Skip to content

Commit f108c0c

Browse files
pchaignopchaigno
committed
ipsec: Simplify XFRM IN policies
Our XFRM IN policies currently look as follows (including the change from the previous commit). The last two are for Encrypted Overlay. The second and fourth are for proxy traffic. src 0.0.0.0/0 dst 10.242.1.0/24 dir in priority 0 mark 0xd00/0xf00 tmpl src 10.242.0.95 dst 10.242.1.62 proto esp spi 0x00000000 reqid 1 mode tunnel src 0.0.0.0/0 dst 10.242.1.0/24 dir in priority 0 mark 0x200/0xf00 tmpl src 0.0.0.0 dst 0.0.0.0 proto esp spi 0x00000000 reqid 0 mode tunnel level use src 172.18.0.2/32 dst 172.18.0.5/32 dir in priority 0 mark 0xd00/0xf00 tmpl src 172.18.0.2 dst 172.18.0.5 proto esp spi 0x00000000 reqid 2 mode tunnel src 172.18.0.2/32 dst 172.18.0.5/32 dir in priority 0 mark 0x200/0xf00 tmpl src 0.0.0.0 dst 0.0.0.0 proto esp spi 0x00000000 reqid 0 mode tunnel level use This commit changes them into a single IN policy to allow everything through: src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 tmpl src 0.0.0.0 dst 0.0.0.0 proto esp spi 0x00000000 reqid 0 mode tunnel level use We've always written our XFRM IN policies to try and match every possible traffic, so this is clearly the easiest way to do that. Signed-off-by: Paul Chaignon <[email protected]>
1 parent 224195a commit f108c0c

3 files changed

Lines changed: 17 additions & 97 deletions

File tree

‎pkg/datapath/linux/ipsec.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ func (n *linuxNodeHandler) enableIPSecIPv4DoSubnetEncryption(newNode *nodeTypes.
233233

234234
params = ipsec.NewIPSecParamaters(template)
235235
params.Dir = ipsec.IPSecDirIn
236-
params.SourceSubnet = cidr
236+
params.SourceSubnet = wildcardCIDR
237237
params.DestSubnet = wildcardCIDR
238238
params.SourceTunnelIP = &remoteCiliumInternalIP
239239
params.DestTunnelIP = &localCiliumInternalIP
@@ -271,7 +271,6 @@ func (n *linuxNodeHandler) enableIPSecIPv4Do(newNode *nodeTypes.Node, nodeID uin
271271
localCiliumInternalIP := n.nodeConfig.CiliumInternalIPv4
272272
localIP := localCiliumInternalIP
273273

274-
localCIDR := n.nodeConfig.AllocCIDRIPv4.IPNet
275274
remoteCIDR := newNode.IPv4AllocCIDR.IPNet
276275
if err := n.replaceNodeIPSecOutRoute(remoteCIDR); err != nil {
277276
errs = errors.Join(errs, fmt.Errorf("failed to replace ipsec OUT (%q): %w", remoteCIDR.IP, err))
@@ -312,7 +311,7 @@ func (n *linuxNodeHandler) enableIPSecIPv4Do(newNode *nodeTypes.Node, nodeID uin
312311
params = ipsec.NewIPSecParamaters(template)
313312
params.Dir = ipsec.IPSecDirIn
314313
params.SourceSubnet = wildcardCIDR
315-
params.DestSubnet = localCIDR
314+
params.DestSubnet = wildcardCIDR
316315
params.SourceTunnelIP = &remoteIP
317316
params.DestTunnelIP = &localIP
318317
spi, err = ipsec.UpsertIPsecEndpoint(n.log, params)
@@ -483,7 +482,7 @@ func (n *linuxNodeHandler) enableIPSecIPv6DoSubnetEncryption(newNode *nodeTypes.
483482

484483
params = ipsec.NewIPSecParamaters(template)
485484
params.Dir = ipsec.IPSecDirIn
486-
params.SourceSubnet = cidr
485+
params.SourceSubnet = wildcardCIDR6
487486
params.DestSubnet = wildcardCIDR6
488487
params.SourceTunnelIP = &remoteCiliumInternalIP
489488
params.DestTunnelIP = &localCiliumInternalIP
@@ -520,7 +519,6 @@ func (n *linuxNodeHandler) enableIPSecIPv6Do(newNode *nodeTypes.Node, nodeID uin
520519
localCiliumInternalIP := n.nodeConfig.CiliumInternalIPv6
521520
localIP := localCiliumInternalIP
522521

