Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

datapath: pass IPv6 NDP traffic to stack without policy check #24919

Merged
merged 1 commit into from
Jun 20, 2023
Merged

datapath: pass IPv6 NDP traffic to stack without policy check #24919

merged 1 commit into from
Jun 20, 2023

Commits on Jun 20, 2023

  1. bpf: skip policy check for IPv6 NDP traffic 

    Previously, our policy check for IPv6 NDP traffic caused issues such
as cilium#23852 and cilium#23910 because this traffic was identified as WORLD_ID,
which would be given a verdict of drop when CiliumNetworkPolicy is
applied for per-endpoint routing.

To resolve this issue, we pass all IPv6 NDP traffic to the stack without
policy check.

This change aligns with how we handle IPv4 ARP: the cilium bpf never
performs policy check for ARP, regardless of whether we enable
`ENABLE_ARP_PASSTHROUGH` or `ENABLE_ARP_RESPONDER`.

Fixes: cilium#23852
Fixes: cilium#23910

Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
    @jschwinger233
    jschwinger233 committed Jun 20, 2023
    Configuration menu
    Copy the full SHA
    4f45052 View commit details
    Browse the repository at this point in the history