1
39%
master: 39%

Ran 08 Jan 2020 06:00PM UTC

Files 447

Run time 31s

Badge

Embed ▾

Committed 08 Jan 2020 05:38PM UTC coverage: 45.862% (+0.006%) from 45.856%

Job # 12515.1

Build Type

push

travis-ci-com

Committed by

borkmann

Commit Message

identity: require global identity for empty labels

On recent master, I noticed that there's a lack of connectivity when going
over vxlan tunnel. Git bisection pointed me to commit 28dc941544f1 ("bpf:
Map HOST_ID to REMOTE_NODE_ID when encapsulating"). After a closer look,
it turns out however that 28dc941544f1 itself does nothing wrong, and for
tunnel ID the reserved REMOTE_NODE_ID was properly set for traffic going
out of the node via curl from hostns. However, the packets got dropped due
to the identity == HOST_ID check on replies even though they are originating
from a remote container. Turns out those containers had identity of 16777217
which is 0b100000000000000000000001 and therefore get truncated in case
of vxlan tunnel id since it's 24 bits width. Moreover, packets with such
0dab1b63b87c ("identity: Introduce local scope for numeric identity")
identity are only for local scope and not destined to leave the node.
Turns out for empty labels f3bbcd8e886d ("identity: Use local identities
to represent CIDR") RequiresGlobalIdentity() returns false which is not
correct; fix gets connectivity working again.

Fixes: f3bbcd8e886d ("identity: Use local identities to represent CIDR")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Coverage Stats

26624 of 58052 relevant lines covered (45.86%)

1206.91 hits per line

cilium / cilium / 12515 / 1
39%
master: 39%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 12515.1

cilium / cilium / 12515 / 1 39% master: 39%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 12515.1

cilium / cilium / 12515 / 1
39%
master: 39%

README BADGES
x