ipsec: Simplify XFRM FWD policies #21602
Merged
+29
−29
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pchaigno
added
area/encryption
pchaigno
added
the
ready-to-merge
We want the FWD XFRM policy to allow all traffic through so we can simply set its source CIDR to 0.0.0.0/0. Similarly, the source IP used in the template doesn't matter so we can set it to 0.0.0.0 to clarify that to the kernel. Signed-off-by: Paul Chaignon <[email protected]>
We currently install two FWD XFRM policies: one as part of UpsertIPsecEndpoint when called for the In direction and another one as part of enableIPsec, even though that function already calls UpsertIPsecEndpoint. Only one FWD XFRM policy is needed to match all forward traffic. This commit removes one of the policies. Signed-off-by: Paul Chaignon <[email protected]>
The `fwd` argument of the UpsertIPsecEndpoitn function is used as the matching CIDR for the destination in the FWD XFRM policy. That CIDR should always be equal to the local CIDR and we already have that as the first argument of UpsertIPsecEndpoint. Therefore, we don't need the third, `fwd`, argument. This commit removes it. Signed-off-by: Paul Chaignon <[email protected]>
pchaigno
force-pushed
the
ipsec-simplify-xfrm-fwd-policies
branch
from
96d788e to
2650e0a
Compare
pchaigno
removed
the
ready-to-merge
|
/test |
|
All required tests are passed, mark ready to merge. |
sayboras
added
the
ready-to-merge
This was referenced Oct 10, 2022
maintainer-s-little-helper
bot
removed
the
ready-to-merge
sayboras
added
backport-pending/1.12
backport-done/1.11
This was referenced Oct 11, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request implements various simplifications of our XFRM FWD policies and the code that installs them. See commits for details.