Skip to content

Commit

Permalink
bpf: Remove IP_POOLS IPsec code
Browse files Browse the repository at this point in the history 
Remove all code pertaining to IP_POOLS in the datapath, including the
CB_ENCRYPT_DST skb->cb slot and the code to rewritte the outer IP
header.

As a result of this commit, IPsec will be broken on AKS, EKS, and
anywhere using IP_POOLS (that is, whenever we don't have a single pod
allocation CIDR per node). A subsequent commit in this series will fix
that. I couldn't find a way to keep a clean commit history without
breaking this temporarily.
Compilation still works so most git bisect use cases should still work.

Signed-off-by: Paul Chaignon <paul@cilium.io>
  • Loading branch information
@pchaigno @sayboras
pchaigno authored and sayboras committed Feb 28, 2023
1 parent 19a62da commit 4c7cce1
Show file tree
Hide file tree
Showing 7 changed files with 39 additions and 135 deletions.
60 changes: 30 additions & 30 deletions bpf/Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ testdata:
BUILD_PERMUTATIONS ?= ""

BPF_SIMPLE_OPTIONS += \
-DENABLE_IPV4=1 -DENABLE_IPV6=1 -DENABLE_IPSEC=1 -DIP_POOLS=1 \
-DENABLE_IPV4=1 -DENABLE_IPV6=1 -DENABLE_IPSEC=1 \
-DHAVE_LPM_TRIE_MAP_TYPE -DHAVE_LRU_HASH_MAP_TYPE

$(BPF_SIMPLE_LL): $(BPF_SIMPLE_C)
Expand All @@ -54,28 +54,28 @@ LB_OPTIONS = \
-DENABLE_IPV4: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPV4_FRAGMENTS: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC: \
-DENABLE_IPV6: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_ENCAP_HOST_REMAP: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_ENCAP_HOST_REMAP: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_NODEPORT: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB:-DENABLE_EGRESS_GATEWAY:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_SRC_RANGE_CHECK: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV:-DENABLE_SOCKET_LB_HOST_ONLY: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV:-DENABLE_SOCKET_LB_HOST_ONLY:-DENABLE_L7_LB:-DENABLE_SCTP:
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB:-DENABLE_EGRESS_GATEWAY:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_L7_LB: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_SRC_RANGE_CHECK: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV:-DENABLE_SOCKET_LB_HOST_ONLY: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_NODEPORT_ACCELERATION:-DENABLE_SESSION_AFFINITY:-DENABLE_BANDWIDTH_MANAGER:-DENABLE_SRC_RANGE_CHECK:-DLB_SELECTION:-DLB_SELECTION_MAGLEV:-DENABLE_SOCKET_LB_HOST_ONLY:-DENABLE_L7_LB:-DENABLE_SCTP:

# These options are intended to max out the BPF program complexity. it is load
# tested as well.
Expand Down Expand Up @@ -151,12 +151,12 @@ HOST_OPTIONS = $(LXC_OPTIONS) \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_HOST_FIREWALL: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_HOST_FIREWALL: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DHAVE_FIB_LOOKUP:-DIP_POOLS:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DHAVE_FIB_LOOKUP:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NODEPORT:-DENABLE_MASQUERADE:-DENABLE_EGRESS_GATEWAY: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DHAVE_FIB_LOOKUP:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DHAVE_FIB_LOOKUP:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NODEPORT:-DENABLE_DSR: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NODEPORT:-DENABLE_DSR:-DENABLE_DSR_HYBRID: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NODEPORT:-DENABLE_DSR:-DENABLE_DSR_HYBRID:-DENABLE_HOST_FIREWALL: \
Expand Down Expand Up @@ -195,9 +195,9 @@ bpf_host.o: bpf_host.ll

