cilium / cilium / 9662

39%

push

travis-ci-com

cilium: encryption, ensure 0x*d00 and 0x*e00 marks dont cause conflicts

We mark encryption packets with 0xd00 and 0xe00 values to indicate if
the packet should be encrypted (0xe00) or decrypted (0xd00). In the
encryption case we also set the next byte (0x*e00) with the keyID to
encrypt the packet with. This allows multiple keys to be in use at any
specific time.

However, it was observed that the upper bits, where the keyID is
placed, may also be used by kube-proxy. To avoid collision add rules
at the top of iptables to accept any packets with the encrypt/decrypt
mark values. These values will be cleared again before being pushed
to the stack so normal rules will still be hit.

Notice, we already had these rules to exclude encrypted traffic in
the masquerading case. This moves those rules installation to be
done any time encryption is enabled. This issue has existed from the
initial implementation, but our CI and my testing never used those
key id with colliding features.

Fixes: b2b901fb19163 ("cilium: ipsec, add go API to configure xfrm (IPSec)")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>

54 of 54 new or added lines in 1 file covered. (100.0%)

25278 of 57265 relevant lines covered (44.14%)

1181.57 hits per line