bpf: Fix Geneve-DSR inconsistency with host-routing off #37937
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
57c1759 to
46a3f4a
Compare
46a3f4a to
bc21995
Compare
ysksuzuki
requested changes
Mar 1, 2025
There was a problem hiding this comment.
Thank you for the PR.
The issue occurs because bpf_overlay delivers packets to the local endpoint without passing through the kernel stack, even in legacy routing mode. This results in asymmetric communication. I believe we can address this by passing DSR GENEVE packets to the kernel from bpf_overlay. However, I'm not certain if this approach covers all scenarios, so further discussion is needed. Additionally, we need to add tests for this.
|
Commit fd20c47 does not match "(?m)^Signed-off-by:". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
fd20c47 to
351fb07
Compare
|
Commit fd20c47 does not match "(?m)^Signed-off-by:". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
351fb07 to
26085e2
Compare
|
Let me convert this PR to draft since the more discussion is needed |
26085e2 to
58b80ce
Compare
|
As you said in the APAC dev mtg, I've add the logic of checking nat_table entry which is created in I think remaining fix point for merging is only BPF-unit-test refactoring . |
10cc44a to
79f5ff1
Compare
1d5f77c to
22c5224
Compare
|
Could you reopen this PR? |
22c5224 to
2700d3d
Compare
2700d3d to
33f2884
Compare
33f2884 to
b196884
Compare
This commit fixes an inconsistency in how Geneve-DSR packets are processed when host-routing is disabled. In the current behavior, only DSR reply packets are seen by the host-stack, while incoming packets are redirected by BPF and skip the host-stack. This causes conntrack entries to be incomplete. As a result, when BPF-masquerade is disabled, reply packets are unintentionally masqueraded by iptables, which break DSR functionality. See: cilium#32189. Note: When BPF-masquerade is disabled, host-routing is also automatically disabled. https://github.com/cilium/cilium/blob/55aecc0f4706b5f8a70fc38ed2817cc2e15b0f60/Documentation/operations/performance/tuning.rst?plain=1#L168 To resolve this, cil_from_overlay() now delivers incoming Geneve-DSR packets to the host-stack, if host-routing is disabled. This ensures conntrack entries are created properly and prevents incorrect masquerading. Signed-off-by: yushoyamaguchi <ysh.824@outlook.jp>
b196884 to
63397f9
Compare
|
/test |
julianwiedmann
approved these changes
May 30, 2025
|
@ysksuzuki just needs your approval now :) |
ysksuzuki
approved these changes
May 30, 2025
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit fixes an inconsistency in how Geneve-DSR packets are processed when host-routing is disabled.
In the current behavior, only DSR reply packets are seen by the host-stack, while incoming packets are redirected by BPF and skip the host-stack.
This causes conntrack entries to be incomplete.
As a result, when BPF-masquerade is disabled, reply packets are unintentionally masqueraded by iptables, which break DSR functionality.
See: #32189.
Note: When BPF-masquerade is disabled, host-routing is also automatically disabled.
cilium/Documentation/operations/performance/tuning.rst
Line 168 in 55aecc0
To resolve this, cil_from_overlay() now delivers incoming Geneve-DSR packets to the host-stack, if host-routing is disabled.
This ensures conntrack entries are created properly and prevents incorrect masquerading.