Prevent inbound NodePort traffic from being forward to kernel

Set ct_mark 0x1 for inbound traffic to NodePort service. Added a
new flow to drop the traffic from OVN to NodePort service to
prevent traffic to nodePort from being forwarded to the host
accidentally during GR OVN LB resyncs.

Fix flake for the test "[sig-network] Conntrack should be able to
preserve UDP traffic when server pod cycles for a NodePort service"

Signed-off-by: Peng Liu <[email protected]>

Author: pliurh

go-controller/pkg/node/gateway_localnet_linux_test.go

@@ -1192,7 +1192,8 @@ var _ = Describe("Node Operations", func() {
 					},
 				}
 				expectedNodePortFlows := []string{
-					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=ct(commit, zone=64003, exec(set_field:0x1->ct_mark)),output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, tcp, tp_dst=31111, ct_state=+est+trk, ct_mark=0x1,actions=drop",
 					fmt.Sprintf("cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, dl_src=%s, tcp, tp_src=31111, actions=output:eth0",
 						gwMAC),
 				}
@@ -2305,7 +2306,8 @@ var _ = Describe("Node Operations", func() {
 				}
 				expectedFlows := []string{
 					// default
-					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=ct(commit, zone=64003, exec(set_field:0x1->ct_mark)),output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, tcp, tp_dst=31111, ct_state=+est+trk, ct_mark=0x1,actions=drop",
 					fmt.Sprintf("cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, dl_src=%s, tcp, tp_src=31111, actions=output:eth0",
 						gwMAC),
 				}
@@ -2595,7 +2597,8 @@ var _ = Describe("Node Operations", func() {
 				}
 				expectedFlows := []string{
 					// default
-					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=eth0, tcp, tp_dst=31111, actions=ct(commit, zone=64003, exec(set_field:0x1->ct_mark)),output:patch-breth0_ov",
+					"cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, tcp, tp_dst=31111, ct_state=+est+trk, ct_mark=0x1,actions=drop",
 					fmt.Sprintf("cookie=0x453ae29bcbbc08bd, priority=110, in_port=patch-breth0_ov, dl_src=%s, tcp, tp_src=31111, actions=output:eth0",
 						gwMAC),
 				}

go-controller/pkg/node/gateway_shared_intf.go

@@ -331,9 +331,16 @@ func (npw *nodePortWatcher) updateServiceFlowCache(service *corev1.Service, netI
 					// case2 (see function description for details)
 					npw.ofm.updateFlowCacheEntry(key, []string{
 						// table=0, matches on service traffic towards nodePort and sends it to OVN pipeline
+						// setting the ct_mark to '0x1' to indicate that this is OVN traffic
 						fmt.Sprintf("cookie=%s, priority=110, in_port=%s, %s, tp_dst=%d, "+
-							"actions=%s",
-							cookie, npw.ofportPhys, flowProtocol, svcPort.NodePort, actions),
+							"actions=ct(commit, zone=%d, exec(set_field:%s->ct_mark)),%s",
+							cookie, npw.ofportPhys, flowProtocol, svcPort.NodePort, config.Default.HostNodePortConntrackZone, nodetypes.CtMarkOVN, actions),
+						// table=0, matches on service traffic towards nodePort from OVN and drops it, to prevent the traffic goes to the host.
+						// match on ct_state=+est+trk and ct_mark=0x1 to ensure that this rule only applies to return traffic from OVN.
+						// This is to prevent traffic to nodePort from being forwarded to the host accidentally during GR OVN LB resyncs.
+						fmt.Sprintf("cookie=%s, priority=110, in_port=%s, %s, tp_dst=%d, ct_state=+est+trk, ct_mark=%s,"+
+							"actions=drop",
+							cookie, netConfig.OfPortPatch, flowProtocol, svcPort.NodePort, nodetypes.CtMarkOVN),
 						// table=0, matches on return traffic from service nodePort and sends it out to primary node interface (br-ex)
 						fmt.Sprintf("cookie=%s, priority=110, in_port=%s, dl_src=%s, %s, tp_src=%d, "+
 							"actions=output:%s",