diff --git a/pkg/agent/openflow/client.go b/pkg/agent/openflow/client.go index bb2ad9de6c2..ba5b89db733 100644 --- a/pkg/agent/openflow/client.go +++ b/pkg/agent/openflow/client.go @@ -502,7 +502,7 @@ func (c *client) InstallPodFlows(interfaceName string, podInterfaceIPs []net.IP, if isAntreaFlexibleIPAM { // Add Pod uplink classifier flows for AntreaFlexibleIPAM Pods. - flows = append(flows, c.featurePodConnectivity.podUplinkClassifierFlows(podInterfaceMAC, cookie.Pod)...) + flows = append(flows, c.featurePodConnectivity.podUplinkClassifierFlows(cookie.Pod, podInterfaceMAC)...) } return c.addFlows(c.featurePodConnectivity.podFlowCache, interfaceName, flows) diff --git a/pkg/agent/openflow/fields.go b/pkg/agent/openflow/fields.go index 717b501ae7a..23ae4ccbf02 100644 --- a/pkg/agent/openflow/fields.go +++ b/pkg/agent/openflow/fields.go @@ -189,9 +189,6 @@ var ( // Mark to indicate the connection is hairpin. // This CT mark is only used in SNATCtZone / SNATCtZoneV6. HairpinCTMark = binding.NewCTMark(0b1, 5, 5) - // Mark to indicate the connection is hairpin as well as Service. - // This CT mark is only used in SNATCtZone / SNATCtZoneV6. - UnionHairpinServiceCTMark = binding.NewCTMark(0b11, 4, 5) ) // Fields using CT label. diff --git a/pkg/agent/openflow/pipeline.go b/pkg/agent/openflow/pipeline.go index 6cca95cbad8..01289aa873d 100644 --- a/pkg/agent/openflow/pipeline.go +++ b/pkg/agent/openflow/pipeline.go @@ -455,7 +455,7 @@ func (c *client) defaultFlows(category cookie.Category) []binding.Flow { // Stage: ClassifierStage // Tables: ClassifierTable // Refactored from: -// - `func (c *client) tunnelClassifierFlow(tunnelOFPort uint32, category cookie.Category) binding.Flow` +// - func (c *client) tunnelClassifierFlow(tunnelOFPort uint32, category cookie.Category) binding.Flow // tunnelClassifierFlow generates the flow to mark traffic comes from the tunnelOFPort. func (c *featurePodConnectivity) tunnelClassifierFlow(category cookie.Category, tunnelOFPort uint32) binding.Flow { return ClassifierTable.ofTable.BuildFlow(priorityNormal). @@ -471,7 +471,7 @@ func (c *featurePodConnectivity) tunnelClassifierFlow(category cookie.Category, // Stage: ClassifierStage // Tables: ClassifierTable // Refactored from: -// - `func (c *client) gatewayClassifierFlow(category cookie.Category) binding.Flow` +// - func (c *client) gatewayClassifierFlow(category cookie.Category) binding.Flow // gatewayClassifierFlow generates the flow to mark traffic comes from the gatewayOFPort. func (c *featurePodConnectivity) gatewayClassifierFlow(category cookie.Category) binding.Flow { return ClassifierTable.ofTable.BuildFlow(priorityNormal). @@ -486,7 +486,7 @@ func (c *featurePodConnectivity) gatewayClassifierFlow(category cookie.Category) // Stage: ClassifierStage // Tables: ClassifierTable // Refactored from: -// - `func (c *client) podClassifierFlow(podOFPort uint32, category cookie.Category, isAntreaFlexibleIPAM bool) binding.Flow` +// - func (c *client) podClassifierFlow(podOFPort uint32, category cookie.Category, isAntreaFlexibleIPAM bool) binding.Flow // podClassifierFlow generates the flow to mark traffic comes from the podOFPort. func (c *featurePodConnectivity) podClassifierFlow(category cookie.Category, podOFPort uint32, isAntreaFlexibleIPAM bool) binding.Flow { flowBuilder := ClassifierTable.ofTable.BuildFlow(priorityLow). @@ -505,10 +505,10 @@ func (c *featurePodConnectivity) podClassifierFlow(category cookie.Category, pod // Stage: ClassifierStage // Tables: ClassifierTable // Refactored from: -// - `func (c *client) podUplinkClassifierFlows(dstMAC net.HardwareAddr, category cookie.Category) (flows []binding.Flow)` +// - func (c *client) podUplinkClassifierFlows(dstMAC net.HardwareAddr, category cookie.Category) (flows []binding.Flow) // podUplinkClassifierFlows generates the flows to mark traffic from uplink and bridge ports, which are needed when // uplink is connected to OVS bridge when AntreaFlexibleIPAM is configured. -func (c *featurePodConnectivity) podUplinkClassifierFlows(dstMAC net.HardwareAddr, category cookie.Category) []binding.Flow { +func (c *featurePodConnectivity) podUplinkClassifierFlows(category cookie.Category, dstMAC net.HardwareAddr) []binding.Flow { return []binding.Flow{ ClassifierTable.ofTable.BuildFlow(priorityHigh). Cookie(c.cookieAllocator.Request(category).Raw()). @@ -528,12 +528,12 @@ func (c *featurePodConnectivity) podUplinkClassifierFlows(dstMAC net.HardwareAdd } // Feature: PodConnectivity -// Stage: ValidationStage +// Stage: ConntrackStateStage // Tables: ConntrackTable, ConntrackStateTable // Stage: ConntrackStage // Tables: ConntrackCommitTable // Refactored from: -// - `func (c *client) connectionTrackFlows(category cookie.Category) []binding.Flow` +// - func (c *client) connectionTrackFlows(category cookie.Category) []binding.Flow // Modifications: // - Remove the flows related with Service since they are for feature Service. // conntrackFlows generates the flows that are related to conntrack. @@ -566,6 +566,7 @@ func (c *featurePodConnectivity) conntrackFlows(category cookie.Category) []bind MatchCTStateTrk(true). Action().Drop(). Done(), + // ConntrackCommitTable.ofTable.BuildFlow(priorityLow). Cookie(c.cookieAllocator.Request(category).Raw()). MatchProtocol(ipProtocol). @@ -1304,7 +1305,7 @@ func (c *featurePodConnectivity) l3FwdFlowToRemoteViaGW(category cookie.Category } return flowBuilder. Action().SetDstMAC(localGatewayMAC). - Action().LoadRegMark(ToGatewayRegMark). + Action().LoadRegMark(ToExternalRegMark). Action().NextTable(). Done() } @@ -2896,7 +2897,6 @@ func (c *featureService) snatConntrackFlows(category cookie.Category) []binding. NAT(). CTDone(). Done(), - // This flow is used to mark the first packet of hairpin Service packet from status 'NotRequireSNATRegMark' // to status 'CTMarkedSNATRegMark'. SNATConntrackCommitTable.ofTable.BuildFlow(priorityNormal). @@ -2935,7 +2935,8 @@ func (c *featureService) snatConntrackFlows(category cookie.Category) []binding. MatchRegMark(CTMarkedSNATRegMark). Action().CT(true, SNATConntrackCommitTable.ofTable.GetNext(), c.snatCtZones[ipProtocol]). SNAT(&binding.IPRange{StartIP: c.virtualIPs[ipProtocol], EndIP: c.virtualIPs[ipProtocol]}, nil). - LoadToCtMark(UnionHairpinServiceCTMark). + LoadToCtMark(ServiceCTMark). + LoadToCtMark(HairpinCTMark). CTDone(). Done(), SNATConntrackCommitTable.ofTable.BuildFlow(priorityNormal). @@ -2947,7 +2948,8 @@ func (c *featureService) snatConntrackFlows(category cookie.Category) []binding. MatchRegMark(CTMarkedSNATRegMark). Action().CT(true, SNATConntrackCommitTable.ofTable.GetNext(), c.snatCtZones[ipProtocol]). SNAT(&binding.IPRange{StartIP: c.gatewayIPs[ipProtocol], EndIP: c.gatewayIPs[ipProtocol]}, nil). - LoadToCtMark(UnionHairpinServiceCTMark). + LoadToCtMark(ServiceCTMark). + LoadToCtMark(HairpinCTMark). CTDone(). Done(), SNATConntrackCommitTable.ofTable.BuildFlow(priorityLow).