ipsec: Fix xfrm output mask

[pchaigno]

First commit temporarily uses our netlink fork to be able to set the xfrm output mask. Second commit sets said mask in our xfrm rules. See commit messages for details.

I tested by applying the following diff to our existing test and manually checking the source identity is preserved when making requests between nodes:

diff --git a/test/k8sT/DatapathConfiguration.go b/test/k8sT/DatapathConfiguration.go
index c11628f67..a91bc17bb 100644
--- a/test/k8sT/DatapathConfiguration.go
+++ b/test/k8sT/DatapathConfiguration.go
@@ -214,7 +214,8 @@ var _ = Describe("K8sDatapathConfig", func() {
 
                        deploymentManager.Deploy(helpers.CiliumNamespace, IPSecSecret)
                        deploymentManager.DeployCilium(map[string]string{
-                               "encryption.enabled": "true",
+                               "encryption.enabled":     "true",
+                               "bpf.monitorAggregation": "none",
                        }, DeployCiliumOptionsAndDNS)
                        validateBPFTunnelMap()
                        Expect(testPodConnectivityAcrossNodes(kubectl)).Should(BeTrue(), "Connectivity test with IPsec between nodes failed")
@@ -736,6 +737,7 @@ func testPodConnectivityAndReturnIP(kubectl *helpers.Kubectl, requireMultiNode b
        if !res.WasSuccessful() {
                return false, targetIP
        }
+       helpers.HoldEnvironment("Let's check the source identity!")
 
        // HTTP connectivity test
        res = kubectl.ExecPodCmd(randomNamespace, srcPod,

Fix missing packet mark mask that can cause policy deny drops in IPSec configuration. 

[aditighag]

Are there any valid cases where we would be sending over zero identities over tunnel header? In other words, can we distinguish between a set/unset identity?

[jrfastab]

Other than small nit about using the default value RouteMarkMask LGTM

[pchaigno]

Are there any valid cases where we would be sending over zero identities over tunnel header? In other words, can we distinguish between a set/unset identity?

I can't think of any. If we fail to resolve an identity we should fallback to WORLD_ID.

Are you thinking we could fallback to an ipcache lookup at the destination node if the identity is unset? That might work, but (1) I'm not sure we always have all the identities on the remote ipcaches and (2) we would need to consider the complexity impact.

[aditighag]

Are there any valid cases where we would be sending over zero identities over tunnel header? In other words, can we distinguish between a set/unset identity?

I can't think of any. If we fail to resolve an identity we should fallback to WORLD_ID.

Are you thinking we could fallback to an ipcache lookup at the destination node if the identity is unset? That might work, but (1) I'm not sure we always have all the identities on the remote ipcaches and (2) we would need to consider the complexity impact.

I was thinking more from detecting such error conditions. Perhaps we can log a warning?

[pchaigno]

I was thinking more from detecting such error conditions. Perhaps we can log a warning?

Could be a topic for the next SIG Datapath meeting? It would definitely help uncovering such bugs in CI. It may be a bit hard to implement though because we either need to trace traffic from time to time and know which identity should be non-zero, or we need to extend the datapath to report such cases. Maybe there's a middle ground where we point those out in the cilium monitor output?

[jrfastab]

An observation,

        RouteMarkMask = 0xF00

and

        // IPsecMarkMask is the mask required for the IPsec SPI and encrypt/decrypt bits
        IPsecMarkMask = 0xFF00

So using IPsecMarkMask is slightly different from original patch. LGTM though.