Skip to content

Commit

Permalink
set networkpolicy log default to false
Browse files Browse the repository at this point in the history
  • Loading branch information
@hongzhen-ma
hongzhen-ma committed Jun 23, 2022
1 parent 4698755 commit 1dcf9a4
Show file tree
Hide file tree
Showing 3 changed files with 69 additions and 14 deletions.
29 changes: 22 additions & 7 deletions pkg/controller/network_policy.go
View file
Expand Up @@ -53,7 +53,8 @@ func (c *Controller) enqueueUpdateNp(old, new interface{}) {
}
oldNp := old.(*netv1.NetworkPolicy)
newNp := new.(*netv1.NetworkPolicy)
if !reflect.DeepEqual(oldNp.Spec, newNp.Spec) {
if !reflect.DeepEqual(oldNp.Spec, newNp.Spec) ||
!reflect.DeepEqual(oldNp.Annotations, newNp.Annotations) {
var key string
var err error
if key, err = cache.MetaNamespaceKeyFunc(new); err != nil {
Expand Down Expand Up @@ -176,6 +177,11 @@ func (c *Controller) handleUpdateNp(key string) error {
}
}()

logEnable := false
if np.Annotations[util.NetworkPolicyLogAnnotation] == "true" {
logEnable = true
}

// TODO: ovn acl doesn't support address_set name with '-', now we replace '-' by '.'.
// This may cause conflict if two np with name test-np and test.np. Maybe hash is a better solution,
// but we do not want to lost the readability now.
Expand Down Expand Up @@ -284,7 +290,7 @@ func (c *Controller) handleUpdateNp(key string) error {
excepts = append(excepts, except...)
}
}
klog.Infof("UpdateNp Ingress, allows is %v, excepts is %v", allows, excepts)
klog.Infof("UpdateNp Ingress, allows is %v, excepts is %v, log %v", allows, excepts, logEnable)
if err := c.ovnClient.CreateAddressSet(ingressAllowAsName, np.Namespace, np.Name, "ingress"); err != nil {
klog.Errorf("failed to create address_set %s, %v", ingressAllowAsName, err)
return err
Expand All @@ -304,7 +310,7 @@ func (c *Controller) handleUpdateNp(key string) error {
}

if len(allows) != 0 || len(excepts) != 0 {
if err := c.ovnClient.CreateIngressACL(pgName, ingressAllowAsName, ingressExceptAsName, svcAsName, protocol, npr.Ports); err != nil {
if err := c.ovnClient.CreateIngressACL(pgName, ingressAllowAsName, ingressExceptAsName, svcAsName, protocol, npr.Ports, logEnable); err != nil {
klog.Errorf("failed to create ingress acls for np %s, %v", key, err)
return err
}
Expand All @@ -323,11 +329,16 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}
ingressPorts := []netv1.NetworkPolicyPort{}
if err := c.ovnClient.CreateIngressACL(pgName, ingressAllowAsName, ingressExceptAsName, svcAsName, protocol, ingressPorts); err != nil {
if err := c.ovnClient.CreateIngressACL(pgName, ingressAllowAsName, ingressExceptAsName, svcAsName, protocol, ingressPorts, logEnable); err != nil {
klog.Errorf("failed to create ingress acls for np %s, %v", key, err)
return err
}
}

if err = c.ovnClient.SetAclLog(pgName, logEnable, true); err != nil {
// just log and do not return err here
klog.Errorf("failed to set ingress acl log for np %s, %v", key, err)
}
}

asNames, err := c.ovnClient.ListAddressSet(np.Namespace, np.Name, "ingress")
Expand Down Expand Up @@ -422,7 +433,7 @@ func (c *Controller) handleUpdateNp(key string) error {
excepts = append(excepts, except...)
}
}
klog.Infof("UpdateNp Egress, allows is %v, excepts is %v", allows, excepts)
klog.Infof("UpdateNp Egress, allows is %v, excepts is %v, log %v", allows, excepts, logEnable)
if err := c.ovnClient.CreateAddressSet(egressAllowAsName, np.Namespace, np.Name, "egress"); err != nil {
klog.Errorf("failed to create address_set %s, %v", egressAllowAsName, err)
return err
Expand All @@ -442,7 +453,7 @@ func (c *Controller) handleUpdateNp(key string) error {
}

if len(allows) != 0 || len(excepts) != 0 {
if err := c.ovnClient.CreateEgressACL(pgName, egressAllowAsName, egressExceptAsName, protocol, npr.Ports, svcAsName); err != nil {
if err := c.ovnClient.CreateEgressACL(pgName, egressAllowAsName, egressExceptAsName, protocol, npr.Ports, svcAsName, logEnable); err != nil {
klog.Errorf("failed to create egress acls for np %s, %v", key, err)
return err
}
Expand All @@ -461,11 +472,15 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}
egressPorts := []netv1.NetworkPolicyPort{}
if err := c.ovnClient.CreateEgressACL(pgName, egressAllowAsName, egressExceptAsName, protocol, egressPorts, svcAsName); err != nil {
if err := c.ovnClient.CreateEgressACL(pgName, egressAllowAsName, egressExceptAsName, protocol, egressPorts, svcAsName, logEnable); err != nil {
klog.Errorf("failed to create egress acls for np %s, %v", key, err)
return err
}
}
if err = c.ovnClient.SetAclLog(pgName, logEnable, false); err != nil {
// just log and do not return err here
klog.Errorf("failed to set egress acl log for np %s, %v", key, err)
}
}

asNames, err := c.ovnClient.ListAddressSet(np.Namespace, np.Name, "egress")
Expand Down
52 changes: 45 additions & 7 deletions pkg/ovs/ovn-nbctl.go
View file
Expand Up @@ -1163,15 +1163,19 @@ func (c Client) DeleteAddressSet(asName string) error {
return err
}

func (c Client) CreateIngressACL(pgName, asIngressName, asExceptName, svcAsName, protocol string, npp []netv1.NetworkPolicyPort) error {
var allowArgs []string
func (c Client) CreateIngressACL(pgName, asIngressName, asExceptName, svcAsName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool) error {
var allowArgs, ovnArgs []string

ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}
pgAs := fmt.Sprintf("%s_%s", pgName, ipSuffix)
ovnArgs := []string{MayExist, "--type=port-group", "--log", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "to-lport", util.IngressDefaultDrop, fmt.Sprintf("%s.dst == $%s", ipSuffix, pgAs), "drop"}
if logEnable {
ovnArgs = []string{MayExist, "--type=port-group", "--log", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "to-lport", util.IngressDefaultDrop, fmt.Sprintf("%s.dst == $%s", ipSuffix, pgAs), "drop"}
} else {
ovnArgs = []string{MayExist, "--type=port-group", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "to-lport", util.IngressDefaultDrop, fmt.Sprintf("%s.dst == $%s", ipSuffix, pgAs), "drop"}
}

if len(npp) == 0 {
allowArgs = []string{"--", MayExist, "--type=port-group", "acl-add", pgName, "to-lport", util.IngressAllowPriority, fmt.Sprintf("%s.src == $%s && %s.src != $%s && %s.dst == $%s", ipSuffix, asIngressName, ipSuffix, asExceptName, ipSuffix, pgAs), "allow-related"}
Expand All @@ -1190,16 +1194,19 @@ func (c Client) CreateIngressACL(pgName, asIngressName, asExceptName, svcAsName,
return err
}

func (c Client) CreateEgressACL(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, portSvcName string) error {
var allowArgs []string
func (c Client) CreateEgressACL(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, portSvcName string, logEnable bool) error {
var allowArgs, ovnArgs []string

ipSuffix := "ip4"
if protocol == kubeovnv1.ProtocolIPv6 {
ipSuffix = "ip6"
}
pgAs := fmt.Sprintf("%s_%s", pgName, ipSuffix)
ovnArgs := []string{"--", MayExist, "--type=port-group", "--log", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "from-lport", util.EgressDefaultDrop, fmt.Sprintf("%s.src == $%s", ipSuffix, pgAs), "drop"}

if logEnable {
ovnArgs = []string{"--", MayExist, "--type=port-group", "--log", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "from-lport", util.EgressDefaultDrop, fmt.Sprintf("%s.src == $%s", ipSuffix, pgAs), "drop"}
} else {
ovnArgs = []string{"--", MayExist, "--type=port-group", fmt.Sprintf("--severity=%s", "warning"), "acl-add", pgName, "from-lport", util.EgressDefaultDrop, fmt.Sprintf("%s.src == $%s", ipSuffix, pgAs), "drop"}
}
if len(npp) == 0 {
allowArgs = []string{"--", MayExist, "--type=port-group", "acl-add", pgName, "from-lport", util.EgressAllowPriority, fmt.Sprintf("%s.dst == $%s && %s.dst != $%s && %s.src == $%s", ipSuffix, asEgressName, ipSuffix, asExceptName, ipSuffix, pgAs), "allow-related"}
ovnArgs = append(ovnArgs, allowArgs...)
Expand Down Expand Up @@ -1775,3 +1782,34 @@ func (c *Client) GetLspExternalIds(lsp string) (map[string]string, []string) {

return nameNsMap, result[0]["addresses"]
}

func (c Client) SetAclLog(pgName string, logEnable, isIngress bool) error {
var direction, match string
if isIngress {
direction = "to-lport"
match = fmt.Sprintf("outport==@%s && ip", pgName)
} else {
direction = "from-lport"
match = fmt.Sprintf("inport==@%s && ip", pgName)
}

priority, _ := strconv.Atoi(util.IngressDefaultDrop)
result, err := c.CustomFindEntity("acl", []string{"_uuid"}, fmt.Sprintf("priority=%d", priority), fmt.Sprintf(`match="%s"`, match), fmt.Sprintf("direction=%s", direction), "action=drop")
if err != nil {
klog.Errorf("failed to get acl UUID: %v", err)
return err
}

if len(result) == 0 {
return nil
}

uuid := result[0]["_uuid"][0]
ovnCmd := []string{"set", "acl", uuid, fmt.Sprintf("log=%v", logEnable)}

if _, err := c.ovnNbCommand(ovnCmd...); err != nil {
return fmt.Errorf("failed to set acl log, %v", err)
}

return nil
}
2 changes: 2 additions & 0 deletions pkg/util/const.go
View file
Expand Up @@ -72,6 +72,8 @@ const (
ExGatewayLabel = "ovn.kubernetes.io/external-gw"
VpcNatGatewayLabel = "ovn.kubernetes.io/vpc-nat-gw"

NetworkPolicyLogAnnotation = "ovn.kubernetes.io/enable_log"

ProtocolTCP = "tcp"
ProtocolUDP = "udp"

Expand Down

0 comments on commit 1dcf9a4

Please sign in to comment.