ipsec: Remove deprecated upgrade code #34709
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
00d8893 to
55a0cfd
Compare
3453b69 to
a8d2b6c
Compare
aanm
previously requested changes
Sep 6, 2024
|
Nice, I believe this also addresses #32040. |
qmonnet
approved these changes
Sep 6, 2024
thorn3r
approved these changes
Sep 9, 2024
tklauser
approved these changes
Sep 10, 2024
a8d2b6c to
ed12852
Compare
There are no more cilium/github-sec (and in general CI) changes.
d663b1b to
8bb660c
Compare
Support for a global IPsec key (i.e., without + sign in the secret or ESN set to false) was deprecated in v1.16. We can now remove it and assume we're always using per-tunnel keys with ESN set to true. As a reminder, global key support was disabled because it's insecure. Removing it will ensure no Cilium user shoot themselves in the foot. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
We made a lot of changes to IPsec a few releases back. With that came a lot of code to handle upgrades and remove or replace old XFRM rules. With v1.17, we can now assume all users went through that upgrade in v1.16 at the latest and the upgrade-specific code is not needed anymore. Old XFRM rules will have been removed or replaced already. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
The IPsec unit tests were previously running with global keys. Since
support for such keys was removed, they will now run with per-tunnel
keys. They however currently fail with per-tunnel keys:
--- FAIL: TestUpsertIPSecEndpoint (0.00s)
panic: runtime error: slice bounds out of range [:36] with capacity 14 [recovered]
panic: runtime error: slice bounds out of range [:36] with capacity 14
This is because the fake boot ID being used is shorter than 36
characters. We need to pass a fake boot ID that is as long as a real
boot ID to fix this.
In addition the expected XFRM's mark must now include the node ID to
match what is installed on the system.
Finally, the expected XFRM state keys have changed and are derived from
the global key instead of simply being the global key.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
8bb660c to
66746e3
Compare
|
/test |
rgo3
approved these changes
Nov 12, 2024
borkmann
approved these changes
Nov 12, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The first commit removes support for the global-key system in IPsec, which had been deprecated in v1.16. The second commit removes IPsec upgrade logic that isn't needed anymore. The third commit fixes the unit tests to support the per-tunnel-keys system.