Filter VXLAN packets from outside the cluster
Only accept VXLAN packets from other nodes, not from outside hosts or
from containers.
(This has to happen before anything else to ensure that we don't
record MAC addresses associated with spoofed VXLAN packets.)
@@ -60,8 +60,15 @@ func (c *FlowController) AddOFRules(nodeIP, nodeSubnetCIDR, localIP string) erro
glog.V(5).Infof("AddOFRules for %s", nodeIP)
cookie := generateCookie(nodeIP)
+ inrule := fmt.Sprintf("table=0,cookie=0x%s,tun_src=%s,actions=goto_table:1", cookie, nodeIP)
+ out, err := exec.Command("ovs-ofctl", "-O", "OpenFlow13", "add-flow", "br0", inrule).CombinedOutput()
+ if err != nil {
+ glog.Errorf("Error adding flow %q: %s (%v)", inrule, out, err)
+ return err
+ }
+
iprule := fmt.Sprintf("table=8,cookie=0x%s,priority=100,ip,nw_dst=%s,actions=move:NXM_NX_REG0[]->NXM_NX_TUN_ID[0..31],set_field:%s->tun_dst,output:1", cookie, nodeSubnetCIDR, nodeIP)
- out, err := exec.Command("ovs-ofctl", "-O", "OpenFlow13", "add-flow", "br0", iprule).CombinedOutput()
+ out, err = exec.Command("ovs-ofctl", "-O", "OpenFlow13", "add-flow", "br0", iprule).CombinedOutput()
if err != nil {
glog.Errorf("Error adding flow %q: %s (%v)", iprule, out, err)
return err
