cilium / cilium / 41142

39%

push

travis-ci-com

datapath: Allow egress GW with XDP

The XDP-based NodePort acceleration currently can't be used in
combination with EgressGW. The underlying reason is that bpf_xdp has no
support for tunnel encapsulation, so it can't redirect the EgressGW's
return traffic. The EgressGW processing is done in nodeport_lb4() and
rev_nodeport_lb4() from lib/nodeport.h (tech debt).

Improve this situation by skipping the tunnel-forward in
rev_nodeport_lb4() when called from XDP context. Thus return traffic for
the EgressGW gets reverse-SNATed inside XDP, and is then passed up to
bpf_host with XFER_PKT_NO_SVC. It bypasses the NodePort processing, and
enters the kernel stack where it gets forwarded to the tunnel netdev due
to an IP route in the host netns stack (i.e., "pod cidr on node X via
cilium_vxlan").

This lets users run with the NodePort acceleration and EgressGW enabled
at the same time. Note that the approach of letting the kernel forward
the traffic into the tunnel can fail (if the iptables' default policy
for the FORWARD chain is DROP).

Long-term we want to cleanly handle this with tunneling support inside
bpf_xdp [1].

[1]: https://github.com/cilium/cilium/issues/17770

The commit message was suggested by Julian Wiedmann.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

4 of 4 new or added lines in 1 file covered. (100.0%)

47403 of 139776 relevant lines covered (33.91%)

6306.23 hits per line