Refine the default flow in ARPSpoofGuardTable (#5421)

The current default flow in ARPSpoofGuardTable forwards packets to ARPResponderTable, which is ineffective in preventing ARP spoofing. To rectify this, the proposed solution is to modify the action of the default flow within ARPSpoofGuardTable to drop the packets. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
antrea-io · Aug 23, 2023 · 46b6aea · 46b6aea
1 parent d34613b
commit 46b6aea
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/pkg/agent/openflow/pipeline.go b/pkg/agent/openflow/pipeline.go
@@ -113,7 +113,7 @@ var (
 	// Tables of pipelineARP are declared below.
 
 	// Tables in stageValidation:
-	ARPSpoofGuardTable = newTable("ARPSpoofGuard", stageValidation, pipelineARP)
+	ARPSpoofGuardTable = newTable("ARPSpoofGuard", stageValidation, pipelineARP, defaultDrop)
 
 	// Tables in stageOutput:
 	ARPResponderTable = newTable("ARPResponder", stageOutput, pipelineARP)

diff --git a/pkg/agent/openflow/pipeline_test.go b/pkg/agent/openflow/pipeline_test.go
@@ -44,7 +44,7 @@ func Test_client_defaultFlows(t *testing.T) {
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,arp actions=goto_table:ARPSpoofGuard",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,ip actions=goto_table:Classifier",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=0 actions=drop",
-				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=goto_table:ARPResponder",
+				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=ARPResponder, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=Classifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=SpoofGuard, priority=0 actions=drop",
@@ -95,7 +95,7 @@ func Test_client_defaultFlows(t *testing.T) {
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,arp actions=goto_table:ARPSpoofGuard",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,ip actions=goto_table:Classifier",
-				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=goto_table:ARPResponder",
+				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=ARPResponder, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=Classifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=SpoofGuard, priority=0 actions=drop",