那些肉眼很难看出的 bug 们
1. 从 k8s secret 里取一个数据出来，抠出数字，++，然后放回去，同时随机生成 key。
KEYID=$(kubectl get secret -n kube-system cilium-ipsec-keys -o go-template --template={{.data.keys}} | base64 -d | cut -c 1)
if [[ $KEYID -ge 15 ]]; then KEYID=0; fi
data=$(echo "{\"stringData\":{\"keys\":\"$((($KEYID+1))) "rfc4106\(gcm\(aes\)\)" $(echo $(dd if=/dev/urandom count=20 bs=1 2> /dev/null| xxd -p -c 64)) 128\"}}")
kubectl patch secret -n kube-system cilium-ipsec-keys -p="${data}" -v=1
2. 输入 global key + src/dst node ip + src/dst boot id，生成 sha 摘要。
// computeNodeIPsecKey computes per-node-pair IPsec keys from the global,
// pre-shared key. The per-node-pair keys are computed with a SHA256 hash of
// the global key, source node IP, destination node IP appended together.
func computeNodeIPsecKey(globalKey, srcNodeIP, dstNodeIP, srcBootID, dstBootID []byte) []byte {
input := append(globalKey, srcNodeIP...)
input = append(input, dstNodeIP...)
input = append(input, srcBootID...)
input = append(input, dstBootID...)
output := sha256.Sum256(input)
return output[:len(globalKey)]
}
3. 一个 macro，拼 ipv6 128 位地址
#define DEFINE_IPV6(NAME, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16) \
DEFINE_U64_I(NAME, 1) = bpf_cpu_to_be64( \
(__u64)(a1) << 56 | (__u64)(a2) << 48 | (__u64)(a3) << 40 | \
(__u64)(a4) << 32 | (a5) << 24 | (a6) << 16 | (a7) << 8 | (a8)); \
DEFINE_U64_I(NAME, 2) = bpf_cpu_to_be64( \
(__u64)(a9) << 56 | (__u64)(a10) << 48 | (__u64)(a11) << 40 | \
(__u64)(a12) << 32 | (a13) << 24 | (a14) << 16 | (a15) << 8 | (a16));
1. 从 k8s secret 里取一个数据出来，抠出数字，++，然后放回去，同时随机生成 key。
KEYID=$(kubectl get secret -n kube-system cilium-ipsec-keys -o go-template --template={{.data.keys}} | base64 -d | cut -c 1)
if [[ $KEYID -ge 15 ]]; then KEYID=0; fi
data=$(echo "{\"stringData\":{\"keys\":\"$((($KEYID+1))) "rfc4106\(gcm\(aes\)\)" $(echo $(dd if=/dev/urandom count=20 bs=1 2> /dev/null| xxd -p -c 64)) 128\"}}")
kubectl patch secret -n kube-system cilium-ipsec-keys -p="${data}" -v=1
2. 输入 global key + src/dst node ip + src/dst boot id，生成 sha 摘要。
// computeNodeIPsecKey computes per-node-pair IPsec keys from the global,
// pre-shared key. The per-node-pair keys are computed with a SHA256 hash of
// the global key, source node IP, destination node IP appended together.
func computeNodeIPsecKey(globalKey, srcNodeIP, dstNodeIP, srcBootID, dstBootID []byte) []byte {
input := append(globalKey, srcNodeIP...)
input = append(input, dstNodeIP...)
input = append(input, srcBootID...)
input = append(input, dstBootID...)
output := sha256.Sum256(input)
return output[:len(globalKey)]
}
3. 一个 macro，拼 ipv6 128 位地址
#define DEFINE_IPV6(NAME, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16) \
DEFINE_U64_I(NAME, 1) = bpf_cpu_to_be64( \
(__u64)(a1) << 56 | (__u64)(a2) << 48 | (__u64)(a3) << 40 | \
(__u64)(a4) << 32 | (a5) << 24 | (a6) << 16 | (a7) << 8 | (a8)); \
DEFINE_U64_I(NAME, 2) = bpf_cpu_to_be64( \
(__u64)(a9) << 56 | (__u64)(a10) << 48 | (__u64)(a11) << 40 | \
(__u64)(a12) << 32 | (a13) << 24 | (a14) << 16 | (a15) << 8 | (a16));