• 24.0 backport of libnetwork/d/overlay: support encryption on any port #45636
• Fixes Encrypted overlay networks don't work on ports other than 4789 #45635

- What I did
While the VXLAN interface and the iptables rules to mark outgoing VXLAN packets for encryption are configured to use the Swarm data path port, the XFRM policies for actually applying the encryption are hardcoded to match packets with destination port 4789/udp. Consequently, encrypted overlay networks do not pass traffic when the Swarm is configured with any other data path port: encryption is not applied to the outgoing VXLAN packets and the destination host drops the received cleartext packets. Use the configured data path port instead of hardcoding port 4789 in the XFRM policies.

We are not considering this to be a security issue as affected overlay networks are functionally non-operational. The only traffic which would be visible on the host network in cleartext would be simplex transmissions (ICMP echo requests, DNS queries, TCP SYN, etc.) shouting into the void, which the addressed recipient would never receive and thus never reply to.

- How I did it
Trivially.

- How to verify it
Initialize a swarm with a --data-path-port other than 4789. Create an encrypted overlay network, run containers on different nodes attached to the network, and verify that the containers can communicate with each other.

Run tcpdump on one of the nodes with the filter udp port $DATA_PATH_PORT or esp and verify that only IPSec ESP traffic is observed when the aforementioned containers are communicating, and not any cleartext UDP traffic.

- Description for the changelog

• Fix an issue which prevented encrypted overlay networks from functioning when the Swarm data path port is not set to 4789.

- A picture of a cute animal (not mandatory but encouraged)