datapath: Support NodePort BPF on L2-less devices #14858
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
brb
added
sig/datapath
brb
force-pushed
the
pr/brb/no-l2-addr
branch
2 times, most recently
from
c3d8dc4 to
32c5872
Compare
|
test-net-next |
brb
force-pushed
the
pr/brb/no-l2-addr
branch
3 times, most recently
from
2d803c0 to
250a8d7
Compare
brb
force-pushed
the
pr/brb/no-l2-addr
branch
from
250a8d7 to
3699607
Compare
|
test-net-next |
2 similar comments
|
test-net-next |
|
test-net-next |
brb
force-pushed
the
pr/brb/no-l2-addr
branch
2 times, most recently
from
23b7b27 to
fc8fc37
Compare
brb
force-pushed
the
pr/brb/no-l2-addr
branch
from
da2fe92 to
da75418
Compare
christarazi
reviewed
Mar 3, 2021
This commit extends NodePort BPF by making it possible to run it on L3 network devices (without L2 addr). One prominent case is the Wireguard tunnel device (wg0). The main idea of the change is to make ETH_HLEN configurable via ELF templating (on L2-less devices we set it to 0 during the load time), and to craft an L2 hdr when forwarding from L2-less to L2 device. Signed-off-by: Martynas Pumputis <[email protected]>
The previous commit added a support for L2-less devices. Signed-off-by: Martynas Pumputis <[email protected]>
Fix a bug when NodePort BPF is disabled after the device detection, and BPF host routing is kept enabled. Fixes: 7e0cb33 ("bpf: do not enable host routing when kpr is disabled") Signed-off-by: Martynas Pumputis <[email protected]>
This should eliminate a datapath perf penalty introduced by the L2-less changes when running on systems which all involved devices have L2 addrs. Signed-off-by: Martynas Pumputis <[email protected]>
Until #15075 has been resolved. Signed-off-by: Martynas Pumputis <[email protected]>
|
test-me-please |
borkmann
approved these changes
Mar 5, 2021
christarazi
approved these changes
Mar 5, 2021
maintainer-s-little-helper
bot
added
the
ready-to-merge
pchaigno
reviewed
Mar 9, 2021
brb
added a commit
that referenced
this pull request
Mar 15, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity. [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
brb
added a commit
that referenced
this pull request
Apr 2, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity when running on net-next (ETH_HLEN=0 depends on the skb_change_head helper which was introduced in 5.8). [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
brb
added a commit
that referenced
this pull request
Apr 6, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity when running on net-next (ETH_HLEN=0 depends on the skb_change_head helper which was introduced in 5.8). [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
brb
added a commit
that referenced
this pull request
Apr 9, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity when running on net-next (ETH_HLEN=0 depends on the skb_change_head helper which was introduced in 5.8). [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
brb
added a commit
that referenced
this pull request
Apr 13, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity when running on net-next (ETH_HLEN=0 depends on the skb_change_head helper which was introduced in 5.8). [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
qmonnet
pushed a commit
that referenced
this pull request
Apr 13, 2021
The PR "datapath: Support NodePort BPF on L2-less devices" [1] has increased the complexity of bpf_host and bpf_lxc by introducing a support for ETH_HLEN=0. Extend the base options by adding ETH_HLEN=0 to stress test the verifier complexity when running on net-next (ETH_HLEN=0 depends on the skb_change_head helper which was introduced in 5.8). [1]: #14858 Suggested-by: Paul Chaignon <[email protected]> Signed-off-by: Martynas Pumputis <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See commit msgs.
I haven't added IPv6 tests, as I'd need to extend https://github.com/cilium/kube-wireguarder to support it. At this point, it would be a waste of time, as we are planning to add the native Wireguard support in this release cycle. So we can add the tests once #15075 has been resolved.
To fix L2-less with the fast redirect I've opened #15075.
Fix #12317