Match dstIP in Classifier to address windows promiscuous mode issue #6528

XinShuYang · 2024-07-17T03:20:32Z

When promiscuous mode is enabled, OVS incorrectly forwards packets destined for
non-local IP addresses from the uplink to the host interface. Due to IP forwarding
being enabled, these packets are re-sent to br-int according to the default route
and are eventually forwarded to the uplink. Since the source MAC of these packets
has been changed to the local host’s MAC, this can potentially cause errors on the switch.

This patch matches dstIP field in ClassifierTable to ensure proper packet handling
and preventing unintended forwarding.

XinShuYang · 2024-07-17T03:23:58Z

/test-windows-e2e

XinShuYang · 2024-07-17T03:24:12Z

/test-windows-all

XinShuYang · 2024-07-18T05:31:42Z

/test-latest-all

XinShuYang · 2024-07-18T06:24:25Z

/test-windows-all

XinShuYang · 2024-07-23T02:43:22Z

/test-windows-containerd-e2e

XinShuYang · 2024-07-23T03:06:40Z

/test-windows-containerd-conformance

wenyingd

I remember that we used to have a dedicated change trying to merge similar functions from pipeline_windows and pipeline_others into pipeline.go. So maybe we can think about introducing a mutateFunc in the the unique hostBridgeLocalFlows(), and provide different mutate implementations in the OS separate files?

pkg/agent/openflow/pipeline_windows.go

rajnkamr · 2024-07-23T04:43:55Z

promiscuous mode is usually enabled for debugging, can we add documentation for this case !

XinShuYang · 2024-07-23T05:16:45Z

promiscuous mode is usually enabled for debugging, can we add documentation for this case !

On Windows, promiscuous mode is not enabled by Antrea. This patch is intended to enhance the pipeline by ensuring the packets destined for other nodes are not forwarded to the local port, which is also reasonable for the debugging purpose.

XinShuYang · 2024-07-23T05:17:01Z

/test-windows-containerd-e2e

rajnkamr · 2024-07-23T06:11:27Z

promiscuous mode is usually enabled for debugging, can we add documentation for this case !

On Windows, promiscuous mode is not enabled by Antrea. This patch is intended to enhance the pipeline by ensuring the packets destined for other nodes are not forwarded to the local port, which is also reasonable for the debugging purpose.

Ok, When promiscuous mode is enabled, the interface ignores the MAC address filter and captures all network traffic it can see. Are we also considering to match in case destip is ipv6 ? what about linux case, this problem can be seen on linux as well !

XinShuYang · 2024-07-23T06:15:17Z

promiscuous mode is usually enabled for debugging, can we add documentation for this case !

On Windows, promiscuous mode is not enabled by Antrea. This patch is intended to enhance the pipeline by ensuring the packets destined for other nodes are not forwarded to the local port, which is also reasonable for the debugging purpose.

Ok, When promiscuous mode is enabled, the interface ignores the MAC address filter and captures all network traffic it can see. Are we also considering to match in case destip is ipv6 ? what about linux case, this problem can be seen on linux as well !

Currently Windows doesn‘t support IPv6, and in Linux, since uplink port is not added to the bridge by default, we didn't find the same issue.

XinShuYang · 2024-07-23T07:54:22Z

I remember that we used to have a dedicated change trying to merge similar functions from pipeline_windows and pipeline_others into pipeline.go. So maybe we can think about introducing a mutateFunc in the the unique hostBridgeLocalFlows(), and provide different mutate implementations in the OS separate files?

Sure, added mutate function implementation, PTAL.

pkg/agent/openflow/pipeline.go

wenyingd

Overall LGTM, one minor comment.

wenyingd · 2024-07-25T02:09:35Z

pkg/agent/openflow/pipeline_windows.go

@@ -23,6 +23,12 @@ import (
 	binding "antrea.io/antrea/pkg/ovs/openflow"
 )

+func (f *featurePodConnectivity) uplinkMatchMutate(flowBuilder binding.FlowBuilder) binding.FlowBuilder {


Add some comments here to explain why we need this mutate function?

