Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: nat: let caller determine whether SNATed connection needs CT #27079

Merged
merged 1 commit into from
Jul 27, 2023
Merged

bpf: nat: let caller determine whether SNATed connection needs CT #27079

merged 1 commit into from
Jul 27, 2023

Conversation

julianwiedmann
Copy link
Member

Right now this is decided at the lowest level of the SNAT path. But actually the callers know much better. In particular this avoids one case where we bake EgressGW knowledge deep into the SNAT code.

@julianwiedmann julianwiedmann added sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. release-note/misc This PR makes changes that have no direct user impact. labels Jul 26, 2023
@julianwiedmann
bpf: nat: let caller determine whether SNATed connection needs CT
97c746d 
Right now this is decided at the lowest level of the SNAT path. But
actually the callers know much better. In particular this avoids one case
where we bake EgressGW knowledge deep into the SNAT code.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@julianwiedmann
Copy link
Member Author

/test

@julianwiedmann
Copy link
Member Author

Ah sweet, this also nicely reduces the instruction count for the tail_nodeport_nat_egress_ipv*() paths. That traffic never needs CT, and now the compiler understands that it can eliminate all the CT-related code when it pulls in __snat_v*_nat().

@julianwiedmann julianwiedmann added the kind/complexity-issue Relates to BPF complexity or program size issues label Jul 26, 2023
@julianwiedmann julianwiedmann marked this pull request as ready for review July 26, 2023 10:04
@julianwiedmann julianwiedmann requested a review from a team as a code owner July 26, 2023 10:04
@julianwiedmann
Copy link
Member Author

@gentoo-root FYI

dylandreimerink
dylandreimerink approved these changes Jul 26, 2023
View reviewed changes
Copy link
Member

@dylandreimerink dylandreimerink left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 26, 2023
@julianwiedmann julianwiedmann merged commit 93c8884 into cilium:main Jul 27, 2023
58 checks passed
@julianwiedmann julianwiedmann deleted the 1.15-bpf-nat-needs-ct branch July 27, 2023 11:38
@julianwiedmann julianwiedmann mentioned this pull request Aug 18, 2023
Merged
3 tasks
@julianwiedmann julianwiedmann added backport-pending/1.14 The backport for Cilium 1.14.x for this PR is in progress. backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. and removed backport-pending/1.14 The backport for Cilium 1.14.x for this PR is in progress. labels Aug 18, 2023
@michi-covalent michi-covalent mentioned this pull request Sep 9, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dylandreimerink dylandreimerink dylandreimerink approved these changes

Assignees
No one assigned
Labels
backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. kind/complexity-issue Relates to BPF complexity or program size issues ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact. sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@julianwiedmann @dylandreimerink