[Multicast] Add validation check for the encryption mode (#5920)

Mutlicast feature cannot work with WireGuard or IPSec configurations in encap
mode. The Agent will now return error when Multicast and encryption are enabled
simultaneously, during config validation.

Fixes #5916

Signed-off-by: wenyingd <wenyingd@vmware.com>

cmd/antrea-agent/options.go

@@ -320,9 +320,12 @@ func (o *Options) validateFlowExporterConfig() error {
 	return nil
 }
 
-func (o *Options) validateMulticastConfig() error {
-	if features.DefaultFeatureGate.Enabled(features.Multicast) {
+func (o *Options) validateMulticastConfig(encryptionMode config.TrafficEncryptionModeType) error {
+	if features.DefaultFeatureGate.Enabled(features.Multicast) && o.config.Multicast.Enable {
 		var err error
+		if encryptionMode != config.TrafficEncryptionModeNone {
+			return fmt.Errorf("Multicast feature doesn't work with the current encryption mode '%s'", encryptionMode)
+		}
 		if o.config.Multicast.IGMPQueryInterval != "" {
 			o.igmpQueryInterval, err = time.ParseDuration(o.config.Multicast.IGMPQueryInterval)
 			if err != nil {
@@ -584,7 +587,7 @@ func (o *Options) validateK8sNodeOptions() error {
 	if err := o.validateFlowExporterConfig(); err != nil {
 		return fmt.Errorf("failed to validate flow exporter config: %v", err)
 	}
-	if err := o.validateMulticastConfig(); err != nil {
+	if err := o.validateMulticastConfig(encryptionMode); err != nil {
 		return fmt.Errorf("failed to validate multicast config: %v", err)
 	}
 	if err := o.validateEgressConfig(encapMode); err != nil {

cmd/antrea-agent/options_test.go

@@ -219,18 +219,42 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 	tests := []struct {
 		name              string
 		igmpQueryVersions []int
+		encryptionMode    config.TrafficEncryptionModeType
 		expectedErr       error
 		expectedVersions  []uint8
 	}{
 		{
 			name:              "wrong versions",
 			igmpQueryVersions: []int{1, 3, 4},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       fmt.Errorf("igmpQueryVersions should be a subset of [1 2 3]"),
 			expectedVersions:  nil,
 		},
+		{
+			name:              "incorrect encryption mode with IPSec",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeIPSec,
+			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'IPsec'"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with WireGuard",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeWireGuard,
+			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'WireGuard'"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with invalid",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeInvalid,
+			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'invalid'"),
+			expectedVersions:  nil,
+		},
 		{
 			name:              "no error",
 			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       nil,
 			expectedVersions:  []uint8{1, 2},
 		},
@@ -240,11 +264,14 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 			defer featuregatetesting.SetFeatureGateDuringTest(t, features.DefaultFeatureGate, features.Multicast, true)()
 			o := &Options{config: &agentconfig.AgentConfig{
 				Multicast: agentconfig.MulticastConfig{
+					Enable:            true,
 					IGMPQueryVersions: tt.igmpQueryVersions},
 			}}
-			err := o.validateMulticastConfig()
-			assert.Equal(t, tt.expectedErr, err)
-			assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			err := o.validateMulticastConfig(tt.encryptionMode)
+			require.Equal(t, tt.expectedErr, err)
+			if err != nil {
+				assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			}
 		})
 	}
 }

test/e2e/wireguard_test.go

@@ -45,16 +45,20 @@ func TestWireGuard(t *testing.T) {
 		skipIfMissingKernelModule(t, data, node.name, []string{"wireguard"})
 	}
 	var previousTrafficEncryptionMode string
+	var previousMulticastEnabledState bool
 	ac := func(config *agentconfig.AgentConfig) {
 		previousTrafficEncryptionMode = config.TrafficEncryptionMode
 		config.TrafficEncryptionMode = "wireguard"
+		previousMulticastEnabledState = config.Multicast.Enable
+		config.Multicast.Enable = false
 	}
 	if err := data.mutateAntreaConfigMap(nil, ac, false, true); err != nil {
 		t.Fatalf("Failed to enable WireGuard tunnel: %v", err)
 	}
 	defer func() {
 		ac := func(config *agentconfig.AgentConfig) {
 			config.TrafficEncryptionMode = previousTrafficEncryptionMode
+			config.Multicast.Enable = previousMulticastEnabledState
 		}
 		if err := data.mutateAntreaConfigMap(nil, ac, false, true); err != nil {
 			t.Errorf("Failed to disable WireGuard tunnel: %v", err)