bpf:ipsec: extend bpf tests for ipsec_maybe_redirect_to_encrypt #39623
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6056013 to
f6f71be
Compare
f6f71be to
aacee97
Compare
|
/test |
YutaroHayakawa
approved these changes
May 21, 2025
This land basic helpers to push: 1. IPv6 underlay VXLAN: despite not being yet fully supported, this commit adds helpers that can be then used for testing when landing support. 2. IPv6 inner packets rather than manually having to do it step-by-step Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This commit lands support to our bpf unit test suite for subsequent commits in which we need to generate either native and VXLAN packets for checking the ipsec egress hook function. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This takes the current test for calling ipsec_maybe_redirect_to_encrypt with a native packet into inline function, which accept a parameter to determine whether the packet is ipv4 or ipv6. This is useful to introduce IPv6 support in subsequent commit. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Given the refactor in the previous commit, let's now enable also ipsec_maybe_redirect_to_encrypt tests for native IPv6 packets. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This adds a separate IPv4 test case when calling ipsec_maybe_redirect_to_encrypt with a native packet to make sure that, given wrong identities, the hook does not encrypt the packet. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Similar as in previous commit, let's now also enable bad identities tests for native IPv6 packets when calling ipsec_maybe_redirect_to_encrypt, to make sure packets don't get encrypted. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Similar as in previous commits, let's now add additional tests for the ipsec_maybe_redirect_to_encrypt hook when being called with an overlay IPv4 packet containing an inner IPv4 packet. Given it is overlay, we now expect it to always be encrypted, expect when already encrypted and marked with the MARK_MAGIC_OVERLAY_ENCRYPTED mark. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Complementary to the previous commit, let's now also add tests when having and IPv4 overlay packet with an inner IPv6 packet. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Complementary to the previous commit, let's now also add tests when having and IPv6 overlay packet with an inner IPv4 packet. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Complementary to the previous commit, let's now also add tests when having and IPv6 overlay packet with an inner IPv6 packet. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
aacee97 to
476b33b
Compare
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Being hugely inspired by b824305, especially for infrastructure and subset of tests to run. Had to refactor a lot of stuff though, and tried to modify the infra so that we just have 2 files,
nativeandtunnel. Inside each of them, they now test both IPv4 and IPv6.In brief, this patch covers tests for
ipsec_maybe_redirect_to_encrypt()with:In addition, this patch lands the infra for the following tests, which cannot be enabled yet (MBOI for/after #39620):