Skip to content

Commit

Permalink
netpol: fix duplicate default drop acl (#3197)
Browse files Browse the repository at this point in the history 
Signed-off-by: 张祖建 <zhangzujian.7@gmail.com>
  • Loading branch information
@zhangzujian
zhangzujian committed Sep 11, 2023
1 parent 1c13e40 commit 012e003
Show file tree
Hide file tree
Showing 3 changed files with 58 additions and 52 deletions.
4 changes: 2 additions & 2 deletions pkg/controller/network_policy.go
View file
Expand Up @@ -332,7 +332,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.ovnNbClient.UpdateIngressAclOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.ovnNbClient.UpdateIngressAclOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, nil, logEnable, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
return err
Expand Down Expand Up @@ -485,7 +485,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.ovnNbClient.UpdateEgressAclOps(pgName, egressAllowAsName, egressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.ovnNbClient.UpdateEgressAclOps(pgName, egressAllowAsName, egressExceptAsName, protocol, nil, logEnable, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
return err
Expand Down
90 changes: 48 additions & 42 deletions pkg/ovs/ovn-nb-acl.go
View file
Expand Up @@ -22,29 +22,32 @@ import (
func (c *ovnNbClient) UpdateIngressAclOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}
if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
// create the default drop rule for only once
ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}

/* default drop acl */
allIpMatch := NewAndAclMatch(
NewAclMatch("outport", "==", "@"+pgName, ""),
NewAclMatch(ipSuffix, "", "", ""),
)
options := func(acl *ovnnb.ACL) {
if logEnable {
acl.Log = true
acl.Severity = &ovnnb.ACLSeverityWarning
/* default drop acl */
allIpMatch := NewAndAclMatch(
NewAclMatch("outport", "==", "@"+pgName, ""),
NewAclMatch(ipSuffix, "", "", ""),
)
options := func(acl *ovnnb.ACL) {
if logEnable {
acl.Log = true
acl.Severity = &ovnnb.ACLSeverityWarning
}
}
}

defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
if err != nil {
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
}
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
if err != nil {
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
}

acls = append(acls, defaultDropAcl)
acls = append(acls, defaultDropAcl)
}

/* allow acl */
matches := newNetworkPolicyAclMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
Expand All @@ -69,36 +72,39 @@ func (c *ovnNbClient) UpdateIngressAclOps(pgName, asIngressName, asExceptName, p
func (c *ovnNbClient) UpdateEgressAclOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}
if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
// create the default drop rule for only once
ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}

/* default drop acl */
allIpMatch := NewAndAclMatch(
NewAclMatch("inport", "==", "@"+pgName, ""),
NewAclMatch(ipSuffix, "", "", ""),
)
options := func(acl *ovnnb.ACL) {
if logEnable {
acl.Log = true
acl.Severity = &ovnnb.ACLSeverityWarning
/* default drop acl */
allIpMatch := NewAndAclMatch(
NewAclMatch("inport", "==", "@"+pgName, ""),
NewAclMatch(ipSuffix, "", "", ""),
)
options := func(acl *ovnnb.ACL) {
if logEnable {
acl.Log = true
acl.Severity = &ovnnb.ACLSeverityWarning
}

if acl.Options == nil {
acl.Options = make(map[string]string)
}
acl.Options["apply-after-lb"] = "true"
}

if acl.Options == nil {
acl.Options = make(map[string]string)
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
if err != nil {
klog.Error(err)
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
}
acl.Options["apply-after-lb"] = "true"
}

defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
if err != nil {
klog.Error(err)
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
acls = append(acls, defaultDropAcl)
}

acls = append(acls, defaultDropAcl)

/* allow acl */
matches := newNetworkPolicyAclMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, npp, namedPortMap)
for _, m := range matches {
Expand Down
16 changes: 8 additions & 8 deletions pkg/ovs/ovn-nb-acl_test.go
View file
Expand Up @@ -81,8 +81,8 @@ func (suite *OvnClientTestSuite) testUpdateIngressAclOps() {
t.Parallel()

pgName := "test_create_v4_ingress_acl_pg"
asIngressName := "test.default.ingress.allow.ipv4"
asExceptName := "test.default.ingress.except.ipv4"
asIngressName := "test.default.ingress.allow.ipv4.all"
asExceptName := "test.default.ingress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4

err := ovnClient.CreatePortGroup(pgName, nil)
Expand All @@ -109,8 +109,8 @@ func (suite *OvnClientTestSuite) testUpdateIngressAclOps() {
t.Parallel()

pgName := "test_create_v6_ingress_acl_pg"
asIngressName := "test.default.ingress.allow.ipv6"
asExceptName := "test.default.ingress.except.ipv6"
asIngressName := "test.default.ingress.allow.ipv6.all"
asExceptName := "test.default.ingress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6

err := ovnClient.CreatePortGroup(pgName, nil)
Expand Down Expand Up @@ -151,8 +151,8 @@ func (suite *OvnClientTestSuite) testUpdateEgressAclOps() {
t.Parallel()

pgName := "test_create_v4_egress_acl_pg"
asEgressName := "test.default.egress.allow.ipv4"
asExceptName := "test.default.egress.except.ipv4"
asEgressName := "test.default.egress.allow.ipv4.all"
asExceptName := "test.default.egress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4

err := ovnClient.CreatePortGroup(pgName, nil)
Expand All @@ -179,8 +179,8 @@ func (suite *OvnClientTestSuite) testUpdateEgressAclOps() {
t.Parallel()

pgName := "test_create_v6_egress_acl_pg"
asEgressName := "test.default.egress.allow.ipv6"
asExceptName := "test.default.egress.except.ipv6"
asEgressName := "test.default.egress.allow.ipv6.all"
asExceptName := "test.default.egress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6

err := ovnClient.CreatePortGroup(pgName, nil)
Expand Down

0 comments on commit 012e003

Please sign in to comment.