bpf: SRv6 fib on encap

[ldelossa]

This is the first PR in a set of two.

In this PR we introduce new functions in lib/fib.h to fix the issue described below

A follow up PR will be opened once this is merged which carries the non-backported refactor of fib/lib.h, removing the duplicate code introduced in this PR.

see #26048 (comment) for an explanation of why this occurs in two PRs.

Original SRv6 encapsulation flow:

 flowchart LR
p["pod"] 
v1["veth1"]
v2["veth2"]
hs["host stack"]
e["eth0"]
tx["tx"]

p-->|egress pkt|v1-->v2-->hs-->|fib lookup|e-->|SRv6 encap|tx

This results in the egress packet always choosing the output interface, source, and destination mac from the FIB lookup that occurred on the inner packet.

SRv6 encapsulation flow corrected:

 flowchart LR
p["pod"] 
v1["veth1"]
v2["veth2"]
hs["host stack"]
e["eth0"]
tx["tx"]

p-->|egress pkt|v1-->v2-->hs-->|fib lookup|e-->|SRv6 encap\n+\nfib lookup|tx

Now, we perform an additional fib lookup once the egress packet has been encapsulated, ensuring the encapsulated packet is forwarded correctly based on the host namespace's FIB.

Performing these actions independently is currently necessary for this SRv6 datapath fix.
This is because we perform the fib_lookup already at a egress interface and we may or may not need to redirect to a new interface for tx.

It is obvious to see that two fib lookups are occurring here.
It does seem to me that this can be reduced to one, however this involves changing where encapsulation occurs and will be a larger refactor, however I will also look into this.

Fixes an issue where SRv6 encapsulated packets are forwarded to the wrong layer 2 next hop.

[ldelossa]

/test

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sUpdates Tests upgrade and downgrade from a Cilium stable image to master

Failure Output

FAIL: Unexpected missed tail call

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/721/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

[ldelossa]

/test-1.26-net-next

[nickolaev]

Is it worth considering a unit test?

[julianwiedmann]

Please apply one small change to the error reporting (and maybe pick up the cosmetic change while at it 😁). Otherwise all good, thanks!

[ldelossa]

@julianwiedmann handled your feedback.

@nickolaev working on a test now, feel free to block until this test commit is present.

[julianwiedmann]

lgtm, thank you!

Two small clarifying questions, but no blocker unless you realize that something is amiss :)

[ldelossa]

@jibi latest push moves the fib_lookup functions to take src/dst addresses instead of the full header

[ldelossa]

@nickolaev added tests: 4bce021

[ldelossa]

/test

[julianwiedmann]

I believe there's no plan to backport this into v1.13 anymore.