bpf: fib: fix issues with L2 resolution #30128
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
julianwiedmann
added
kind/bug
maintainer-s-little-helper
bot
added
dont-merge/needs-release-note-label
julianwiedmann
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
julianwiedmann
force-pushed
the
1.16-bpf-fib-redirect
branch
2 times, most recently
from
b96793a to
6ee9489
Compare
|
/test |
julianwiedmann
force-pushed
the
1.16-bpf-fib-redirect
branch
from
6ee9489 to
b567da2
Compare
|
/test |
borkmann
reviewed
Jan 8, 2024
julianwiedmann
force-pushed
the
1.16-bpf-fib-redirect
branch
from
b567da2 to
f8d422d
Compare
|
/test |
ldelossa
reviewed
Jan 10, 2024
The neighbour map is populated by the inbound nodeport path, and used to cache the client's MAC address. Therefore it only makes sense to use this fallback in the LB's reply path. Opt-out from using it in - the LB NAT forward path - the LB DSR forward path - the outbound EgressGW paths - bpf_lxc's reply path, as that's only used with ENABLE_HOST_ROUTING and thus can always use the neigh-resolver. Note that callers which can't use the neigh-map will need *some* sort of toleration for failed L2 resolution / DROP_NO_FIB result. Signed-off-by: Julian Wiedmann <[email protected]>
A recent FIB refactor introduced a bug, where fib_redirect*() no longer performs a FIB lookup if ENABLE_SKIP_FIB is set. But for configs without neigh-resolver, some code paths (that can't fall back to the neigh map) strictly require this FIB lookup to obtain the next-hop's MAC address. Fix things by reintroducing the FIB lookup when neigh_resolver_available() returns false. Fixes: e30e18b ("bpf,fib: use fib_do_redirect in fib_redirect") Signed-off-by: Julian Wiedmann <[email protected]>
Clarify the different paths of L2 resolution: 1. when the neigh-resolver is available, always use it. Forward the next-hop info from a preceding FIB lookup where available. 2. otherwise fallback to the neigh map, for callers that have opted in. Signed-off-by: Julian Wiedmann <[email protected]>
When XDP manually builds the tunnel headers and forwards to a remote node, it makes no sense to rely on the neighbour map for L2 resolution. We have to trust that the agent installs managed neigh entries for all other nodes, and thus the FIB lookup will always return a L2 resolution. Signed-off-by: Julian Wiedmann <[email protected]>
julianwiedmann
force-pushed
the
1.16-bpf-fib-redirect
branch
from
f8d422d to
4c46cde
Compare
julianwiedmann
added
release-note/misc
julianwiedmann
changed the title
|
/test |
julianwiedmann
added
release-blocker/1.15
ldelossa
approved these changes
Jan 15, 2024
jschwinger233
approved these changes
Jan 16, 2024
This was referenced Jan 17, 2024
giorio94
added
backport-pending/1.15
1 task
julianwiedmann
added
the
backport-pending/1.14
github-actions
bot
added
backport-done/1.14
giorio94
added
backport-done/1.15
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Clarify in which scenarios the fallback to the neigh-map makes sense.
Then fix a recent regression where some code paths are no longer able to obtain a L2 resolution on BPF redirect. This would for instance affect the forwarding of LBed requests to remote backends, when running in XDP or on a pre-5.10 kernel.