Add coverage for the firewall rules which mark VXLAN datagrams for
encryption. Each test joins a fresh network namespace and programs the
rules into the kernel, so the rulesets are asserted as the kernel renders
them rather than as the driver constructs them.
Two orderings are load-bearing for the correctness of the rules, and
neither was pinned by anything but a comment:
- In iptables mode the rule which strips the encryption mark from
socket-associated datagrams has to be evaluated after every rule which
sets that mark, so that it neutralizes the unrestricted rules left
behind by daemons predating the mark-spoofing fix. Reverting
programMangleMarkSpoofProtection() to insert its rule at the head of
the chain rather than appending it fails
TestMangleMarkSpoofProtectionOrdering.
- In nftables mode the socket-exists predicate and the statement which
clears the mark have to precede the mark-setting statement in the
enc-out chain. The rendered ruleset is asserted against golden files.
The remaining cases cover replacing a legacy rule with the restricted
one, the install and removal lifecycle for two VNIs, and the selection of
ip6tables when the Swarm data plane is IPv6.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Assisted-By: Claude Opus 5
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit fda66a3bc0)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Cory Snider
8af9fe3a36