StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker · ‎2023-02-13

Is there an easy way to create a traffic classification policy that does AND instead of OR on the matching rules? I'd like to match if clients from a certain CIDR are hitting a sub-optimal endpoint.

elementx · ‎2023-02-13

Have you tried? Is it not possible? Or not easy?

benkorvemaker · ‎2023-02-14

As documented, it's an OR of all conditions, and I've confirmed that. (https://docs.netapp.com/us-en/storagegrid-116/admin/creating-traffic-classification-policies.html -- "Traffic that matches any rule is included in the policy.") It also has inverse matches, and thinking back to a logic course many years ago, I was hoping I could leverage that, but it looks like I need more levels of NOT than available.

elementx · ‎2023-02-14

Right, so if your "allow" IPs are all over the place and there are many, then it may not be possible.

In that case I'd try to keep rules in a flat file and commit them with Ansible with SG modules?

I haven't looked if the module that can set the rules is available. If not, just write a shell script loop with curl and process manually crafted request template, perhaps?

benkorvemaker · ‎2023-02-14

Right now, I'm trying with even just one and no success.

elementx · ‎2023-02-14

Just one rule or just one Ansible/curl script?

If you're in the mood to try Discord, there may be some folks online for available for real-time chat.

benkorvemaker · ‎2023-02-14

Just one IP hitting one wrong endpoint.

elementx · ‎2023-02-14

🤔

Maybe there's a bug? If you could share your rule, someone from the SG team could try on a real SG (or maybe even tell you if the rule's not correct).

benkorvemaker · ‎2023-02-14

It doesn't look like a bug -- it's operating as designed. Just not designed the way we want to use it.

elementx · ‎2023-02-14

I thought you used a NOT rule and tried to access from an allowed address.

benkorvemaker · ‎2023-02-14

It's not the access rules, but the traffic classification.

IP + Endpoint A, with IP accessing Endpoint A, matches (and also matches anything else hitting Endpoint A)

NOT IP + Endpoint A, with IP accessing Endpoint A, matches (ditto)

IP + NOT Endpoint A, with IP accessing Endpoint A, matches (and also matches anything else hitting any other endpoint)

NOT IP + NOT Endpoint A, with IP accessing Endpoint A, does not match (ditto)