[v1.17] bpf:wireguard: reuse MARK_MAGIC_ENCRYPT for encrypted packets #39652
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
247e889 to
b724466
Compare
[ upstream commit 294818e ] This commit protects current usages of MARK_MAGIC_ENCRYPT and MARK_MAGIC_DECRYPT for only when IPSec is enabled. This should make sure that in case of further re-using such marks or overlapping marks we do not hit unexpected codepaths. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This commit adds the minimal logic to v1.17 to handle downgrades from v1.18, where we started to use the MARK_MAGIC_ENCRYPT also in the WireGuard codepath to signal encrypted packets post to-wireguard hook. Therefore, here the ctx_mark_is_wireguard() function should handle that case. We protected previous usages of that mark in the IPSec codepath, so here we should be safe. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
b724466 to
3d77b7a
Compare
|
/test |
pchaigno
approved these changes
Jun 5, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Manual backport of:
With this patch, we protect previous usages of MARK_MAGIC_ENCRYPT which refer only to the IPSec codepath.
In v1.18, we start using that mark to signal also WireGuard encrypted packets, replacing the old MARK_MAGIC_WG_ENCRYPTED that overlaps with the k8s mark space.
This means that v1.17 needs to be able to understand that mark too in the WireGuard codepaths.
Once this PR is merged, a GitHub action will update the labels of these PRs: