.0.2) on hostA--ls1--lr0--ls2--lp2(10.0.1.2) on hostB, - For a ping from lp1 to lp2, First, the response will go through ct() - with a zone for lp2 in the ls2 ingress pipeline on hostB. - That ct zone knows about this connection. Next, it goes through ct() - with the zone for the router port in the egress pipeline of ls2 on hostB. - This zone does not know about the connection, as the icmp request - went through the logical router on hostA, not hostB. This would only work - with distributed conntrack state across all chassis. */ - - ds_init(&match_in); - ds_init(&match_out); + /* Can't use ct() for router ports. Consider the + * following configuration: lp1(10.0.0.2) on + * hostA--ls1--lr0--ls2--lp2(10.0.1.2) on hostB, For a + * ping from lp1 to lp2, First, the response will go + * through ct() with a zone for lp2 in the ls2 ingress + * pipeline on hostB. That ct zone knows about this + * connection. Next, it goes through ct() with the zone + * for the router port in the egress pipeline of ls2 on + * hostB. This zone does not know about the connection, + * as the icmp request went through the logical router + * on hostA, not hostB. This would only work with + * distributed conntrack state across all chassis. */ + struct ds match_in = DS_EMPTY_INITIALIZER; + struct ds match_out = DS_EMPTY_INITIALIZER; + ds_put_format(&match_in, "ip && inport == %s", op->json_key); ds_put_format(&match_out, "ip && outport == %s", op->json_key); - ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110, ds_cstr(&match_in), "next;"); - ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110, ds_cstr(&match_out), "next;"); + ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110, + ds_cstr(&match_in), "next;"); + ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110, + ds_cstr(&match_out), "next;"); ds_destroy(&match_in); ds_destroy(&match_out);