Sure, comments updated.

antoninbas · 2024-07-31T17:34:16Z

This seems to indicate that even with promiscuous mode disabled on br-int, packets sent to it through the OVS pipeline will bypass the MAC check...

Ok

BTW, in my vSphere lab network environment, the uplink interface always has promiscuous mode enabled, and only enabling promiscuous mode on the standard switch will send unrelated packets to the Windows host.

Yes, I imagine that promiscuous mode works a bit differently in a virtual environment with a virtual switch.

It's still hard for me to understand why the Windows OS would do IP forwarding on arbitrary packets with an unknown MAC address.

XinShuYang · 2024-08-01T03:26:03Z

This seems to indicate that even with promiscuous mode disabled on br-int, packets sent to it through the OVS pipeline will bypass the MAC check...

Ok

BTW, in my vSphere lab network environment, the uplink interface always has promiscuous mode enabled, and only enabling promiscuous mode on the standard switch will send unrelated packets to the Windows host.

Yes, I imagine that promiscuous mode works a bit differently in a virtual environment with a virtual switch.

It's still hard for me to understand why the Windows OS would do IP forwarding on arbitrary packets with an unknown MAC address.

@antoninbas I can see the IP-to-MAC info in the ARP table for packets captured on br-int. Based on the behavior observed from Windows, it appears that packets indeed ignore MAC checks during IP forwarding. My guess is the Windows network stack completes the Layer 2 decapsulation before handling IP forwarding. When it decides to forward the packet back to br-int based on the default route, it encapsulates the packet with Layer 2 info, where the src MAC is the local host's MAC, and the dst MAC is the MAC maintained in the ARP table.

wenyingd

LGTM

XinShuYang · 2024-08-01T05:15:52Z

/test-windows-all

antoninbas

LGTM
Would it make sense to use f.matchUplinkInPort for other occurrences of MatchInPort(f.uplinkPort) as well? I see 2 of them in pipeline.go

XinShuYang · 2024-08-02T01:20:34Z

LGTM Would it make sense to use f.matchUplinkInPort for other occurrences of MatchInPort(f.uplinkPort) as well? I see 2 of them in pipeline.go

@antoninbas MatchInPort(f.uplinkPort) in podUplinkClassifierFlows is used for IPAM, which is a feature not currently supported by Windows. Another instance is in hostBridgeUplinkVLANFlows. Since the VLANTable is located after the Classifier in the pipeline, I also believe there is no need to modify the rules?

luolanzone · 2024-08-02T02:41:17Z

@XinShuYang so this is actually a connection issue when the promiscuous mode is enabled on Windows, right?
@antoninbas I am thinking that if we should add the label 'action/release-note' if we consider it as a bug fix.

antoninbas · 2024-08-02T17:59:02Z

@XinShuYang got it, then maybe we should update the method name again, to something more specific such as matchUplinkInPortInClassifierTable.

@luolanzone sounds good to me. We can also backport as needed, there is very little risk involved with this change IMO.

When promiscuous mode is enabled, OVS incorrectly forwards packets destined for non-local IP addresses from the uplink to the host interface. Due to IP forwarding being enabled, these packets are re-sent to br-int according to the default route and are eventually forwarded to the uplink. Since the source MAC of these packets has been changed to the local host’s MAC, this can potentially cause errors on the switch. This patch matches dstIP field in ClassifierTable to ensure proper packet handling and preventing unintended forwarding. Signed-off-by: Shuyang Xin <[email protected]>

XinShuYang · 2024-08-05T01:57:18Z

@XinShuYang got it, then maybe we should update the method name again, to something more specific such as matchUplinkInPortInClassifierTable.

Sure, code updated.

antoninbas · 2024-08-05T18:27:36Z

/test-windows-all

XinShuYang · 2024-08-08T03:06:38Z

Hi @antoninbas , windows CI passed, can we merged this PR?

