Match dstIP in Classifier to address windows promiscuous mode issue

When multiple VMs have duplicate MAC addresses and promiscuous mode is enabled, OVS incorrectly
forwards packets destined for non-local IP addresses from the uplink to the host interface.
This patch matches dstIP field in ClassifierTable to ensure proper packet handling
and preventing unintended forwarding.

Signed-off-by: Shuyang Xin <gavinx@vmware.com>

pkg/agent/openflow/pipeline.go

@@ -2963,13 +2963,13 @@ func (f *featurePodConnectivity) l3FwdFlowToExternal() binding.Flow {
 }
 
 // hostBridgeLocalFlows generates the flows to match the packets forwarded between bridge local port and uplink port.
-func (f *featurePodConnectivity) hostBridgeLocalFlows() []binding.Flow {
+func (f *featurePodConnectivity) hostBridgeLocalFlows(mutate func(flowBuilder binding.FlowBuilder) binding.FlowBuilder) []binding.Flow {
 	cookieID := f.cookieAllocator.Request(f.category).Raw()
 	return []binding.Flow{
 		// This generates the flow to forward the packets from uplink port to bridge local port.
-		ClassifierTable.ofTable.BuildFlow(priorityNormal).
+		applyMutateFunc(ClassifierTable.ofTable.BuildFlow(priorityNormal).
 			Cookie(cookieID).
-			MatchInPort(f.uplinkPort).
+			MatchInPort(f.uplinkPort), mutate).
 			Action().Output(f.hostIfacePort).
 			Done(),
 		// This generates the flow to forward the packets from bridge local port to uplink port.
@@ -2981,6 +2981,13 @@ func (f *featurePodConnectivity) hostBridgeLocalFlows() []binding.Flow {
 	}
 }
 
+func applyMutateFunc(flowBuilder binding.FlowBuilder, mutate mutateFunc) binding.FlowBuilder {
+	if mutate != nil {
+		return mutate(flowBuilder)
+	}
+	return flowBuilder
+}
+
 // hostBridgeUplinkVLANFlows generates the flows to match VLAN packets from uplink port.
 func (f *featurePodConnectivity) hostBridgeUplinkVLANFlows() []binding.Flow {
 	vlanMask := uint16(openflow15.OFPVID_PRESENT)

pkg/agent/openflow/pipeline_other.go

@@ -32,7 +32,7 @@ func (f *featurePodConnectivity) hostBridgeUplinkFlows() []binding.Flow {
 	// outputToBridgeRegMark marks that the output interface is OVS bridge.
 	outputToBridgeRegMark := binding.NewRegMark(TargetOFPortField, f.hostIfacePort)
 	cookieID := f.cookieAllocator.Request(f.category).Raw()
-	flows := f.hostBridgeLocalFlows()
+	flows := f.hostBridgeLocalFlows(nil)
 	if f.networkConfig.IPv4Enabled {
 		flows = append(flows,
 			// This generates the flow to forward ARP packets from uplink port in normal way since uplink port is set to enable

pkg/agent/openflow/pipeline_windows.go

@@ -23,11 +23,17 @@ import (
 	binding "antrea.io/antrea/pkg/ovs/openflow"
 )
 
+func hostBridgeLocalMutateFunc(flowBuilder binding.FlowBuilder) binding.FlowBuilder {
+	return flowBuilder.
+		MatchProtocol(binding.ProtocolIP).
+		MatchDstIP(f.nodeConfig.NodeTransportIPv4Addr.IP)
+}
+
 // hostBridgeUplinkFlows generates the flows that forward traffic between the bridge local port and the uplink port to
 // support the host traffic with outside.
 func (f *featurePodConnectivity) hostBridgeUplinkFlows() []binding.Flow {
 	cookieID := f.cookieAllocator.Request(f.category).Raw()
-	flows := f.hostBridgeLocalFlows()
+	flows := f.hostBridgeLocalFlows(hostBridgeLocalMutateFunc)
 	if f.networkConfig.IPv4Enabled {
 		flows = append(flows,
 			// This generates the flow to forward ARP packets from uplink port to bridge local port since uplink port is set

pkg/agent/openflow/pod_connectivity_test.go

@@ -90,7 +90,7 @@ func podConnectivityInitFlows(
 			flows = append(flows,
 				"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=32770 actions=output:4294967294",
 				"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=4294967294 actions=output:32770",
-				"cookie=0x1010000000000, table=Classifier, priority=200,in_port=32770 actions=output:4294967294",
+				"cookie=0x1010000000000, table=Classifier, priority=200,ip,in_port=32770,nw_dst=192.168.77.100 actions=output:4294967294",
 				"cookie=0x1010000000000, table=Classifier, priority=200,in_port=4294967294 actions=output:32770",
 				"cookie=0x1010000000000, table=IngressSecurityClassifier, priority=210,ct_state=-rpl+trk,ip,nw_src=10.10.0.1 actions=goto_table:ConntrackCommit",
 			)
@@ -161,7 +161,7 @@ func podConnectivityInitFlows(
 				"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=32770 actions=output:4294967294",
 				"cookie=0x1010000000000, table=ARPSpoofGuard, priority=200,in_port=4294967294 actions=output:32770",
 				"cookie=0x1010000000000, table=Classifier, priority=210,ip,in_port=32770,nw_dst=10.10.0.0/24 actions=set_field:0x4/0xf->reg0,set_field:0x200/0x200->reg0,goto_table:UnSNAT",
-				"cookie=0x1010000000000, table=Classifier, priority=200,in_port=32770 actions=output:4294967294",
+				"cookie=0x1010000000000, table=Classifier, priority=200,ip,in_port=32770,nw_dst=192.168.77.100 actions=output:4294967294",
 				"cookie=0x1010000000000, table=Classifier, priority=200,in_port=4294967294 actions=output:32770",
 				"cookie=0x1010000000000, table=SpoofGuard, priority=200,ip,in_port=32769 actions=goto_table:UnSNAT",
 				"cookie=0x1010000000000, table=ConntrackZone, priority=200,ip actions=ct(table=ConntrackState,zone=65520,nat)",