noironetworks / aci-containers / 11986

63%

master: 63%

Pull #1735

travis-pro

Fix HPP Direct IPv6 policy enforcement for NetworkPolicies

1. Protocol-to-number translation did not exist for IPv6 rules. Added
   protocolNameToNumber() to map protocol names to their IP protocol
   numbers. Without this, "icmpv6" had no mapping, so the L24
   classifier for the static-discovery ICMPv6/NDP allow rule was
   generated with no protocol constraint, matching all IPv6 traffic
   (ethertype=ipv6, any protocol). This gave every IPv6 packet a free
   pass through the whitelist, bypassing deny rules entirely.
   Fixed by adding the function with "icmpv6" mapped to protocol 58.

2. Remote IP normalization did not exist for IPv6 subnet classifiers.
   Added normalizeRemoteAddr() in hpp_lib.go to append the correct
   prefix length to bare IP addresses. Without this, bare IPv6
   addresses were used as-is, causing wrong or no match in the GBP
   subnet classifier. Fixed by appending /32 for IPv4 and /128 for
   IPv6.
3. NodeEPRegAdd() in pods.go hardcoded /32 for all pod IPs including
   IPv6, resulting in wrong prefix length in NodePodIF entries for
   dual-stack nodes. Fixed by adding normalizeRemoteAddrForEP() which
   applies /32 for IPv4 and /128 for IPv6.

0 of 30 new or added lines in 1 file covered. (0.0%)

13319 of 21097 relevant lines covered (63.13%)

0.72 hits per line