Skip to content

Commit 3ebfb05

Browse files
gentoo-rootgentoo-root
committed
Revert "cilium-cli: Reenable L7 IPv6 tests"
This reverts commit 3e2b2f48559d169e5ebe4853c8325542e4229a98.
1 parent 86f0f1c commit 3ebfb05

File tree

4 files changed

+30
-12
lines changed

4 files changed

+30
-12
lines changed

‎cilium-cli/connectivity/builder/client_egress_l7.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ func clientEgressL7Test(ct *check.ConnectivityTest, templates map[string]string,
3232
WithCiliumPolicy(templates[templateName]). // L7 allow policy with HTTP introspection
3333
WithScenarios(
3434
tests.PodToPod(),
35-
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
35+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
36+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
37+
tests.PodToWorld(false, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
3638
).
3739
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
3840
if a.Source().HasLabel("other", "client") && // Only client2 is allowed to make HTTP calls.

‎cilium-cli/connectivity/builder/client_egress_l7_named_port.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ func (t clientEgressL7NamedPort) build(ct *check.ConnectivityTest, templates map
1919
WithCiliumPolicy(templates["clientEgressL7HTTPNamedPortPolicyYAML"]). // L7 allow policy with HTTP introspection (named port)
2020
WithScenarios(
2121
tests.PodToPod(),
22-
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
22+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
23+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
24+
tests.PodToWorld(false, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
2325
).
2426
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
2527
if a.Source().HasLabel("other", "client") && // Only client2 is allowed to make HTTP calls.

‎cilium-cli/connectivity/builder/client_egress_tls_sni.go‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
2828
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
2929
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
3030
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
31-
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
31+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
32+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
33+
WithScenarios(tests.PodToWorld(false)).
3234
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
3335
if a.Destination().Port() == 443 {
3436
return check.ResultOK, check.ResultNone
@@ -40,9 +42,11 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
4042
newTest(fmt.Sprintf("%s-denied", testName), ct).
4143
WithCiliumVersion("!1.14.15 !1.14.16 !1.15.9 !1.15.10 !1.16.2 !1.16.3").
4244
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
43-
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
44-
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
45-
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)). // External Target is not allowed
45+
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
46+
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
47+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
48+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
49+
WithScenarios(tests.PodToWorld(false)). // External Target is not allowed
4650
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
4751
if a.Destination().Port() == 443 {
4852
// SSL error as another external target (e.g. cilium.io) SNI is not allowed
@@ -57,7 +61,9 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
5761
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
5862
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
5963
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
60-
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
64+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
65+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
66+
WithScenarios(tests.PodToWorld(false)).
6167
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
6268
if a.Destination().Port() == 443 {
6369
return check.ResultOK, check.ResultNone
@@ -71,7 +77,9 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
7177
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
7278
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
7379
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
74-
WithScenarios(tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable)).
80+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
81+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
82+
WithScenarios(tests.PodToWorld2(false)).
7583
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
7684
if a.Destination().Port() == 443 {
7785
// SSL error as another external target (e.g. cilium.io) SNI is not allowed
@@ -89,7 +97,9 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
8997
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
9098
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
9199
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
92-
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
100+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
101+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
102+
WithScenarios(tests.PodToWorld(false)).
93103
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
94104
if a.Destination().Port() == 443 {
95105
return check.ResultOK, check.ResultNone
@@ -103,7 +113,9 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
103113
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
104114
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
105115
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
106-
WithScenarios(tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable)).
116+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
117+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
118+
WithScenarios(tests.PodToWorld2(false)).
107119
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
108120
if a.Destination().Port() == 443 {
109121
// SSL error as another external target (e.g. cilium.io) SNI is not allowed

‎cilium-cli/connectivity/builder/to_fqdns.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,10 @@ func (t toFqdnsWithProxy) build(ct *check.ConnectivityTest, templates map[string
6262
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]).
6363
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
6464
WithScenarios(
65-
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80)),
66-
tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable), // resolves to ExternalOtherTarget
65+
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
66+
// https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
67+
tests.PodToWorld(false, tests.WithRetryDestPort(80)),
68+
tests.PodToWorld2(false), // resolves to ExternalOtherTarget
6769
).
6870
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
6971
if a.Destination().Address(features.IPFamilyAny) == ct.Params().ExternalOtherTarget {

0 commit comments

Comments
 (0)