mesh: set src for encapsulated tunl routes

[kvaps]

This PR contains only one commit (cherry-picked from 150671c) to set source address on encapsulated tunl routes and update tests accordingly.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch draft/mesh-route-src-only

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello @kvaps, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the routing logic within the mesh network by ensuring that encapsulated tunnel routes are configured with the correct source IP address. This change is crucial for maintaining proper network communication and preventing potential routing issues, especially in complex network topologies. The update includes modifications to the route creation process and the encapsulation helper, along with corresponding adjustments to the test suite.

Highlights

• Encapsulated Tunnel Routes: Explicitly set the source IP address for encapsulated tunnel routes to ensure correct routing behavior within the mesh network.
• Route Encapsulation Logic: Modified the encapsulateRoute helper function to safely handle nil subnets and to assign the source IP from the subnet if it's not already defined for encapsulated routes.
• Unit Test Updates: Updated existing unit tests to reflect the new behavior of setting the source IP for encapsulated routes, ensuring test coverage for the change.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• pkg/mesh/routes.go
  • Added Src field to netlink.Route objects for encapsulated tunnel routes, setting it to the private IP of the topology.
  • Updated encapsulateRoute function to include a subnet != nil check before accessing subnet.Contains(route.Gw) to prevent nil pointer dereferences.
  • Implemented logic in encapsulateRoute to set route.Src to subnet.IP if subnet is not nil and route.Src is not already set.
• pkg/mesh/routes_test.go
  • Modified various test cases within TestRoutes to include the Src field in the expected netlink.Route objects for encapsulated routes, aligning tests with the updated routing logic.

Activity

• No human activity (comments, reviews) has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request aims to set the source address on encapsulated tunnel routes, which is a crucial fix for correct routing behavior. The changes involve modifying the Routes function to explicitly set the source IP for certain encapsulated routes and updating the encapsulateRoute helper function to do the same for other routes. The corresponding tests are also updated to reflect these changes.

The overall approach is correct. I've identified one potential issue in encapsulateRoute where a route could be marked for encapsulation via tunlIface even when a source IP is not available (subnet is nil), which could lead to incorrect routing. I've suggested a change to prevent this by making encapsulation conditional on the availability of a source IP. The rest of the changes look good.

[gemini-code-assist]

The current logic for encapsulation when encapsulate == encapsulation.Always and subnet == nil could lead to issues. In this scenario, the route's LinkIndex is updated to tunlIface to enable encapsulation, but the source IP (Src) is not set. This might cause the kernel to select an incorrect source IP for the encapsulated packets.

To prevent this, we should avoid encapsulation altogether if a source IP (subnet) is not available.

I suggest modifying the condition to ensure subnet is not nil before attempting any encapsulation logic. This makes the function more robust and avoids creating potentially misconfigured routes.

Suggested change

	if encapsulate == encapsulation.Always || (encapsulate == encapsulation.CrossSubnet && subnet != nil && !subnet.Contains(route.Gw)) {
	route.LinkIndex = tunlIface
	if subnet != nil && route.Src == nil {
	route.Src = subnet.IP
	}
	}
	if subnet != nil && (encapsulate == encapsulation.Always || (encapsulate == encapsulation.CrossSubnet && !subnet.Contains(route.Gw))) {
	route.LinkIndex = tunlIface
	if route.Src == nil {
	route.Src = subnet.IP
	}
	}

[kvaps]

Squashed into PR #4