XDP_OPTIONS = $(LB_OPTIONS) \
-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_DSR:-DFROM_HOST: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_DSR:-DFROM_HOST: \
-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_IPSEC:-DENABLE_DSR:-DFROM_HOST: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_IPSEC:-DENABLE_NODEPORT:-DENABLE_MASQUERADE: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_NODEPORT:-DENABLE_DSR: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_NODEPORT:-DENABLE_DSR:-DENABLE_DSR_HYBRID: \
-DENABLE_NODEPORT_ACCELERATION:-DENABLE_IPV4:-DENABLE_IPV6:-DENABLE_NODEPORT:-DENABLE_DSR:-DDSR_ENCAP_MODE:-DDSR_ENCAP_NONE:-DDSR_ENCAP_IPIP=2 \
Expand Down Expand Up @@ -233,21 +233,21 @@ LXC_OPTIONS = \
-DHAVE_LRU_HASH_MAP_TYPE: \
-DENABLE_IPV4: \
-DENABLE_IPV6: \
-DENABLE_IPV4:-DENABLE_IPV6:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV4:-DENABLE_IPV6:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DHAVE_LPM_TRIE_MAP_TYPE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DHAVE_LPM_TRIE_MAP_TYPE:-DENABLE_EGRESS_GATEWAY: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DHAVE_LPM_TRIE_MAP_TYPE:-DHAVE_LRU_HASH_MAP_TYPE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4_FRAGMENTS: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC:-DIP_POOLS: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPSEC: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DHAVE_LPM_TRIE_MAP_TYPE: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DHAVE_LPM_TRIE_MAP_TYPE:-DHAVE_LRU_HASH_MAP_TYPE: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4:-DENABLE_ROUTING: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_ENCAP_HOST_REMAP: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4:-DENABLE_IPSEC:-DIP_POOLS:-DENABLE_ENCAP_HOST_REMAP:-DENABLE_L7_LB: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4:-DENABLE_IPSEC:-DENABLE_ENCAP_HOST_REMAP: \
-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV4:-DENABLE_IPSEC:-DENABLE_ENCAP_HOST_REMAP:-DENABLE_L7_LB: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV6:-DHAVE_LPM_TRIE_MAP_TYPE:-DHAVE_LRU_HASH_MAP_TYPE: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV6:-DHAVE_LPM_TRIE_MAP_TYPE:-DHAVE_LRU_HASH_MAP_TYPE:-DENABLE_TPROXY: \
-DENABLE_IPV4:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_IPV6:-DHAVE_LPM_TRIE_MAP_TYPE:-DHAVE_LRU_HASH_MAP_TYPE:-DENABLE_TPROXY:-DENABLE_L7_LB: \
Expand Down
64 changes: 2 additions & 62 deletions bpf/bpf_host.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -309,11 +309,7 @@ handle_ipv6(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
__u8 key = get_min_encrypt_key(info->key);

set_encrypt_key_meta(ctx, key);
#ifdef IP_POOLS
set_encrypt_dip(ctx, info->tunnel_endpoint);
#else
set_identity_meta(ctx, secctx);
#endif
}
#endif
return CTX_ACT_OK;
Expand Down Expand Up @@ -609,11 +605,7 @@ handle_ipv4(struct __ctx_buff *ctx, __u32 secctx,
__u8 key = get_min_encrypt_key(info->key);

set_encrypt_key_meta(ctx, key);
#ifdef IP_POOLS
set_encrypt_dip(ctx, info->tunnel_endpoint);
#else
set_identity_meta(ctx, secctx);
#endif
}
#endif
return CTX_ACT_OK;
Expand Down Expand Up @@ -681,61 +673,9 @@ handle_to_netdev_ipv4(struct __ctx_buff *ctx, struct trace_ctx *trace, __s8 *ext
#ifdef ENABLE_IPSEC
#ifndef TUNNEL_MODE
static __always_inline int
do_netdev_encrypt_pools(struct __ctx_buff *ctx __maybe_unused)
do_netdev_encrypt(struct __ctx_buff *ctx __maybe_unused,
__u32 src_id __maybe_unused)
{
int ret = 0;
#ifdef IP_POOLS
__be32 tunnel_endpoint = ctx_get_encrypt_dip(ctx);
void *data, *data_end;
__u32 tunnel_source = IPV4_ENCRYPT_IFACE;
struct iphdr *iphdr;
__be32 sum;

ctx->mark = 0;

if (!revalidate_data(ctx, &data, &data_end, &iphdr)) {
ret = DROP_INVALID;
goto drop_err;
}

