feat(egressgw): multicast CEGP gateway-node datapath rewrite and redirect (BLO-8009)#6
Open
allyblockcast[bot] wants to merge 5 commits into
Conversation
ENABLE_SIP_VERIFICATION drops pod egress at the veth unless
saddr == endpoint_ip. The kernel AMT relay (drivers/net/amt.c) is
configured with `local <VIP>` per BLO-3293 design and uses that VIP as
the source in AMT Advertisements per RFC 7450 §5.1.2.
Add is_valid_l2_announced_ipv{4,6} helpers in bpf_lxc.c that probe
the cilium_l2_responder_v{4,6} map keyed on direct_routing_dev_ifindex.
Mirror b5b3b4b (sock4_skip_xlate). At the two call sites, run the
strict saddr check first (early-return on hit); fall through to the
L2 lookup only on miss.
l2_responder.h is included from bpf_lxc.c (not lib/lxc.h) because
l2_responder.h carries handle_l2_announcement which references
arp/icmp6/runtime-config symbols only available where those headers
are already pulled. bpf_lxc.c has them; tests and other lxc.h
consumers don't (codex review flagged this as the compile-risk vector
during the v3 attempt, and runtime confirmed it).
Targeted at feat/l2fix-mcast so the resulting image overlays cleanly
on the cluster's current cilium:v1.19.3-l2fix-mcast-v3-prototype-rev2
base. feat/l2fix-mcast-v3 is currently broken on runtime bpf_sock.c
compile (b5b3b4b added L2 fallthrough that the agent's config
generator doesn't satisfy) — that's tracked separately.
Security note: broadens SIP allow-set from "pod may source only its
endpoint IP" to "any pod on this node may source any VIP in the L2
responder map for the direct routing dev". Sock4_skip_xlate precedent
justifies it for hostNetwork ExternalIP reach; not fully proven safe
for raw pod egress. Operators relying on SIP as a spoofing defense
should be aware co-tenant pods could now spoof L2-announced VIPs.
Operational caveat: lookup only succeeds on the node currently holding
the L2 announce lease for the VIP. Pods on non-holder nodes still see
DROP_INVALID_SIP — colocate with the lease holder via nodeSelector or
use hostNetwork.
Signed-off-by: Omar Ramadan <omar@blockcast.net>
fix(sip): allow lxc egress with L2-announced VIP saddr (clean base)
…(BLO-8007)
Pod-originated IPv4 multicast in the from-container path
(bpf_lxc.c::__tail_handle_ipv4) was short-circuited into the
cluster-internal subscriber-map fast path (CILIUM_CALL_MULTICAST_EP_DELIVERY)
before any egress-gateway lookup could run. A 232.0.0.0/4 destination that
also had a local subscriber map therefore bypassed the multicast CEGP
intercept and was emitted locally, violating the requirement that matching
multicast CEGP hits classify before host/local emission.
Add egw_mcast_request_is_egress() and consult it before the subscriber-map
tail call: a multicast destination matching a real-gateway multicast EGW
policy now falls through to the normal egress path (per-packet LB -> CT
egress -> handle_ipv4_from_lxc), where the existing, already multicast-aware
EGW redirect/SNAT machinery takes over. Non-matching multicast (no policy,
excluded CIDR, or no gateway) keeps the pre-existing local multicast path,
and unicast is untouched (the helper is multicast-only).
Map/policy contract: multicast destinations reuse the existing
cilium_egress_gw_policy_v4 LPM map and egress_gw_policy_{key,entry} structs
unchanged - a 232.0.0.0/4 entry is just another (saddr, daddr-prefix) row.
No new map or struct field, so unicast CEGP semantics are unaffected.
Downstream-only divergence from upstream Cilium: upstream never consults the
EGW policy map for multicast destinations, because the from-container path
short-circuits IN_MULTICAST traffic to local delivery before any EGW lookup.
We deliberately add a multicast-only EGW lookup on the origin node so
multicast CEGP egress wins over local fanout for groups an operator has
placed under a policy. Documented inline in egress_gateway.h and bpf_lxc.c.
Test: bpf/tests/tc_egressgw_origin_node_multicast.c pins the classifier
contract against the real policy map (mcast policy hit -> egress; no-policy /
excluded-CIDR / no-gateway -> local; unicast -> never reclassified). The
gateway-node from-overlay redirect remains covered by
tc_egressgw_redirect_multicast.c.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
This pull request has been automatically marked as stale because it |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gateway-node downstream datapath for multicast Egress Gateway (CEGP extension), implementing the BLO-8009 slice of BLO-3952.
bpf/lib/egress_gateway.h):egw_mcast_request_is_egress()detects overlay-delivered multicast CEGP traffic on the selected gateway node before the subscriber-map short-circuit inbpf/bpf_lxc.c::__tail_handle_ipv4.bpf/tests/tc_egressgw_redirect_multicast.c): IPv4 (CLIENT_IP→232.1.1.50 with 232.0.0.0/4 CEGP policy) and IPv6 (FF00::/8) paths both assertTC_ACT_REDIRECT.BPF verifier result (BLO-9893)
Run:
Blockcast/cilium· Actions Run 27328516192 —ubuntu-24.04runner, Cilium builder imageaf739f8db4e7f9368713e6bdbcb4dc8bc45cb7fd, clang-Werroractive.4 PASS, 0 FAIL. Two
Tunnel decapdebug traces confirm the overlay receive path executed correctly.Test plan
make run_bpf_tests BPF_TEST=tc_egressgw_redirect_multicast BPF_TEST_VERBOSE=1— 4 PASStc_egressgw_redirect_multicast.ccleanly with-Werror -mcpu=v3tc_egressgw*suite) — pending full suite runegressgw_status_check(ctx, {.status_code = TC_ACT_REDIRECT})in test harness🤖 Generated with Claude Code