datapath: move policy map value prefix length to flags #35534
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
a56d346 to
776cb22
Compare
Move the prefix length field in the policy map value to the flags (same byte as 'deny') to a previously unused space. This cleans up padding space for future use. Skip map entries with inconsistent prefix length field in value vs. key so that the entry will be rewritten with the correct prefix length field in the value. This fixes a potential issue in upgrade where a policy map entry may remain with zero valued prefix length in value leading to incorrect policy enforcement. Fixes: cilium#35150 Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
776cb22 to
4e23b96
Compare
|
/test |
squeed
approved these changes
Oct 25, 2024
nathanjsweet
approved these changes
Oct 25, 2024
2 tasks
jrajahalme
added a commit
to jrajahalme/cilium
that referenced
this pull request
Nov 7, 2024
Mark policymap entries not valid explicitly when policy map entry is not valid so that map sync will update the entry, instead just ignoring the key, as in that case the key would remain in the map if it would have needed to be removed instead. Fixes: cilium#35534 Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 12, 2024
Mark policymap entries not valid explicitly when policy map entry is not valid so that map sync will update the entry, instead just ignoring the key, as in that case the key would remain in the map if it would have needed to be removed instead. Fixes: #35534 Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Move the prefix length field in the policy map value to the flags (same byte as 'deny') to a previously unused space. This cleans up padding space for future use.
Skip map entries with inconsistent prefix length field in value vs. key so that the entry will be rewritten with the correct prefix length field in the value. This fixes a potential issue in upgrade where a policy map entry may remain with zero valued prefix length in value leading to incorrect policy enforcement.
Fixes: #35150