/* When IP_POOLS is enabled ip addresses are not
* assigned on a per node basis so lacking node
* affinity we can not use IP address to assign the
* destination IP. Instead rewrite it here from cb[].
*/
sum = csum_diff(&iphdr->daddr, sizeof(__u32), &tunnel_endpoint,
sizeof(tunnel_endpoint), 0);
sum = csum_diff(&iphdr->saddr, sizeof(__u32), &tunnel_source,
sizeof(tunnel_source), sum);

if (ctx_store_bytes(ctx, ETH_HLEN + offsetof(struct iphdr, daddr),
&tunnel_endpoint, sizeof(tunnel_endpoint), 0) < 0) {
ret = DROP_WRITE_ERROR;
goto drop_err;
}
if (ctx_store_bytes(ctx, ETH_HLEN + offsetof(struct iphdr, saddr),
&tunnel_source, sizeof(tunnel_source), 0) < 0) {
ret = DROP_WRITE_ERROR;
goto drop_err;
}
if (ipv4_csum_update_by_diff(ctx, ETH_HLEN, sum) < 0) {
ret = DROP_CSUM_L3;
goto drop_err;
}
drop_err:
#endif /* IP_POOLS */
return ret;
}

static __always_inline int do_netdev_encrypt(struct __ctx_buff *ctx,
__u32 src_id)
{
int ret;

ret = do_netdev_encrypt_pools(ctx);
if (ret)
return send_drop_notify_error(ctx, src_id, ret, CTX_ACT_DROP, METRIC_INGRESS);

return CTX_ACT_OK;
}

Expand Down
6 changes: 0 additions & 6 deletions bpf/bpf_lxc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -631,9 +631,6 @@ static __always_inline int handle_ipv6_from_lxc(struct __ctx_buff *ctx, __u32 *d
# ifdef ENABLE_IPSEC
if (encrypt_key && tunnel_endpoint) {
set_encrypt_key_mark(ctx, encrypt_key);
# ifdef IP_POOLS
set_encrypt_dip(ctx, tunnel_endpoint);
# endif /* IP_POOLS */
# ifdef ENABLE_IDENTITY_MARK
set_identity_mark(ctx, SECLABEL);
# endif /* ENABLE_IDENTITY_MARK */
Expand Down Expand Up @@ -1133,9 +1130,6 @@ static __always_inline int handle_ipv4_from_lxc(struct __ctx_buff *ctx, __u32 *d
# ifdef ENABLE_IPSEC
if (encrypt_key && tunnel_endpoint) {
set_encrypt_key_mark(ctx, encrypt_key);
# ifdef IP_POOLS
set_encrypt_dip(ctx, tunnel_endpoint);
# endif /* IP_POOLS */
# ifdef ENABLE_IDENTITY_MARK
set_identity_mark(ctx, SECLABEL);
# endif
Expand Down
3 changes: 0 additions & 3 deletions bpf/lib/common.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -713,9 +713,6 @@ enum {
#define CB_SRV6_SID_4 CB_NAT /* Alias, non-overlapping */
CB_CT_STATE,
#define CB_ADDR_V6_4 CB_CT_STATE /* Alias, non-overlapping */
#define CB_ENCRYPT_DST CB_CT_STATE /* Alias, non-overlapping,
* Not used by xfrm.
*/
#define CB_CUSTOM_CALLS CB_CT_STATE /* Alias, non-overlapping */
#define CB_SRV6_VRF_ID CB_CT_STATE /* Alias, non-overlapping */
};
Expand Down
20 changes: 7 additions & 13 deletions bpf/lib/encap.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@
#ifdef HAVE_ENCAP
#ifdef ENABLE_IPSEC
static __always_inline int
encap_and_redirect_nomark_ipsec(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
__u8 key, __u32 seclabel)
encap_and_redirect_nomark_ipsec(struct __ctx_buff *ctx, __u8 key,
__u32 seclabel)
{
/* Traffic from local host in tunnel mode will be passed to
* cilium_host. In non-IPSec case traffic with non-local dst
Expand All @@ -32,13 +32,11 @@ encap_and_redirect_nomark_ipsec(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
*/
set_encrypt_key_meta(ctx, key);
set_identity_meta(ctx, seclabel);
set_encrypt_dip(ctx, tunnel_endpoint);
return CTX_ACT_OK;
}

