bpf: nodeport: add RevDNAT-based FIB lookup for reply traffic #26638
+673
−26
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
|
/test |
julianwiedmann
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
8e4d6b6 to
67f1862
Compare
|
/test |
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
67f1862 to
67659fc
Compare
|
/test |
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
67659fc to
5a74b80
Compare
|
/test |
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
5a74b80 to
44d365e
Compare
|
/test |
julianwiedmann
changed the title
julianwiedmann
added
kind/bug
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
44d365e to
383e5ab
Compare
|
/test |
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
383e5ab to
7c21344
Compare
|
/test |
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
7c21344 to
89f6c71
Compare
|
/test |
gentoo-root
approved these changes
Jul 31, 2023
maintainer-s-little-helper
bot
added
the
ready-to-merge
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
89f6c71 to
2996fb3
Compare
|
/test |
When replies by local / DSR backends enter to-netdev, they have been routed
to the interface using the backend IP as source IP. But depending on what
routing rules are installed on the system, the routing for the RevDNATed
packet is different.
Improve the RevDNAT code in to-netdev to first perform a FIB lookup (based
on the src IP from the RevDNAT info), and if needed redirect the packet to
the correct egress interface.
This requires that bpf_host is also attached to the chosen egress iface,
so that the actual RevDNAT rewrite gets performed there.
Also update some of the tests to cover this scenario.
[Note: ideally we would have this check much earlier in to-netdev, before
even going through the HostFW code. But that requires shrinking the
program size first, so postponing that to a follow-on PR]
Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
force-pushed
the
1.14-nodeport-revdnat-fib-v3
branch
from
2996fb3 to
a708962
Compare
|
/test |
|
Before merging this PR, it would be good to get Anyway, the suggested testing plan for
|
|
Rebased to resolve trivial |
gentoo-root
reviewed
Aug 1, 2023
| send_trace_notify(ctx, obs_point, 0, 0, 0, 0, trace.reason, | ||
| trace.monitor); | ||
| if (ret == CTX_ACT_OK) | ||
| send_trace_notify(ctx, obs_point, 0, 0, 0, 0, trace.reason, |
There was a problem hiding this comment.
For my education... do we only trace the forwarded packets at the destination interface?
There was a problem hiding this comment.
I'm not sure if we have a strict precedent for it at the moment.
I could be convinced that throwing notifications for the intermediate interfaces has value. But then we should also apply proper CT-driven aggregration, and include the corresponding ifindex?
julianwiedmann
added
the
backport/author
2 tasks
julianwiedmann
added
backport-pending/1.14
2 tasks
michi-covalent
added
backport-done/1.14
julianwiedmann
added
affects/v1.13
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When moving the RevDNAT for backend replies from
bpf_lxcintobpf_host, we lost the routing based on the post-RevDNAT layout of the packet. Depending on the installed routing rules, we then end up sending the (RevDNATed) packet from the wrong egress interface.So as part of the RevDNAT processing in
to-netdev, do a FIB lookup that considers the desired source IP. And redirect the packet if it's currently on the wrong interface. We intentionally delay the actual RevDNAT rewrite until the packet has reached the correct interface, so that the packet looks as expected to components into-netdev(in particular HostFW).Long-term we would want
FIB_DONEmark on the packet (similar toSNAT_DONE), to skip additional lookups.from-container(for BPF Host Routing) to already consider service RevDNAT.The initial idea was to have this check at the very top of the to-netdev program (see #26635). But we're hitting program size limits in 4.19 there, and improving that is too much of a refactor for a fix PR.
Fixes: #26166