-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bpf: egw: delay SNAT for local client to actual egress interface #32428
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/test |
1626523
to
258edda
Compare
258edda
to
f8d9b0c
Compare
/test |
d8a07f2
to
6ed7669
Compare
To let EGW traffic exit the gateway through the correct interface, we've introduced FIB lookup-driven redirects in the to-netdev path (cilium#26215). This is needed for cases where the traffic first hits one interface via the default route, but then needs to bounce to some other interface that matches the actual egressIP. In this approach we masquerade the packet on its first pass through to-netdev, set the SNAT_DONE mark, and then redirect to the actual egress interface. Due to the SNAT_DONE mark we then skip the SNAT logic in the second pass through to-netdev. cilium#29379 then improved the situation for any EGW traffic that enters the gateway from the overlay network (== anything that's not by a pod on the gateway). We now redirect in from-overlay, straight to the actual egress interface and masquerade the packet there. Now also harmonize the approach for local pods, and defer the masquerade until the packet hits the actual egress interface. This simplifies the overall picture. But it also allows us to raise TO_NETWORK datapath trace events that are enriched with the packet's original source IP - this event is raised on the *second* pass through to-netdev, so we need the SNAT to happen at the same time. Also add a comment to clarify the check to skip HostFW for SNATed traffic. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
6ed7669
to
4ecf539
Compare
/test |
jibi
reviewed
May 23, 2024
jibi
approved these changes
May 23, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
area/monitor
Impacts monitoring, access logging, flow logging, visibility of datapath traffic.
backport-done/1.15
The backport for Cilium 1.15.x for this PR is done.
feature/egress-gateway
Impacts the egress IP gateway feature.
kind/enhancement
This would improve or streamline existing functionality.
release-note/misc
This PR makes changes that have no direct user impact.
sig/datapath
Impacts bpf/ or low-level forwarding details, including map management and monitor messages.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To let EGW traffic exit the gateway through the correct interface,
we've introduced FIB lookup-driven redirects in the to-netdev path
(#26215). This is needed for cases
where the traffic first hits one interface via the default route, but then
needs to bounce to some other interface that matches the actual egressIP.
In this approach we masquerade the packet on its first pass through
to-netdev, set the SNAT_DONE mark, and then redirect to the actual egress
interface. Due to the SNAT_DONE mark we then skip the SNAT logic in the
second pass through to-netdev.
#29379 then improved the situation for
any EGW traffic that enters the gateway from the overlay network (==
anything that's not by a pod on the gateway). We now redirect in
from-overlay, straight to the actual egress interface and masquerade the
packet there.
Now also harmonize the approach for local pods, and defer the masquerade
until the packet hits the actual egress interface. This simplifies the
overall picture. But it also allows us to raise TO_NETWORK datapath trace
events that are enriched with the packet's original source IP - this event
is raised on the second pass through to-netdev, so we need the SNAT to
happen at the same time.
Also add a comment to clarify the check to skip HostFW for SNATed traffic.