From b6f5eb99e04456250ae0fbe113aa3e78701e2822 Mon Sep 17 00:00:00 2001 From: Hongliang Liu Date: Mon, 4 Dec 2023 17:12:20 +0800 Subject: [PATCH] Prioritize L7NP flows over TrafficControl When applying an L7NP to a Pod, there's a potential issue where creating a TrafficControl CR with a redirect action to the same Pod could bypass the L7 engine. This is due to the fact that both the ct mark `L7NPRedirectCTMark` for identifying L7NP packets and the reg mark `TrafficControlRedirectRegMark` for identifying TrafficControl redirect packets can be set together. In `OutputTable`, the priorities of flows to match the ct mark and the reg mark are the same. Without an additional condition to distinguish between them, packets with both the reg mark and ct mark may be matched by either flow with an equal chance. To rectify this and ensure proper L7NP enforcement, it is crucial to assign a higher priority to the flow that matches the ct mark L7NPRedirectCTMark. Signed-off-by: Hongliang Liu --- pkg/agent/openflow/network_policy.go | 4 ++-- pkg/agent/openflow/network_policy_test.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/agent/openflow/network_policy.go b/pkg/agent/openflow/network_policy.go index 8a8c96a344d..9ea7de9983c 100644 --- a/pkg/agent/openflow/network_policy.go +++ b/pkg/agent/openflow/network_policy.go @@ -2218,7 +2218,7 @@ func (f *featureNetworkPolicy) l7NPTrafficControlFlows() []binding.Flow { // This generates the flow to output the packets marked with L7NPRedirectCTMark to an application-aware engine // via the target ofPort. Note that, before outputting the packets, VLAN ID stored on field L7NPRuleVlanIDCTMarkField // will be copied to VLAN ID register (OXM_OF_VLAN_VID) to set VLAN ID of the packets. - OutputTable.ofTable.BuildFlow(priorityHigh+1). + OutputTable.ofTable.BuildFlow(priorityHigh+2). Cookie(cookieID). MatchRegMark(OutputToOFPortRegMark). MatchCTMark(L7NPRedirectCTMark). @@ -2239,7 +2239,7 @@ func (f *featureNetworkPolicy) l7NPTrafficControlFlows() []binding.Flow { Done(), // This generates the flow to forward the returned packets (with FromTCReturnRegMark) to stageOutput directly // after loading output port number to reg1 in L2ForwardingCalcTable. - TrafficControlTable.ofTable.BuildFlow(priorityHigh). + TrafficControlTable.ofTable.BuildFlow(priorityHigh+1). Cookie(cookieID). MatchRegMark(OutputToOFPortRegMark, FromTCReturnRegMark). Action().GotoStage(stageOutput). diff --git a/pkg/agent/openflow/network_policy_test.go b/pkg/agent/openflow/network_policy_test.go index 898b178f7b8..355d3f4a23b 100644 --- a/pkg/agent/openflow/network_policy_test.go +++ b/pkg/agent/openflow/network_policy_test.go @@ -1403,8 +1403,8 @@ func networkPolicyInitFlows(ovsMeterSupported, externalNodeEnabled, l7NetworkPol if l7NetworkPolicyEnabled { initFlows = append(initFlows, "cookie=0x1020000000000, table=Classifier, priority=200,in_port=11,vlan_tci=0x1000/0x1000 actions=pop_vlan,set_field:0x6/0xf->reg0,goto_table:L3Forwarding", - "cookie=0x1020000000000, table=TrafficControl, priority=210,reg0=0x200006/0x60000f actions=goto_table:Output", - "cookie=0x1020000000000, table=Output, priority=211,ct_mark=0x80/0x80,reg0=0x200000/0x600000 actions=push_vlan:0x8100,move:NXM_NX_CT_LABEL[64..75]->OXM_OF_VLAN_VID[0..11],output:10", + "cookie=0x1020000000000, table=TrafficControl, priority=211,reg0=0x200006/0x60000f actions=goto_table:Output", + "cookie=0x1020000000000, table=Output, priority=212,ct_mark=0x80/0x80,reg0=0x200000/0x600000 actions=push_vlan:0x8100,move:NXM_NX_CT_LABEL[64..75]->OXM_OF_VLAN_VID[0..11],output:10", ) } return initFlows