…ntrea-io#6528) When promiscuous mode is enabled, OVS incorrectly forwards packets destined for non-local IP addresses from the uplink to the host interface. Due to IP forwarding being enabled, these packets are re-sent to br-int according to the default route and are eventually forwarded to the uplink. Since the source MAC of these packets has been changed to the local host’s MAC, this can potentially cause errors on the switch. This patch matches dstIP field in ClassifierTable to ensure proper packet handling and preventing unintended forwarding. Signed-off-by: Shuyang Xin <[email protected]>

…ntrea-io#6528) When promiscuous mode is enabled, OVS incorrectly forwards packets destined for non-local IP addresses from the uplink to the host interface. Due to IP forwarding being enabled, these packets are re-sent to br-int according to the default route and are eventually forwarded to the uplink. Since the source MAC of these packets has been changed to the local host’s MAC, this can potentially cause errors on the switch. This patch matches dstIP field in ClassifierTable to ensure proper packet handling and preventing unintended forwarding. Signed-off-by: Shuyang Xin <[email protected]> Co-authored-by: Wenying Dong <[email protected]>

…ntrea-io#6528) When promiscuous mode is enabled, OVS incorrectly forwards packets destined for non-local IP addresses from the uplink to the host interface. Due to IP forwarding being enabled, these packets are re-sent to br-int according to the default route and are eventually forwarded to the uplink. Since the source MAC of these packets has been changed to the local host’s MAC, this can potentially cause errors on the switch. This patch matches dstIP field in ClassifierTable to ensure proper packet handling and preventing unintended forwarding. Signed-off-by: Gavin Xin <[email protected]>

…6528) When promiscuous mode is enabled, OVS incorrectly forwards packets destined for non-local IP addresses from the uplink to the host interface. Due to IP forwarding being enabled, these packets are re-sent to br-int according to the default route and are eventually forwarded to the uplink. Since the source MAC of these packets has been changed to the local host’s MAC, this can potentially cause errors on the switch. This patch matches dstIP field in ClassifierTable to ensure proper packet handling and preventing unintended forwarding. Signed-off-by: Gavin Xin <[email protected]>

XinShuYang requested a review from wenyingd July 17, 2024 03:24

XinShuYang force-pushed the windowsuplink branch from 5e6e462 to 6775c5e Compare July 18, 2024 06:16

XinShuYang changed the title ~~Match dstmac in Classifier to address windows promiscuous mode issue~~ Match dstIP in Classifier to address windows promiscuous mode issue Jul 23, 2024

wenyingd reviewed Jul 23, 2024

View reviewed changes

pkg/agent/openflow/pipeline_windows.go Outdated Show resolved Hide resolved

XinShuYang force-pushed the windowsuplink branch from 6775c5e to 44c8595 Compare July 23, 2024 03:26

XinShuYang force-pushed the windowsuplink branch from 44c8595 to a57d40c Compare July 23, 2024 05:10

XinShuYang force-pushed the windowsuplink branch from a57d40c to ca6d857 Compare July 23, 2024 05:45

XinShuYang force-pushed the windowsuplink branch 3 times, most recently from 14f5066 to c74ca81 Compare July 23, 2024 06:52

XinShuYang requested a review from wenyingd July 24, 2024 02:12

XinShuYang marked this pull request as ready for review July 24, 2024 02:12

wenyingd reviewed Jul 24, 2024

View reviewed changes

pkg/agent/openflow/pipeline.go Outdated Show resolved Hide resolved

XinShuYang force-pushed the windowsuplink branch from c74ca81 to 7d23f4c Compare July 24, 2024 06:28

XinShuYang requested a review from wenyingd July 24, 2024 07:23

wenyingd reviewed Jul 25, 2024

View reviewed changes

XinShuYang force-pushed the windowsuplink branch from 7d23f4c to c3ec381 Compare July 25, 2024 02:35

