Skip to content

Commit b1d70aa

Browse files
gentoo-rootpchaigno
gentoo-root
authored and
pchaigno
committed
cilium-cli: Reenable L7 IPv6 tests
Our CI already runs the kernels with the fix applied: https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/ We can reenable PodToWorld and PodToWorld2 tests that were disabled due to the bug with L7 policies. Note that they are still conditionally disabled if the fake external target is not supported. We still, however, disable those tests on RHEL kernels, as they lack the backport of the fix mentioned above. Fixes: 09b3cd8 ("cilium-cli: Disable IPv6 in PodToWorld and PodToWorld2 tests") Fixes: cilium#38396 Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
1 parent 664308c commit b1d70aa

4 files changed

Lines changed: 21 additions & 30 deletions

File tree

‎cilium-cli/connectivity/builder/client_egress_l7.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,12 @@ func clientEgressL7Test(ct *check.ConnectivityTest, templates map[string]string,
2828
// Test L7 HTTP introspection using an egress policy on the clients.
2929
newTest(testName, ct).
3030
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
31+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
3132
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
3233
WithCiliumPolicy(templates[templateName]). // L7 allow policy with HTTP introspection
3334
WithScenarios(
3435
tests.PodToPod(),
35-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
36-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
37-
tests.PodToWorld(false, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
36+
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
3837
).
3938
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
4039
if a.Source().HasLabel("other", "client") && // Only client2 is allowed to make HTTP calls.

‎cilium-cli/connectivity/builder/client_egress_l7_named_port.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,12 @@ func (t clientEgressL7NamedPort) build(ct *check.ConnectivityTest, templates map
1515
// Test L7 HTTP named port introspection using an egress policy on the clients.
1616
newTest("client-egress-l7-named-port", ct).
1717
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
18+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
1819
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
1920
WithCiliumPolicy(templates["clientEgressL7HTTPNamedPortPolicyYAML"]). // L7 allow policy with HTTP introspection (named port)
2021
WithScenarios(
2122
tests.PodToPod(),
22-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
23-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
24-
tests.PodToWorld(false, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
23+
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),
2524
).
2625
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
2726
if a.Source().HasLabel("other", "client") && // Only client2 is allowed to make HTTP calls.

‎cilium-cli/connectivity/builder/client_egress_tls_sni.go‎

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
2626
newTest(testName, ct).
2727
WithCiliumVersion("!1.14.15 !1.14.16 !1.15.9 !1.15.10 !1.16.2 !1.16.3").
2828
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
29+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
2930
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
3031
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
31-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
32-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
33-
WithScenarios(tests.PodToWorld(false)).
32+
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
3433
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
3534
if a.Destination().Port() == 443 {
3635
return check.ResultOK, check.ResultNone
@@ -42,11 +41,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
4241
newTest(fmt.Sprintf("%s-denied", testName), ct).
4342
WithCiliumVersion("!1.14.15 !1.14.16 !1.15.9 !1.15.10 !1.16.2 !1.16.3").
4443
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
45-
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
46-
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
47-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
48-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
49-
WithScenarios(tests.PodToWorld(false)). // External Target is not allowed
44+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
45+
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
46+
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
47+
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)). // External Target is not allowed
5048
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
5149
if a.Destination().Port() == 443 {
5250
// SSL error as another external target (e.g. cilium.io) SNI is not allowed
@@ -59,11 +57,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
5957
newTest(fmt.Sprintf("%s-wildcard", testName), ct).
6058
WithCiliumVersion(">=1.18.0").
6159
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
60+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
6261
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
6362
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
64-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
65-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
66-
WithScenarios(tests.PodToWorld(false)).
63+
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
6764
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
6865
if a.Destination().Port() == 443 {
6966
return check.ResultOK, check.ResultNone
@@ -75,11 +72,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
7572
newTest(fmt.Sprintf("%s-wildcard-denied", testName), ct).
7673
WithCiliumVersion(">=1.18.0").
7774
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
75+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
7876
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
7977
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
80-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
81-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
82-
WithScenarios(tests.PodToWorld2(false)).
78+
WithScenarios(tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable)).
8379
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
8480
if a.Destination().Port() == 443 {
8581
// SSL error as another external target (e.g. cilium.io) SNI is not allowed
@@ -95,11 +91,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
9591
newTest(fmt.Sprintf("%s-double-wildcard", testName), ct).
9692
WithCiliumVersion(">=1.18.0").
9793
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
94+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
9895
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
9996
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
100-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
101-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
102-
WithScenarios(tests.PodToWorld(false)).
97+
WithScenarios(tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable)).
10398
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
10499
if a.Destination().Port() == 443 {
105100
return check.ResultOK, check.ResultNone
@@ -111,11 +106,10 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
111106
newTest(fmt.Sprintf("%s-double-wildcard-denied", testName), ct).
112107
WithCiliumVersion(">=1.18.0").
113108
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
109+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
114110
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
115111
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
116-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
117-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
118-
WithScenarios(tests.PodToWorld2(false)).
112+
WithScenarios(tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable)).
119113
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
120114
if a.Destination().Port() == 443 {
121115
// SSL error as another external target (e.g. cilium.io) SNI is not allowed

‎cilium-cli/connectivity/builder/to_fqdns.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,10 @@ func (t toFqdnsWithProxy) build(ct *check.ConnectivityTest, templates map[string
6262
WithCiliumPolicy(templates["clientEgressToFQDNsAndHTTPGetPolicyYAML"]).
6363
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]).
6464
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
65+
WithFeatureRequirements(features.RequireDisabled(features.RHEL)).
6566
WithScenarios(
66-
// TODO: Reenable IPv6 for this test once the kernel with the bugfix is released:
67-
// https://patchwork.kernel.org/project/netdevbpf/patch/20250318161516.3791383-1-maxim@isovalent.com/
68-
tests.PodToWorld(false, tests.WithRetryDestPort(80)),
69-
tests.PodToWorld2(false), // resolves to ExternalOtherTarget
67+
tests.PodToWorld(ct.Params().ExternalTargetIPv6Capable, tests.WithRetryDestPort(80)),
68+
tests.PodToWorld2(ct.Params().ExternalTargetIPv6Capable), // resolves to ExternalOtherTarget
7069
).
7170
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
7271
if a.Destination().Address(features.IPFamilyAny) == ct.Params().ExternalOtherTarget {

0 commit comments

Comments
 (0)