Comments (7)
ovn : 21.12.3
ovs : 2.17.5
The acl rule applies to the ls。
from ovn.
@BigCousin-z thanks for the report!
However, this is expected behavior, as allow-related ACLs rely on conntrack to allow reply traffic for sessions allowed in the original direction.
For this ICMP exchange, in the first case (no "allow-related" ACL):
a. ICMP request from 100.100.100.2 -> 100.100.200.2 is allowed to reach the destination (the drop rule is for source 100.100.200.2)
b. ICMP reply from 100.100.200.2 -> 100.100.100.2 is dropped in the egress pipeline before reaching the destination (matches the drop rule)
In the second case ("allow-related" ACL):
a. ICMP request from 100.100.100.2 -> 100.100.200.2 creates a conntrack entry in the zone of the LSP connected to 100.100.100.2
b. ICMP request from 100.100.100.2 -> 100.100.200.2 is allowed to reach the destination (the drop rule is for source 100.100.200.2)
c. ICMP reply from 100.100.200.2 -> 100.100.100.2 is allowed in the ingress pipeline (from LSP connected to 100.100.200.2)
d. in the egress pipeline the ICMP reply matches the conntrack entry created at step "a" so the packet is allowed towards 100.100.100.2
I'm not completely sure what policy you're trying to implement with these ACLs. If you share that we might be able to help you figure out the correct way of defining the ACLs.
Regards,
Dumitru
from ovn.
@dceara thanks for your answer.
I did another test, and if I add a default rule like 0.0.0.0/0 drop, like this:
ovn-nbctl acl-list subnet
1:to-lport 2000 (ip4.src == 100.100.200.0/24) drop
2:to-lport 2000 (ip4.src == 1.2.3.4/24) allow-related
3:to-lport 1999 (ip4.src == 0.0.0.0/0) drop
The network from ping 100.100.100.2 to 100.100.200.2 is not work.
For this result, ACL has a "allow-related" ,but why is it not based on the action “conntrack entry created at step "a" ” , but rather on the action drop rule of “0.0.0.0/0”?
from ovn.
@dceara thanks for your answer. I did another test, and if I add a default rule like 0.0.0.0/0 drop, like this: ovn-nbctl acl-list subnet 1:to-lport 2000 (ip4.src == 100.100.200.0/24) drop 2:to-lport 2000 (ip4.src == 1.2.3.4/24) allow-related 3:to-lport 1999 (ip4.src == 0.0.0.0/0) drop The network from ping 100.100.100.2 to 100.100.200.2 is not work.
For this result, ACL has a "allow-related" ,but why is it not based on the action “conntrack entry created at step "a" ” , but rather on the action drop rule of “0.0.0.0/0”?
That's because the traffic that initiates the connection (ICMP request 100.100.100.2 -> 100.100.200.2) doesn't match the "allow-related" ACL, it actually matches the drop rule ("3"). So in this case the ICMP request doesn't even reach the destination.
from ovn.
@dceara thanks for your answer. I did another test, and if I add a default rule like 0.0.0.0/0 drop, like this: ovn-nbctl acl-list subnet 1:to-lport 2000 (ip4.src == 100.100.200.0/24) drop 2:to-lport 2000 (ip4.src == 1.2.3.4/24) allow-related 3:to-lport 1999 (ip4.src == 0.0.0.0/0) drop The network from ping 100.100.100.2 to 100.100.200.2 is not work.
For this result, ACL has a "allow-related" ,but why is it not based on the action “conntrack entry created at step "a" ” , but rather on the action drop rule of “0.0.0.0/0”?That's because the traffic that initiates the connection (ICMP request 100.100.100.2 -> 100.100.200.2) doesn't match the "allow-related" ACL, it actually matches the drop rule ("3"). So in this case the ICMP request doesn't even reach the destination.
Yes, this statement is understandable to me,but if the ACL rules in the subnet cannot take effect after establishing the conntrack tab,what tool or commands can be used to configure them to take effect in the conntrack table?
from ovn.
@dceara thanks for your answer. I did another test, and if I add a default rule like 0.0.0.0/0 drop, like this: ovn-nbctl acl-list subnet 1:to-lport 2000 (ip4.src == 100.100.200.0/24) drop 2:to-lport 2000 (ip4.src == 1.2.3.4/24) allow-related 3:to-lport 1999 (ip4.src == 0.0.0.0/0) drop The network from ping 100.100.100.2 to 100.100.200.2 is not work.
For this result, ACL has a "allow-related" ,but why is it not based on the action “conntrack entry created at step "a" ” , but rather on the action drop rule of “0.0.0.0/0”?That's because the traffic that initiates the connection (ICMP request 100.100.100.2 -> 100.100.200.2) doesn't match the "allow-related" ACL, it actually matches the drop rule ("3"). So in this case the ICMP request doesn't even reach the destination.
I have a question, the establishment of conntrack initiates needs to be bidirectional, the request 100.100.100.2->100.100.200.2 passed, but relpy 100.100.200.2->100.100.100.2 did not come back, how does conntrack deal with it at this time?
from ovn.
@dceara thanks for your answer. I did another test, and if I add a default rule like 0.0.0.0/0 drop, like this: ovn-nbctl acl-list subnet 1:to-lport 2000 (ip4.src == 100.100.200.0/24) drop 2:to-lport 2000 (ip4.src == 1.2.3.4/24) allow-related 3:to-lport 1999 (ip4.src == 0.0.0.0/0) drop The network from ping 100.100.100.2 to 100.100.200.2 is not work.
For this result, ACL has a "allow-related" ,but why is it not based on the action “conntrack entry created at step "a" ” , but rather on the action drop rule of “0.0.0.0/0”?That's because the traffic that initiates the connection (ICMP request 100.100.100.2 -> 100.100.200.2) doesn't match the "allow-related" ACL, it actually matches the drop rule ("3"). So in this case the ICMP request doesn't even reach the destination.
I have a question, the establishment of conntrack initiates needs to be bidirectional, the request 100.100.100.2->100.100.200.2 passed, but relpy 100.100.200.2->100.100.100.2 did not come back, how does conntrack deal with it at this time?
If the reply doesn't come back (doesn't get sent to conntrack in the same zones as the request) then the conntrack entry stays in state UNREPLIED. But the reason why the reply doesn't get sent to conntrack is what should be investigated. Do you have a NB database we can have a look at?
from ovn.
Related Issues (20)
- Installing ovn-21.12.2 and ovs-2.17.5 makes error HOT 2
- DNAT PortRange missbehaves HOT 4
- ovsdb follower always join the leader and status is catchup HOT 16
- permanent mac_bindig cause traffic blackhole HOT 5
- Make arpresponder less aggressive, reply only for broadcast arp requests
- allow-related is not working for reply flow HOT 1
- how can i capture traffic usage of float ip and router port in ovn?
- Why the flow is needed for unknown mac addresses to send to the MC_UNKNOWN multicast group? HOT 4
- When ACL is applied to a subnet, affects ACL rules based on security groups, such as pg group? HOT 4
- can mac arm silicon m2 use openvswitch mod
- Hot upgrading OVN-controller | down time after restarting ovn_controller HOT 12
- NorthD SB_datapath_binding Handler
- FIX: delete Mac binding test HOT 1
- ovn-controller is stuck for a long time, causing the port to be unable to come up.
- Does ovn | ovs support tcp connections QoS limitation on Logical Switch port or ovs port ?
- IPV6
- Change default port for encapsulation HOT 3
- Does OVN (with Yoga release) use OVS or Linux TC for QoS implementation? HOT 3
- If a lsp has a host snat rule, then dnat_and_snat can not be accessed.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ovn.