Skip to content

Commit

Permalink
Match dstIP in Classifier to address windows promiscuous mode issue
Browse files Browse the repository at this point in the history
When multiple VMs have duplicate MAC addresses and promiscuous mode is enabled, OVS incorrectly
forwards packets destined for non-local IP addresses from the uplink to the host interface.
This patch matches dstIP field in ClassifierTable to ensure proper packet handling
and preventing unintended forwarding.

Signed-off-by: Shuyang Xin <[email protected]>
  • Loading branch information
XinShuYang committed Jul 23, 2024
1 parent 5cee770 commit c74ca81
Show file tree
Hide file tree
Showing 4 changed files with 20 additions and 7 deletions.
13 changes: 10 additions & 3 deletions pkg/agent/openflow/pipeline.go
Original file line number Diff line number Diff line change
Expand Up @@ -2963,13 +2963,13 @@ func (f *featurePodConnectivity) l3FwdFlowToExternal() binding.Flow {
}

// hostBridgeLocalFlows generates the flows to match the packets forwarded between bridge local port and uplink port.
func (f *featurePodConnectivity) hostBridgeLocalFlows() []binding.Flow {
func (f *featurePodConnectivity) hostBridgeLocalFlows(mutate func(flowBuilder binding.FlowBuilder) binding.FlowBuilder) []binding.Flow {
cookieID := f.cookieAllocator.Request(f.category).Raw()
return []binding.Flow{
// This generates the flow to forward the packets from uplink port to bridge local port.
ClassifierTable.ofTable.BuildFlow(priorityNormal).
applyMutateFunc(ClassifierTable.ofTable.BuildFlow(priorityNormal).
Cookie(cookieID).
MatchInPort(f.uplinkPort).
MatchInPort(f.uplinkPort), mutate).
Action().Output(f.hostIfacePort).
Done(),
// This generates the flow to forward the packets from bridge local port to uplink port.
Expand All @@ -2981,6 +2981,13 @@ func (f *featurePodConnectivity) hostBridgeLocalFlows() []binding.Flow {
}
}

func applyMutateFunc(flowBuilder binding.FlowBuilder, mutate func(flowBuilder binding.FlowBuilder) binding.FlowBuilder) binding.FlowBuilder {
if mutate != nil {
return mutate(flowBuilder)
}
return flowBuilder
}

// hostBridgeUplinkVLANFlows generates the flows to match VLAN packets from uplink port.
func (f *featurePodConnectivity) hostBridgeUplinkVLANFlows() []binding.Flow {
vlanMask := uint16(openflow15.OFPVID_PRESENT)
Expand Down
2 changes: 1 addition & 1 deletion pkg/agent/openflow/pipeline_other.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ func (f *featurePodConnectivity) hostBridgeUplinkFlows() []binding.Flow {
// outputToBridgeRegMark marks that the output interface is OVS bridge.
outputToBridgeRegMark := binding.NewRegMark(TargetOFPortField, f.hostIfacePort)
cookieID := f.cookieAllocator.Request(f.category).Raw()
flows := f.hostBridgeLocalFlows()
flows := f.hostBridgeLocalFlows(nil)
if f.networkConfig.IPv4Enabled {
flows = append(flows,
// This generates the flow to forward ARP packets from uplink port in normal way since uplink port is set to enable
Expand Down
8 changes: 7 additions & 1 deletion pkg/agent/openflow/pipeline_windows.go
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,17 @@ import (
binding "antrea.io/antrea/pkg/ovs/openflow"
)

func (f *featurePodConnectivity) hostBridgeLocalMutateFunc(flowBuilder binding.FlowBuilder) binding.FlowBuilder {
return flowBuilder.
MatchProtocol(binding.ProtocolIP).
MatchDstIP(f.nodeConfig.NodeTransportIPv4Addr.IP)
}

// hostBridgeUplinkFlows generates the flows that forward traffic between the bridge local port and the uplink port to
// support the host traffic with outside.
func (f *featurePodConnectivity) hostBridgeUplinkFlows() []binding.Flow {
cookieID := f.cookieAllocator.Request(f.category).Raw()
flows := f.hostBridgeLocalFlows()
flows := f.hostBridgeLocalFlows(f.hostBridgeLocalMutateFunc)
if f.networkConfig.IPv4Enabled {
flows = append(flows,
// This generates the flow to forward ARP packets from uplink port to bridge local port since uplink port is set
Expand Down
4 changes: 2 additions & 2 deletions pkg/agent/openflow/pod_connectivity_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ func podConnectivityInitFlows(
flows = append(flows,
"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=32770 actions=output:4294967294",
"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=4294967294 actions=output:32770",
"cookie=0x1010000000000, table=Classifier, priority=200,in_port=32770 actions=output:4294967294",
"cookie=0x1010000000000, table=Classifier, priority=200,ip,in_port=32770,nw_dst=192.168.77.100 actions=output:4294967294",
"cookie=0x1010000000000, table=Classifier, priority=200,in_port=4294967294 actions=output:32770",
"cookie=0x1010000000000, table=IngressSecurityClassifier, priority=210,ct_state=-rpl+trk,ip,nw_src=10.10.0.1 actions=goto_table:ConntrackCommit",
)
Expand Down Expand Up @@ -161,7 +161,7 @@ func podConnectivityInitFlows(
"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=32770 actions=output:4294967294",
"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=4294967294 actions=output:32770",
"cookie=0x1010000000000, table=Classifier, priority=210,ip,in_port=32770,nw_dst=10.10.0.0/24 actions=set_field:0x4/0xf->reg0,set_field:0x200/0x200->reg0,goto_table:UnSNAT",
"cookie=0x1010000000000, table=Classifier, priority=200,in_port=32770 actions=output:4294967294",
"cookie=0x1010000000000, table=Classifier, priority=200,ip,in_port=32770,nw_dst=192.168.77.100 actions=output:4294967294",
"cookie=0x1010000000000, table=Classifier, priority=200,in_port=4294967294 actions=output:32770",
"cookie=0x1010000000000, table=SpoofGuard, priority=200,ip,in_port=32769 actions=goto_table:UnSNAT",
"cookie=0x1010000000000, table=ConntrackZone, priority=200,ip actions=ct(table=ConntrackState,zone=65520,nat)",
Expand Down

0 comments on commit c74ca81

Please sign in to comment.