From eb172cc05b2e610e48f637cb3588a8871c28038e Mon Sep 17 00:00:00 2001
From: ssonigra <ssonigra@redhat.com>
Date: Mon, 7 Sep 2026 14:57:00 +0530
Subject: [PATCH] fix(ovnkube): prevent duplicate NOTRACK iptables rules on
 container restart

Check whether each NOTRACK rule already exists (iptables -C) before
appending it. Without this guard, every ovnkube-controller container
restart blindly appends duplicate rules for the Geneve and hybrid
overlay VXLAN ports. Because NOTRACK is a non-terminating target,
duplicates are all evaluated sequentially, inflating packet counters
and wasting CPU.

Signed-off-by: Saurab Sonigra <ssonigra@redhat.com>
---
 .../ovn-kubernetes/common/008-script-lib.yaml | 32 +++++++++++++++----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
index 63b7c2f52c..b6342a3b04 100644
--- a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
+++ b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
@@ -487,6 +487,26 @@ data:
       cp -f "/usr/libexec/cni/ovn-k8s-cni-overlay" /cni-bin-dir/
     }
 
+    # ensure-notrack-rule ensures exactly one NOTRACK rule exists for the given
+    # iptables command, chain, and port. Adds the rule if missing, removes only
+    # duplicates if present, and does nothing if a single rule already exists.
+    ensure-notrack-rule()
+    {
+      local cmd=$1
+      local chain=$2
+      local port=$3
+      local count
+      count=$($cmd -t raw -S $chain 2>/dev/null | grep -c "\-\-dport $port -j NOTRACK" || true)
+      if [ "$count" -eq 0 ]; then
+        $cmd -t raw -A $chain -p udp --dport $port -j NOTRACK
+      elif [ "$count" -gt 1 ]; then
+        local to_delete=$((count - 1))
+        for ((i=0; i<to_delete; i++)); do
+          $cmd -t raw -D $chain -p udp --dport $port -j NOTRACK
+        done
+      fi
+    }
+
     # start-ovnkube-node starts the ovnkube-node process. This function does not
     # return.
     start-ovnkube-node()
@@ -520,15 +540,15 @@ data:
       cni-bin-copy
 
       echo "I$(date "+%m%d %H:%M:%S.%N") - disable conntrack on geneve port"
-      iptables -t raw -A PREROUTING -p udp --dport {{.GenevePort}} -j NOTRACK
-      iptables -t raw -A OUTPUT -p udp --dport {{.GenevePort}} -j NOTRACK
-      ip6tables -t raw -A PREROUTING -p udp --dport {{.GenevePort}} -j NOTRACK
-      ip6tables -t raw -A OUTPUT -p udp --dport {{.GenevePort}} -j NOTRACK
+      ensure-notrack-rule iptables PREROUTING {{.GenevePort}}
+      ensure-notrack-rule iptables OUTPUT {{.GenevePort}}
+      ensure-notrack-rule ip6tables PREROUTING {{.GenevePort}}
+      ensure-notrack-rule ip6tables OUTPUT {{.GenevePort}}
 
       {{- if .OVNHybridOverlayVXLANPort}}
       echo "I$(date "+%m%d %H:%M:%S.%N") - disable conntrack on hybrid overlay VXLAN port"
-      iptables -t raw -A PREROUTING -p udp --dport {{.OVNHybridOverlayVXLANPort}} -j NOTRACK
-      iptables -t raw -A OUTPUT -p udp --dport {{.OVNHybridOverlayVXLANPort}} -j NOTRACK
+      ensure-notrack-rule iptables PREROUTING {{.OVNHybridOverlayVXLANPort}}
+      ensure-notrack-rule iptables OUTPUT {{.OVNHybridOverlayVXLANPort}}
       {{- end}}
 
       echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node"