[v1.16] check-encryption-leak:features: backport 2025-04-04 #38741
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
319ef91 to
1824d91
Compare
|
/test |
julianwiedmann
approved these changes
Apr 9, 2025
[ upstream commit fe5329c ] This commit adds to the leakage report the $skb pointer, which has two main advantages: 1. for the bpftrace script itself, now subsequent print reporting the type of the packet (ex. "Detected DNS") will use the same timestamp and $skb pointer of the previous print. This makes much more easy to correlate the output. 2. when using in combination with other packet tracers such as `pwru`, while the timestamp might slightly vary, the $skb pointer will point to the same packet, simplifying the correlation between the two outputs. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit 022d5e9 ] This commit extends comments in the code to cover all functions/probes and explanations of our assumptions to execute the script. In addition, it refactors the current macros CIDR4 and CIDR6 to use the provided IPv4/6 addresses for CIDR computation. We always assume a /8, but with this improvement the script can be tested even in env where PodCIDRs are different than 10.0.0.0/8 or fd00::/8. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit 4037d59 ] This commit adds the BEGN probe to the bpftrace script to check arguments number and correctness. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit d1ffac0 ] This commit extends the set of information dispalyed upon reporting the leak of an ICMP packet. As well as for DNS (and upcoming TCP), we make use of the ICMP header to print additional information concerning the packet, in particular the Type and Code, and the status of fragmentation. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit eb377e0 ] This commit extends our leak detection script to output also whether a connection being tracked by the proxy has been source masqueraded or not. Prior to this, we just update or insert a new entry in case the proxy is already tracking that specific skb. Let's be more specific then while outputting the leak detected, to also specify whether a connection has been source masqueraded or not. The logic to detect this is as follows. The value in @trace_ip4/@trace_ip6 maps for a given flow traced by the proxy is: 1. first set to 1 in `tcp_connect/udp_sendmsg` 2. then incremented by 1 in `__dev_queue_xmit`. Therefore, when checking the leak in br_forward, we should observe the value == 2. However, when the packet is being source masqueraded, the map entry created in (1) would differ from the entry incremented in (2) due to the different IP address. In that case, the value in br_forward should be == 1. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit 19417a7 ] This commits adds additional info to the leak report, in particular: 1. the length of the IPv4/IPv6 packet 1. the status of source/destination IPs, whether they're Pods and/or special CiliumInternalIPs Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
[ upstream commit 2a3575c ] This commit splits the TCP-related output from the previous one, similarly as we do for DNS packets. This way, we have more room to report values from TCP header such as sequence and ack numbers. Trace logs are correlated via (1) timestamp and (2) skb pointer value. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
1824d91 to
d0c3ef0
Compare
|
Just rebased to see if CI's now happy (hit 🔴 on |
brlbil
approved these changes
Apr 9, 2025
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Manual backport of:
Doing to soften the pain for future fixes/changes to the script.
Once this PR is merged, a GitHub action will update the labels of these PRs: