Allow Specifying Firewall Log Label

[edwardbadboy]

Describe the problem/challenge you have
Antrea NetworkPolicy and ClusterNetworkPolicy allows to turn on firewall rule log. The first packet in a connection which hits the rule will generate log message /var/log/antrea/networkpolicy/np.log.

The log format is as below.

<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
    Deduplication:
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> [<num of packets> packets in <duplicate duration>]

It will be helpful that the ACNP and ANP allows to specify a log label in rule definition, and the log label is written to the log message.

Describe the solution you'd like

For example:

  egress:
    - action: Drop
      ...
      name: exampleDropRule
      enableLogging: true
      logLabel: "arbitrary string shorter than 32 chars"  #### introduce a new field for log label
  ingress:
    - action: Allow
      ...
      name: exampleAllowRule
      enableLogging: true
      logLabel: "arbitrary string shorter than 32 chars"  #### introduce a new field for log label

The log label then appears in the firewall log line.

<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> <log label>
    Deduplication:
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> <log label> [<num of packets> packets in <duplicate duration>]

This allow some convenient operations like specifying the same log label on multiple rules across multiple ACNPs, then grep the firewall logs via this log label.

[qiyueyao]

Thanks @edwardbadboy @Dyanngg. I have one open question about this feature: how about moving logLabel to a sub-field of enableLogging, so that it is more organized? Something like

  egress:
    - action: Drop
      ...
      name: exampleDropRule
      enableLogging:
        logStatus: true
        logLabel: "arbitrary string shorter than 32 chars"  #### introduce a new field for log label

Thinking twice, maybe the con is for users not requesting log label, it is troublesome to update the current manifest.

[qiyueyao]

After discussion with @salv-orlando, the above approach is not backport compatible. Here is a new proposal:

egress:
    - action: Drop
      ...
      name: exampleDropRule
      logSetting:
        enabled: true
        logLabel: "arbitrary string shorter than 32 chars"  #### introduce a new field for log label

Where logSetting and enableLogging cannot be set at the same time.