523-
localCIDR := n.nodeConfig.AllocCIDRIPv6.IPNet
524522
remoteCIDR := newNode.IPv6AllocCIDR.IPNet
525523
if err := n.replaceNodeIPSecOutRoute(remoteCIDR); err != nil {
526524
errs = errors.Join(errs, fmt.Errorf("failed to replace ipsec OUT (%q): %w", remoteCIDR.IP, err))
@@ -564,7 +562,7 @@ func (n *linuxNodeHandler) enableIPSecIPv6Do(newNode *nodeTypes.Node, nodeID uin
564562
params = ipsec.NewIPSecParamaters(template)
565563
params.Dir = ipsec.IPSecDirIn
566564
params.SourceSubnet = wildcardCIDR6
567-
params.DestSubnet = localCIDR
565+
params.DestSubnet = wildcardCIDR6
568566
params.SourceTunnelIP = &remoteIP
569567
params.DestTunnelIP = &localIP
570568
spi, err = ipsec.UpsertIPsecEndpoint(n.log, params)

‎pkg/datapath/linux/ipsec/ipsec_linux.go‎

Lines changed: 5 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -555,8 +555,7 @@ func ipSecReplaceStateOut(log *slog.Logger, params *IPSecParameters) (uint8, err
555555
return key.Spi, xfrmStateReplace(log, state, params.RemoteRebooted)
556556
}
557557

558-
func _ipSecReplacePolicyIn(params *IPSecParameters, proxyMark bool, dir netlink.Dir) error {
559-
optional := false
558+
func ipSecReplacePolicyIn(params *IPSecParameters) error {
560559
// We can use the global IPsec key here because we are not going to
561560
// actually use the secret itself.
562561
key := getGlobalIPsecKey(params.DestSubnet.IP)
@@ -566,37 +565,13 @@ func _ipSecReplacePolicyIn(params *IPSecParameters, proxyMark bool, dir netlink.
566565
key.ReqID = params.ReqID
567566

568567
policy := ipSecNewPolicy()
569-
policy.Dir = dir
570-
if dir == netlink.XFRM_DIR_IN {
571-
policy.Src = params.SourceSubnet
572-
policy.Dst = params.DestSubnet
573-
policy.Mark = &netlink.XfrmMark{
574-
Mask: linux_defaults.IPsecMarkBitMask,
575-
}
576-
if proxyMark {
577-
// We require a policy to match on packets going to the proxy which are
578-
// therefore carrying the proxy mark. We however don't need a policy
579-
// for the encrypted packets because there is already a state matching
580-
// them.
581-
policy.Mark.Value = linux_defaults.RouteMarkToProxy
582-
// We must mark the IN policy for the proxy optional simply because it
583-
// is lacking a corresponding state.
584-
optional = true
585-
} else {
586-
policy.Mark.Value = linux_defaults.RouteMarkDecrypt
587-
}
588-
}
589-
ipSecAttachPolicyTempl(policy, key, *params.SourceTunnelIP, *params.DestTunnelIP, false, optional)
568+
policy.Src = params.SourceSubnet
569+
policy.Dst = params.DestSubnet
570+
policy.Dir = netlink.XFRM_DIR_IN
571+
ipSecAttachPolicyTempl(policy, key, *params.SourceTunnelIP, *params.DestTunnelIP, false, true)
590572
return netlink.XfrmPolicyUpdate(policy)
591573
}
592574

593-
func ipSecReplacePolicyIn(params *IPSecParameters) error {
594-
if err := _ipSecReplacePolicyIn(params, true, netlink.XFRM_DIR_IN); err != nil {
595-
return err
596-
}
597-
return _ipSecReplacePolicyIn(params, false, netlink.XFRM_DIR_IN)
598-
}
599-
600575
func IpSecReplacePolicyFwd(params *IPSecParameters) error {
601576
// We can use the global IPsec key here because we are not going to
602577
// actually use the secret itself.

