cilium / cilium / 11050 / 1
39%
master: 39%

DEFAULT BRANCH: master
Ran
Files 441
Run time 32s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 45.159% (+0.007%) from 45.152%
11050.1

push

travis-ci-com

borkmann 
bpf: fix cilium_host unroutable check

We do have unroutable tests in the Cilium datapath which return DROP_UNROUTABLE,
but they never trigger since in the ipcache lookup returned info is never NULL.
For an entry not known to the Cilium ipcache we get the catch-all 0.0.0.0/32
case which has only WORLD_ID as a security context. Thus one way to extend/fix
the test is to check for WORLD_ID and then drop it. skbs routed via cilium_host
should never have unknown routing context anyway.

Before:

  # ./cilium/cilium monitor
  [...]
  <- overlay flow 0xfcf59153 identity 0->0 state new ifindex cilium_vxlan: 10.11.79.63:50420 -> 10.12.111.12:80 tcp SYN
  <- host flow 0xfcf59153 identity 2->0 state new ifindex cilium_host: 10.11.79.63:50420 -> 10.12.111.12:80 tcp SYN
  [...]
  <- host flow 0xfcf59153 identity 2->0 state new ifindex cilium_net: 10.11.79.63:50420 -> 10.12.111.12:80 tcp SYN
  <- host flow 0xade815b1 identity 1->0 state new ifindex 0: 10.12.194.81 -> 10.11.79.63 TimeExceeded(TTLExceeded)
  -> overlay flow 0xade815b1 identity 1->0 state new ifindex cilium_vxlan: 10.12.194.81 -> 10.11.79.63 TimeExceeded(TTLExceeded)
  [...]

After:

  # ./cilium/cilium monitor
  [...]
  <- overlay flow 0xc8441019 identity 0->0 state new ifindex cilium_vxlan: 10.11.79.63:50410 -> 10.12.111.12:80 tcp SYN
  < - host flow 0xc8441019 identity 2->0 state new ifindex cilium_host: 10.11.79.63:50410 -> 10.12.111.12:80 tcp SYN
  xx drop (Stale or unroutable IP) flow 0xc8441019 to endpoint 0, identity 2->0: 10.11.79.63:50410 -> 10.12.111.12:80 tcp SYN
  [...]

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

25507 of 56483 relevant lines covered (45.16%)

1190.83 hits per line

Source Files on job 11050.1