sdnagent

README

todo

1. failsafe trigger

2. more usable cmdline

   add-flow br1 cookie=0x99,priority=99,,actions=

3. lock yunioncloud/pkg/log in Gopkg.toml

4. ping check on startup

5. encode who in cookie

6. intranet, external net

7. config file

8. vlan and ct zone allocation

9. match field, order by Name()

10. ovsdb port external_id

11. hostconfig with ct zone management, collision with ovn-controller?

12. check availability of conntrack

13. cgo libopenvswitch

14. maybe, robustness, add logic to detect ct() , ct_state arguments order

15. TODO redirect broadcast ip traffic to sec_IN

16. do we need to kill existing connection when new secrule applies

    • delete zone conntrack entries

17. conntrack entry timeout setting

Test

Prepare dummy desc directory

• br0 in namespaces as physical hosts
• veth in namespace as virtual hosts

virtual hosts with single nic on the same host or different hosts

• 2 on the same hosts
• 2 on different hosts

virtual host with 2 nics enslaved to the same br0

• 1 with 2 nics on different networks
• 1 with the above as gateway in one of the network
• 1 with the above as gateway in the other network

1. test ftp rel
2. regrestion test
3. nat for testing purposes

traffic control test

• server start

• server stop

• server change bandwidth

• zero bandwidth: no limit: api forbids this

• qdisc statistics no reset on normal running

• qdisc automatic restore after manual delete, change

   sudo tc qdisc delete dev vnet2-197 root
   sudo tc qdisc replace dev vnet2-197 root handle 1: tbf rate 100Kbit burst 100b latency 10ms
  

• initial noqueue

• initial with ingress

• initial pfifo_fast

• minimize erruption on restart

plan: stateless flavour

• PRO: More efficient
• PRO: More straightforward, less error-prone
• CON: Bob can DoS Alice with invalid TCP traffic

in:<ACTION> any

dl_dst=<MAC_VM>,ip[,nw_src=<NET>] <ACTION>

out:<ACTION> any

dl_src=<MAC_VM>,ip[,nw_dst=<NET>] <ACTION>

in:<ACTION> tcp

dl_dst=<MAC_VM>,tcp,tcpflags=+syn-ack[,tp_dst=<PORT>][,nw_src=<NET>] <ACTION>
dl_dst=<MAC_VM>,tcp[,tp_dst=<PORT>][,nw_src=<NET>] accept
dl_src=<MAC_VM>,tcp[,tp_src=<PORT>][,nw_dst=<NET>] accept

out:<ACTION> tcp

dl_src=<MAC_VM>,tcp,tcpflags=+syn-ack[,tp_dst=<PORT>][,nw_dst=<NET>] <ACTION>
dl_dst=<MAC_VM>,tcp[,tp_src=<PORT>][,nw_src=<NET>] accept
dl_src=<MAC_VM>,tcp[,tp_dst=<PORT>][,nw_dst=<NET>] accept

in:<ACTION> udp

dl_dst=<MAC_VM>.udp[,tp_dst=<PORT>][,nw_src=<NET>] <ACTION>
dl_src=<MAC_VM>.udp[,tp_src=<PORT>][,nw_dst=<NET>] <ACTION>

out:<ACTION> udp

dl_src=<MAC_VM>.udp[,tp_dst=<PORT>][,nw_dst=<NET>] <ACTION>
dl_dst=<MAC_VM>.udp[,tp_src=<PORT>][,nw_src=<NET>] <ACTION>

in:<ACTION> icmp

dl_dst=<MAC_VM>,icmp[,nw_src=<NET>] <ACTION>

out:<ACTION> icmp

dl_src=<MAC_VM>,icmp[,nw_dst=<NET>] <ACTION>