Revision - e3e3509 - ipsec: Don't remove stale XFRM IN configs - origin: https://github.com/cilium/cilium

visit type:

https://github.com/cilium/cilium

09 April 2024, 21:14:05 UTC

Revision e3e350949d21ee34c37284cc29341ab63222c653 authored by Paul Chaignon on 03 May 2023, 09:50:59 UTC, committed by Sebastian Wicki on 13 June 2023, 19:22:04 UTC

ipsec: Don't remove stale XFRM IN configs

[ upstream commit 600c7d4846989fb058fbd7ec400fe1a0a499efc7 ]

The XFRM IN policies and states didn't change so we should never need
to remove any stale XFRM IN configs. Let's thus simplify the logic to
find stale policies and states accordingly.

I would expect this incorrect removal to cause a few drops on agent
restart, but after multiple attempts to reproduce on small (3 nodes)
and larger (20) clusters (EKS & GKE) with a drop-sensitive application
(migrate-svc), I'm not able to see such drops. I'm guessing this is
because we reinstall the XFRM IN configs right after we removed them so
there isn't really much time for a packet to be received and dropped.

Fixes: 688dc9ac80 ("ipsec: Remove stale XFRM states and policies")
Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

1 parent 22e3800

Files
Changes

Permalinks

Tip revision: e3e350949d21ee34c37284cc29341ab63222c653 authored by Paul Chaignon on 03 May 2023, 09:50:59 UTC
ipsec: Don't remove stale XFRM IN configs

Tip revision: e3e3509

File	Mode	Size
.github
.travis
Documentation
api
bpf
bugtool
cilium
cilium-health
clustermesh-apiserver
contrib
daemon
envoy
examples
hack
hubble-relay
images
install
jenkinsfiles
operator
pkg
plugins
proxylib
test
tools
vendor
.authors.aux	-rw-r--r--	416 bytes
.gitattributes	-rw-r--r--	301 bytes
.gitignore	-rw-r--r--	1.5 KB
.gitmodules	-rw-r--r--	0 bytes
.golangci.yaml	-rw-r--r--	3.3 KB
.mailmap	-rw-r--r--	5.0 KB
.travis.yml	-rw-r--r--	1.2 KB
AUTHORS	-rw-r--r--	26.3 KB
CHANGELOG.md	-rw-r--r--	151.8 KB
CODEOWNERS	-rw-r--r--	1.2 KB
CODE_OF_CONDUCT.md	-rw-r--r--	2.2 KB
CONTRIBUTING.md	-rw-r--r--	227 bytes
FURTHER_READINGS.rst	-rw-r--r--	4.9 KB
GO_VERSION	-rw-r--r--	8 bytes
LICENSE	-rw-r--r--	11.1 KB
MAINTAINERS.md	-rw-r--r--	3.8 KB
Makefile	-rw-r--r--	29.1 KB
Makefile.defs	-rw-r--r--	6.0 KB
Makefile.docker	-rw-r--r--	6.3 KB
Makefile.quiet	-rw-r--r--	788 bytes
README.rst	-rw-r--r--	15.0 KB
SECURITY.md	-rw-r--r--	615 bytes
USERS.md	-rw-r--r--	8.1 KB
VERSION	-rw-r--r--	8 bytes
Vagrantfile	-rw-r--r--	12.9 KB
go.mod	-rw-r--r--	10.9 KB
go.sum	-rw-r--r--	206.7 KB
netlify.toml	-rw-r--r--	92 bytes
stable.txt	-rw-r--r--	8 bytes
vagrant_box_defaults.rb	-rw-r--r--	394 bytes

Showing with 0 additions and 0 deletions (0 / 0 diffs computed)

Computing file changes ...

https://github.com/cilium/cilium

ipsec: Don't remove stale XFRM IN configs

README.rst