Srv6 encap relocation #28817
Merged
Srv6 encap relocation #28817
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit moves the srv6 h.encap functionality to bpf_lxc.c
In this change we determine if the egress traffic belongs to a VRF early
in the pod egress data path.
The lookup and subsequent h.encap is then performed in
"handle_ipv{4,6}_from_lxc" functions, after policy lookup occurs.
As of today, we do not support l7 policy, thus we do not even try to
redirect to proxy for VRF traffic, this may change in the future.
This commit makes the bpf_host.c handling of h.encap redundant and a
follow up commit will remove this.
Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
This commit removes the redundant h.encap logic from bpf_host.c. Since h.encap no longer occurs at bpf_host.c we also eliminate the "srv6_refib" function found in "egress_policies.h", alleviating the need for redundant FIB lookups for egress VRF traffic. Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
ldelossa
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
|
/test |
|
' Cilium IPsec upgrade (ci-ipsec-upgrade) ' failure is unrelated to this change. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change moves SRv6 h.encap to bpf_lxc rather then bpf_host.
This ensures that the packet is encapsulated before it enters the host networking stack.
Ensuring the encapsulated packet hits the network stack resolves issues with IPv4Masq compatibility.
Additionally, this change now ensures the source address of the encapsulated packet is consistent, see commit messages for more details.
This changes has the added benefit of removing a double FIB lookup on an SRv6 encapsulated egress packet.