cilium / cilium / 10380

39%

push

travis-ci-com

bpf: Skip ingress proxy ip rule with endpoint routes

When endpoint routes are enabled, we don't need to install the ip rules
or routes to ensure that the traffic from the ingress proxy goes into
cilium_host; Instead, we configure BPF programs attached to the TC
egress filter of the endpoint device to ensure that it implements the
policy logic.

Treat this case as datapath mode "routed", where we will now skip those
rules. All other datapath configuration should be equivalent to direct
mode.

If we don't do this, then when applying L7 ingress policy, the traffic
from the ingress proxy towards the pod is first directed towards the
cilium_host device, then subsequently passed to the stack and re-routed
towards the endpoint device, which causes the BPF to lose the context
that this traffic comes from the proxy and hence the BPF program treats
it as newly inbound traffic from the world. As a result, inbound HTTP
requests see a message like:

    upstream connect error or disconnect/reset before headers

Signed-off-by: Joe Stringer <joe@cilium.io>

3 of 3 new or added lines in 1 file covered. (100.0%)

25478 of 57875 relevant lines covered (44.02%)

1169.51 hits per line