Skip to content

Commit 012e003

Browse files
zhangzujianzhangzujian
committed
netpol: fix duplicate default drop acl (#3197)
Signed-off-by: 张祖建 <zhangzujian.7@gmail.com>
1 parent 1c13e40 commit 012e003

File tree

3 files changed

+58
-52
lines changed

3 files changed

+58
-52
lines changed

‎pkg/controller/network_policy.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ func (c *Controller) handleUpdateNp(key string) error {
332332
return err
333333
}
334334

335-
ops, err := c.ovnNbClient.UpdateIngressAclOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
335+
ops, err := c.ovnNbClient.UpdateIngressAclOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, nil, logEnable, namedPortMap)
336336
if err != nil {
337337
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
338338
return err
@@ -485,7 +485,7 @@ func (c *Controller) handleUpdateNp(key string) error {
485485
return err
486486
}
487487

488-
ops, err := c.ovnNbClient.UpdateEgressAclOps(pgName, egressAllowAsName, egressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
488+
ops, err := c.ovnNbClient.UpdateEgressAclOps(pgName, egressAllowAsName, egressExceptAsName, protocol, nil, logEnable, namedPortMap)
489489
if err != nil {
490490
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
491491
return err

‎pkg/ovs/ovn-nb-acl.go

+48-42
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,32 @@ import (
2222
func (c *ovnNbClient) UpdateIngressAclOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
2323
acls := make([]*ovnnb.ACL, 0)
2424

25-
ipSuffix := "ip4"
26-
if protocol == kubeovnv1.ProtocolIPv6 {
27-
ipSuffix = "ip6"
28-
}
25+
if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
26+
// create the default drop rule for only once
27+
ipSuffix := "ip4"
28+
if protocol == kubeovnv1.ProtocolIPv6 {
29+
ipSuffix = "ip6"
30+
}
2931

30-
/* default drop acl */
31-
allIpMatch := NewAndAclMatch(
32-
NewAclMatch("outport", "==", "@"+pgName, ""),
33-
NewAclMatch(ipSuffix, "", "", ""),
34-
)
35-
options := func(acl *ovnnb.ACL) {
36-
if logEnable {
37-
acl.Log = true
38-
acl.Severity = &ovnnb.ACLSeverityWarning
32+
/* default drop acl */
33+
allIpMatch := NewAndAclMatch(
34+
NewAclMatch("outport", "==", "@"+pgName, ""),
35+
NewAclMatch(ipSuffix, "", "", ""),
36+
)
37+
options := func(acl *ovnnb.ACL) {
38+
if logEnable {
39+
acl.Log = true
40+
acl.Severity = &ovnnb.ACLSeverityWarning
41+
}
3942
}
40-
}
4143

42-
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
43-
if err != nil {
44-
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
45-
}
44+
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
45+
if err != nil {
46+
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
47+
}
4648

47-
acls = append(acls, defaultDropAcl)
49+
acls = append(acls, defaultDropAcl)
50+
}
4851

4952
/* allow acl */
5053
matches := newNetworkPolicyAclMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
@@ -69,36 +72,39 @@ func (c *ovnNbClient) UpdateIngressAclOps(pgName, asIngressName, asExceptName, p
6972
func (c *ovnNbClient) UpdateEgressAclOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
7073
acls := make([]*ovnnb.ACL, 0)
7174

72-
ipSuffix := "ip4"
73-
if protocol == kubeovnv1.ProtocolIPv6 {
74-
ipSuffix = "ip6"
75-
}
75+
if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
76+
// create the default drop rule for only once
77+
ipSuffix := "ip4"
78+
if protocol == kubeovnv1.ProtocolIPv6 {
79+
ipSuffix = "ip6"
80+
}
7681