‎pkg/datapath/linux/ipsec/ipsec_linux_test.go‎

Lines changed: 8 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -519,80 +519,27 @@ func TestUpsertIPSecEndpointIn(t *testing.T) {
519519
},
520520
}
521521
policy, err := netlink.XfrmPolicyGet(&netlink.XfrmPolicy{
522-
Src: remote,
523-
Dst: local,
524-
Dir: netlink.XFRM_DIR_IN,
525-
Mark: &netlink.XfrmMark{
526-
Mask: linux_defaults.IPsecMarkBitMask,
527-
Value: linux_defaults.RouteMarkDecrypt,
528-
},
522+
Src: wildcardCIDRv4,
523+
Dst: wildcardCIDRv4,
524+
Dir: netlink.XFRM_DIR_IN,
529525
Tmpls: tmpls,
530526
})
531527
require.NoError(t, err)
532528
require.NotNil(t, policy)
533529

534530
// ensure XFRM policy is as we want it...
535-
if !policy.Src.IP.Equal(remote.IP) {
536-
t.Fatalf("Expected Src to be %s, but got %s", remote.IP.String(), policy.Src.IP.String())
531+
if !policy.Src.IP.Equal(wildcardIPv4) {
532+
t.Fatalf("Expected Src to be %s, but got %s", wildcardIPv4.String(), policy.Src.IP.String())
537533
}
538-
if !policy.Dst.IP.Equal(local.IP) {
539-
t.Fatalf("Expected Dst to be %s, but got %s", local.IP.String(), policy.Dst.IP.String())
534+
if !policy.Dst.IP.Equal(wildcardIPv4) {
535+
t.Fatalf("Expected Dst to be %s, but got %s", wildcardIPv4.String(), policy.Dst.IP.String())
540536
}
541537
require.Equal(t, netlink.XFRM_DIR_IN, policy.Dir)
542-
require.Equal(t, uint32(linux_defaults.RouteMarkDecrypt), policy.Mark.Value)
543-
require.Equal(t, uint32(linux_defaults.IPsecMarkBitMask), policy.Mark.Mask)
538+
require.Nil(t, policy.Mark)
544539
require.Len(t, policy.Tmpls, 1)
545540

546541
// ensure the template is correct as well...
547542
policyTmpl := policy.Tmpls[0]
548-
if !policyTmpl.Src.Equal(remote.IP) {
549-
t.Fatalf("Expected Src to be %s, but got %s", remote.IP.String(), policyTmpl.Src.String())
550-
}
551-
if !policyTmpl.Dst.Equal(local.IP) {
552-
t.Fatalf("Expected Dst to be %s, but got %s", local.IP.String(), policyTmpl.Dst.String())
553-
}
554-
require.Equal(t, netlink.XFRM_PROTO_ESP, policyTmpl.Proto)
555-
require.Equal(t, params.ReqID, policyTmpl.Reqid)
556-
require.Equal(t, netlink.XFRM_MODE_TUNNEL, policyTmpl.Mode)
557-
558-
// Confirm a policy was created for L7 traffic as well...
559-
tmpls = []netlink.XfrmPolicyTmpl{
560-
{
561-
Src: remote.IP,
562-
Dst: local.IP,
563-
Proto: netlink.XFRM_PROTO_ESP,
564-
Reqid: params.ReqID,
565-
Mode: netlink.XFRM_MODE_TUNNEL,
566-
},
567-
}
568-
policy, err = netlink.XfrmPolicyGet(&netlink.XfrmPolicy{
569-
Src: remote,
570-
Dst: local,
571-
Dir: netlink.XFRM_DIR_IN,
572-
Mark: &netlink.XfrmMark{
573-
Mask: linux_defaults.IPsecMarkBitMask,
574-
Value: linux_defaults.RouteMarkToProxy,
575-
},
576-
Tmpls: tmpls,
577-
})
578-
require.NoError(t, err)
579-
require.NotNil(t, policy)
580-
581-
// ensure XFRM policy is as we want it...
582-
if !policy.Src.IP.Equal(remote.IP) {
583-
t.Fatalf("Expected Src to be %s, but got %s", remote.IP.String(), policy.Src.IP.String())
584-
}
585-
if !policy.Dst.IP.Equal(local.IP) {
586-
t.Fatalf("Expected Dst to be %s, but got %s", local.IP.String(), policy.Dst.IP.String())
587-
}
588-
require.Equal(t, netlink.XFRM_DIR_IN, policy.Dir)
589-
require.Equal(t, uint32(linux_defaults.RouteMarkToProxy), policy.Mark.Value)
590-
require.Equal(t, uint32(linux_defaults.IPsecMarkBitMask), policy.Mark.Mask)
591-
require.Len(t, policy.Tmpls, 1)
592-
593-
// ensure the template is correct as well...
594-
policyTmpl = policy.Tmpls[0]
595-
// l7 proxy policy has a wildcard source
596543
if !policyTmpl.Src.Equal(wildcardIPv4) {
597544
t.Fatalf("Expected Src to be %s, but got %s", wildcardIPv4.String(), policyTmpl.Src.String())
598545
}

0 commit comments

Comments
 (0)