ipsec: Fix unencrypted traffic when IPsec is used with L7 egress proxy #32683
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
Author
|
/ci-ipsec-upgrade |
Member
Author
|
Maybe even the first 2 patches are also not needed? Will try later. |
Member
Author
No we still need that: https://github.com/cilium/cilium/actions/runs/9205906830/job/25322612955 I think this is because adding But I don't understand how #32331 passed ci-ipsec-e2e on kpr=true + bpf.masq=true. My understanding is, since proxy is always transparent, we always need netfilter to do masquerade for go-to-world traffic. |
a0f49ac to
aceca82
Compare
aceca82 to
c4d9fe5
Compare
71facda to
7807510
Compare
3766731 to
6cb00de
Compare
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Jun 5, 2024
This was addressed by cilium#32683. Signed-off-by: Julian Wiedmann <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Jun 5, 2024
This was addressed by #32683. Signed-off-by: Julian Wiedmann <[email protected]>
This was referenced Jun 7, 2024
Merged
Merged
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Jun 7, 2024
[ upstream commit 5f18d88 ] This was addressed by cilium#32683. Signed-off-by: Julian Wiedmann <[email protected]>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Jun 7, 2024
[ upstream commit 5f18d88 ] This was addressed by cilium#32683. Signed-off-by: Julian Wiedmann <[email protected]>
julianwiedmann
added a commit
that referenced
this pull request
Jun 7, 2024
[ upstream commit 5f18d88 ] This was addressed by #32683. Signed-off-by: Julian Wiedmann <[email protected]>
julianwiedmann
added a commit
that referenced
this pull request
Jun 7, 2024
[ upstream commit 5f18d88 ] This was addressed by #32683. Signed-off-by: Julian Wiedmann <[email protected]>
jschwinger233
pushed a commit
that referenced
this pull request
Jun 10, 2024
[ upstream commit: 5f18d88 ] This was addressed by #32683. Signed-off-by: Julian Wiedmann <[email protected]> Signed-off-by: gray <[email protected]>
dylandreimerink
pushed a commit
that referenced
this pull request
Jun 11, 2024
[ upstream commit: 5f18d88 ] This was addressed by #32683. Signed-off-by: Julian Wiedmann <[email protected]> Signed-off-by: gray <[email protected]>
jrajahalme
added a commit
to jrajahalme/cilium
that referenced
this pull request
Jul 31, 2024
Allow Envoy listener chaining via the loopback device by not routing transparent proxy traffic destined to the loopback device to the cilium_host device. Fixes: cilium#32683, cilium/proxy#742 Signed-off-by: Jarno Rajahalme <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Aug 8, 2024
Allow Envoy listener chaining via the loopback device by not routing transparent proxy traffic destined to the loopback device to the cilium_host device. Fixes: #32683, cilium/proxy#742 Signed-off-by: Jarno Rajahalme <[email protected]>
ti-mo
pushed a commit
to ti-mo/cilium
that referenced
this pull request
Aug 8, 2024
Allow Envoy listener chaining via the loopback device by not routing transparent proxy traffic destined to the loopback device to the cilium_host device. Fixes: cilium#32683, cilium/proxy#742 Signed-off-by: Jarno Rajahalme <[email protected]>
jschwinger233
pushed a commit
that referenced
this pull request
Aug 12, 2024
[ upstream commit 4c9cf37 ] Allow Envoy listener chaining via the loopback device by not routing transparent proxy traffic destined to the loopback device to the cilium_host device. Fixes: #32683, cilium/proxy#742 Signed-off-by: Jarno Rajahalme <[email protected]> Signed-off-by: gray <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Aug 13, 2024
[ upstream commit 4c9cf37 ] Allow Envoy listener chaining via the loopback device by not routing transparent proxy traffic destined to the loopback device to the cilium_host device. Fixes: #32683, cilium/proxy#742 Signed-off-by: Jarno Rajahalme <[email protected]> Signed-off-by: gray <[email protected]>
Comment on lines
+861
to
+865
|
|
||
| if (from_proxy && | ||
| (!info || !identity_is_cluster(info->sec_identity))) | ||
| ctx->mark = MARK_MAGIC_PROXY_TO_WORLD; | ||
| #endif /* ENABLE_IPSEC && !TUNNEL_MODE */ |
Member
There was a problem hiding this comment.
@jschwinger233 coming back to this - I only now realized that #36329 also applies here, and the mark potentially gets scrubbed on the transfer between cilium_host and cilium_net. Which is why we're still setting use_meta=true in the set_ipsec_encrypt() call above.
So I suppose this mark works well as mechanism to skip the transparent-socket match in iptables - but we can't really trust yet that it also survives until cilium_net (or a subsequent to-netdev) would see it.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes unencrypted traffic among nodes when IPsec is used with L7 egress proxy.
This PR supersedes #31955 that didn't take cilium/proxy#742 into consideration.
(The last three patches are temporarily added to run leak detection in CI, they'll be dropped after approval. Leak detection will be added separately soon.)
Fixes: #31984