ipsec: Safely delete Xfrm state #32450
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4a47d10 to
6ba68e9
Compare
|
/test |
No functional change, just to make further revision easier. Signed-off-by: gray <gray.liang@isovalent.com>
6ba68e9 to
30f969e
Compare
|
/test |
rgo3
reviewed
May 13, 2024
1eb9e26 to
71f722f
Compare
|
/test |
rgo3
approved these changes
May 14, 2024
71f722f to
a7903f4
Compare
|
/test |
pchaigno
approved these changes
May 16, 2024
julianwiedmann
approved these changes
May 16, 2024
15 tasks
This was referenced May 24, 2024
This was referenced May 24, 2024
This was referenced Jun 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit messages elaborate details. Although this is to fix an upgrade issue from 1.13, it doesn't harm main.
If the cilium is upgraded from an old version, it's possible a latest version cilium cluster has the old xfrm states left over. In this case, this PR performs unnecessary xfrm churn, but won't affect any traffic.
If the cilium is installed from scratch, it indeed doesn't need this fix at all. In this situation, the
SafelyDeleteXfrmState()doesn't even cause xfrm churn because it can't find the old style xfrm state to delete.This can be removed along with https://github.com/cilium/cilium/blob/v1.15.4/pkg/datapath/linux/ipsec/ipsec_linux.go#L351.