ipsec: set interface ID different from 0

[tormath1]

in this patch:
https://patchwork.kernel.org/project/netdevbpf/patch/20220106093606.3046771-6-steffen.klassert@secunet.com/
we see that if_id must be different from 0 for policy and
state construction.

With a 0 value, it makes the creation of the dummy interface fail with
the following error:

level=fatal msg="IPSec with tunneling requires support for xfrm state output masks (Linux 4.19 or later)." error="invalid argument" subsys=daemon

Related-To: flatcar/Flatcar#626
Signed-off-by: Mathieu Tortuyaux mtortuyaux@microsoft.com

[tormath1]

Hi, I see this test is failing: "ConformanceKind1.19 / installation-and-connectivity" is that a flaky test or something needs to be investigated ?

[tormath1]

Thanks @pchaigno for the new run,it is still failing. Investigating on the cilium logs

[pchaigno]

The failure in privileged unit tests (runtime Jenkins job) seems related:

	 START: ipsec_linux_test.go:120: IPSecSuitePrivileged.TestUpsertIPSecEndpoint
	 START: ipsec_linux_test.go:37: IPSecSuitePrivileged.SetUpTest
	 PASS: ipsec_linux_test.go:37: IPSecSuitePrivileged.SetUpTest	0.000s
	 
	 ipsec_linux_test.go:175:
	     c.Assert(err, IsNil)
	 ... value syscall.Errno = 0x2 ("no such file or directory")
	 
	 START: ipsec_linux_test.go:42: IPSecSuitePrivileged.TearDownTest
	 PASS: ipsec_linux_test.go:42: IPSecSuitePrivileged.TearDownTest	0.000s
	 
	 FAIL: ipsec_linux_test.go:120: IPSecSuitePrivileged.TestUpsertIPSecEndpoint

[tormath1]

@pchaigno I don't think it's a flaky test. I can "reproduce" the "no such file or directory" error. I think it's related to the change on the policy creation: the Ifid is now different from 0 on the policy itself to avoid a mismatch. So policies are created with Ifid = 1 which leads to a failure when the policy is trying to be Get in the test:

cilium/pkg/datapath/linux/ipsec/ipsec_linux_test.go

Lines 166 to 175 in 7350969

	toProxyPolicy, err := netlink.XfrmPolicyGet(&netlink.XfrmPolicy{
	Src: remote,
	Dst: local,
	Dir: netlink.XFRM_DIR_IN,
	Mark: &netlink.XfrmMark{
	Mask: linux_defaults.IPsecMarkMaskIn,
	Value: linux_defaults.RouteMarkToProxy,
	},
	})
	c.Assert(err, IsNil)

The &netlink.XfrmPolicy{...} will have an Ifid != 1 so the policy is not found and the test is failing.

[tormath1]

@pchaigno not sure if I can re-trigger the test myself ?

[tormath1]

@pchaigno rebased the branch on master and squashed fixup! commits. 🙂

[pchaigno]

/test