Bug 1507871
| Summary: | [hwivBoNF] Should not be able to access the denied network which defined in EgressNetworkPolicy via the egressIP | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Meng Bo <bmeng> |
| Component: | Networking | Assignee: | Dan Winship <danw> |
| Status: | CLOSED ERRATA | QA Contact: | Meng Bo <bmeng> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.7.0 | CC: | aos-bugs, bbennett, eparis |
| Target Milestone: | --- | ||
| Target Release: | 3.7.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: |
undefined
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-11-28 22:20:29 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
added a fix for this to the existing PR https://github.com/openshift/origin/pull/17099 Tested on ocp v3.7.0-0.194.0 Issue has been fixed, all the connections will follow the rules defined in egressnetworkpolicy. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:3188 |
Description of problem: Add both egressIPs and EgressNetworkPolicy to the project, try to access the network which is defined as denied in the EgressNetworkPolicy. It will be able to access the network through the egressIP. Version-Release number of selected component (if applicable): v3.7.0-0.188.0 How reproducible: always Steps to Reproduce: 1. Setup multi node env with multitenant or networkpolicy plugin 2. Add the egressIP to one of the node 10.66.140.100 3. Add the egressIP defined above to the user's netnamespace 4. Add the following egressnetworkpolicy to the same project above { "kind": "EgressNetworkPolicy", "apiVersion": "v1", "metadata": { "name": "default" }, "spec": { "egress": [ { "type": "Deny", "to": { "cidrSelector": "10.66.140.0/23" } } ] } } 5. Try to access the denied network which defined in above rule from the pod in the project. Actual results: The denied network is able to be accessed by the pod which landed on the egressNode. Expected results: Should not be able to access the denied network by the pods. Additional info: Looks like the openflow rules for the egressnetworkpolicy which defined in table 101 was bypassed, since the packet goes out from table 100. # ovs-appctl ofproto/trace br0 "in_port=6,ip,ct_state(trk),nw_dst=10.66.141.175,nw_src=10.128.0.29,tun_id=0x696634" Flow: ct_state=trk,ip,tun_id=0x696634,in_port=6,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.29,nw_dst=10.66.141.175,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0 bridge("br0") ------------- 0. ip, priority 100 goto_table:20 20. ip,in_port=6,nw_src=10.128.0.29, priority 100 load:0x696634->NXM_NX_REG0[] goto_table:21 21. priority 0 goto_table:30 30. ip, priority 0 goto_table:100 100. ip,reg0=0x696634, priority 100 set_field:0xa428c64->pkt_mark output:2 Final flow: pkt_mark=0xa428c64,ct_state=trk,ip,reg0=0x696634,tun_id=0x696634,in_port=6,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.29,nw_dst=10.66.141.175,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0 Megaflow: pkt_mark=0,recirc_id=0,ip,in_port=6,nw_src=10.128.0.29,nw_dst=10.0.0.0/9,nw_frag=no Datapath actions: set(skb_mark(0xa428c64)),2