Add ARP spoofing guard for host gateway port

[wenyingd]

Add ARP spoof guard flow entry after host gateway interface is created.

Fixes #200

[antrea-bot]

Thanks for your PR.
Unit tests and code linters are run automatically every time the PR is updated.
E2e tests can only be triggered by a member of the vmware-tanzu organization. Regular contributors to the project should join the org.

The following commands are available:

• /test-e2e: to trigger e2e tests. This command can only be run by members of the vmware-tanzu organization
• /skip-e2e: to skip e2e tests. This command can only be run by members of the vmware-tanzu organization

[wenyingd]

/test-e2e

[jianjuns]

I personally feel no need to restrict the default namespace traffic. Anyway, you could not control all interfaces on the node.

[wenyingd]

@antoninbas and I have an offline discussion about it, and we thought if the ARP reply sent from gw0 is using a fake MAC, later Openflow entries might not work, especially for the traffic that needs to be forwarded by host gateway. Technically, the MAC/IP address could be changed when the packets enters OVS from gw0 interface.

[jianjuns]

You see if a Pod could send raw packets from a host interface, it could do many attacks, like it could even send VXLAN packets from a physical interface. And such containers should not be viewed as an application container, but more like a local daemon like antrea-agent.

[antoninbas]

@jianjuns I agree about your statement. However, ARP spoofing is pretty bad IMO since it can mess up the networking for other Pods and that change actually prevents that it seems. So unless there is a downside to this change I am not seeing, I suggest we merge it.

[jianjuns]

@antoninbas @wenyingd : I just do not like to add unnecessary flows and do not like to restrict host interface/traffic. But for this one I do not have a strong opinion. As you said there is no hard either (not sure if there could be cases that we want to manually bind another IP to the gateway interface though, of course for testing purposes only).