bpf: nat: support ICMPV6_DEST_UNREACH in egress path #37766
Conversation
59362f9 to
c88fcf9
Compare
|
Alright, let's do this. I'm planning to add a bit more ICMPv6 support (basically establish equivalent to the ICMPv4 support), will look into adding some tests in that context to cover the actual rewrite scenarios. |
|
/test |
c88fcf9 to
11d88f5
Compare
|
(de-duplicated the CHECK() stage. Still need to deal with some checksum fallout - our pkt generator currently doesn't fill the ICMPv6 checksum, and something's odd about the IPv4 checksum as well ...) |
Add the minimal bits to handle ICMPv6 error messages in the IPv6 NAT egress path. This is basically a copy of the corresponding ICMPv4 code. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Slim down the inner function __tail_no_service_ipv*() sufficiently, so that it contains *only* the packet-rewrite logic. This allows us to easily reuse it from test context, to build identical packets. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Use the intended helper to be a bit more self-documenting. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
The LB path sends an ICMP error message when the accessed service has no backend available (see cilium#28157). In the case of a nodeport service, validate that this ICMP error message can exit the node (and traverse the `to-netdev` program) when BPF masquerading is enabled. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
11d88f5 to
4cc8aa6
Compare
|
/test |
@dylandreimerink addressed the tests in a slightly different way, mind having another quick look? Shouldn't be controversial. Long-term, I think for "multi-tests" (like here) we want a bit of helper logic to copy packets between a I've refactored the test a bit, re-using the actual production logic to transform the request into an ICMP error message. This actually feels like a good approach in general, converting |
Yea, we really should start looking into the next generation of BPF testing. We are at the limit of what is practical with the current framework (which is already much more then I ever thought possible).
Yes, I agree. |
Add the missing bits in the IPv6 SNAT engine, so that
ICMPV6_DEST_UNREACHpackets (which we generate for a NodePort service without backends) can exit the node.