From patchwork Tue Feb 15 17:17:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dumitru Ceara X-Patchwork-Id: 1593172 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=TPHvGy7K; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4Jynpj0GK4z9s07 for ; Wed, 16 Feb 2022 04:17:48 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 594FE60FAF; Tue, 15 Feb 2022 17:17:46 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iv1zHWmWhUwP; Tue, 15 Feb 2022 17:17:45 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [IPv6:2605:bc80:3010:104::8cd3:938]) by smtp3.osuosl.org (Postfix) with ESMTPS id 1FB5D60D68; Tue, 15 Feb 2022 17:17:44 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id E38BCC0011; Tue, 15 Feb 2022 17:17:43 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 9EFE0C000B for ; Tue, 15 Feb 2022 17:17:42 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 8DF734170B for ; Tue, 15 Feb 2022 17:17:42 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Authentication-Results: smtp4.osuosl.org (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JvNo93ZF0m3O for ; Tue, 15 Feb 2022 17:17:41 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by smtp4.osuosl.org (Postfix) with ESMTPS id 1D7BD4170A for ; Tue, 15 Feb 2022 17:17:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1644945459; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TJMCm9rDXENxZF1Zcl1QSSu/NcrFFBwZVxV3w7RiRVw=; b=TPHvGy7KoFE3gl5121xBFHGZ4M6VWisLZIsyfNcS45hIEc1nONoGhlWcZGp4vG0XZsyyq1 pvuO7cDZztis8VowDjmdQFVKHLQQRUAlM/qwvaIRrkGwLAwCdpkNXXTZ7BCw/AOWIbPyZA 7X4uMo9Zfp8jSkKZW0jLVUDhlEJyVp4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-99-47vsq9VxMEekGhHou0AJ9w-1; Tue, 15 Feb 2022 12:17:36 -0500 X-MC-Unique: 47vsq9VxMEekGhHou0AJ9w-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id EF08C185302A; Tue, 15 Feb 2022 17:17:34 +0000 (UTC) Received: from dceara.remote.csb (unknown [10.39.192.89]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3E04B10A4B20; Tue, 15 Feb 2022 17:17:28 +0000 (UTC) From: Dumitru Ceara To: ovs-dev@openvswitch.org Date: Tue, 15 Feb 2022 18:17:25 +0100 Message-Id: <20220215171725.9546-1-dceara@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dceara@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Subject: [ovs-dev] [PATCH ovn v5] acl-log: Log the direction (logical pipeline) of the matching ACL. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" It's useful to differentiate between ingress and egress pipelines in the ACL logs. To achieve this we determine the direction by interpreting the openflow table ID when processing packets punted to pinctrl by "log()" action. Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1992641 Acked-by: Numan Siddique Signed-off-by: Dumitru Ceara --- v5: - Rebased and fixed minor conflict in NEWS. v4: - Log direction as from-lport/to-lport. - Add Numan's ack. v3: Simplify the patch as suggested by Numan; detect pipeline based on openflow table id. v2: Add the "direction" after the "verdict" and "severity" fields in the ACL logs. --- NEWS | 2 ++ controller/pinctrl.c | 4 ++- lib/acl-log.c | 8 +++-- lib/acl-log.h | 3 +- tests/ovn.at | 68 ++++++++++++++++++++++++++++++++++--------- utilities/ovn-trace.c | 9 ++++-- 6 files changed, 73 insertions(+), 21 deletions(-) diff --git a/NEWS b/NEWS index 984e9977e9..a309fe8df7 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,8 @@ Post v21.12.0 - Support version pinning between ovn-northd and ovn-controller-vtep as an option. If the option is enabled and the versions don't match, ovn-controller-vtep will not process any DB changes. + - When configured to log packtes matching ACLs, log the direction (logical + pipeline) too. OVN v21.12.0 - 22 Dec 2021 -------------------------- diff --git a/controller/pinctrl.c b/controller/pinctrl.c index 1b8b47523f..2dd1bc7bd5 100644 --- a/controller/pinctrl.c +++ b/controller/pinctrl.c @@ -3166,7 +3166,9 @@ process_packet_in(struct rconn *swconn, const struct ofp_header *msg) break; case ACTION_OPCODE_LOG: - handle_acl_log(&headers, &userdata); + handle_acl_log(&headers, &userdata, + pin.table_id < OFTABLE_LOG_EGRESS_PIPELINE + ? "from-lport" : "to-lport"); break; case ACTION_OPCODE_PUT_ND_RA_OPTS: diff --git a/lib/acl-log.c b/lib/acl-log.c index 220b6dc30e..9530dd7635 100644 --- a/lib/acl-log.c +++ b/lib/acl-log.c @@ -76,7 +76,8 @@ log_severity_from_string(const char *name) } void -handle_acl_log(const struct flow *headers, struct ofpbuf *userdata) +handle_acl_log(const struct flow *headers, struct ofpbuf *userdata, + const char *direction) { if (!VLOG_IS_INFO_ENABLED()) { return; @@ -94,9 +95,10 @@ handle_acl_log(const struct flow *headers, struct ofpbuf *userdata) struct ds ds = DS_EMPTY_INITIALIZER; ds_put_cstr(&ds, "name="); json_string_escape(name_len ? name : "", &ds); - ds_put_format(&ds, ", verdict=%s, severity=%s: ", + ds_put_format(&ds, ", verdict=%s, severity=%s, direction=%s: ", log_verdict_to_string(lph->verdict), - log_severity_to_string(lph->severity)); + log_severity_to_string(lph->severity), + direction); flow_format(&ds, headers, NULL); VLOG_INFO("%s", ds_cstr(&ds)); diff --git a/lib/acl-log.h b/lib/acl-log.h index 4f23f790dd..da7fa2f02c 100644 --- a/lib/acl-log.h +++ b/lib/acl-log.h @@ -49,6 +49,7 @@ const char *log_verdict_to_string(uint8_t verdict); const char *log_severity_to_string(uint8_t severity); uint8_t log_severity_from_string(const char *name); -void handle_acl_log(const struct flow *headers, struct ofpbuf *userdata); +void handle_acl_log(const struct flow *headers, struct ofpbuf *userdata, + const char *direction); #endif /* lib/acl-log.h */ diff --git a/tests/ovn.at b/tests/ovn.at index 184594831a..47e3e18a99 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -8965,33 +8965,59 @@ ovn-nbctl lsp-set-addresses lp2 $lp2_mac ovn-nbctl --wait=sb sync wait_for_ports_up -ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==80' drop -ovn-nbctl --log --severity=alert --name=drop-flow acl-add lsw0 to-lport 1000 'tcp.dst==81' drop +ovn-nbctl acl-add lsw0 from-lport 1000 'tcp.dst==80' drop +ovn-nbctl --log --severity=alert --name=drop-flow acl-add lsw0 from-lport 1000 'tcp.dst==81' drop + +ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==180' drop +ovn-nbctl --log --severity=alert --name=drop-flow acl-add lsw0 to-lport 1000 'tcp.dst==181' drop + +ovn-nbctl acl-add lsw0 from-lport 1000 'tcp.dst==82' allow +ovn-nbctl --log --severity=info --name=allow-flow acl-add lsw0 from-lport 1000 'tcp.dst==83' allow ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==82' allow ovn-nbctl --log --severity=info --name=allow-flow acl-add lsw0 to-lport 1000 'tcp.dst==83' allow +ovn-nbctl acl-add lsw0 from-lport 1000 'tcp.dst==84' allow-related +ovn-nbctl --log acl-add lsw0 from-lport 1000 'tcp.dst==85' allow-related + ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==84' allow-related ovn-nbctl --log acl-add lsw0 to-lport 1000 'tcp.dst==85' allow-related -ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==86' reject -ovn-nbctl --wait=hv --log --severity=alert --name=reject-flow acl-add lsw0 to-lport 1000 'tcp.dst==87' reject +ovn-nbctl acl-add lsw0 from-lport 1000 'tcp.dst==86' reject +ovn-nbctl --log --severity=alert --name=reject-flow acl-add lsw0 from-lport 1000 'tcp.dst==87' reject + +ovn-nbctl acl-add lsw0 to-lport 1000 'tcp.dst==186' reject +ovn-nbctl --log --severity=alert --name=reject-flow acl-add lsw0 to-lport 1000 'tcp.dst==187' reject + +ovn-nbctl --wait=hv sync ovn-sbctl dump-flows > sbflows AT_CAPTURE_FILE([sbflows]) -# Send packet that should be dropped without logging. +# Send packet that should be dropped without logging in the ingress pipeline. packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && tcp && tcp.flags==2 && tcp.src==4360 && tcp.dst==80" as hv ovs-appctl -t ovn-controller inject-pkt "$packet" -# Send packet that should be dropped with logging. +# Send packet that should be dropped with logging in the ingress pipeline. packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && tcp && tcp.flags==2 && tcp.src==4361 && tcp.dst==81" as hv ovs-appctl -t ovn-controller inject-pkt "$packet" +# Send packet that should be dropped without logging in the eggress pipeline. +packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && + ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && + tcp && tcp.flags==2 && tcp.src==4360 && tcp.dst==180" +as hv ovs-appctl -t ovn-controller inject-pkt "$packet" + +# Send packet that should be dropped with logging in the egress pipeline. +packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && + ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && + tcp && tcp.flags==2 && tcp.src==4361 && tcp.dst==181" +as hv ovs-appctl -t ovn-controller inject-pkt "$packet" + # Send packet that should be allowed without logging. packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && @@ -9016,25 +9042,41 @@ packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && tcp && tcp.flags==2 && tcp.src==4365 && tcp.dst==85" as hv ovs-appctl -t ovn-controller inject-pkt "$packet" -# Send packet that should be rejected without logging. +# Send packet that should be rejected without logging in the ingress pipeline. packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && tcp && tcp.flags==2 && tcp.src==4366 && tcp.dst==86" as hv ovs-appctl -t ovn-controller inject-pkt "$packet" -# Send packet that should be rejected with logging. +# Send packet that should be rejected with logging in the ingress pipeline. packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && tcp && tcp.flags==2 && tcp.src==4367 && tcp.dst==87" as hv ovs-appctl -t ovn-controller inject-pkt "$packet" -OVS_WAIT_UNTIL([ test 4 = $(grep -c 'acl_log' hv/ovn-controller.log) ]) +# Send packet that should be rejected without logging in the egress pipeline. +packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && + ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && + tcp && tcp.flags==2 && tcp.src==4366 && tcp.dst==186" +as hv ovs-appctl -t ovn-controller inject-pkt "$packet" + +# Send packet that should be rejected with logging in the egress pipeline. +packet="inport==\"lp1\" && eth.src==$lp1_mac && eth.dst==$lp2_mac && + ip4 && ip.ttl==64 && ip4.src==$lp1_ip && ip4.dst==$lp2_ip && + tcp && tcp.flags==2 && tcp.src==4367 && tcp.dst==187" +as hv ovs-appctl -t ovn-controller inject-pkt "$packet" + +OVS_WAIT_UNTIL([ test 8 = $(grep -c 'acl_log' hv/ovn-controller.log) ]) AT_CHECK([grep 'acl_log' hv/ovn-controller.log | sed 's/.*name=/name=/'], [0], [dnl -name="drop-flow", verdict=drop, severity=alert: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4361,tp_dst=81,tcp_flags=syn -name="allow-flow", verdict=allow, severity=info: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4363,tp_dst=83,tcp_flags=syn -name="", verdict=allow, severity=info: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4365,tp_dst=85,tcp_flags=syn -name="reject-flow", verdict=reject, severity=alert: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4367,tp_dst=87,tcp_flags=syn +name="drop-flow", verdict=drop, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4361,tp_dst=81,tcp_flags=syn +name="drop-flow", verdict=drop, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4361,tp_dst=181,tcp_flags=syn +name="allow-flow", verdict=allow, severity=info, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4363,tp_dst=83,tcp_flags=syn +name="allow-flow", verdict=allow, severity=info, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4363,tp_dst=83,tcp_flags=syn +name="", verdict=allow, severity=info, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4365,tp_dst=85,tcp_flags=syn +name="", verdict=allow, severity=info, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4365,tp_dst=85,tcp_flags=syn +name="reject-flow", verdict=reject, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4367,tp_dst=87,tcp_flags=syn +name="reject-flow", verdict=reject, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=f0:00:00:00:00:01,dl_dst=f0:00:00:00:00:02,nw_src=192.168.1.2,nw_dst=192.168.1.3,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=4367,tp_dst=187,tcp_flags=syn ]) OVN_CLEANUP([hv]) diff --git a/utilities/ovn-trace.c b/utilities/ovn-trace.c index 0795913d3e..ece5803f29 100644 --- a/utilities/ovn-trace.c +++ b/utilities/ovn-trace.c @@ -2457,12 +2457,14 @@ execute_select(const struct ovnact_select *select, static void execute_log(const struct ovnact_log *log, struct flow *uflow, - struct ovs_list *super) + struct ovs_list *super, const char *direction) { char *packet_str = flow_to_string(uflow, NULL); ovntrace_node_append(super, OVNTRACE_NODE_TRANSFORMATION, - "LOG: ACL name=%s, verdict=%s, severity=%s, packet=\"%s\"", + "LOG: ACL name=%s, direction=%s, verdict=%s, " + "severity=%s, packet=\"%s\"", log->name ? log->name : "", + direction, log_verdict_to_string(log->verdict), log_severity_to_string(log->severity), packet_str); @@ -2726,7 +2728,8 @@ trace_actions(const struct ovnact *ovnacts, size_t ovnacts_len, break; case OVNACT_LOG: - execute_log(ovnact_get_LOG(a), uflow, super); + execute_log(ovnact_get_LOG(a), uflow, super, + pipeline == OVNACT_P_INGRESS ? "IN" : "OUT"); break; case OVNACT_SET_METER: