-
Notifications
You must be signed in to change notification settings - Fork 359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove invalid flow when WireGuard is enabled #5909
Remove invalid flow when WireGuard is enabled #5909
Conversation
59744d5
to
909d062
Compare
@@ -1625,10 +1625,6 @@ func (c *client) InstallMulticlusterClassifierFlows(tunnelOFPort uint32, isGatew | |||
c.featurePodConnectivity.l2ForwardCalcFlow(GlobalVirtualMACForMulticluster, tunnelOFPort), | |||
} | |||
|
|||
if c.networkConfig.TrafficEncapMode != config.TrafficEncapModeEncap { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this should no longer be needed after the change to pod_connectivity.go
909d062
to
ef321d4
Compare
/test-all |
ef321d4
to
572920c
Compare
build/yamls/antrea.yml
Outdated
@@ -5692,7 +5692,7 @@ data: | |||
# the PSK value must be passed to Antrea Agent through an environment | |||
# variable: ANTREA_IPSEC_PSK. | |||
# - wireGuard: Enable WireGuard for tunnel traffic encryption. | |||
trafficEncryptionMode: "none" | |||
trafficEncryptionMode: "wireGuard" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it for testing only?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oops I committed all local changes when I addressed your comment above
should be reverted now
572920c
to
6e84cb6
Compare
After merging antrea-io#5885, the OVS tunnel port is no longer created when enabling WireGuard, as it is not being used. However, we were still trying to install flows referencing the tunnel port. Even though the port was non-existent, flow creation would succeed, but the condition matching on the tunnel port was being dropped silently. This would lead to invalid datapath behavior. We update the code to prevent installing these invalid flows when WireGuard is enabled. Fixes antrea-io#5905 Signed-off-by: Antonin Bas <antonin.bas@broadcom.com>
6e84cb6
to
b5d0b10
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
/test-all |
|
/test-e2e |
/test-conformance |
/skip-conformance |
After merging #5885, the OVS tunnel port is no longer created when enabling WireGuard, as it is not being used. However, we were still trying to install flows referencing the tunnel port. Even though the port was non-existent, flow creation would succeed, but the condition matching on the tunnel port was being dropped silently. This would lead to invalid datapath behavior. We update the code to prevent installing these invalid flows when WireGuard is enabled.
Fixes #5905