77-
/* default drop acl */
78-
allIpMatch := NewAndAclMatch(
79-
NewAclMatch("inport", "==", "@"+pgName, ""),
80-
NewAclMatch(ipSuffix, "", "", ""),
81-
)
82-
options := func(acl *ovnnb.ACL) {
83-
if logEnable {
84-
acl.Log = true
85-
acl.Severity = &ovnnb.ACLSeverityWarning
82+
/* default drop acl */
83+
allIpMatch := NewAndAclMatch(
84+
NewAclMatch("inport", "==", "@"+pgName, ""),
85+
NewAclMatch(ipSuffix, "", "", ""),
86+
)
87+
options := func(acl *ovnnb.ACL) {
88+
if logEnable {
89+
acl.Log = true
90+
acl.Severity = &ovnnb.ACLSeverityWarning
91+
}
92+
93+
if acl.Options == nil {
94+
acl.Options = make(map[string]string)
95+
}
96+
acl.Options["apply-after-lb"] = "true"
8697
}
8798

88-
if acl.Options == nil {
89-
acl.Options = make(map[string]string)
99+
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
100+
if err != nil {
101+
klog.Error(err)
102+
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
90103
}
91-
acl.Options["apply-after-lb"] = "true"
92-
}
93104

94-
defaultDropAcl, err := c.newAclWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIpMatch.String(), ovnnb.ACLActionDrop, options)
95-
if err != nil {
96-
klog.Error(err)
97-
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
105+
acls = append(acls, defaultDropAcl)
98106
}
99107

100-
acls = append(acls, defaultDropAcl)
101-
102108
/* allow acl */
103109
matches := newNetworkPolicyAclMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, npp, namedPortMap)
104110
for _, m := range matches {

‎pkg/ovs/ovn-nb-acl_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@ func (suite *OvnClientTestSuite) testUpdateIngressAclOps() {
8181
t.Parallel()
8282

8383
pgName := "test_create_v4_ingress_acl_pg"
84-
asIngressName := "test.default.ingress.allow.ipv4"
85-
asExceptName := "test.default.ingress.except.ipv4"
84+
asIngressName := "test.default.ingress.allow.ipv4.all"
85+
asExceptName := "test.default.ingress.except.ipv4.all"
8686
protocol := kubeovnv1.ProtocolIPv4
8787

8888
err := ovnClient.CreatePortGroup(pgName, nil)
@@ -109,8 +109,8 @@ func (suite *OvnClientTestSuite) testUpdateIngressAclOps() {
109109
t.Parallel()
110110

111111
pgName := "test_create_v6_ingress_acl_pg"
112-
asIngressName := "test.default.ingress.allow.ipv6"
113-
asExceptName := "test.default.ingress.except.ipv6"
112+
asIngressName := "test.default.ingress.allow.ipv6.all"
113+
asExceptName := "test.default.ingress.except.ipv6.all"
114114
protocol := kubeovnv1.ProtocolIPv6
115115

116116
err := ovnClient.CreatePortGroup(pgName, nil)
@@ -151,8 +151,8 @@ func (suite *OvnClientTestSuite) testUpdateEgressAclOps() {
151151
t.Parallel()
152152

153153
pgName := "test_create_v4_egress_acl_pg"
154-
asEgressName := "test.default.egress.allow.ipv4"
155-
asExceptName := "test.default.egress.except.ipv4"
154+
asEgressName := "test.default.egress.allow.ipv4.all"
155+
asExceptName := "test.default.egress.except.ipv4.all"
156156
protocol := kubeovnv1.ProtocolIPv4
157157

158158
err := ovnClient.CreatePortGroup(pgName, nil)
@@ -179,8 +179,8 @@ func (suite *OvnClientTestSuite) testUpdateEgressAclOps() {
179179
t.Parallel()
180180

181181
pgName := "test_create_v6_egress_acl_pg"
182-
asEgressName := "test.default.egress.allow.ipv6"
183-
asExceptName := "test.default.egress.except.ipv6"
182+
asEgressName := "test.default.egress.allow.ipv6.all"
183+
asExceptName := "test.default.egress.except.ipv6.all"
184184
protocol := kubeovnv1.ProtocolIPv6
185185

186186
err := ovnClient.CreatePortGroup(pgName, nil)

0 commit comments

Comments
 (0)