Refine the default flow in ARPSpoofGuardTable

The current default flow in ARPSpoofGuardTable forwards packets to ARPResponderTable, which is ineffective in preventing ARP spoofing. To rectify this, the proposed solution is to modify the action of the default flow within ARPSpoofGuardTable to drop the packets. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
antrea-io · Aug 22, 2023 · e23a9a0 · e23a9a0
1 parent d34613b
commit e23a9a0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/pkg/agent/openflow/pipeline.go b/pkg/agent/openflow/pipeline.go
@@ -113,7 +113,7 @@ var (
 	// Tables of pipelineARP are declared below.
 
 	// Tables in stageValidation:
-	ARPSpoofGuardTable = newTable("ARPSpoofGuard", stageValidation, pipelineARP)
+	ARPSpoofGuardTable = newTable("ARPSpoofGuard", stageValidation, pipelineARP, defaultDrop)
 
 	// Tables in stageOutput:
 	ARPResponderTable = newTable("ARPResponder", stageOutput, pipelineARP)

diff --git a/pkg/agent/openflow/pipeline_test.go b/pkg/agent/openflow/pipeline_test.go
@@ -44,7 +44,7 @@ func Test_client_defaultFlows(t *testing.T) {
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,arp actions=goto_table:ARPSpoofGuard",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,ip actions=goto_table:Classifier",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=0 actions=drop",
-				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=goto_table:ARPResponder",
+				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=ARPResponder, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=Classifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=SpoofGuard, priority=0 actions=drop",
@@ -95,7 +95,7 @@ func Test_client_defaultFlows(t *testing.T) {
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,arp actions=goto_table:ARPSpoofGuard",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=PipelineRootClassifier, priority=200,ip actions=goto_table:Classifier",
-				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=goto_table:ARPResponder",
+				"cookie=0x1000000000000, table=ARPSpoofGuard, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=ARPResponder, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=Classifier, priority=0 actions=drop",
 				"cookie=0x1000000000000, table=SpoofGuard, priority=0 actions=drop",