Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BPF] skip FIB when dest is unknown at HEP #8921

Merged

Conversation

tomastigera
Copy link
Contributor

@tomastigera tomastigera commented Jun 17, 2024

Description

[BPF] skip FIB when dest is unknown at HEP

* fix when CALI_ST_SKIP_FIB is set on the way to the host, set
  CALI_CT_FLAG_SKIP_FIB on conntrack - not just when from WEP

* add test for ^^^ and issue https://github.com/projectcalico/calico/issues/6450

* In addition to skipping FIB when there is no route to post-dnat
  destination, also skip FIB when there is a route, but it is not local
  while there was no service involved. In that case, we are not
  forwarding a service (NodePort) to another node and we should only
  forward locally. Let the host decide what to do with such a packet.

[BPF/UT] set RPF to strict as test provision for that.

Make tests execute the path again after we introduced the option to
disable RPF.

Fixes #8918

Related issues/PRs

Todos

  • Tests
  • Documentation
  • Release note

Release Note

ebpf: fix - let the node handle packet when we are not sure about the destination

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

  • docs-pr-required: This change requires a change to the documentation that has not been completed yet.
  • docs-completed: This change has all necessary documentation completed.
  • docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

  • release-note-required: This PR has user-facing changes. Most PRs should have this label.
  • release-note-not-required: This PR has no user-facing changes.

Other optional labels:

  • cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
  • needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

Make tests execute the path again after we introduced the option to
disable RPF.
* fix when CALI_ST_SKIP_FIB is set on the way to the host, set
  CALI_CT_FLAG_SKIP_FIB on conntrack - not just when from WEP

* add test for ^^^ and issue projectcalico#6450

* In addition to skipping FIB when there is no route to post-dnat
  destination, also skip FIB when there is a route, but it is not local
  while there was no service involved. In that case, we are not
  forwarding a service (NodePort) to another node and we should only
  forward locally. Let the host decide what to do with such a packet.

Fixes projectcalico#8918
@tomastigera tomastigera requested a review from a team as a code owner June 17, 2024 22:10
@marvin-tigera marvin-tigera added this to the Calico v3.29.0 milestone Jun 17, 2024
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Jun 17, 2024
@tomastigera tomastigera added docs-not-required Docs not required for this change and removed docs-pr-required Change is not yet documented labels Jun 18, 2024
@tomastigera
Copy link
Contributor Author

/merge-when-ready

@marvin-tigera
Copy link
Contributor

OK, I will merge the pull request when it's ready, leave the commits as is when I merge it, and leave the branch after I've merged it.

Copy link
Member

@fasaxc fasaxc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@marvin-tigera marvin-tigera merged commit 14fdd68 into projectcalico:master Jun 18, 2024
2 checks passed
@tomastigera tomastigera deleted the tomas-bpf-unknown-flood branch June 18, 2024 15:37
tomastigera added a commit that referenced this pull request Jun 18, 2024
…-release-v3.28

[release-v3.28] Auto pick #8921: set RPF to strict as test provision for that.
tomastigera added a commit that referenced this pull request Jun 18, 2024
…-release-v3.27

[release-v3.27] Auto pick #8921: set RPF to strict as test provision for that.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs-not-required Docs not required for this change merge-when-ready release-note-required Change has user-facing impact (no matter how small)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Calico/eBPF node flooding unknown unicast traffic
3 participants