datapath: optionally disable SIP verification

[oblazek]

Enable an old datapath option for disabling source IP
verification which prevents IP spoofing. In some cases
it might be beneficial for users to have this option
(for example something like DHCP discover which sends
a packet with srcIP 0.0.0.0).

Signed-off-by: Ondrej Blazek ondra.blazkuj@gmail.com

The macro DISABLE_SIP_VERIFICATION has been unused,
the new datapath option enables it.

[pchaigno]

@oblazek The tests are failing because some generated files need to be regenerated.

[oblazek]

@oblazek The tests are failing because some generated files need to be regenerated.

Oh, I accidentally modified autogenerated file, will try to fix. Thanks.

[oblazek]

Code should be ready now, but could not figure out how to keep naming in this format DisableSIPVerification vs DisableSipVerification which is generated by the swagger.
One thing I am unsure what to do with build_commits / Check if build works for every commit (pull_request) failing.

Details show this:

../pkg/endpoint/bpf.go:1485:32: e.DatapathConfiguration.DisableSIPVerification undefined (type models.EndpointDatapathConfiguration has no field or method DisableSIPVerification

which I have fixed in the latest commit.

[pchaigno]

Details show this:

../pkg/endpoint/bpf.go:1485:32: e.DatapathConfiguration.DisableSIPVerification undefined (type models.EndpointDatapathConfiguration has no field or method DisableSIPVerification

which I have fixed in the latest commit.

That GitHub action ensures your commits don't break git bisect. It checks your commit history is clean. I think you just need to squash your commits to fix it.

[oblazek]

Details show this:

../pkg/endpoint/bpf.go:1485:32: e.DatapathConfiguration.DisableSIPVerification undefined (type models.EndpointDatapathConfiguration has no field or method DisableSIPVerification

which I have fixed in the latest commit.

That GitHub action ensures your commits don't break git bisect. It checks your commit history is clean. I think you just need to squash your commits to fix it.

Ah, got it.. thought gh has a way of squashing commits with a simple checkbox like gitlab has (but is hidden by default).

[ti-mo]

Thanks for the patch! Let's try to keep acronyms capitalized on non-autogenerated files wherever possible. Only the field in EndpointDatapathConfiguration should contain Sip, the rest should be capitalized. 👍

[pchaigno]

Smoke tests should already cover these changes and I don't think we need to run the full end-to-end tests given the option is never enabled in CI. All team reviews are covered. Marking as ready to merge.

[michaelraskansky]

Hello, where can I set the parameter to disable sip verification? I can't find any reference in the documentation?

Thanks.

[pchaigno]

@michaelraskansky I don't believe it's currently possible to enable it unless you integrate directly with Cilium. I would be in favor of adding a flag to enable it globally for the agent. Though I'm wondering what's your use case to skip this check?

[michaelraskansky]

Hi @pchaigno , thanks for the quick reply.
I am routing traffic from external IP networks via pods within the Kuberenets cluster.
The external networks are connected with a tunneling interface to the pods namespace.

Something like this.
External IP Network < ---------> (wg0) Pod (eth0) <---------> Internet