Skip to content

Commit aebabeb

Browse files
julianwiedmannsmagnani96
julianwiedmann
authored and
smagnani96
committed
datapath: switch ENABLE_HOST_ROUTING to runtime config
As the title says. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
1 parent 736eda2 commit aebabeb

119 files changed

Lines changed: 101 additions & 195 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎bpf/Makefile‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ MAX_BASE_OPTIONS += -DENABLE_MASQUERADE_IPV4=1 -DENABLE_IP_MASQ_AGENT_IPV4=1 \
4848
-DENABLE_NODEPORT_ACCELERATION=1 \
4949
-DENABLE_DSR_ICMP_ERRORS=1 -DENABLE_DSR=1 -DENABLE_DSR_BYUSER=1
5050
MAX_BASE_OPTIONS += -DENABLE_BANDWIDTH_MANAGER=1 -DENABLE_EGRESS_GATEWAY=1 -DENABLE_VTEP=1
51-
MAX_BASE_OPTIONS += -DENABLE_HOST_ROUTING=1
5251
MAX_BASE_OPTIONS += -DENABLE_CLUSTER_AWARE_ADDRESSING=1 -DENABLE_INTER_CLUSTER_SNAT=1
5352

5453
ifndef MAX_LB_OPTIONS
@@ -135,10 +134,10 @@ LXC_OPTIONS = \
135134
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DPOLICY_VERDICT_NOTIFY:-DENABLE_NAT_46X64:-DENABLE_NAT_46X64_GATEWAY: \
136135
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_NODEPORT:-DPOLICY_VERDICT_NOTIFY: \
137136
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_NODEPORT:-DENABLE_DSR:-DPOLICY_VERDICT_NOTIFY: \
138-
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_HOST_ROUTING: \
139-
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_HOST_ROUTING:-DENABLE_SCTP: \
140-
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_HOST_ROUTING:-DENABLE_SCTP:-DENABLE_VTEP: \
141-
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DENABLE_HOST_ROUTING:-DENABLE_SCTP: \
137+
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE: \
138+
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_SCTP: \
139+
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DTUNNEL_MODE:-DENABLE_SCTP:-DENABLE_VTEP: \
140+
-DENABLE_IPV4:-DENABLE_IPV6:-DENCAP_IFINDEX:-DENABLE_SCTP: \
142141

143142
# These options are intended to max out the BPF program complexity. it is load
144143
# tested as well.

‎bpf/bpf_host.c‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,7 @@ handle_ipv6_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
315315
* This must tailcall, as the decap could be for inner ipv6 or ipv4 making
316316
* the remaining path potentially erroneous.
317317
*
318-
* Perform this before the ENABLE_HOST_ROUTING check as the decap is not dependent
318+
* Perform this before the BPF Host Routing check as the decap is not dependent
319319
* on this feature being enabled or not.
320320
*/
321321
#ifdef ENABLE_SRV6
@@ -329,11 +329,9 @@ handle_ipv6_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
329329
}
330330
#endif /* ENABLE_SRV6 */
331331

332-
#ifndef ENABLE_HOST_ROUTING
333332
/* See the equivalent v4 path for comments */
334-
if (!from_host)
333+
if (!from_host && !CONFIG(enable_bpf_host_routing))
335334
return CTX_ACT_OK;
336-
#endif /* !ENABLE_HOST_ROUTING */
337335

338336
/* Lookup IPv6 address in list of local endpoints */
339337
ep = lookup_ip6_endpoint(ip6);
@@ -344,9 +342,8 @@ handle_ipv6_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
344342
if (ep->flags & ENDPOINT_MASK_HOST_DELIVERY)
345343
return CTX_ACT_OK;
346344

347-
#ifdef ENABLE_HOST_ROUTING
348345
/* add L2 header for L2-less interface: */
349-
if (!from_host && THIS_IS_L3_DEV) {
346+
if (!from_host && CONFIG(enable_bpf_host_routing) && THIS_IS_L3_DEV) {
350347
bool l2_hdr_required = true;
351348

352349
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
@@ -357,7 +354,7 @@ handle_ipv6_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
357354
l3_off += __ETH_HLEN;
358355
}
359356
}
360-
#endif
357+
361358
return ipv6_local_delivery(ctx, l3_off, secctx, magic, ep,
362359
METRIC_INGRESS, from_host, false);
363360
}
@@ -735,7 +732,6 @@ handle_ipv4_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
735732
}
736733
#endif /* ENABLE_HOST_FIREWALL */
737734

738-
#ifndef ENABLE_HOST_ROUTING
739735
/* Without bpf_redirect_neigh() helper, we cannot redirect a
740736
* packet to a local endpoint in the direct routing mode, as
741737
* the redirect bypasses nf_conntrack table. This makes a
@@ -745,9 +741,8 @@ handle_ipv4_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
745741
* we bypass request and reply path in the host namespace and
746742
* do not run into this issue.
747743
*/
748-
if (!from_host)
744+
if (!from_host && !CONFIG(enable_bpf_host_routing))
749745
return CTX_ACT_OK;
750-
#endif /* !ENABLE_HOST_ROUTING */
751746

752747
/* Lookup IPv4 address in list of local endpoints and host IPs */
753748
ep = lookup_ip4_endpoint(ip4);
@@ -760,9 +755,8 @@ handle_ipv4_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
760755
if (ep->flags & ENDPOINT_MASK_HOST_DELIVERY)
761756
return CTX_ACT_OK;
762757

763-
#ifdef ENABLE_HOST_ROUTING
764758
/* add L2 header for L2-less interface: */
765-
if (!from_host && THIS_IS_L3_DEV) {
759+
if (!from_host && CONFIG(enable_bpf_host_routing) && THIS_IS_L3_DEV) {
766760
bool l2_hdr_required = true;
767761

768762
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
@@ -777,7 +771,6 @@ handle_ipv4_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
777771
return DROP_INVALID;
778772
}
779773
}
780-
#endif
781774

782775
return ipv4_local_delivery(ctx, l3_off, secctx, magic, ip4, ep,
783776
METRIC_INGRESS, from_host, false, 0);

‎bpf/bpf_lxc.c‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,7 @@ lxc_deliver_to_host(struct __ctx_buff *ctx, __u32 src_sec_identity)
7878
}
7979
#endif
8080

81-
#if defined(ENABLE_HOST_ROUTING) || defined(ENABLE_ROUTING)
82-
static __always_inline int
81+
static __always_inline __maybe_unused int
8382
lxc_redirect_to_host(struct __ctx_buff *ctx, __u32 src_sec_identity,
8483
__be16 proto, struct trace_ctx *trace)
8584
{
@@ -88,7 +87,6 @@ lxc_redirect_to_host(struct __ctx_buff *ctx, __u32 src_sec_identity,
8887
trace->reason, trace->monitor, proto);
8988
return ctx_redirect(ctx, CONFIG(cilium_net_ifindex), BPF_F_INGRESS);
9089
}
91-
#endif
9290

9391
/* Per-packet LB is needed if all LB cases can not be handled in bpf_sock.
9492
* Most services with L7 LB flag can not be redirected to their proxy port
@@ -726,7 +724,7 @@ ipv6_forward_to_destination(struct __ctx_buff *ctx, struct ipv6hdr *ip6,
726724
if (CONFIG(enable_identity_mark))
727725
set_identity_mark(ctx, SECLABEL_IPV6, MARK_MAGIC_IDENTITY);
728726

729-
if (is_defined(ENABLE_ROUTING) || hairpin_flow || is_defined(ENABLE_HOST_ROUTING)) {
727+
if (is_defined(ENABLE_ROUTING) || hairpin_flow || CONFIG(enable_bpf_host_routing)) {
730728
const struct endpoint_info *ep;
731729
union v6addr daddr;
732730

@@ -749,8 +747,8 @@ ipv6_forward_to_destination(struct __ctx_buff *ctx, struct ipv6hdr *ip6,
749747
*/
750748
ep = __lookup_ip6_endpoint(&daddr);
751749
if (ep) {
752-
#if defined(ENABLE_HOST_ROUTING) || defined(ENABLE_ROUTING)
753-
if (ep->flags & ENDPOINT_MASK_HOST_DELIVERY) {
750+
if ((ep->flags & ENDPOINT_MASK_HOST_DELIVERY) &&
751+
(CONFIG(enable_bpf_host_routing) || is_defined(ENABLE_ROUTING))) {
754752
if (is_defined(ENABLE_ROUTING) &&
755753
is_defined(ENABLE_HOST_FIREWALL) &&
756754
dst_sec_identity == HOST_ID)
@@ -760,7 +758,6 @@ ipv6_forward_to_destination(struct __ctx_buff *ctx, struct ipv6hdr *ip6,
760758

761759
goto pass_to_stack;
762760
}
763-
#endif /* ENABLE_HOST_ROUTING || ENABLE_ROUTING */
764761

765762
/* If the packet is from L7 LB it is coming from the host */
766763
return ipv6_local_delivery(ctx, ETH_HLEN, SECLABEL_IPV6,
@@ -785,7 +782,7 @@ ipv6_forward_to_destination(struct __ctx_buff *ctx, struct ipv6hdr *ip6,
785782
bpf_htons(ETH_P_IPV6));
786783
}
787784
#endif
788-
if (is_defined(ENABLE_HOST_ROUTING)) {
785+
if (CONFIG(enable_bpf_host_routing)) {
789786
int oif = 0;
790787
__u32 tbid = CONFIG(rt_info);
791788

@@ -1227,7 +1224,7 @@ ipv4_forward_to_destination(struct __ctx_buff *ctx, struct iphdr *ip4,
12271224
* that endpoint.
12281225
*/
12291226
if (is_defined(ENABLE_ROUTING) || hairpin_flow ||
1230-
is_defined(ENABLE_HOST_ROUTING)) {
1227+
CONFIG(enable_bpf_host_routing)) {
12311228
__be32 daddr = ip4->daddr;
12321229
const struct endpoint_info *ep;
12331230

@@ -1250,8 +1247,8 @@ ipv4_forward_to_destination(struct __ctx_buff *ctx, struct iphdr *ip4,
12501247
*/
12511248
ep = __lookup_ip4_endpoint(daddr);
12521249
if (ep) {
1253-
#if defined(ENABLE_HOST_ROUTING) || defined(ENABLE_ROUTING)
1254-
if (ep->flags & ENDPOINT_MASK_HOST_DELIVERY) {
1250+
if ((ep->flags & ENDPOINT_MASK_HOST_DELIVERY) &&
1251+
(CONFIG(enable_bpf_host_routing) || is_defined(ENABLE_ROUTING))) {
12551252
if (is_defined(ENABLE_ROUTING) &&
12561253
is_defined(ENABLE_HOST_FIREWALL) &&
12571254
dst_sec_identity == HOST_ID)
@@ -1261,7 +1258,6 @@ ipv4_forward_to_destination(struct __ctx_buff *ctx, struct iphdr *ip4,
12611258

12621259
goto pass_to_stack;
12631260
}
1264-
#endif /* ENABLE_HOST_ROUTING || ENABLE_ROUTING */
12651261

12661262
/* If the packet is from L7 LB it is coming from the host */
12671263
return ipv4_local_delivery(ctx, ETH_HLEN, SECLABEL_IPV4,
@@ -1351,7 +1347,7 @@ ipv4_forward_to_destination(struct __ctx_buff *ctx, struct iphdr *ip4,
13511347
}
13521348
#endif /* TUNNEL_MODE */
13531349

1354-
if (is_defined(ENABLE_HOST_ROUTING)) {
1350+
if (CONFIG(enable_bpf_host_routing)) {
13551351
int oif = 0;
13561352
__u32 tbid = CONFIG(rt_info);
13571353

‎bpf/bpf_overlay.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ static __always_inline int handle_ipv6(struct __ctx_buff *ctx,
144144
* so this logic is needed to prevent the packets from being handled
145145
* by netfilter in an unintended way.
146146
*/
147-
if (!is_defined(ENABLE_HOST_ROUTING) && is_dsr) {
147+
if (!CONFIG(enable_bpf_host_routing) && is_dsr) {
148148
ctx_change_type(ctx, PACKET_HOST);
149149
return CTX_ACT_OK;
150150
}
@@ -386,7 +386,7 @@ static __always_inline int handle_ipv4(struct __ctx_buff *ctx,
386386
* so this logic is needed to prevent the packets from being handled
387387
* by netfilter in an unintended way.
388388
*/
389-
if (!is_defined(ENABLE_HOST_ROUTING) && is_dsr) {
389+
if (!CONFIG(enable_bpf_host_routing) && is_dsr) {
390390
ctx_change_type(ctx, PACKET_HOST);
391391
return CTX_ACT_OK;
392392
}

‎bpf/bpf_wireguard.c‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -79,21 +79,21 @@ handle_ipv6(struct __ctx_buff *ctx, __u32 identity __maybe_unused, __s8 *ext_err
7979

8080
ep = lookup_ip6_endpoint(ip6);
8181
if (ep && !(ep->flags & ENDPOINT_MASK_HOST_DELIVERY)) {
82-
#ifdef ENABLE_HOST_ROUTING
83-
int l3_off = ETH_HLEN;
84-
bool l2_hdr_required = true;
85-
86-
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
87-
if (ret != 0)
88-
return ret;
89-
if (l2_hdr_required)
90-
l3_off += __ETH_HLEN;
91-
92-
return ipv6_local_delivery(ctx, l3_off, identity, MARK_MAGIC_IDENTITY, ep,
93-
METRIC_INGRESS, false, false);
94-
#else
95-
return CTX_ACT_OK;
96-
#endif /* ENABLE_HOST_ROUTING */
82+
if (CONFIG(enable_bpf_host_routing)) {
83+
int l3_off = ETH_HLEN;
84+
bool l2_hdr_required = true;
85+
86+
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
87+
if (ret != 0)
88+
return ret;
89+
if (l2_hdr_required)
90+
l3_off += __ETH_HLEN;
91+
92+
return ipv6_local_delivery(ctx, l3_off, identity, MARK_MAGIC_IDENTITY, ep,
93+
METRIC_INGRESS, false, false);
94+
} else {
95+
return CTX_ACT_OK;
96+
}
9797
}
9898

9999
ret = add_l2_hdr(ctx);
@@ -190,27 +190,27 @@ handle_ipv4(struct __ctx_buff *ctx, __u32 identity __maybe_unused, __s8 *ext_err
190190
*/
191191
ep = lookup_ip4_endpoint(ip4);
192192
if (ep && !(ep->flags & ENDPOINT_MASK_HOST_DELIVERY)) {
193-
#ifdef ENABLE_HOST_ROUTING
194-
int l3_off = ETH_HLEN;
195-
bool l2_hdr_required = true;
196-
197-
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
198-
if (ret != 0)
199-
return ret;
200-
if (l2_hdr_required) {
201-
/* l2 header is added */
202-
l3_off += __ETH_HLEN;
203-
if (!__revalidate_data_pull(ctx, &data, &data_end,
204-
(void **)&ip4, l3_off,
205-
sizeof(*ip4), false))
206-
return DROP_INVALID;
193+
if (CONFIG(enable_bpf_host_routing)) {
194+
int l3_off = ETH_HLEN;
195+
bool l2_hdr_required = true;
196+
197+
ret = maybe_add_l2_hdr(ctx, ep->ifindex, &l2_hdr_required);
198+
if (ret != 0)
199+
return ret;
200+
if (l2_hdr_required) {
201+
/* l2 header is added */
202+
l3_off += __ETH_HLEN;
203+
if (!__revalidate_data_pull(ctx, &data, &data_end,
204+
(void **)&ip4, l3_off,
205+
sizeof(*ip4), false))
206+
return DROP_INVALID;
207+
}
208+
209+
return ipv4_local_delivery(ctx, l3_off, identity, MARK_MAGIC_IDENTITY,
210+
ip4, ep, METRIC_INGRESS, false, false, 0);
211+
} else {
212+
return CTX_ACT_OK;
207213
}
208-
209-
return ipv4_local_delivery(ctx, l3_off, identity, MARK_MAGIC_IDENTITY, ip4, ep,
210-
METRIC_INGRESS, false, false, 0);
211-
#else
212-
return CTX_ACT_OK;
213-
#endif /* ENABLE_HOST_ROUTING */
214214
}
215215

216216
ret = add_l2_hdr(ctx);

‎bpf/complexity-tests/510/bpf_host/1.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
-DENABLE_DSR_ICMP_ERRORS=1
1515
-DENABLE_DSR=1
1616
-DENABLE_DSR_BYUSER=1
17-
-DENABLE_HOST_ROUTING=1
1817
-DENABLE_BANDWIDTH_MANAGER=1
1918
-DENCAP_IFINDEX=1
2019
-DTUNNEL_MODE=1

‎bpf/complexity-tests/510/bpf_host/2.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
-DDSR_ENCAP_MODE=1
1818
-DDSR_ENCAP_GENEVE=1
1919
-DDSR_ENCAP_IPIP=2
20-
-DENABLE_HOST_ROUTING=1
2120
-DENABLE_BANDWIDTH_MANAGER=1
2221
-DENCAP_IFINDEX=1
2322
-DTUNNEL_MODE=1

‎bpf/complexity-tests/510/bpf_host/3.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
-DENABLE_DSR_ICMP_ERRORS=1
1313
-DENABLE_DSR=1
1414
-DENABLE_DSR_BYUSER=1
15-
-DENABLE_HOST_ROUTING=1
1615
-DENABLE_BANDWIDTH_MANAGER=1
1716
-DENCAP_IFINDEX=1
1817
-DTUNNEL_MODE=1

‎bpf/complexity-tests/510/bpf_host/4.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
-DDSR_ENCAP_MODE=1
1616
-DDSR_ENCAP_GENEVE=1
1717
-DDSR_ENCAP_IPIP=2
18-
-DENABLE_HOST_ROUTING=1
1918
-DENABLE_BANDWIDTH_MANAGER=1
2019
-DENCAP_IFINDEX=1
2120
-DTUNNEL_MODE=1

‎bpf/complexity-tests/510/bpf_host/5.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
-DENABLE_DSR_ICMP_ERRORS=1
1414
-DENABLE_DSR=1
1515
-DENABLE_DSR_BYUSER=1
16-
-DENABLE_HOST_ROUTING=1
1716
-DENABLE_BANDWIDTH_MANAGER=1
1817
-DENCAP_IFINDEX=1
1918
-DTUNNEL_MODE=1

0 commit comments

Comments
 (0)