Backport v1.14: ipsec: fixes for key rotation #27586
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
backport/1.14
|
/test |
|
/test-backport-1.14 |
|
The only failed CI task |
[ upstream commit bba3dfc ] From: John Fastabend <john.fastabend@gmail.com> On key update we only update the policy for our local node. But with latest round of changes we need to update for all nodes in the node cache. With out this we would rely on the validation interval timer to sync the nodes policy before we remove the old policy. This may or may not happen depending on how large the cluster is. Further I've seen us miss it even on relatively small clusters say around 30 nodes so seems its not entirely reliable to count on. Rather than rely on some external to ipsec timer to fire and sync the policies and to do it hopefully in our time window lets just force the nodeUpdate() call on all nodes in the cache when we get the key rotate event. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
[ upstream commit 4f3bc9f ] From: John Fastabend <john.fastabend@gmail.com> The cilium_encrypt_map is used to determine what key the datapath should use. This is done by setting the mark value of the skb and then in the XFRM policy the mark value is matched to designate what encryption policy/state to use. However, on key rotation we have an issue where the map entry with the key is updated before the xfrm policy is plumbed. The result is its possible to mark the skb with a value that will have no matching xfrm policy and result in a policy block error and drop the skb. To resolve ensure we do setup in the correct order and only set the min key in the cilium_encrypt_map after the policy has been updated. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/v1.14-ipsec-key-ro
branch
from
09a1771
to
bd26cf2
Compare
|
/test-backport-1.14 |
jrfastab
approved these changes
Aug 24, 2023
joestringer
approved these changes
Aug 24, 2023
There was a problem hiding this comment.
Ack for tophat, I presume @jrfastab already took a closer look.
maintainer-s-little-helper
bot
added
the
ready-to-merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Manual backport of #27319
Signed-off-by: Zhichuan Liang gray.liang@isovalent.com