Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Flow Exporter] Fix deny connections tracking for ANP baseline tier #2542

Merged
merged 1 commit into from
Aug 27, 2021
Merged

[Flow Exporter] Fix deny connections tracking for ANP baseline tier #2542

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 44 additions & 27 deletions pkg/agent/controller/networkpolicy/packetin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,43 +335,60 @@ func (c *Controller) storeDenyConnection(pktIn *ofctrl.PacketIn) error {
}
disposition := openflow.DispositionToString[id]

// For K8s NetworkPolicy implicit drop action, we cannot get name/namespace.
if tableID == openflow.IngressDefaultTable {
denyConn.IngressNetworkPolicyType = registry.PolicyTypeK8sNetworkPolicy
denyConn.IngressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
} else if tableID == openflow.EgressDefaultTable {
denyConn.EgressNetworkPolicyType = registry.PolicyTypeK8sNetworkPolicy
denyConn.EgressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
} else { // Get name and namespace for Antrea Network Policy or Antrea Cluster Network Policy
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug seems to be we are ignoring the ANP associated tables.

If so, please revise this description. Connection is not inside the specified table, but they are just associated with those tables.

it will be filled as K8s NetworkPolicy instead of ANP
since the connection will be in IngressDefaultTable/EgressDefaultTable.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated. Thanks!

// Set match to corresponding ingress/egress reg according to disposition
match = getMatch(matchers, tableID, id)
// Set match to corresponding ingress/egress reg according to disposition
match = getMatch(matchers, tableID, id)
if match != nil {
ruleID, err := getInfoInReg(match, nil)
if err != nil {
return fmt.Errorf("error when obtaining rule id from reg: %v", err)
}
policy := c.GetNetworkPolicyByRuleFlowID(ruleID)
rule := c.GetRuleByFlowID(ruleID)

if policy == nil || rule == nil {
// Default drop by K8s NetworkPolicy
klog.V(4).Infof("Cannot find NetworkPolicy or rule that has ruleID %v", ruleID)
} else {
if tableID == openflow.AntreaPolicyIngressRuleTable {
denyConn.IngressNetworkPolicyName = policy.Name
denyConn.IngressNetworkPolicyNamespace = policy.Namespace
denyConn.IngressNetworkPolicyType = flowexporter.PolicyTypeToUint8(policy.Type)
denyConn.IngressNetworkPolicyRuleName = rule.Name
denyConn.IngressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
} else if tableID == openflow.AntreaPolicyEgressRuleTable {
denyConn.EgressNetworkPolicyName = policy.Name
denyConn.EgressNetworkPolicyNamespace = policy.Namespace
denyConn.EgressNetworkPolicyType = flowexporter.PolicyTypeToUint8(policy.Type)
denyConn.EgressNetworkPolicyRuleName = rule.Name
denyConn.EgressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
}
}
// Get name and namespace for Antrea Network Policy or Antrea Cluster Network Policy
if isAntreaPolicyIngressTable(tableID) {
denyConn.IngressNetworkPolicyName = policy.Name
denyConn.IngressNetworkPolicyNamespace = policy.Namespace
denyConn.IngressNetworkPolicyType = flowexporter.PolicyTypeToUint8(policy.Type)
denyConn.IngressNetworkPolicyRuleName = rule.Name
denyConn.IngressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
} else if isAntreaPolicyEgressTable(tableID) {
denyConn.EgressNetworkPolicyName = policy.Name
denyConn.EgressNetworkPolicyNamespace = policy.Namespace
denyConn.EgressNetworkPolicyType = flowexporter.PolicyTypeToUint8(policy.Type)
denyConn.EgressNetworkPolicyRuleName = rule.Name
denyConn.EgressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
}
} else {
// For K8s NetworkPolicy implicit drop action, we cannot get name/namespace.
if tableID == openflow.IngressDefaultTable {
denyConn.IngressNetworkPolicyType = registry.PolicyTypeK8sNetworkPolicy
denyConn.IngressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
} else if tableID == openflow.EgressDefaultTable {
denyConn.EgressNetworkPolicyType = registry.PolicyTypeK8sNetworkPolicy
denyConn.EgressNetworkPolicyRuleAction = flowexporter.RuleActionToUint8(disposition)
}
}

c.denyConnStore.AddOrUpdateConn(&denyConn, time.Now(), uint64(packet.IPLength))
return nil
}

func isAntreaPolicyIngressTable(tableID binding.TableIDType) bool {
for _, table := range openflow.GetAntreaPolicyIngressTables() {
if table == tableID {
return true
}
}
return false
}

func isAntreaPolicyEgressTable(tableID binding.TableIDType) bool {
for _, table := range openflow.GetAntreaPolicyEgressTables() {
if table == tableID {
return true
}
}
return false
}