Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: lb: deal with stale rev_nat_index after svc lookup in fallback path #24757

Merged
merged 3 commits into from
May 11, 2023
Merged

bpf: lb: deal with stale rev_nat_index after svc lookup in fallback path #24757

merged 3 commits into from
May 11, 2023

Commits on May 10, 2023

  1. bpf: lb: clean up state->rev_nat_index assignments in lb*_local() 

    The caller expects us to reflect back a valid state->rev_nat_index
(that matches svc->rev_nat_index).

- On CT_NEW we already assign this, as part of creating the CT entry.
- On CT_REPLY the obtained state->rev_nat_index will already contain some
  value, and we subsequently check whether it still matches the selected
  svc entry (and update accordingly).

So the additional assignment at the `update_state` label is not required.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
    @julianwiedmann
    julianwiedmann committed May 10, 2023
    Configuration menu
    Copy the full SHA
    60e9169 View commit details
    Browse the repository at this point in the history

  2. bpf: lb: update revNAT index after SVC change 

    lb*_local() has a fallback path for when the previously selected backend
for a svc connection is no longer available. In this case we perform a
fresh svc lookup, and select a new backend.

As this can potentially return a different svc entry, make sure to also
update the rev_nat_index in the CT_SERVICE entry. Otherwise the backend
lookup for the *next* packet will detect a mismatch between svc and
CT entry, and trigger a fresh backend selection.

Also reflect the new rev_nat_index back to the caller in the ct_state
struct.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
    @julianwiedmann
    julianwiedmann committed May 10, 2023
    Configuration menu
    Copy the full SHA
    00cc102 View commit details
    Browse the repository at this point in the history

  3. bpf: nodeport: fix rev_nat_index check for stale NAT CT entries 

    For non-DSR connections, the nodeport code creates a special CT_EGRESS
entry to maintain its own state (and eg. trigger RevDNAT from it).

This CT entry also tracks the service's rev_nat_index. On a successful
CT lookup, we detect a stale entry by comparing its rev_nat_index to
the currently matched svc's rev_nat_index.

But there's a special case in lb*_lookup() where the backend lookup fails,
and we fall back to a fresh svc lookup. The new svc entry isn't reflected
back to the callers, and consequently they would use the wrong
svc->rev_nat_index to check for staleness of their CT entry.

The actual rev_nat_index *is* reflected back to the caller via the
passed-in ct_state_new struct. So use that for the staleness check instead.

Note that this matches how bpf_lxc determines the current rev_nat_index
in lb*_ctx_store_state().

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
    @julianwiedmann
    julianwiedmann committed May 10, 2023
    Configuration menu
    Copy the full SHA
    a311993 View commit details
    Browse the repository at this point in the history