ovs的dot1q-tunnel的vlan-mode

# man ovs-vswitchd.conf.db

              dot1q-tunnel
                     A  dot1q-tunnel  port  is somewhat like an access port. Like an access port, it carries packets on the single VLAN specified in the tag column and this VLAN,
                     called the service VLAN, does not appear in an 802.1Q header for packets that ingress or egress on the port. The main difference lies in  the  behavior  when
                     packets  that  include a 802.1Q header ingress on the port. Whereas an access port drops such packets, a dot1q-tunnel port treats these as double-tagged with
                     the outer service VLAN tag and the inner customer VLAN taken from the 802.1Q header. Correspondingly, to egress on the port, a packet  outer  VLAN  (or  only
                     VLAN) must be tag, which is removed before egress, which exposes the inner (customer) VLAN if one is present.

                     If cvlans is set, only allows packets in the specified customer VLANs.

       other_config : qinq-ethtype: optional string, either 802.1ad or 802.1q
              For a dot1q-tunnel port, this is the TPID for the service tag, that is, for the 802.1Q header that contains the service  VLAN  ID.  Because  packets  that  actually
              ingress  and  egress a dot1q-tunnel port do not include an 802.1Q header for the service VLAN, this does not affect packets on the dot1q-tunnel port itself. Rather,
              it determines the service VLAN for a packet that ingresses on a dot1q-tunnel port and egresses on a trunk port.

              The value 802.1ad specifies TPID 0x88a8, which is also the default if the setting is omitted. The value 802.1q specifies TPID 0x8100.

# ovs-vsctl add-port br enp4s0f0_1 tag=1000 vlan-mode=dot1q-tunnel -- set Interface enp4s0f0_1 ofport_request=2
# ovs-vsctl set Port enp4s0f0_1 other_config:qinq-ethtype=802.1q
# ovs-vsctl set Port enp4s0f0_1 other_config:qinq-ethtype=802.1ad # default value
# ovs-vsctl show
f6e5c4c7-1613-4e8a-aab4-7369caa10dbd
    Bridge br
        Port br
            Interface br
                type: internal
        Port "enp4s0f0"
            Interface "enp4s0f0"
        Port "enp4s0f0_1"
            tag: 1000
            Interface "enp4s0f0_1"
        Port "enp4s0f0_0"
            tag: 1000
            Interface "enp4s0f0_0"
        Port "enp4s0f0_2"
            tag: 1000
            Interface "enp4s0f0_2"
    ovs_version: "2.11.90"

commit fed8962aff57f552163ef718cc1b0db582f2295e
Author: Eric Garver <[e-mail]>
Date:   Wed Mar 1 17:48:00 2017 -0500

    Add new port VLAN mode "dot1q-tunnel"

     - Example:
         ovs-vsctl set Port p1 vlan_mode=dot1q-tunnel tag=100
       Pushes another VLAN 100 header on packets (tagged and untagged) on
       ingress, and pops it on egress.
     - Customer VLAN check:
         ovs-vsctl set Port p1 vlan_mode=dot1q-tunnel tag=100 cvlans=10,20
       Only customer VLAN of 10 and 20 are allowed.

    Co-authored-by: Xiao Liang <[e-mail]>
    Signed-off-by: Xiao Liang <[e-mail]>
    Signed-off-by: Eric Garver <[e-mail]>
    Signed-off-by: Ben Pfaff <[e-mail]>

调用关系如下：
recv_upcalls
        flow_extract
                miniflow_extract
        process_upcall
                upcall_xlate(SLOW_PATH_UPCALL)
                        xlate_actions
                                do_xlate_actions(OFPACT_OUTPUT)
                                        xlate_output_action(OFPP_NORMAL)
                                                xlate_normal
                                                        xvlan_extract
                                                        xvlan_input_translate

如果虚拟机里面已经带了vlan tag，并且ovs的port配成了默认的access port，packet就会被drop。

2019-05-11T07:34:16.471Z|00038|ofproto_dpif_xlate(handler85)|WARN|dropping VLAN 5 tagged packet received on port enp4s0f0_1 configured as VLAN 1000 access port on bridge br while processing arp,in_port=2,dl_vlan=5,dl_vlan_pcp=0,vlan_tci1=0x0000,dl_src=02:25:d0:14:01:02,dl_dst=ff:ff:ff:ff:ff:ff,arp_spa=1.1.14.1,arp_tpa=1.1.13.1,arp_op=1,arp_sha=02:25:d0:14:01:02,arp_tha=00:00:00:00:00:00

如果配成dot1q-tunnel模式就没有问题。

17:13:24.846272 02:25:d0:13:01:02 > 02:25:d0:14:01:02, ethertype 802.1Q-QinQ (0x88a8), length 106: vlan 1000, p 0, ethertype 802.1Q, vlan 5, p 0, ethertype IPv4, 1.1.13.1 > 1.1.14.1: ICMP echo reply, id 10020, seq 117, length 64
        0x0000:  0225 d014 0102 0225 d013 0102 88a8 03e8  .%.....%........
        0x0010:  8100 0005 0800 4500 0054 fcc7 0000 4001  ......E..T....@.
        0x0020:  60de 0101 0d01 0101 0e01 0000 e670 2724  `............p'$
        0x0030:  0075 b4e3 d75c 0000 0000 9ae2 0c00 0000  .u...\..........
        0x0040:  0000 1011 1213 1415 1617 1819 1a1b 1c1d  ................
        0x0050:  1e1f 2021 2223 2425 2627 2829 2a2b 2c2d  ...!"#$%&'()*+,-
        0x0060:  2e2f 3031 3233 3435 3637                 ./01234567

还需要注意的是rxvlan要设置为off。