cilium: improve 16bit ifindex probe on old kernels

[msune]

Previously, HaveFibIfindex probe checked the presence of commit d1c362e1dd68 in the Linux kernel indirectly, by verifying the presence of the redirect helpers (which were merged alongside).

Since d1c362e1dd68 has been backported to older kernels - but not helpers -, this commit improves HaveFibIfindex detection by running a live probe.

Fixes: #27642

On kernels where `d1c362e1dd68` has been backported, don't store `ifindex` in the CT map

[msune]

RFC

I don't think the unit is enough. I would think adding a check in integration/e2e that checks the flag is correctly detected would be a better approach than a unit (which I am not even sure is actually correct for backports as is). Please advise

[julianwiedmann]

/test

[lmb]

Why? On old kernels it should still work, but return an error saying that the feature is not supported, no?

[msune]

Humm.. HaveFibIfindex call will return err = ebpf.ErrNotSupported, so no, the test - as written here - shouldn't succeed for Kernels that don't have the patch.

But as I say in the comment, I see little value on this unit, as you don't have much control on which Kernel the CI is actually running. I think a much better approach would be to run it as part of the e2e or integr, where tests are run against specific kernels, making sure detection (true/false) is correct based on the specific kernel version.

[lmb]

Good question, I don't actually know how we test these. ci-runtime only runs on whatever CI has.

[lmb]

There are a couple of vet errors due to fmt.Errorf.

[lmb]

Still a CI failure unfortunately: https://github.com/cilium/cilium/actions/runs/9077690092/job/24943135667?pr=32466#step:14:35

[lmb]

You might need a

go get golang.org/x/sys/unix@latest
go mod vendor

[julianwiedmann]

I was discussing with Marc a bit on how this might affect downgrades.

Considering the scenario where a 1.16 Cilium would detect HAVE_FIB_IFINDEX on a fixed 5.4 kernel, create new CT entries (without filling the ct_entry->ifindex) ... and then we downgrade into 1.15, which doesn't detect HAVE_FIB_IFINDEX and relies on the non-existent ct_entry->ifindex value. We could solve this by having some compat code in 1.16 that continues to fill the ifindex (without using it in the datapath), to enable the downgrade. And then in 1.17 remove that compat code.

But Marc also made the fair point that we didn't consider this downgrade aspect when merging #27622. Which also produced such CT states, that were not safe for downgrade.

[lmb]

Based on my earlier work to bump the minimum kernel version we know that at least ubuntu 20.04 lts started on a 5.4 kernel. But the current version in repos is 5.10: https://packages.ubuntu.com/search?suite=focal&searchon=names&keywords=linux-image Probably this would only people that hand roll their kernels / distros and are on an old version?