[v1.17] ipsec: handle tunnelled ipv6 in v1.17 leak detection#38843
Merged
[v1.17] ipsec: handle tunnelled ipv6 in v1.17 leak detection#38843
Conversation
maintainer-s-little-helper
bot
added
backport/1.17
ldelossa
force-pushed
the
ldelossa/ipsec-hook-tunnelled-ipv6
branch
from
3746154 to
9c8fc06
Compare
nathanjsweet
added
the
dont-merge/wait-until-release
ldelossa
added
release-note/bug
ldelossa
force-pushed
the
ldelossa/ipsec-hook-tunnelled-ipv6
branch
from
9c8fc06 to
d7d9f40
Compare
Contributor
Author
|
/test |
qmonnet
changed the title
ldelossa
force-pushed
the
ldelossa/ipsec-hook-tunnelled-ipv6
branch
3 times, most recently
from
75095d2 to
9123221
Compare
joestringer
removed
the
dont-merge/wait-until-release
ldelossa
force-pushed
the
ldelossa/ipsec-hook-tunnelled-ipv6
branch
from
9123221 to
e0cc492
Compare
Add additional helpers for vxlan encapsulated packets in the context of IPsec. This will be used for upgrade/downgrade leak detection between v1.17 and v1.18. Signed-off-by: Louis DeLosSantos <[email protected]>
In 38bfeca code was backported to v1.17 to ensure no leaked packets would slip through when upgrading/downgrading from v1.17 to v1.18. The leak detection mechanism failed to include checking for encapsulated IPv6 packets. Update the leak detection bits to parse out the inner MAC header, determine the IP version, and check the inner IP protocol accordingly. This will now ensure leaked tunnelled IPv6 traffic is encapsulated during v1.17<->v1.18 upgrade/downgrade. Signed-off-by: Louis DeLosSantos <[email protected]>
ldelossa
force-pushed
the
ldelossa/ipsec-hook-tunnelled-ipv6
branch
from
e0cc492 to
b824305
Compare
Contributor
Author
|
/test |
maintainer-s-little-helper
bot
added
the
ready-to-merge
Member
|
@ldelossa does this actually qualify as If you agree, please flip to |
Contributor
Author
|
@julianwiedmann yup, I think that reasoning makes sense. I'll change. |
ldelossa
added
release-note/misc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In 38bfeca code was backported to v1.17 to ensure no leaked packets would slip through when upgrading/downgrading from v1.17 to v1.18.
The leak detection mechanism failed to include checking for encapsulated IPv6 packets.
Update the leak detection bits to parse out the inner MAC header, determine the IP version, and check the inner IP protocol accordingly.
This will now ensure leaked tunnelled IPv6 traffic is encapsulated during v1.17<->v1.18 upgrade/downgrade.