Remove invalid flow when WireGuard is enabled #5909
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
antoninbas
force-pushed
the
remove-invalid-flow-when-wireguard-enabled
branch
from
59744d5
to
909d062
Compare
antoninbas
commented
Jan 24, 2024
| @@ -1625,10 +1625,6 @@ func (c *client) InstallMulticlusterClassifierFlows(tunnelOFPort uint32, isGatew | |||
| c.featurePodConnectivity.l2ForwardCalcFlow(GlobalVirtualMACForMulticluster, tunnelOFPort), | |||
| } | |||
|
|
|||
| if c.networkConfig.TrafficEncapMode != config.TrafficEncapModeEncap { | |||
There was a problem hiding this comment.
this should no longer be needed after the change to pod_connectivity.go
tnqn
reviewed
Jan 24, 2024
antoninbas
force-pushed
the
remove-invalid-flow-when-wireguard-enabled
branch
from
909d062
to
ef321d4
Compare
|
/test-all |
antoninbas
force-pushed
the
remove-invalid-flow-when-wireguard-enabled
branch
from
ef321d4
to
572920c
Compare
tnqn
reviewed
Jan 24, 2024
build/yamls/antrea.yml
Outdated
| @@ -5692,7 +5692,7 @@ data: | |||
| # the PSK value must be passed to Antrea Agent through an environment | |||
| # variable: ANTREA_IPSEC_PSK. | |||
| # - wireGuard: Enable WireGuard for tunnel traffic encryption. | |||
| trafficEncryptionMode: "none" | |||
| trafficEncryptionMode: "wireGuard" | |||
There was a problem hiding this comment.
oops I committed all local changes when I addressed your comment above
should be reverted now
antoninbas
force-pushed
the
remove-invalid-flow-when-wireguard-enabled
branch
from
572920c
to
6e84cb6
Compare
After merging antrea-io#5885, the OVS tunnel port is no longer created when enabling WireGuard, as it is not being used. However, we were still trying to install flows referencing the tunnel port. Even though the port was non-existent, flow creation would succeed, but the condition matching on the tunnel port was being dropped silently. This would lead to invalid datapath behavior. We update the code to prevent installing these invalid flows when WireGuard is enabled. Fixes antrea-io#5905 Signed-off-by: Antonin Bas <antonin.bas@broadcom.com>
antoninbas
force-pushed
the
remove-invalid-flow-when-wireguard-enabled
branch
from
6e84cb6
to
b5d0b10
Compare
|
/test-all |
|
|
|
/test-e2e |
|
/test-conformance |
|
/skip-conformance |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After merging #5885, the OVS tunnel port is no longer created when enabling WireGuard, as it is not being used. However, we were still trying to install flows referencing the tunnel port. Even though the port was non-existent, flow creation would succeed, but the condition matching on the tunnel port was being dropped silently. This would lead to invalid datapath behavior. We update the code to prevent installing these invalid flows when WireGuard is enabled.
Fixes #5905