Skip to content
This repository was archived by the owner on May 30, 2023. It is now read-only.

sys-kernel: Revert change to forbid using xfrm id 0#1682

Merged
pothos merged 1 commit intomainfrom
kai/revert-ipsec-change
Mar 2, 2022
Merged

sys-kernel: Revert change to forbid using xfrm id 0#1682
pothos merged 1 commit intomainfrom
kai/revert-ipsec-change

Conversation

@pothos
Copy link
Copy Markdown
Contributor

@pothos pothos commented Mar 2, 2022

The changes broke userspace (e.g., Cilium is affected because it used
id 0 for the dummy state cilium/cilium#18789)
and we decided to revert them to give the affected software more time
to adapt (cf. https://marc.info/?t=164607426900002&r=1&w=2).

How to use

Test that, e.g.,

sudo ip link add ipsec0  type xfrm dev lo

works again.

Backport to all channels

Testing done

Ongoing

  • Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)

Copy link
Copy Markdown

@borkmann borkmann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your help, Kai! Much appreciated!

@jepio
Copy link
Copy Markdown
Contributor

jepio commented Mar 2, 2022

Reading this (https://marc.info/?l=linux-netdev&m=164614735600855&w=2) it appears like only one patch needs to be reverted, not both?

@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Mar 2, 2022

For Cilium yes, only the state change needs to be reverted but I think that in general we should not start failing something like sudo ip link add ipsec0 type xfrm dev lo if it worked before.

@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Mar 2, 2022

Ok, actually this didn't work on Flatcar before :D I'm fine dropping the patch then and only keep the first.

@pothos pothos force-pushed the kai/revert-ipsec-change branch from be2468d to e92aa06 Compare March 2, 2022 16:48
The change broke userspace (e.g., Cilium is affected because it used
id 0 for the dummy state cilium/cilium#18789)
and we decided to revert it to give the affected software more time
to adapt (cf. https://marc.info/?t=164607426900002&r=1&w=2).
@pothos pothos force-pushed the kai/revert-ipsec-change branch from e92aa06 to e585dcc Compare March 2, 2022 16:48
@pothos pothos merged commit b72ff5e into main Mar 2, 2022
@pothos pothos deleted the kai/revert-ipsec-change branch March 2, 2022 16:49
@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Mar 2, 2022

Picked for 3033, 3139, 3165

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants