Fixes for ip-masq-agent #26435

Fix a bug introduced with the support for IPv6 ip-masq-agent. The macros for IPv6 are not at the right location, and they will be set if IPv4 masquerading is set, even if it is disabled for IPv6. Let's move the code to its right location. Fixes: 7fd9a0d ("ipmasq: Enable IPv6 support for ip-masq-agent") Signed-off-by: Quentin Monnet <quentin@isovalent.com>

When adding support for IPv6 ip-masq-agent, the related maps were not handled correctly in RemoveDisabledMaps(), resulting in maps being kept, even if option.Config.EnableIPv(4|6)Masquerade is disabled. Let's fix the conditions to sweep these maps. Fixes: c5348d2 ("ipmasq: Implement ip-masq-agent support for IPv6") Signed-off-by: Quentin Monnet <quentin@isovalent.com>

Before we introduced support for the IPv6 ip-masq-agent, only IPv4 would support it. Therefore, if the ip-masq-agent agent was enabled in the config, this meant that we had validated that IPv4 masquerading was set, and we could afford creating the related map on the combination of options (IPv4 + ip-masq-agent enabled). Now that we have IPv6 support, having IPv4 and the ip-masq-agent enabled no longer means we're using it for IPv4, given that we may chose to enable masquerading for IPv6 only. So we need to update the conditions in the datapath package, to create these maps only when necessary. Fixes: 7fd9a0d ("ipmasq: Enable IPv6 support for ip-masq-agent") Signed-off-by: Quentin Monnet <quentin@isovalent.com>

If we don't pay attention to what IP protocols should get masqueraded, and try to interact with ip-masq-agent maps without precautions, we can end up in a situation where we try to open a map that does not exist. For example, if the cluster runs with IPv4 only, and we try to add the default prefixes (IPv4 and IPv6) to the ip-masq-agent, then we try to Update() an entry in the IPv6 map for the ip-masq-agent. But this map does not exist (we run with IPv4 only and never created it). So we get a warning in the logs, preventing Cilium to be healthy: loading pinned map /sys/fs/bpf/tc/globals/cilium_ipmasq_v6: no such file or directory Fix this by restricting the operations to the IP versions for which we have masquerading enabled. Fixes: c5348d2 ("ipmasq: Implement ip-masq-agent support for IPv6") Reported-by: Sebastian Wicki <sebastian@isovalent.com> Signed-off-by: Quentin Monnet <quentin@isovalent.com>

When adding support for IPv6 ip-masq-agent in Cilium, we made sure to Dump() the contents of the maps only for the map that had been defined (IPv4 and/or IPv6 versions). This works well in the agent, but not from the CLI, which also calls Dump() for "cilium bpf ipmasq list". In that case, the variable referencing the maps have never been set, and we end up exiting from the function without dumping any contents. To fix this, we need the CLI to be able to chose what maps should be needed. The ipmasq package does not expose the maps directly, so we want to pass it the values for option.Config.EnableIPv(4|6)Masquerade instead. These configuration options are not directly available from the CLI. Instead, we check whether the IPv4 and IPv6 ip-masq-agent maps are open, and let the ipmasq package know which maps to dump accordingly. Fixes: c5348d2 ("ipmasq: Implement ip-masq-agent support for IPv6") Reported-by: Sebastian Wicki <sebastian@isovalent.com> Signed-off-by: Quentin Monnet <quentin@isovalent.com>

YAML indentation is not correct, and the example file cannot be applied in a straightforward fashion. Let's fix it. Fixes: 2dc829b ("docs: Simplify example how to config ipmasq via ConfigMap") Signed-off-by: Quentin Monnet <quentin@isovalent.com>

In order to detect issues occurring with ip-masq-agent when IPv4 only is enabled, add a new test to deploy the ip-masq-agent without IPv6. Signed-off-by: Quentin Monnet <quentin@isovalent.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes for ip-masq-agent #26435

Fixes for ip-masq-agent #26435

Commits on Jun 26, 2023