mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 13:22:57 +00:00
dab4e1f06c
Extend the bpf_fib_lookup() helper by making it to return the source IPv4/IPv6 address if the BPF_FIB_LOOKUP_SRC flag is set. For example, the following snippet can be used to derive the desired source IP address: struct bpf_fib_lookup p = { .ipv4_dst = ip4->daddr }; ret = bpf_skb_fib_lookup(skb, p, sizeof(p), BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_SKIP_NEIGH); if (ret != BPF_FIB_LKUP_RET_SUCCESS) return TC_ACT_SHOT; /* the p.ipv4_src now contains the source address */ The inability to derive the proper source address may cause malfunctions in BPF-based dataplanes for hosts containing netdevs with more than one routable IP address or for multi-homed hosts. For example, Cilium implements packet masquerading in BPF. If an egressing netdev to which the Cilium's BPF prog is attached has multiple IP addresses, then only one [hardcoded] IP address can be used for masquerading. This breaks connectivity if any other IP address should have been selected instead, for example, when a public and private addresses are attached to the same egress interface. The change was tested with Cilium [1]. Nikolay Aleksandrov helped to figure out the IPv6 addr selection. [1]: https://github.com/cilium/cilium/pull/28283 Signed-off-by: Martynas Pumputis <m@lambda.lt> Link: https://lore.kernel.org/r/20231007081415.33502-2-m@lambda.lt Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> |
||
---|---|---|
.. | ||
bpf_sk_storage.c | ||
datagram.c | ||
dev.c | ||
dev.h | ||
dev_addr_lists.c | ||
dev_addr_lists_test.c | ||
dev_ioctl.c | ||
drop_monitor.c | ||
dst.c | ||
dst_cache.c | ||
failover.c | ||
fib_notifier.c | ||
fib_rules.c | ||
filter.c | ||
flow_dissector.c | ||
flow_offload.c | ||
gen_estimator.c | ||
gen_stats.c | ||
gro.c | ||
gro_cells.c | ||
gso.c | ||
hwbm.c | ||
link_watch.c | ||
lwt_bpf.c | ||
lwtunnel.c | ||
Makefile | ||
neighbour.c | ||
net-procfs.c | ||
net-sysfs.c | ||
net-sysfs.h | ||
net-traces.c | ||
net_namespace.c | ||
netclassid_cgroup.c | ||
netdev-genl-gen.c | ||
netdev-genl-gen.h | ||
netdev-genl.c | ||
netevent.c | ||
netpoll.c | ||
netprio_cgroup.c | ||
of_net.c | ||
page_pool.c | ||
pktgen.c | ||
ptp_classifier.c | ||
request_sock.c | ||
rtnetlink.c | ||
scm.c | ||
secure_seq.c | ||
selftests.c | ||
skbuff.c | ||
skmsg.c | ||
sock.c | ||
sock_destructor.h | ||
sock_diag.c | ||
sock_map.c | ||
sock_reuseport.c | ||
stream.c | ||
sysctl_net_core.c | ||
timestamping.c | ||
tso.c | ||
utils.c | ||
xdp.c |