Hello:
This series was applied to bpf/bpf-next.git (net)
by Martin KaFai Lau <martin.lau@xxxxxxxxxx>:
On Fri, 4 Oct 2024 12:13:31 +0200 you wrote:
> Jordan reported that when running Cilium with netkit in per-endpoint-routes
> mode, network policy misclassifies traffic. In this direct routing mode
> of Cilium which is used in case of GKE/EKS/AKS, the Pod's BPF program to
> enforce policy sits on the netkit primary device's egress side.
>
> The issue here is that in case of netkit's netkit_prep_forward(), it will
> clear meta data such as skb->mark and skb->priority before executing the
> BPF program. Thus, identity data stored in there from earlier BPF programs
> (e.g. from tcx ingress on the physical device) gets cleared instead of
> being made available for the primary's program to process. While for traffic
> egressing the Pod via the peer device this might be desired, this is
> different for the primary one where compared to tcx egress on the host
> veth this information would be available.
>
> [...]
Here is the summary with links:
- [bpf-next,v2,1/5] netkit: Add option for scrubbing skb meta data
https://git.kernel.org/bpf/bpf-next/c/83134ef46093
- [bpf-next,v2,2/5] netkit: Simplify netkit mode over to use NLA_POLICY_MAX
https://git.kernel.org/bpf/bpf-next/c/0ebe224ffce8
- [bpf-next,v2,3/5] netkit: Add add netkit scrub support to rt_link.yaml
https://git.kernel.org/bpf/bpf-next/c/7b9b713b8ef3
- [bpf-next,v2,4/5] tools: Sync if_link.h uapi tooling header
https://git.kernel.org/bpf/bpf-next/c/107525833bce
- [bpf-next,v2,5/5] selftests/bpf: Extend netkit tests to validate skb meta data
https://git.kernel.org/bpf/bpf-next/c/716fa7dadf11
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
