cilium-cli:fix: account for current TunnelPort when building tcpdump overlay filters #38680
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f25357a to
739d8d3
Compare
|
/test |
pchaigno
approved these changes
Apr 3, 2025
squeed
reviewed
Apr 3, 2025
This commit adds TunnePort to the set of features detected from our CLI during tests. This can be useful from tests to retrieve the current active tunnel port. The `Enabled` is set to false in case `tunnel-port` is not present in the ConfigMap, but its value `Mode` is always set to either the provided port or the default one for the currently active protocol. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
739d8d3 to
2a6357d
Compare
This commit adjusts the current TunnelFilter logic to account for the
current tunnel-port in use when building tcpdump filters for the overlay.
This should prevent CLI tests from failing in all those environments where
tunnel-port is not the default one (ex. 8472 VXLAN, 6081 Geneve).
Given that now the filter `(udp and port tunnelPort)` make use of the
current tunnel port in use, we don't need anymore additional hacks:
- VXLAN: "udp[8:2] = 0x0800" would compare the first two bytes of an UDP
payload against VXLAN commonly used flags.
- Geneve: we could not use the "geneve" filter, as it shifts offset of a
filtered packet, which invalidates a filter matching on the outer headers.
Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This commit adjusts the overlay tcpdump filters according to the previous commit changes. Prior to this, we did not account for the current tunnel-port in use, making this test to fail in all those environment where the port is not the default one. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
2a6357d to
fbe31bd
Compare
|
/test |
squeed
approved these changes
Apr 4, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We now rely on tcpdump filters where we expect the default tunnel port to be in use (ex 8472 VXLAN, 6081 Geneve).
This means that CLI tests would fail in all environments where
tunnel-port != default.Let's retrieve the value from the Cilium ConfigMap.