XinShuYang requested a review from wenyingd July 25, 2024 02:35

XinShuYang force-pushed the windowsuplink branch from 6917edf to fcaeced Compare July 31, 2024 08:41

XinShuYang force-pushed the windowsuplink branch 2 times, most recently from 66e9ffe to 8b7cdc6 Compare August 1, 2024 03:10

XinShuYang requested a review from wenyingd August 1, 2024 04:38

wenyingd previously approved these changes Aug 1, 2024

View reviewed changes

antoninbas previously approved these changes Aug 1, 2024

View reviewed changes

luolanzone added the area/OS/windows Issues or PRs related to the Windows operating system. label Aug 2, 2024

XinShuYang dismissed stale reviews from antoninbas and wenyingd via 22a3163 August 5, 2024 01:56

XinShuYang force-pushed the windowsuplink branch from 8b7cdc6 to 22a3163 Compare August 5, 2024 01:56

XinShuYang requested a review from antoninbas August 5, 2024 01:57

antoninbas approved these changes Aug 5, 2024

View reviewed changes

antoninbas merged commit 2f863f4 into antrea-io:main Aug 8, 2024
53 of 60 checks passed

antoninbas added the action/release-note Indicates a PR that should be included in release notes. label Aug 8, 2024

wenyingd mentioned this pull request Jan 23, 2025

Automated cherry pick of #6763: Install Pod flows after PortStatus message is#6889: Support OF port state "down" when installing Pod... #6937

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Match dstIP in Classifier to address windows promiscuous mode issue #6528

Match dstIP in Classifier to address windows promiscuous mode issue #6528

XinShuYang commented Jul 17, 2024 •

edited

Loading

XinShuYang commented Jul 17, 2024

XinShuYang commented Jul 17, 2024

XinShuYang commented Jul 18, 2024

XinShuYang commented Jul 18, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

wenyingd left a comment •

edited

Loading

rajnkamr commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

rajnkamr commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

wenyingd left a comment

wenyingd Jul 25, 2024

XinShuYang Jul 25, 2024

antoninbas commented Jul 31, 2024

XinShuYang commented Aug 1, 2024

wenyingd left a comment

XinShuYang commented Aug 1, 2024

antoninbas left a comment

XinShuYang commented Aug 2, 2024

luolanzone commented Aug 2, 2024

antoninbas commented Aug 2, 2024

XinShuYang commented Aug 5, 2024

antoninbas commented Aug 5, 2024

XinShuYang commented Aug 8, 2024

Match dstIP in Classifier to address windows promiscuous mode issue #6528

Match dstIP in Classifier to address windows promiscuous mode issue #6528

Conversation

XinShuYang commented Jul 17, 2024 • edited Loading

XinShuYang commented Jul 17, 2024

XinShuYang commented Jul 17, 2024

XinShuYang commented Jul 18, 2024

XinShuYang commented Jul 18, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

wenyingd left a comment • edited Loading

Choose a reason for hiding this comment

rajnkamr commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

rajnkamr commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

XinShuYang commented Jul 23, 2024

wenyingd left a comment

Choose a reason for hiding this comment

wenyingd Jul 25, 2024

Choose a reason for hiding this comment

XinShuYang Jul 25, 2024

Choose a reason for hiding this comment

antoninbas commented Jul 31, 2024

XinShuYang commented Aug 1, 2024

wenyingd left a comment

Choose a reason for hiding this comment

XinShuYang commented Aug 1, 2024

antoninbas left a comment

Choose a reason for hiding this comment

XinShuYang commented Aug 2, 2024

luolanzone commented Aug 2, 2024

antoninbas commented Aug 2, 2024

XinShuYang commented Aug 5, 2024

antoninbas commented Aug 5, 2024

XinShuYang commented Aug 8, 2024

XinShuYang commented Jul 17, 2024 •

edited

Loading

wenyingd left a comment •

edited

Loading