bpf:wireguard: delivery host packets to bpf_host for ingress policies#42892
bpf:wireguard: delivery host packets to bpf_host for ingress policies#42892julianwiedmann merged 1 commit intomainfrom
Conversation
c41c7b9 to
2405bac
Compare
|
/test |
2405bac to
97aa39d
Compare
|
fyi: given I'll backport this to v1.18 once finished, bpf tests have not been written in scapy-like language. |
97aa39d to
a624bbc
Compare
a624bbc to
5bf395b
Compare
|
For the last patch:
I believe that's not accurate - So if we now want to always forward an identity, then we also need to unconditionally resolve it (which feels like a reasonable choice to me). |
5bf395b to
6b489a1
Compare
|
Many many thanks Julian. Your input was essential here. It took me a while, but I think we're close now.
I moved the whole removal of
It was not easy for me, but I think now I understand it slightly better. Will need to update the BPF test accordingly, doing it right now. |
f70bf2f to
105e10e
Compare
6547155 to
a4ecfef
Compare
|
I tried to enable HostFirewall in CI in the unique config in which we have WireGuard+NativeRouting+NodeEncryption. EDIT: branched off CI tests into a separate PR, which will be used for testing this feature. (#43450) |
9227d89 to
f45ba7b
Compare
|
Cherry-picked this commit and enabled testing in |
This effectively restores HostFw for WireGuard.
Prior to this, we were erroneously always returning to the stack all
packets destined for local host, skipping the HostFw policies if enabled.
With this patch, packets for local host will always be delivered to
cilium_net@egress, similarly to what we do in bpf_overlay after decap.
With HostFw enabled, the to-host program in `cilium_host@ingress` will
then enforce policies.
This patch does not affect packets for local endpoint:
* With BPF Host Routing: will be directly delivered to the pod, tail
calling into its ep->lxc_id function to enforce ingress policies.
* Without BPF Host Routing: will return to stack, which then goes to its
to-container installed program to match ingress policies.
Trying to pull-in the whole `host_firewall.h` and `policy.h` would require
to set bpf_wireguard similarly as we do for bpf_host, meaning assigning
an endpoint ID, otherwise host policies would block all host related
packets (ep id == 0). For this reason, we decide here to go through cilium_host.
From a bpf test perspective:
* no changes for packet to/from local endpoint INGRESS/EGRESS
* no changes for packet from local host EGRESS
* packet to local host INGRESS: differently than bpf_host, in WireGuard
we always redirect to cilium_host@ingress.
While fixing this bits, let's move the superfluous `revalidate_data`
post NodePort inside the NodePort code, as not needed otherwise.
Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
f45ba7b to
3b9daea
Compare
|
/test |
In previous PR #39239, we enabled marking the decrypted packet in bpf_wireguard with MARK_MAGIC_DECRYPT only when ENABLE_IDENTITY_MARK is enabled. This is because w/o ENABLE_IDENTITY_MARK, marking the packet causes issues with AWS, probably due to overlapping marks. Now that #42892 is merged, we either deliver the packet to the endpoint or to cilium_host, so we can always safely mark the decrypted packet. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This effectively restores HostFw for WireGuard.
Prior to this, we were erroneously always returning to the stack all
packets destined for local host, skipping the HostFw policies if enabled.
With this patch, packets for local host will always be delivered to
cilium_net@egress, similarly to what we do in bpf_overlay after decap.
With HostFw enabled, the to-host program in
cilium_host@ingresswillthen enforce policies.
This patch does not affect packets for local endpoint:
calling into its ep->lxc_id function to enforce ingress policies.
to-container installed program to match ingress policies.
Trying to pull-in the whole
host_firewall.handpolicy.hwould requireto set bpf_wireguard similarly as we do for bpf_host, meaning assigning
an endpoint ID, otherwise host policies would block all host related
packets (ep id == 0). For this reason, we decide here to go through cilium_host.
From a bpf test perspective:
we always redirect to cilium_host@ingress.
While fixing this bits, let's move the superfluous
revalidate_datapost NodePort inside the NodePort code, as not needed otherwise.