Skip to content

Ingress proxy is ignored if both egress and ingress are in path of two local endpoints #1456

@tgraf

Description

@tgraf

[endpoint1] - [proxy1] - [proxy2] - [endpoint2]

The datapath currently makes the following assumption:

        orig_was_proxy = ip4->saddr == IPV4_GATEWAY;

The meaning of this bool is to indicate whether this is a reply packet that came from the proxy.

This is wrong if:

  • the source is a local process on the local host other than the proxy
  • the source is an egress proxy sending to another local endpoint

Metadata

Metadata

Assignees

Labels

kind/bugThis is a bug in the Cilium logic.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions