Merge ~fnordahl/ubuntu/+source/ovn:bug/1914988-focal into ~ubuntu-server-dev/ubuntu/+source/ovn:ubuntu/focal

[Frode Nordahl]

[Frode Nordahl (fnordahl)]

Package building here: https://launchpad.net/~fnordahl/+archive/ubuntu/lp1914988

[Erlon R. Cruz (sombrafam)]

Tested this on Focal and it does solve the problem!

diff --git a/debian/changelog b/debian/changelog
index 3a96e4b..92f56a2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+ovn (20.03.2-0ubuntu0.20.04.3) focal; urgency=medium
+
+  * d/p/lp-1914988-tests-*: Backport test cases for SSL+RBAC (LP: #1914988).
+  * d/p/lp-1943266-physical-do-not-forward-traffic-from-localport-to-a-.patch:
+    Do not forward traffic from localport to localnet ports (LP: #1943266).
+
+ -- Frode Nordahl <[e-mail]>  Fri, 01 Oct 2021 09:42:00 +0200
+
 ovn (20.03.2-0ubuntu0.20.04.2) focal; urgency=medium
 
   * d/p/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch:
diff --git a/debian/patches/lp-1914988-tests-Make-certificate-generation-extendable.patch b/debian/patches/lp-1914988-tests-Make-certificate-generation-extendable.patch
new file mode 100644
index 0000000..073b2cb
--- /dev/null
+++ b/debian/patches/lp-1914988-tests-Make-certificate-generation-extendable.patch
@@ -0,0 +1,213 @@
+Origin: backport, https://github.com/ovn-org/ovn/commit/2bbb9fc7ed8aa193848fccbdf28437f79f0cd4f7
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1914988
+Last-Update: 2021-10-01
+
+From b05ce42d1a6c4ca468b6a5fd1a16a0f6a5867663 Mon Sep 17 00:00:00 2001
+From: Frode Nordahl <[e-mail]>
+Date: Fri, 5 Mar 2021 13:16:30 +0100
+Subject: [PATCH 2/3] tests: Make certificate generation extendable
+
+In preparation for enabling testing with SSL and RBAC enabled by
+default, rework the certificate generation so that we can easily
+add generation of more certificates/CN on demand.
+
+A side erffect of the change is a more generic naming scheme for
+the certificate files so the patch also contains an update to
+existing tests so that they use the new filenames.
+
+Signed-off-by: Frode Nordahl <[e-mail]>
+Acked-by: Mark Michelson <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+(cherry picked from commit 2bbb9fc7ed8aa193848fccbdf28437f79f0cd4f7)
+---
+ tests/automake.mk | 48 ++++++++++++++++++++++-------------------------
+ tests/ovn.at      | 48 +++++++++++++++++++++++------------------------
+ 2 files changed, 46 insertions(+), 50 deletions(-)
+
+diff --git a/tests/automake.mk b/tests/automake.mk
+index 9740f085a..6eabb97e6 100644
+--- a/tests/automake.mk
++++ b/tests/automake.mk
+@@ -215,39 +215,35 @@ PYCOV_CLEAN_FILES += $(CHECK_PYFILES:.py=.py,cover) .coverage
+ FLAKE8_PYFILES += $(CHECK_PYFILES)
+ 
+ if HAVE_OPENSSL
+-TESTPKI_FILES = \
+-	tests/testpki-cacert.pem \
+-	tests/testpki-cert.pem \
+-	tests/testpki-privkey.pem \
+-	tests/testpki-req.pem \
+-	tests/testpki-cert2.pem \
+-	tests/testpki-privkey2.pem \
+-	tests/testpki-req2.pem
++OVS_PKI_DIR = $(CURDIR)/tests/pki
++TESTPKI_CNS = test test2
++TESTPKI_FILES = $(shell \
++	for cn in $(TESTPKI_CNS); do \
++		echo tests/testpki-$$cn-cert.pem ; \
++		echo tests/testpki-$$cn-privkey.pem ; \
++		echo tests/testpki-$$cn-req.pem ; \
++	done)
++
++tests/testpki-cacert.pem: tests/pki/stamp
++	$(AM_V_GEN)cp $(OVS_PKI_DIR)/switchca/cacert.pem $@
++
++$(TESTPKI_FILES): tests/pki/stamp
++	$(AM_V_GEN)cp $(OVS_PKI_DIR)/$(notdir $(subst testpki-,,$@)) $@
++
++check_DATA += tests/testpki-cacert.pem
+ check_DATA += $(TESTPKI_FILES)
++CLEANFILES += tests/testpki-cacert.pem
+ CLEANFILES += $(TESTPKI_FILES)
+ 
+-tests/testpki-cacert.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/switchca/cacert.pem $@
+-tests/testpki-cert.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test-cert.pem $@
+-tests/testpki-req.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test-req.pem $@
+-tests/testpki-privkey.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test-privkey.pem $@
+-tests/testpki-cert2.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test2-cert.pem $@
+-tests/testpki-req2.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test2-req.pem $@
+-tests/testpki-privkey2.pem: tests/pki/stamp
+-	$(AM_V_GEN)cp tests/pki/test2-privkey.pem $@
+-
+-OVS_PKI = $(SHELL) $(ovs_srcdir)/utilities/ovs-pki.in --dir=tests/pki --log=tests/ovs-pki.log
++
++OVS_PKI = $(SHELL) $(ovs_srcdir)/utilities/ovs-pki.in --dir=$(OVS_PKI_DIR) --log=tests/ovs-pki.log
+ tests/pki/stamp:
+ 	$(AM_V_at)rm -f tests/pki/stamp
+ 	$(AM_V_at)rm -rf tests/pki
+ 	$(AM_V_GEN)$(OVS_PKI) init && \
+-	$(OVS_PKI) req+sign tests/pki/test && \
+-	$(OVS_PKI) req+sign tests/pki/test2 && \
++	for cn in $(TESTPKI_CNS); do \
++		$(OVS_PKI) req+sign tests/pki/$$cn; \
++	done && \
+ 	: > tests/pki/stamp
+ CLEANFILES += tests/ovs-pki.log
+ 
+diff --git a/tests/ovn.at b/tests/ovn.at
+index 4d9ee1256..6de5a6d3f 100644
+--- a/tests/ovn.at
++++ b/tests/ovn.at
+@@ -7701,8 +7701,8 @@ AT_CHECK(
+ 
+ start_daemon ovsdb-server --remote=punix:ovn-sb.sock \
+                           --remote=db:OVN_Southbound,SB_Global,connections \
+-                          --private-key="$PKIDIR/testpki-privkey2.pem" \
+-                          --certificate="$PKIDIR/testpki-cert2.pem" \
++                          --private-key="$PKIDIR/testpki-test2-privkey.pem" \
++                          --certificate="$PKIDIR/testpki-test2-cert.pem" \
+                           --ca-cert="$PKIDIR/testpki-cacert.pem" \
+                           ovn-sb.db
+ 
+@@ -7710,20 +7710,20 @@ PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT])
+ 
+ # read-only accesses should succeed
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+                     list SB_Global], [0], [stdout], [ignore])
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+                     list Connection], [0], [stdout], [ignore])
+ 
+ # write access should fail
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+                     chassis-add ch vxlan 1.2.4.8], [1], [ignore],
+ [ovn-sbctl: transaction error: {"details":"insert operation not allowed when database server is in read only mode","error":"not allowed"}
+@@ -7751,8 +7751,8 @@ start_daemon ovsdb-server --remote=punix:ovnnb_db.sock \
+ 
+ # Populate SSL configuration entries in nb db
+ AT_CHECK(
+-    [ovn-nbctl set-ssl $PKIDIR/testpki-privkey.pem \
+-                       $PKIDIR/testpki-cert.pem \
++    [ovn-nbctl set-ssl $PKIDIR/testpki-test-privkey.pem \
++                       $PKIDIR/testpki-test-cert.pem \
+                        $PKIDIR/testpki-cacert.pem], [0], [stdout], [ignore])
+ 
+ # Populate a passive SSL connection in nb db
+@@ -7762,20 +7762,20 @@ PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT])
+ 
+ # Verify SSL connetivity to nb db server
+ AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           list NB_Global],
+          [0], [stdout], [ignore])
+ AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           list Connection],
+          [0], [stdout], [ignore])
+ AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           get-connection],
+          [0], [stdout], [ignore])
+@@ -7802,8 +7802,8 @@ start_daemon ovsdb-server --remote=punix:ovnsb_db.sock \
+ 
+ # Populate SSL configuration entries in sb db
+ AT_CHECK(
+-    [ovn-sbctl set-ssl $PKIDIR/testpki-privkey.pem \
+-                       $PKIDIR/testpki-cert.pem \
++    [ovn-sbctl set-ssl $PKIDIR/testpki-test-privkey.pem \
++                       $PKIDIR/testpki-test-cert.pem \
+                        $PKIDIR/testpki-cacert.pem], [0], [stdout], [ignore])
+ 
+ # Populate a passive SSL connection in sb db
+@@ -7813,20 +7813,20 @@ PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT])
+ 
+ # Verify SSL connetivity to sb db server
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           list SB_Global],
+          [0], [stdout], [ignore])
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           list Connection],
+          [0], [stdout], [ignore])
+ AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \
+-                    --private-key=$PKIDIR/testpki-privkey.pem \
+-                    --certificate=$PKIDIR/testpki-cert.pem \
++                    --private-key=$PKIDIR/testpki-test-privkey.pem \
++                    --certificate=$PKIDIR/testpki-test-cert.pem \
+                     --ca-cert=$PKIDIR/testpki-cacert.pem \
+           get-connection],
+          [0], [stdout], [ignore])
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1914988-tests-Test-with-SSL-and-RBAC-for-controller-by-defau.patch b/debian/patches/lp-1914988-tests-Test-with-SSL-and-RBAC-for-controller-by-defau.patch
new file mode 100644
index 0000000..3336825
--- /dev/null
+++ b/debian/patches/lp-1914988-tests-Test-with-SSL-and-RBAC-for-controller-by-defau.patch
@@ -0,0 +1,153 @@
+Origin: backport, https://github.com/ovn-org/ovn/commit/c948d6bb05b4d8d34db7a88590eddb4c6de2b3c4
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1914988
+Last-Update: 2021-10-01
+
+From d2a358676e6d7260f44baa7ab2c23065c23f5968 Mon Sep 17 00:00:00 2001
+From: Frode Nordahl <[e-mail]>
+Date: Fri, 5 Mar 2021 13:16:31 +0100
+Subject: [PATCH 3/3] tests: Test with SSL and RBAC for controller by default
+
+To help ourself to not forget updating RBAC rules when we land
+changes to existing functionality and new features we must enable
+SSL+RBAC on the `ovn-controller` <-> SB DB connection for builds
+with OpenSSL enabled.
+
+Signed-off-by: Frode Nordahl <[e-mail]>
+Acked-by: Mark Michelson <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+(cherry picked from commit c948d6bb05b4d8d34db7a88590eddb4c6de2b3c4)
+---
+ tests/automake.mk       |  9 +++++++--
+ tests/ofproto-macros.at | 12 ++++++++++++
+ tests/ovn-macros.at     | 38 ++++++++++++++++++++++++++++++++++++--
+ 3 files changed, 55 insertions(+), 4 deletions(-)
+
+diff --git a/tests/automake.mk b/tests/automake.mk
+index 6eabb97e6..2df1e7a4f 100644
+--- a/tests/automake.mk
++++ b/tests/automake.mk
+@@ -216,7 +216,10 @@ FLAKE8_PYFILES += $(CHECK_PYFILES)
+ 
+ if HAVE_OPENSSL
+ OVS_PKI_DIR = $(CURDIR)/tests/pki
+-TESTPKI_CNS = test test2
++# NOTE: Certificate generation has to be done serially, and each one adds a few
++# seconds to the test run. Please try to re-use one of the many CNs already
++# used in the existing tests.
++TESTPKI_CNS = test test2 main hv hv-foo hv1 hv2 hv3 hv4 hv5 hv6 hv7 hv8 hv9 hv10 hv-1 hv-2 hv-10-1 hv-10-2 hv-20-1 hv-20-2 vtep hv_gw pbr-hv gw1 gw2 gw3 gw4 gw5 ext1
+ TESTPKI_FILES = $(shell \
+ 	for cn in $(TESTPKI_CNS); do \
+ 		echo tests/testpki-$$cn-cert.pem ; \
+@@ -241,9 +244,11 @@ tests/pki/stamp:
+ 	$(AM_V_at)rm -f tests/pki/stamp
+ 	$(AM_V_at)rm -rf tests/pki
+ 	$(AM_V_GEN)$(OVS_PKI) init && \
++	cd tests/pki && \
+ 	for cn in $(TESTPKI_CNS); do \
+-		$(OVS_PKI) req+sign tests/pki/$$cn; \
++		$(OVS_PKI) -u req+sign $$cn; \
+ 	done && \
++	cd ../../ && \
+ 	: > tests/pki/stamp
+ CLEANFILES += tests/ovs-pki.log
+ 
+diff --git a/tests/ofproto-macros.at b/tests/ofproto-macros.at
+index 22999c1ca..502313083 100644
+--- a/tests/ofproto-macros.at
++++ b/tests/ofproto-macros.at
+@@ -99,6 +99,7 @@ start_daemon () {
+ #
+ #     sim_add hv0
+ #     as hv0 ovs-vsctl add-br br0
++PKIDIR="$(cd $abs_top_builddir/tests && pwd)"
+ sims=
+ sim_add () {
+    echo "adding simulator '$1'"
+@@ -120,6 +121,17 @@ sim_add () {
+ 
+    # Start ovs-vswitchd
+    as $1 start_daemon ovs-vswitchd --enable-dummy=system -vvconn -vofproto_dpif -vunixctl
++   if test X$HAVE_OPENSSL = Xyes; then
++      if test -f $PKIDIR/testpki-$1-privkey.pem; then
++         as $1 ovs-vsctl set-ssl \
++            $PKIDIR/testpki-$1-privkey.pem \
++            $PKIDIR/testpki-$1-cert.pem \
++            $PKIDIR/testpki-cacert.pem \
++            || return 1
++      else
++         echo "WARNING: No certificate created for sim '$1', check TESTPKI_CNS variable in tests/automake.mk"
++      fi
++   fi
+ }
+ 
+ # "as $1" sets the OVS_*DIR environment variables to point to $ovs_base/$1.
+diff --git a/tests/ovn-macros.at b/tests/ovn-macros.at
+index 6089ccf67..6ac23c51e 100644
+--- a/tests/ovn-macros.at
++++ b/tests/ovn-macros.at
+@@ -108,7 +108,18 @@ ovn_init_db () {
+     mkdir "$d" || return 1
+     : > "$d"/.$1.db.~lock~
+     as $as_d ovsdb-tool create "$d"/$1.db "$abs_top_srcdir"/$1.ovsschema
+-    as $as_d start_daemon ovsdb-server --remote=punix:"$d"/$1.sock "$d"/$1.db
++
++    local remote_in_db=
++    if test X$HAVE_OPENSSL = Xyes -a X"$1" = X"ovn-sb"; then
++        remote_in_db="--remote=db:OVN_Southbound,SB_Global,connections --private-key=$PKIDIR/testpki-test-privkey.pem --certificate=$PKIDIR/testpki-test-cert.pem --ca-cert=$PKIDIR/testpki-cacert.pem"
++    fi
++
++    as $as_d start_daemon ovsdb-server \
++        -vjsonrpc \
++        --remote=punix:"$d"/$1.sock \
++        $remote_in_db \
++        "$d"/$1.db
++
+     local var=`echo $1_db | tr a-z- A-Z_`
+     AS_VAR_SET([$var], [unix:"$d"/$1.sock]); export $var
+ }
+@@ -161,6 +172,24 @@ ovn_start () {
+                --ovnnb-db=$ovn_nb_db \
+                --ovnsb-db=$ovn_sb_db
+ 
++    if test X$HAVE_OPENSSL = Xyes; then
++        # Create the SB DB pssl+RBAC connection. Ideally we could pre-create
++        # SB_Global and Connection with ovsdb-tool transact at DB creation
++        # time, but unfortunately that does not work, northd-ddlog will replace
++        # the SB_Global record on startup.
++        ovn-sbctl \
++            -- --id=@c create connection \
++                target=\"pssl:0:127.0.0.1\" role=ovn-controller \
++            -- add SB_Global . connections @c
++        local d=$ovs_base
++        if test -n "$1"; then
++            d=$d/$1
++        fi
++        PARSE_LISTENING_PORT([$d/ovn-sb/ovsdb-server.log], [TCP_PORT])
++        var="SSL_OVN_SB_DB"
++        AS_VAR_SET([$var], [ssl:127.0.0.1:$TCP_PORT]); export $var
++    fi
++
+     if test -n "$1"; then
+         as_d=$1/ic
+         echo "starting ovn-ic"
+@@ -225,11 +254,16 @@ ovn_az_attach() {
+ 
+     local ovn_remote
+     if test X"$az" = XNONE; then
+-        ovn_remote=unix:$ovs_base/ovn-sb/ovn-sb.sock
++        if test X$HAVE_OPENSSL = Xyes; then
++            ovn_remote=$SSL_OVN_SB_DB
++        else
++            ovn_remote=unix:$ovs_base/ovn-sb/ovn-sb.sock
++        fi
+     else
+         ovn_remote=unix:$ovs_base/$az/ovn-sb/ovn-sb.sock
+     fi
+     ovs-vsctl \
++        -- set Open_vSwitch . external-ids:hostname=$sandbox \
+         -- set Open_vSwitch . external-ids:system-id=$sandbox \
+         -- set Open_vSwitch . external-ids:ovn-remote=$ovn_remote \
+         -- set Open_vSwitch . external-ids:ovn-encap-type=geneve,vxlan \
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1914988-tests-Use-ovn_start-in-tests-ovn-controller.at.patch b/debian/patches/lp-1914988-tests-Use-ovn_start-in-tests-ovn-controller.at.patch
new file mode 100644
index 0000000..d6751dc
--- /dev/null
+++ b/debian/patches/lp-1914988-tests-Use-ovn_start-in-tests-ovn-controller.at.patch
@@ -0,0 +1,138 @@
+Origin: backport, https://github.com/ovn-org/ovn/commit/020dab90f725b548a6131c988bd52e96623d3b8f
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1914988
+Last-Update: 2021-10-01
+
+From fecda75d32d187cab785089d3435915a9582de35 Mon Sep 17 00:00:00 2001
+From: Frode Nordahl <[e-mail]>
+Date: Fri, 5 Mar 2021 13:16:29 +0100
+Subject: [PATCH 1/3] tests: Use ovn_start in tests/ovn-controller.at
+
+The current version of the tests only initializes the SB DB and
+instruments it directly. This does not work with SSL+RBAC as
+northd must run to program the RBAC rules into the SB DB.
+
+Run tests both for C and ddlog version of northd.
+
+Add workaround for ovn-controller not re-reading certificates to
+'ovn-controller - Chassis other_config' test.
+
+Signed-off-by: Frode Nordahl <[e-mail]>
+Acked-by: Mark Michelson <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+(cherry picked from commit 020dab90f725b548a6131c988bd52e96623d3b8f)
+---
+ tests/ovn-controller.at | 38 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at
+index b9d8c3f36..44a449403 100644
+--- a/tests/ovn-controller.at
++++ b/tests/ovn-controller.at
+@@ -2,7 +2,7 @@ AT_BANNER([ovn-controller])
+ 
+ AT_SETUP([ovn-controller - ovn-bridge-mappings])
+ AT_KEYWORDS([ovn])
+-ovn_init_db ovn-sb
++ovn_start
+ net_add n1
+ sim_add hv
+ as hv
+@@ -54,6 +54,14 @@ check_bridge_mappings () {
+     OVS_WAIT_UNTIL([test x"${local_mappings}" = x$(ovn-sbctl get Chassis ${sysid} external_ids:ovn-bridge-mappings | sed -e 's/\"//g')])
+ }
+ 
++# NOTE: This test originally ran with only the SB-DB and no northd. For the
++# test to be successfull with SSL+RBAC we need to initially run northd to get
++# the RBAC rules programmed into the SB-DB. The test instruments the SB-DB
++# directly and we need to stop northd to avoid overwriting the instrumentation.
++kill `cat northd/ovn-northd.pid`
++kill `cat northd-backup/ovn-northd.pid`
++kill `cat ovn-nb/ovsdb-server.pid`
++
+ # Initially there should be no patch ports.
+ check_patches
+ 
+@@ -116,12 +124,13 @@ as ovn-sb
+ OVS_APP_EXIT_AND_WAIT([ovsdb-server])
+ 
+ AT_CLEANUP
++])
+ 
+ # Checks that ovn-controller populates datapath-type and iface-types
+ # correctly in the Chassis external-ids column.
+ AT_SETUP([ovn-controller - Chassis external_ids])
+ AT_KEYWORDS([ovn])
+-ovn_init_db ovn-sb
++ovn_start
+ 
+ net_add n1
+ sim_add hv
+@@ -192,7 +201,21 @@ OVS_WAIT_UNTIL([
+ # Until that happens ovn-controller fails to create the records due to
+ # constraint violation on the Encap table.
+ sysid=${sysid}-foo
+-ovs-vsctl set Open_vSwitch . external-ids:system-id="${sysid}"
++current_remote=`ovs-vsctl get Open_vSwitch . external-ids:ovn-remote`
++if test X$HAVE_OPENSSL = Xyes; then
++    # To change chassis name we need to change certificate with matching CN
++    ovs-vsctl set-ssl \
++        $PKIDIR/testpki-${sysid}-privkey.pem \
++        $PKIDIR/testpki-${sysid}-cert.pem \
++        $PKIDIR/testpki-cacert.pem
++    # force reconnect which makes OVN controller read the new certificates
++    # TODO implement check for change of certificates in ovn-controller
++    # and remove this workaround.
++    ovs-vsctl set Open_vSwitch . external-ids:ovn-remote=unix:/dev/null
++fi
++ovs-vsctl -- set Open_vSwitch . external-ids:hostname="${sysid}" \
++          -- set Open_vSwitch . external-ids:system-id="${sysid}" \
++          -- set Open_vSwitch . external-ids:ovn-remote="${current_remote}"
+ 
+ OVS_WAIT_UNTIL([
+     grep -q 'Transaction causes multiple rows in \\"Encap\\" table to have identical values (geneve and \\"192.168.0.1\\") for index on columns \\"type\\" and \\"ip\\".' hv/ovn-controller.log
+@@ -217,12 +240,13 @@ as ovn-sb
+ OVS_APP_EXIT_AND_WAIT([ovsdb-server])
+ 
+ AT_CLEANUP
++])
+ 
+ # Checks that ovn-controller correctly maintains the mapping from the Encap
+ # table in the Southbound database to OVS in the face of changes on both sides
+ AT_SETUP([ovn-controller - change Encap properties])
+ AT_KEYWORDS([ovn])
+-ovn_init_db ovn-sb
++ovn_start
+ 
+ net_add n1
+ sim_add hv
+@@ -272,11 +296,12 @@ as ovn-sb
+ OVS_APP_EXIT_AND_WAIT([ovsdb-server])
+ 
+ AT_CLEANUP
++])
+ 
+ # Check ovn-controller connection status to Southbound database
+ AT_SETUP([ovn-controller - check sbdb connection])
+ AT_KEYWORDS([ovn])
+-ovn_init_db ovn-sb
++ovn_start
+ 
+ net_add n1
+ sim_add hv
+@@ -306,11 +331,12 @@ as ovn-sb
+ OVS_APP_EXIT_AND_WAIT([ovsdb-server])
+ 
+ AT_CLEANUP
++])
+ 
+ # Checks that ovn-controller recreates its chassis record when deleted externally.
+ AT_SETUP([ovn-controller - Chassis self record])
+ AT_KEYWORDS([ovn])
+-ovn_init_db ovn-sb
++ovn_start
+ 
+ net_add n1
+ sim_add hv
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1943266-physical-do-not-forward-traffic-from-localport-to-a-.patch b/debian/patches/lp-1943266-physical-do-not-forward-traffic-from-localport-to-a-.patch
new file mode 100644
index 0000000..8e24101
--- /dev/null
+++ b/debian/patches/lp-1943266-physical-do-not-forward-traffic-from-localport-to-a-.patch
@@ -0,0 +1,145 @@
+From 10ade706b64a9752e4fc75838b0eddb1bad7e9ec Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <[e-mail]>
+Date: Tue, 4 May 2021 19:59:00 +0200
+Subject: [PATCH] physical: do not forward traffic from localport to a localnet
+ one
+
+Since the localnet port is available on each hv, do not forward traffic
+to the localnet port if it is present in order to avoid switch fdb
+misconfiguration.
+Related bz: https://bugzilla.redhat.com/show_bug.cgi?id=1942877
+
+Signed-off-by: Lorenzo Bianconi <[e-mail]>
+Acked-by: Mark Michelson
+Signed-off-by: Numan Siddique <[e-mail]>
+(cherry picked from commit 96959e56d634c8d888af9e3ee340602593c7e4fa)
+---
+ controller/physical.c        | 23 +++++++++++++++++++++++
+ include/ovn/logical-fields.h | 16 ++++++++++++++++
+ tests/ovn.at                 | 17 +++++++++++++++++
+ 3 files changed, 56 insertions(+)
+
+diff --git a/controller/physical.c b/controller/physical.c
+index 3c5bbe027..87a0cff72 100644
+--- a/controller/physical.c
++++ b/controller/physical.c
+@@ -1137,6 +1137,11 @@ consider_port_binding(struct ovsdb_idl_index *sbrec_port_binding_by_name,
+ 
+         load_logical_ingress_metadata(binding, &zone_ids, ofpacts_p);
+ 
++        if (!strcmp(binding->type, "localport")) {
++            /* mark the packet as incoming from a localport */
++            put_load(1, MFF_LOG_FLAGS, MLF_LOCALPORT_BIT, 1, ofpacts_p);
++        }
++
+         /* Resubmit to first logical ingress pipeline table. */
+         put_resubmit(OFTABLE_LOG_INGRESS_PIPELINE, ofpacts_p);
+         ofctrl_add_flow(flow_table, OFTABLE_PHY_TO_LOG,
+@@ -1196,6 +1201,24 @@ consider_port_binding(struct ovsdb_idl_index *sbrec_port_binding_by_name,
+                                               ofport, flow_table);
+         }
+ 
++        /* Table 39, priority 160.
++         * =======================
++         *
++         * Do not forward local traffic from a localport to a localnet port.
++         */
++        if (!strcmp(binding->type, "localnet")) {
++            /* do not forward traffic from localport to localnet port */
++            match_init_catchall(&match);
++            ofpbuf_clear(ofpacts_p);
++            match_set_metadata(&match, htonll(dp_key));
++            match_set_reg(&match, MFF_LOG_OUTPORT - MFF_REG0, port_key);
++            match_set_reg_masked(&match, MFF_LOG_FLAGS - MFF_REG0,
++                                 MLF_LOCALPORT, MLF_LOCALPORT);
++            ofctrl_add_flow(flow_table, OFTABLE_CHECK_LOOPBACK, 160,
++                            binding->header_.uuid.parts[0], &match,
++                            ofpacts_p, &binding->header_.uuid);
++        }
++
+     } else if (!tun && !is_ha_remote) {
+         /* Remote port connected by localnet port */
+         /* Table 33, priority 100.
+diff --git a/include/ovn/logical-fields.h b/include/ovn/logical-fields.h
+index c7bd2dba9..b7e0affe9 100644
+--- a/include/ovn/logical-fields.h
++++ b/include/ovn/logical-fields.h
+@@ -57,6 +57,10 @@ enum mff_log_flags_bits {
+     MLF_LOCAL_ONLY_BIT = 4,
+     MLF_NESTED_CONTAINER_BIT = 5,
+     MLF_LOOKUP_MAC_BIT = 6,
++    MLF_LOOKUP_LB_HAIRPIN_BIT = 7,
++    MLF_LOOKUP_FDB_BIT = 8,
++    MLF_SKIP_SNAT_FOR_LB_BIT = 9,
++    MLF_LOCALPORT_BIT = 10,
+ };
+ 
+ /* MFF_LOG_FLAGS_REG flag assignments */
+@@ -88,6 +92,18 @@ enum mff_log_flags {
+ 
+     /* Indicate that the lookup in the mac binding table was successful. */
+     MLF_LOOKUP_MAC = (1 << MLF_LOOKUP_MAC_BIT),
++
++    MLF_LOOKUP_LB_HAIRPIN = (1 << MLF_LOOKUP_LB_HAIRPIN_BIT),
++
++    /* Indicate that the lookup in the fdb table was successful. */
++    MLF_LOOKUP_FDB = (1 << MLF_LOOKUP_FDB_BIT),
++
++    /* Indicate that a packet must not SNAT in the gateway router when
++     * load-balancing has taken place. */
++    MLF_SKIP_SNAT_FOR_LB = (1 << MLF_SKIP_SNAT_FOR_LB_BIT),
++
++    /* Indicate the packet has been received from a localport */
++    MLF_LOCALPORT = (1 << MLF_LOCALPORT_BIT),
+ };
+ 
+ /* OVN logical fields
+diff --git a/tests/ovn.at b/tests/ovn.at
+index 6de5a6d3f..4ad5e5809 100644
+--- a/tests/ovn.at
++++ b/tests/ovn.at
+@@ -10348,10 +10348,17 @@ AT_CLEANUP
+ AT_SETUP([ovn -- localport suppress gARP])
+ ovn_start
+ 
++send_garp() {
++    local inport=$1 eth_src=$2 eth_dst=$3 spa=$4 tpa=$5
++    local request=${eth_dst}${eth_src}08060001080006040001${eth_src}${spa}${eth_dst}${tpa}
++    as hv1 ovs-appctl netdev-dummy/receive vif$inport $request
++}
++
+ net_add n1
+ sim_add hv1
+ as hv1
+ check ovs-vsctl add-br br-phys
++ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys:br-phys
+ ovn_attach n1 br-phys 192.168.0.1
+ 
+ check ovs-vsctl set open . external-ids:ovn-bridge-mappings=phys:br-phys
+@@ -10362,6 +10369,7 @@ check ovn-nbctl ls-add ls \
+     -- lsp-set-addresses lp "00:00:00:00:00:01 10.0.0.1" \
+     -- lsp-add ls ln \
+     -- lsp-set-type ln localnet \
++    -- lsp-set-addresses ln unknown \
+     -- lsp-set-options ln network_name=phys \
+     -- lsp-add ls lsp \
+     -- lsp-set-addresses lsp "00:00:00:00:00:02 10.0.0.2"
+@@ -10395,6 +10403,15 @@ AT_CHECK([
+     test 0 -eq $pkts
+ ])
+ 
++spa=$(ip_to_hex 10 0 0 1)
++tpa=$(ip_to_hex 10 0 0 100)
++send_garp 1 000000000001 ffffffffffff $spa $tpa
++
++dnl traffic from localport should not be sent to localnet
++AT_CHECK([tcpdump -r hv1/br-phys_n1-tx.pcap arp[[24:4]]=0x0a000064 | wc -l],[0],[dnl
++0
++],[ignore])
++
+ OVN_CLEANUP([hv1])
+ AT_CLEANUP
+ 
+-- 
+2.32.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 9afd08f..fbe5db9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,6 @@
-lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
 lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch
+lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
+lp-1914988-tests-Use-ovn_start-in-tests-ovn-controller.at.patch
+lp-1914988-tests-Make-certificate-generation-extendable.patch
+lp-1914988-tests-Test-with-SSL-and-RBAC-for-controller-by-defau.patch
+lp-1943266-physical-do-not-forward-traffic-from-localport-to-a-.patch