Skip to content

plain TCP RST packet in pod-to-pod-with-l7-policy-encryption for IPv6+IPSec+VXLan #35485

@smagnani96

Description

@smagnani96

After fixing the MTU issue when having IPSec with both in+egress proxy in #35173, we enabled the pod-to-pod-with-l7-policy-encryption test for IPv4. When trying to enable also the test for IPv6, we see a flaky behavior:

  1. native routing: after the MTU patch, no problems are encountered and the tests execute smoothly.
  2. overlay mode: either with or without the MTU patch, enabling the tests would cause a plain-test TCP RST packet to be leaked when using VxLan as overlay. This behavior is probably unrelated to the MTU patch and should be related only to CI and not to the whole IPv6 functioning. A guessing would be that bpftrace is still monitoring looking for plain-text packets while tearing down Cilium and something's probably happening in between.

As discussed in the previous MTU issue, the failing tests seems randomly happen with kernels rhel8-20240404.144247, 5.15-20240710.064909, and bpf-next-20240711.013133. Testing with Geneve is ok, while with VXLan there's this problem.

Metadata

Metadata

Assignees

Labels

area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.area/encryptionImpacts encryption support such as IPSec, WireGuard, or kTLS.area/proxyImpacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.feature/ipsecRelates to Cilium's IPsec featurefeature/ipv6Relates to IPv6 protocol supportneeds/triageThis issue requires triaging to establish severity and next steps.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions