Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix NetworkPolicy logging for IPv6 connections #1990

Conversation

antoninbas
Copy link
Contributor

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes #1989

I ran the test successfully in an IPv6 cluster creating with Vagrant VMs:

=== RUN   TestAntreaPolicy/TestGroupAuditLogging
=== RUN   TestAntreaPolicy/TestGroupAuditLogging/Case=AuditLoggingBasic
I0324 16:58:27.096931   80575 entry.go:314] Creating/updating ClusterNetworkPolicy test-log-acnp-deny
I0324 16:58:40.655439   80575 entry.go:314] Deleting AntreaClusterNetworkPolicies test-log-acnp-deny
I0324 16:58:40.664245   80575 entry.go:314] Deleting test Namespace x
I0324 16:58:40.667629   80575 entry.go:314] Deleting test Namespace y
I0324 16:58:40.670239   80575 entry.go:314] Deleting test Namespace z
=== CONT  TestAntreaPolicy
    fixtures.go:338: Deleting 'antrea-test' K8s Namespace
--- PASS: TestAntreaPolicy (85.75s)
    --- PASS: TestAntreaPolicy/TestGroupAuditLogging (13.56s)
        --- PASS: TestAntreaPolicy/TestGroupAuditLogging/Case=AuditLoggingBasic (13.56s)
=== RUN   TestAntreaPolicyStatus
    fixtures.go:140: Creating 'antrea-test' K8s Namespace
    fixtures.go:103: Applying Antrea YAML
    fixtures.go:107: Waiting for all Antrea DaemonSet Pods
    fixtures.go:111: Checking CoreDNS deployment
    fixtures.go:345: Deleting Pod 'server-1vo3xb5yy'
    fixtures.go:345: Deleting Pod 'server-0krb06ddg'
    fixtures.go:338: Deleting 'antrea-test' K8s Namespace
--- PASS: TestAntreaPolicyStatus (21.07s)
PASS

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989
@codecov-io
Copy link

codecov-io commented Mar 25, 2021

Codecov Report

Merging #1990 (4239739) into main (cb840ce) will decrease coverage by 5.92%.
The diff coverage is 43.33%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1990      +/-   ##
==========================================
- Coverage   65.37%   59.44%   -5.93%     
==========================================
  Files         197      197              
  Lines       17217    17237      +20     
==========================================
- Hits        11256    10247    -1009     
- Misses       4786     5887    +1101     
+ Partials     1175     1103      -72     
Flag Coverage Δ
kind-e2e-tests 44.65% <0.00%> (-11.80%) ⬇️
unit-tests 41.84% <43.33%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
pkg/ovs/openflow/ofctrl_action.go 47.84% <ø> (ø)
pkg/util/ip/ip.go 77.27% <38.46%> (-9.52%) ⬇️
pkg/agent/controller/networkpolicy/packetin.go 9.93% <47.05%> (-60.85%) ⬇️
pkg/apis/controlplane/helper.go 25.00% <0.00%> (-75.00%) ⬇️
pkg/apis/controlplane/v1beta2/helper.go 25.00% <0.00%> (-75.00%) ⬇️
pkg/controller/networkpolicy/store/group.go 6.66% <0.00%> (-73.34%) ⬇️
pkg/controller/networkpolicy/mutate.go 0.00% <0.00%> (-71.77%) ⬇️
pkg/controller/networkpolicy/validate.go 0.00% <0.00%> (-71.57%) ⬇️
pkg/k8s/name.go 33.33% <0.00%> (-66.67%) ⬇️
... and 41 more

}
ob.protocolStr = opsv1alpha1.ProtocolsToString[int32(prot)]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about:

val, ok := opsv1alpha1.ProtocolsToString[int32(prot)]
if !ok {
    val = "UnsupportProtocol"
}
ob.protocolStr = val

And add ICMPv6 related info to ProtocolsToString?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the suggestion. I added support for IPv6-ICMP, and I removed the dependency on the ops API types, as it didn't make sense to me.

And add support for the IPv6-ICMP protocol
Copy link
Member

@tnqn tnqn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for fixing it so quickly

@antoninbas
Copy link
Contributor Author

/test-all

Copy link
Contributor

@GraysonWu GraysonWu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@antoninbas antoninbas merged commit 7cc7fb7 into antrea-io:main Mar 25, 2021
@antoninbas antoninbas deleted the fix-network-policy-logging-for-IPv6-traffic branch March 25, 2021 21:49
GraysonWu pushed a commit to GraysonWu/antrea that referenced this pull request Mar 26, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit to antoninbas/antrea that referenced this pull request Apr 30, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit to antoninbas/antrea that referenced this pull request Apr 30, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit that referenced this pull request Apr 30, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes #1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit to antoninbas/antrea that referenced this pull request Apr 30, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit that referenced this pull request May 1, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes #1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit to antoninbas/antrea that referenced this pull request May 1, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes antrea-io#1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
antoninbas added a commit that referenced this pull request May 3, 2021
* Fix NetworkPolicy logging for IPv6 connections

The code in charge of parsing the PacketIn messages was only handling
IPv4 packets and not filling-in any information for IPv6 packets,
leading to logs with empty fields.

Fixes #1989

* Remove dependency on pkg/apis/ops/v1alpha1 for packetin handling

And add support for the IPv6-ICMP protocol
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Packet metadata missing in logs when Antrea NetworkPolicy logging is enabled for IPv6 cluster
5 participants