Add coverage for the firewall rules which mark VXLAN datagrams for
encryption. Each test joins a fresh network namespace and programs the
rules into the kernel, so the rulesets are asserted as the kernel renders
them rather than as the driver constructs them.
The ordering is load-bearing for the correctness of the rules, and was
not pinned by anything but a comment:
- The rule which strips the encryption mark from socket-associated
datagrams has to be evaluated after every rule which sets that mark,
so that it neutralizes the unrestricted rules left behind by daemons
predating the mark-spoofing fix. Reverting
programMangleMarkSpoofProtection() to insert its rule at the head of
the chain rather than appending it fails
TestMangleMarkSpoofProtectionOrdering.
The remaining cases cover replacing a legacy rule with the restricted
one, the install and removal lifecycle for two VNIs, and the selection of
ip6tables when the Swarm data plane is IPv6.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Assisted-by: Claude Opus 5
(cherry picked from commit dcfd4926dde7ed878cfe6090a429c10d14ee0aeb)
Signed-off-by: Cory Snider <csnider@mirantis.com>
Cory Snider
a18fc28acb