mbox series

[ovs-dev,v2,0/2] ALLOW Stateless NAT operations

Message ID 1570220071-16483-1-git-send-email-ankur.sharma@nutanix.com
Headers show
Series ALLOW Stateless NAT operations | expand

Message

Ankur Sharma Oct. 4, 2019, 8:13 p.m. UTC 
NAT implementation in OVN uses connection tracker to replace
source and dest ips. This implementation works fine and
is the right approach for cases where external ips are shared
(i.e. SNAT) or where we replace ip only when relevant flow is there
(i.e. DNAT).

However, it opens the possibility of Dos Attack, where attacker
can easily simluate multiple 5 tuples, to consume the connection
tracker entry in an OVN chassis. This way they can easily attain
the CT  limit, there by impacting the usage of it by other features
like valid NAT, ACL etc.

This attack is even worse, when external ip is a public ip,
i.e internet routable ip.

In this patch we are introducing an option with NAT table entry.
Option "is_stateless=true" indicates that NAT implmentation
should not be using CT, i.e it should not use ct_snat/dnat actions.

Instead of ct_* actions, we will use ip4.src/dst OVN actions, which
will replace source and destination ips, while recalculating the
checksums.

This option is applicable only for the NAT rules which can be
1:1 mapped between inner and external ips, i.e dnat_and_snat rule.

Signed-off-by: Ankur Sharma <ankur.sharma@nutanix.com>

Ankur Sharma (2):
  OVN: ADD nbctl cli to mark a dnat_and_snat rule as stateless
  OVN: Use ipv4.src and ipv4.dst actions for NAT rules

 northd/ovn-northd.8.xml   | 34 +++++++++++++++----
 northd/ovn-northd.c       | 86 ++++++++++++++++++++++++++++++++++++++++++-----
 ovn-nb.ovsschema          |  6 ++--
 ovn-nb.xml                |  5 +++
 tests/ovn-nbctl.at        | 29 ++++++++++++++++
 tests/ovn-northd.at       | 50 +++++++++++++++++++++++++++
 utilities/ovn-nbctl.8.xml | 12 ++++++-
 utilities/ovn-nbctl.c     | 30 ++++++++++++++++-
 8 files changed, 232 insertions(+), 20 deletions(-)

Comments

Ben Pfaff Oct. 4, 2019, 8:26 p.m. UTC | #1 
Thanks for the revised series!  I know I spoke up in the first round of
review, but that was just because I noticed something quickly.  I'm
going to let other people do the detailed review of this work.

Thanks,

Ben.