Extend BPF unit tests for IPsec #28438
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
dont-merge/needs-sign-off
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
from
d3ae14f to
c2ea7d4
Compare
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-sign-off
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
6 times, most recently
from
195c447 to
2dddd24
Compare
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
jschwinger233
added
sig/datapath
maintainer-s-little-helper
bot
removed
dont-merge/needs-release-note-label
jschwinger233
added
the
area/encryption
jschwinger233
changed the title
|
/test |
jschwinger233
requested review from
markpash,
a team and
brb
and removed request for
a team
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
from
2dddd24 to
62a18ed
Compare
|
/test |
pchaigno
reviewed
Oct 31, 2023
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
from
62a18ed to
108a8ed
Compare
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
4 times, most recently
from
68af2fa to
516a532
Compare
markpash
approved these changes
Nov 13, 2023
brb
approved these changes
Nov 15, 2023
pchaigno
approved these changes
Nov 21, 2023
The original ipsec_from_lxc_test.c covers tunnel=vxlan plus endpointRoutes=disabled only. This commit splits it into generic part (*_generic.h) and configure-specific part (*_tunnel.c). Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
ipsec_from_lxc_*: - *_tunnel.c: tunnel + !endpointRoutes - *_tunnel_endpoint: tunnel + endpointRoutes - *_native.c: !tunnel + !endpointRoutes - *_native_endpoint.c: !tunnel + endpointRoutes Please note the different macros defined among combinations: Macros for Cilium: - TUNNEL_MODE & HAVE_ENCAP: defined for tunnel - ENABLE_ROUTING: defined for !endpointRoutes - ENABLE_ENDPOINT_ROUTES & USE_BPF_PROG_FOR_INGRESS_POLICY: defined for endpointRoutes Macros for test: - EXPECTED_DEST_MAC: especially defined for !tunnel + !endpointRoutes, because of https://github.com/cilium/cilium/blob/a42ef40ad137a7688ff533ff1d9a0ddfd6f72a0a/bpf/bpf_lxc.c#L1230 Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
The original ipsec_from_host_test.c covers tunnel=vxlan plus endpointRoutes=disabled only. This commit splits it into generic part (*_generic.h) and configure-specific part (*_tunnel.c). Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
ipsec_from_host_*.c: - *_tunnel.c: tunnel + !endpointRoutes - *_tunnel_endpoint.c: tunnel + endpointRoutes - *_native.c: !tunnel + !endpointRoutes - *_native_endpoint.c: !tunnel + endpointRoutes Please note the different macros defined among combinations: Macros for Cilium: - TUNNEL_MODE & HAVE_ENCAP: defined for tunnel - ENABLE_ROUTING: defined for !endpointRoutes - ENABLE_ENDPOINT_ROUTES: defined for endpointRoutes Macros for test: - EXPECTED_STATUS_CODE: ACT_REDIRECT for tunnel, ACT_OK for !tunnel - CHECK_CB_ENCRYPT_IDENTITY: defined for tunnel, because of https://github.com/cilium/cilium/blob/a42ef40ad137a7688ff533ff1d9a0ddfd6f72a0a/bpf/lib/encrypt.h#L42 Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
The original ipsec_from_overlay_test.c covers tunnel=vxlan plus endpointRoutes=disabled only. This commit splits it into generic part (*_generic.h) and configure-specific part (*_tunnel.c). Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
Macro ENABLE_ENDPOINT_ROUTES is defined instead of ENABLE_ROUTING. TC_ACT_OK is also expected rather than TC_ACT_REDIRECT. Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
from
516a532 to
2289b72
Compare
Bpf from_network is used to attach on eth0 when tunnel is disabled. This
commit covers tunnel=disabled with endpointRoutes={enabled,disabled}.
Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/ci-ipsec-ext
branch
from
2289b72 to
79e6114
Compare
pchaigno
added
the
ready-to-merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Existing IPsec BPF test only covers tunnel=vxlan, so this PR covers combination of tunnel={vxlan,disabled} and endpointRoutes={disabled,enabled}.
Fixes: #25699
Signed-off-by: Zhichuan Liang gray.liang@isovalent.com