Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ipsec: fixes for key rotation #27319

Merged
merged 2 commits into from
Aug 17, 2023
Merged

ipsec: fixes for key rotation #27319

merged 2 commits into from
Aug 17, 2023

Commits on Aug 16, 2023

  1. cilium: trigger validation of all nodes when key updated 

    From: John Fastabend <john.fastabend@gmail.com>

On key update we only update the policy for our local node. But with
latest round of changes we need to update for all nodes in the node
cache. With out this we would rely on the validation interval timer
to sync the nodes policy before we remove the old policy. This
may or may not happen depending on how large the cluster is.

Further I've seen us miss it even on relatively small clusters say
around 30 nodes so seems its not entirely reliable to count on.

Rather than rely on some external to ipsec timer to fire and sync
the policies and to do it hopefully in our time window lets just
force the nodeUpdate() call on all nodes in the cache when we
get the key rotate event.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    @jrfastab
    jrfastab committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    46f7422 View commit details
    Browse the repository at this point in the history

  2. cilium/ipsec: only update cilium_encrypt_map after xfrm is configured 

    From: John Fastabend <john.fastabend@gmail.com>

The cilium_encrypt_map is used to determine what key the datapath should
use. This is done by setting the mark value of the skb and then in the
XFRM policy the mark value is matched to designate what encryption
policy/state to use.

However, on key rotation we have an issue where the map entry with the
key is updated before the xfrm policy is plumbed. The result is its
possible to mark the skb with a value that will have no matching
xfrm policy and result in a policy block error and drop the skb.

To resolve ensure we do setup in the correct order and only set the
min key in the cilium_encrypt_map after the policy has been updated.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    @jrfastab
    jrfastab committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    37cb2d6 View commit details
    Browse the repository at this point in the history