bpf: lb: deal with stale rev_nat_index after svc lookup in fallback path #24757
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
julianwiedmann
added
kind/bug
|
/test |
|
Note that https://github.com/julianwiedmann/cilium/blob/03ee82df8229363e0b2966afefcdf2e7984320f9/bpf/lib/lb.h#L1635 is also missing a |
julianwiedmann
force-pushed
the
1.14-nodeport-rev_nat-index
branch
from
03ee82d
to
6d47eef
Compare
|
/test |
|
/test-1.26-net-next |
julianwiedmann
changed the title
gentoo-root
reviewed
May 10, 2023
The caller expects us to reflect back a valid state->rev_nat_index (that matches svc->rev_nat_index). - On CT_NEW we already assign this, as part of creating the CT entry. - On CT_REPLY the obtained state->rev_nat_index will already contain some value, and we subsequently check whether it still matches the selected svc entry (and update accordingly). So the additional assignment at the `update_state` label is not required. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
lb*_local() has a fallback path for when the previously selected backend for a svc connection is no longer available. In this case we perform a fresh svc lookup, and select a new backend. As this can potentially return a different svc entry, make sure to also update the rev_nat_index in the CT_SERVICE entry. Otherwise the backend lookup for the *next* packet will detect a mismatch between svc and CT entry, and trigger a fresh backend selection. Also reflect the new rev_nat_index back to the caller in the ct_state struct. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
For non-DSR connections, the nodeport code creates a special CT_EGRESS entry to maintain its own state (and eg. trigger RevDNAT from it). This CT entry also tracks the service's rev_nat_index. On a successful CT lookup, we detect a stale entry by comparing its rev_nat_index to the currently matched svc's rev_nat_index. But there's a special case in lb*_lookup() where the backend lookup fails, and we fall back to a fresh svc lookup. The new svc entry isn't reflected back to the callers, and consequently they would use the wrong svc->rev_nat_index to check for staleness of their CT entry. The actual rev_nat_index *is* reflected back to the caller via the passed-in ct_state_new struct. So use that for the staleness check instead. Note that this matches how bpf_lxc determines the current rev_nat_index in lb*_ctx_store_state(). Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
force-pushed
the
1.14-nodeport-rev_nat-index
branch
from
6d47eef
to
a311993
Compare
gentoo-root
approved these changes
May 10, 2023
|
/test |
maintainer-s-little-helper
bot
added
the
ready-to-merge
This was referenced May 11, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix two corner-case bugs in the fallback path for
lb_local(), when a previously selected backend is unavailable. In this case we perform a fresh svc lookup, and thus need to handle that the new svc entry is associated with a differentrev_nat_index.