bpf: lxc: split forwarding section from handle_ipv*_from_lxc()#43226
Merged
julianwiedmann merged 2 commits intomainfrom Dec 16, 2025
Merged
bpf: lxc: split forwarding section from handle_ipv*_from_lxc()#43226julianwiedmann merged 2 commits intomainfrom
julianwiedmann merged 2 commits intomainfrom
Conversation
Member
Author
|
/test |
aditighag
approved these changes
Dec 15, 2025
Member
aditighag
left a comment
There was a problem hiding this comment.
LGTM! I think you need to rebase the PR to trigger the L3L4 and L7 workflows.
Take the whole tail-end of handle_ipv6_from_lxc(), and move it into its own function. This will allow us to re-use the code from other contexts which need to forward a packet to its destination. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Take the whole tail-end of handle_ipv4_from_lxc(), and move it into its own function. This will allow us to re-use the code from other contexts which need to forward a packet to its destination. Co-authored-by: Anton Ippolitov <anton.ippolitov@datadoghq.com> Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
74775e3 to
c3c7b47
Compare
Member
Author
|
/test |
This was referenced Dec 16, 2025
6 tasks
smagnani96
added a commit
that referenced
this pull request
Mar 16, 2026
[ upstream commit ea17ed8 ] [ backporter's notes: * using macro CILIUM_HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported. * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported. ] In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
smagnani96
added a commit
that referenced
this pull request
Mar 16, 2026
[ upstream commit ea17ed8 ] [ backporter's notes: * using macro CILIUM_HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported. * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported. ] In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
smagnani96
added a commit
that referenced
this pull request
Mar 16, 2026
[ upstream commit ea17ed8 ] [ backporter's notes: * using macro HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported. * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported. ] In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Mar 16, 2026
[ upstream commit ea17ed8 ] [ backporter's notes: * using macro CILIUM_HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported. * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported. ] In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Mar 16, 2026
[ upstream commit ea17ed8 ] [ backporter's notes: * using macro HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported. * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported. ] In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(in two patches to keep it manageable, and to make the diff look pretty.)
@antonipp mentioned that sorting out the refactor pre-work for landing #42068 is a bit of a pain. Let's keep it super-straightforward and hopefully merge this quickly, without hitting conflicts.
Even if #42068 then doesn't land immediately, splitting this big function into more reasonable pieces makes sense to me on its own.