From 2adf729764540339637ce4e6b4e3bb66f24b5b07 Mon Sep 17 00:00:00 2001 From: Marco Iorio <marco.iorio@isovalent.com> Date: Thu, 16 Nov 2023 13:57:47 +0100 Subject: [PATCH] connectivity: fix encryption validation if net.ipv4.conf.lo.rp_filter=1 2ff3df00a04f ("connectivity: fix encryption validation when running in ENI mode") fixed the encryption validation when running in ENI mode, by extending the source interface determination logic to additionally consider the source address, i.e., running ip route get dst from src iif lo The `iif lo` part is required, otherwise the command returns "RTNETLINK answers: Network is unreachable" in case the src address is not assigned to any local interface (which is expected, being src a pod IP). Yet, this fails with "RTNETLINK answers: Invalid cross-device link" in case rp_filter=1 (strict) is set of the given interface (lo in this case). Given that any local interface can be used there, let's switch it to cilium_host, as it is managed by Cilium, and we explicitly set rp_filter=0 to it. Fixes: 2ff3df00a04f ("connectivity: fix encryption validation when running in ENI mode") Fixes: cilium/cilium#29197 Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> --- connectivity/tests/encryption.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/connectivity/tests/encryption.go b/connectivity/tests/encryption.go index 2ff199cf6a..c3d7736dee 100644 --- a/connectivity/tests/encryption.go +++ b/connectivity/tests/encryption.go @@ -51,11 +51,16 @@ func getInterNodeIface(ctx context.Context, t *check.Test, srcIP, dstIP := client.Address(ipFam), server.Address(ipFam) ipRouteGetCmd := fmt.Sprintf("ip -o route get %s from %s", dstIP, srcIP) if srcIP != clientHost.Address(ipFam) { - // The "iif lo" part is required when the source address is not one - // of the addresses of the host. If an interface is not specified + // The "iif cilium_host" part is required when the source address is not + // one of the addresses of the host. If an interface is not specified // "ip route" returns "RTNETLINK answers: Network is unreachable" in // case the "from" address is not assigned to any local interface. - ipRouteGetCmd = fmt.Sprintf("%s iif lo", ipRouteGetCmd) + // Any existing interface name works, as long as the corresponding + // rp_filter value is different from 1, i.e., strict (otherwise it + // returns "RTNETLINK answers: Invalid cross-device link"). For this + // reason, let's use one of the interfaces managed by Cilium, as we + // explicitly set rp_filter=0 for them. + ipRouteGetCmd = fmt.Sprintf("%s iif cilium_host", ipRouteGetCmd) } if enc, ok := t.Context().Feature(features.EncryptionPod); wgEncap && ok && enc.Enabled && enc.Mode == "wireguard" {