Description of problem:
Add both egressIPs and EgressNetworkPolicy to the project, try to access the network which is defined as denied in the EgressNetworkPolicy.

It will be able to access the network through the egressIP.


Version-Release number of selected component (if applicable):
v3.7.0-0.188.0

How reproducible:
always

Steps to Reproduce:
1. Setup multi node env with multitenant or networkpolicy plugin

2. Add the egressIP to one of the node
10.66.140.100

3. Add the egressIP defined above to the user's netnamespace

4. Add the following egressnetworkpolicy to the same project above
{
    "kind": "EgressNetworkPolicy",
    "apiVersion": "v1",
    "metadata": {
        "name": "default"
    },
    "spec": {
        "egress": [
            {
                "type": "Deny",
                "to": {
                    "cidrSelector": "10.66.140.0/23"
                }
            }
        ]
    }
}

5. Try to access the denied network which defined in above rule from the pod in the project.


Actual results:
The denied network is able to be accessed by the pod which landed on the egressNode.

Expected results:
Should not be able to access the denied network by the pods.

Additional info:
Looks like the openflow rules for the egressnetworkpolicy which defined in table 101 was bypassed, since the packet goes out from table 100.


# ovs-appctl ofproto/trace br0 "in_port=6,ip,ct_state(trk),nw_dst=10.66.141.175,nw_src=10.128.0.29,tun_id=0x696634"
Flow: ct_state=trk,ip,tun_id=0x696634,in_port=6,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.29,nw_dst=10.66.141.175,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0

bridge("br0")
-------------
 0. ip, priority 100
    goto_table:20   
20. ip,in_port=6,nw_src=10.128.0.29, priority 100
    load:0x696634->NXM_NX_REG0[]
    goto_table:21   
21. priority 0
    goto_table:30   
30. ip, priority 0  
    goto_table:100  
100. ip,reg0=0x696634, priority 100
    set_field:0xa428c64->pkt_mark
    output:2

Final flow: pkt_mark=0xa428c64,ct_state=trk,ip,reg0=0x696634,tun_id=0x696634,in_port=6,vlan_tci=0x0000,dl_src=00:00:00:00:00:00,dl_dst=00:00:00:00:00:00,nw_src=10.128.0.29,nw_dst=10.66.141.175,nw_proto=0,nw_tos=0,nw_ecn=0,nw_ttl=0
Megaflow: pkt_mark=0,recirc_id=0,ip,in_port=6,nw_src=10.128.0.29,nw_dst=10.0.0.0/9,nw_frag=no
Datapath actions: set(skb_mark(0xa428c64)),2