wireguard add check on ipv6_hdrlen for failures #35345
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9eb4bf5 to
9fba8ae
Compare
|
/test |
9fba8ae to
0b55d00
Compare
|
/test |
db9d11c to
2a01586
Compare
|
/test |
|
/ci-eks |
This commit adjusts the name of a variable in the `do_netdev` function. Instead of directly naming `l4_off`, let's opt for `hdrlen` so that, when adding check in the following commit, it is more clear what are we testing. Adjusting values passed to the `ctx_is_wireguard` accordingly with ETH_HLEN. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This commit introduces a check to the output of `ipv6_hdrlen` before calling the ctx_is_wireguard` function for setting the tracing encryption bit to WireGuard packets. In case of no errors, execute `ctx_is_wireguard` and set the encryption bit in case of WireGuard packets. Otherwise, continue without trying to set the encryption bit to the trace event. We do not directly drop the packet here since tracing does not necessarily rely on `ipv6_hdrlen`. The subsequent tail call (`handle_ipv6`) will handle such error case. Offending commit hash: a732cd7 Offending PR: cilium#35183 Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
2a01586 to
c31da0a
Compare
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds additional checks after the
ipv6_hdrlenfunction call to make sure it didn't fail before continuing processing the packet withctx_is_wireguard. In case of failure, stop trying to mark it as encrypted, but do not drop the packet. In case we need to drop it, it'll be in the following tailcallhandle_ipv6, whose processing logic actually relies on that value.Offending commit hash: a732cd7
Offending PR: #35183