[NETVIRT-160] Learn SG - correct matches for rules for ICMP and other general changes Created: 21/Sep/16  Updated: 19/Oct/17  Resolved: 25/Oct/16

Status: Resolved
Project: netvirt
Component/s: General
Affects Version/s: Carbon
Fix Version/s: None

Type: Bug
Reporter: Alon Kochba Assignee: Unassigned
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Operating System: All
Platform: All

External issue ID: 6769

 Description   

1. When configuring an ICMP allow rule - I got this:
table=42, priority=61010,ip,metadata=0x30000000000/0x1fffff0000000000 actions=learn(table=252,idle_timeout=60,hard_timeout=60,priority=61010,cookie=0x6900000,eth_type=0x800,NXM_OF_IP_SRC[]=NXM_OF_IP_DST[],NXM_OF_IP_PROTO[],load:0x1->NXM_NX_REG6[0..7]),resubmit(,17)

We need to match on ICMP not IP in this case - otherwise it conflicts with other SG rules

2. Why dont we match on both directions of IP? This would be more correct - add NXM_OF_IP_DST[]=NXM_OF_IP_SRC[]

 Comments   
Comment by Alon Kochba [ 21/Sep/16 ]

(1) is my mistake - irrelevant, it does work ok.

(2) should be added AND we are also missing much more important rules, for TCP for example we need to add NXM_OF_TCP_DST[]=NXM_OF_TCP_SRC[], otherwise we allow all packets from source port 80 to pass, without validating the connection:

table=252, idle_timeout=3600, hard_timeout=3600, priority=61010,tcp,nw_src=8.8.8.8,tp_src=80 actions=fin_timeout(idle_timeout=60,hard_timeout=60),load:0x1->NXM_NX_REG6[0..7]

3. Currently these 252 (or 41) rules will allow this for all VMs - we need to support this per-VM that has the security group - ideally the metadata lport should be used, but i'm not sure we can configure that with learn - maybe this logic needs to be in the first ACL table (251 or 40)

Comment by Alon Kochba [ 21/Sep/16 ]

More on this - it makes no point to set a hard timeout like the idle timeout. We probably don't even want a hard timeout.

Comment by Alon Kochba [ 21/Sep/16 ]

And idle timeout should be 5 hours for TCP.
60 second for other protocols

Comment by Alon Kochba [ 21/Sep/16 ]

If possible, I would also remove the drop rules from tables 41 and 252 - because of the double resubmit they don't really drop anything, so they just confuse debugging in this case

Comment by Shlomi Alfasi [ 25/Oct/16 ]

fixed in https://git.opendaylight.org/gerrit/#/c/46884/

Generated at Wed Feb 07 20:20:51 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.