static __always_inline int
encap_and_redirect_ipsec(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
__u8 key, __u32 seclabel)
encap_and_redirect_ipsec(struct __ctx_buff *ctx, __u8 key, __u32 seclabel)
{
/* IPSec is performed by the stack on any packets with the
* MARK_MAGIC_ENCRYPT bit set. During the process though we
Expand All @@ -49,7 +47,6 @@ encap_and_redirect_ipsec(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
*/
set_encrypt_key_mark(ctx, key);
set_identity_mark(ctx, seclabel);
ctx_store_meta(ctx, CB_ENCRYPT_DST, tunnel_endpoint);
return CTX_ACT_OK;
}
#endif /* ENABLE_IPSEC */
Expand Down Expand Up @@ -187,7 +184,7 @@ encap_and_redirect_with_nodeid(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
{
#ifdef ENABLE_IPSEC
if (key)
return encap_and_redirect_nomark_ipsec(ctx, tunnel_endpoint, key, seclabel);
return encap_and_redirect_nomark_ipsec(ctx, key, seclabel);
#endif
return __encap_and_redirect_with_nodeid(ctx, tunnel_endpoint, seclabel, dstid, NOT_VTEP_DST,
trace);
Expand All @@ -206,8 +203,7 @@ __encap_and_redirect_lxc(struct __ctx_buff *ctx, __be32 tunnel_endpoint,

#ifdef ENABLE_IPSEC
if (encrypt_key)
return encap_and_redirect_ipsec(ctx, tunnel_endpoint,
encrypt_key, seclabel);
return encap_and_redirect_ipsec(ctx, encrypt_key, seclabel);
#endif

#if !defined(ENABLE_NODEPORT) && (defined(ENABLE_IPSEC) || defined(ENABLE_HOST_FIREWALL))
Expand Down Expand Up @@ -261,8 +257,7 @@ encap_and_redirect_lxc(struct __ctx_buff *ctx, __be32 tunnel_endpoint,
if (tunnel->key) {
__u8 min_encrypt_key = get_min_encrypt_key(tunnel->key);

return encap_and_redirect_ipsec(ctx, tunnel->ip4,
min_encrypt_key,
return encap_and_redirect_ipsec(ctx, min_encrypt_key,
seclabel);
}
#endif
Expand All @@ -284,8 +279,7 @@ encap_and_redirect_netdev(struct __ctx_buff *ctx, struct tunnel_key *k,
if (tunnel->key) {
__u8 key = get_min_encrypt_key(tunnel->key);

return encap_and_redirect_nomark_ipsec(ctx, tunnel->ip4,
key, seclabel);
return encap_and_redirect_nomark_ipsec(ctx, key, seclabel);
}
#endif
return __encap_and_redirect_with_nodeid(ctx, tunnel->ip4, seclabel,
Expand Down
12 changes: 0 additions & 12 deletions bpf/lib/overloadable_skb.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,18 +36,6 @@ get_epid(const struct __sk_buff *ctx)
return ctx->mark >> 16;
}

static __always_inline __maybe_unused void
set_encrypt_dip(struct __sk_buff *ctx, __be32 ip_endpoint)
{
ctx->cb[CB_ENCRYPT_DST] = ip_endpoint;
}

static __always_inline __maybe_unused __be32
ctx_get_encrypt_dip(struct __sk_buff *ctx)
{
return ctx->cb[CB_ENCRYPT_DST];
}

/**
* set_identity_mark - pushes 24 bit identity into ctx mark value.
*/
Expand Down
9 changes: 0 additions & 9 deletions pkg/datapath/linux/config/config.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ import (
"github.com/cilium/cilium/pkg/datapath/link"
"github.com/cilium/cilium/pkg/defaults"
"github.com/cilium/cilium/pkg/identity"
ipamOption "github.com/cilium/cilium/pkg/ipam/option"
"github.com/cilium/cilium/pkg/labels"
"github.com/cilium/cilium/pkg/logging"
"github.com/cilium/cilium/pkg/logging/logfields"
Expand Down Expand Up @@ -542,14 +541,6 @@ func (h *HeaderfileWriter) WriteNodeConfig(w io.Writer, cfg *datapath.LocalNodeC
cDefinesMap["ENCRYPT_IFACE"] = fmt.Sprintf("%d", link.Attrs().Index)
}
}
// If we are using EKS or AKS IPAM modes, we should use IP_POOLS
// datapath as the pod subnets will be auto-discovered later at
// runtime.
if option.Config.IPAM == ipamOption.IPAMENI ||
option.Config.IPAM == ipamOption.IPAMAzure ||
option.Config.IsPodSubnetsDefined() {
cDefinesMap["IP_POOLS"] = "1"
}
}

if option.Config.EnableNodePort {
Expand Down

0 comments on commit 4c7cce1

Please sign in to comment.