cilium: encryption fixes for ipv6 and tear down #9649
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We do not currently remove the 'dir in' encryption rules when encryption is disabled. The original thinking is we could simply leave these xfrm policy/state around because they would only ever be triggered if the datapath marked packets for encryption which it wouldn't because encryption was disabled. Then if encryption was ever (re)enabled the rules would already be there. But, subtle detail if the cilium_host IP changes after encryption is disabled then it (re)enabled with a new IP the 'dir in' state/policy in the xfrm table will no longer be valid. And if the new cilium host IP is in the same CIDR we can end up with a collision in the table and possible use old out of date rules. Fix by removing any 'dir in' rules when encryption is disabled. Signed-off-by: John Fastabend <john.fastabend@gmail.com>
houndci-bot
reviewed
Nov 22, 2019
|
test-me-please |
When we added FIB support we only added it for IPv4. This adds support IPv6 and fixes an issue where IPv6 packets were being dropped due to fib lookup failing. Signed-off-by: John Fastabend <john.fastabend@gmail.com>
863c408 to
300bdd2
Compare
|
test-me-please |
joestringer
requested changes
Nov 22, 2019
300bdd2 to
77e7f17
Compare
|
test-me-please |
|
pushed update with printing dropped and some consolidation of |
joestringer
approved these changes
Nov 25, 2019
vadorovsky
approved these changes
Nov 26, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes fib lookup case for IPv6 and ensures when disabling encryption remaining state is remove.
This change is