connectivity: fix encryption validation if net.ipv4.conf.lo.rp_filter=1

2ff3df0 ("connectivity: fix encryption validation when running in
ENI mode") fixed the encryption validation when running in ENI mode, by
extending the source interface determination logic to additionally
consider the source address, i.e., running

  ip route get dst from src iif lo

The `iif lo` part is required, otherwise the command returns "RTNETLINK
answers: Network is unreachable" in case the src address is not assigned
to any local interface (which is expected, being src a pod IP).

Yet, this fails with "RTNETLINK answers: Invalid cross-device link" in case
rp_filter=1 (strict) is set of the given interface (lo in this case). Given
that any local interface can be used there, let's switch it to cilium_host,
as it is managed by Cilium, and we explicitly set rp_filter=0 to it.

Fixes: 2ff3df0 ("connectivity: fix encryption validation when running in ENI mode")
Fixes: cilium/cilium#29197
Signed-off-by: Marco Iorio <[email protected]>

connectivity/tests/encryption.go

@@ -51,11 +51,16 @@ func getInterNodeIface(ctx context.Context, t *check.Test,
 	srcIP, dstIP := client.Address(ipFam), server.Address(ipFam)
 	ipRouteGetCmd := fmt.Sprintf("ip -o route get %s from %s", dstIP, srcIP)
 	if srcIP != clientHost.Address(ipFam) {
-		// The "iif lo" part is required when the source address is not one
-		// of the addresses of the host. If an interface is not specified
+		// The "iif cilium_host" part is required when the source address is not
+		// one of the addresses of the host. If an interface is not specified
 		// "ip route" returns "RTNETLINK answers: Network is unreachable" in
 		// case the "from" address is not assigned to any local interface.
-		ipRouteGetCmd = fmt.Sprintf("%s iif lo", ipRouteGetCmd)
+		// Any existing interface name works, as long as the corresponding
+		// rp_filter value is different from 1, i.e., strict (otherwise it
+		// returns "RTNETLINK answers: Invalid cross-device link"). For this
+		// reason, let's use one of the interfaces managed by Cilium, as we
+		// explicitly set rp_filter=0 for them.
+		ipRouteGetCmd = fmt.Sprintf("%s iif cilium_host", ipRouteGetCmd)
 	}
 
 	if enc, ok := t.Context().Feature(features.EncryptionPod); wgEncap && ok && enc.Enabled && enc.Mode == "wireguard" {