-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ipsec: Fix incorrect trace in from-network #18643
ipsec: Fix incorrect trace in from-network #18643
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix incorrect trace in from-network
from-network
won't mean anything to users (though they could guess :) ). What about Fix incorrect packet trace for encrypted packets received from the network
?
Yep, sounds more user-friendly. I used that. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the third commit is enough (changes made in the first commit are overwritten by the third anyway). Also, don't we need the same fix as in commit 3 for bpf_overlay? Changes in bpf_network look good to me 👍
Yep, let me clean up the commit.
Yes, I'm now working for the overlay as well now. Hopefully, I can make a commit in short. |
9ca7d11
to
2ba897c
Compare
When IPSec is enabled, it is helpful to trace ESP packets as encrypted. Fix the current program to do that. In non-IPSec mode, it won't happen because we are not interested in the encrypted packets. Please see the comment as well for more details. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
2ba897c
to
b34476d
Compare
Now overlay side is done and commits are cleaned up. Unfortunately, the overlay side became a bit wasteful program since it adds one extra packet parsing just for tracing. If it seems not good, I'm happy to remove it actually :( |
/test Job 'Cilium-PR-K8s-1.22-kernel-4.19' failed and has not been observed before, so may be related to your PR: Click to show.Test Name
Failure Output
If it is a flake, comment Job 'Cilium-PR-K8s-GKE' failed and has not been observed before, so may be related to your PR: Click to show.Test Name
Failure Output
If it is a flake, comment Job 'Cilium-PR-K8s-1.23-kernel-net-next' failed and has not been observed before, so may be related to your PR: Click to show.Test Name
Failure Output
If it is a flake, comment |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Only minor comments this time.
If you only push fixes for those without rebasing, I don't think we'll need to rerun the end-to-end tests (assuming they pass now).
When IPSec is enabled, it is helpful to trace ESP packets as encrypted. Fix the current program to do that. In non-IPSec mode, it won't happen because we are not interested in the encrypted packets. Please see the comment as well for more details. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
b34476d
to
8bad03c
Compare
Fixed based on Paul's comment. |
The cilium/bpf review request is covered. Tests were passing before the last push, except for |
Please ensure your pull request adheres to the following guidelines:
description and a
Fixes: #XXX
line if the commit addresses a particularGitHub issue.
In from-network, there is a wrong send_trace_notify which sets
TRACE_REASON_ENCRYPTED for decrypted packets.