-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pkg: add missing xfrm-no-track rules from ipv6 #24557
Conversation
By right there should be a rule to let ipsec skb bypass conntrack: -A CILIUM_PRE_raw -m mark --mark 0xd00/0xf00 -m comment --comment "cilium-xfrm-notrack:" -j CT --notrack However ipv6 missed it and this commit adds the rule back. Fixes: cilium#23481 Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
This reverts commit b1b9fbd and re-enables test for IPv6 externalTrafficPolicy=Local E/W for IPsec. Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
/test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice! Thanks for tracking and fixing this!
I see it's labeled as release-note/minor
, but it feels more like a release-note/bug
, no? The release note should also describe the user impact. It currently describes the change itself.
Finally, I think we should figure out where we need to backport.
I noticed there is no PR labelled with |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚀
[word-smith'ed the release-note. Also adding backport labels for 1.12 and 1.13] |
Backport PR will be taken care of by renovate bot, right? Is there anything I should follow up? |
By right there should be a rule to let ipsec skb bypass conntrack:
-A CILIUM_PRE_raw -m mark --mark 0xd00/0xf00 -m comment --comment "cilium-xfrm-notrack:" -j CT --notrack
However ipv6 missed it and this commit adds the rule back.
Fixes: #23481