Use bpf programs for l3 devices for IPIP tunnels in kernel 5.14 (rhel 4.18.0-330) and newer #5846
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mazdakn
added
docs-not-required
tomastigera
changed the title
tomastigera
added
release-note-required
tomastigera
reviewed
Apr 6, 2022
felix/bpf-gpl/skb.h
Outdated
| @@ -68,6 +68,10 @@ static CALI_BPF_INLINE void skb_refresh_start_end(struct cali_tc_ctx *ctx) { | |||
| static CALI_BPF_INLINE long skb_iphdr_offset(void) | |||
| { | |||
| if (CALI_F_IPIP_ENCAPPED) { | |||
| if (GLOBAL_FLAGS & CALI_GLOBALS_IPIP_NO_OUTER_HEADERS) { | |||
There was a problem hiding this comment.
I wonder if instead we would be able to just load the L3 (CALI_F_L3) programs rather than handling it as a runtime configuration. Then the change could be limited to felix only 🤔
Co-authored-by: Tomas Hruby <[email protected]>
Co-authored-by: Tomas Hruby <[email protected]>
mazdakn
changed the title
mazdakn
changed the title
tomastigera
approved these changes
Apr 8, 2022
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Unlike other L3 devices, IPIP tunnels used to see ethernet, outer IP header, inner IP header and payload in ingress path. In kernel 5.14 a commit (
7ad136fd288c0 : ipip: allow redirecting ipip and mplsip packets to eth devices) made IPIP tunnels act like other L3 device, and for that bpf programs attached to IPIP tunnel only see inner IP header and payload.This PR generalises the wirguard programs for all L3 devices including IPIP tunnels with the new behaviour. This PR should also fix this issue: #5449
Related issues/PRs
Todos
Release Note