bpf,lxc: do not pass non-routed traffic to stack when tbid is explicit#45061
bpf,lxc: do not pass non-routed traffic to stack when tbid is explicit#45061
Conversation
aspsk
left a comment
There was a problem hiding this comment.
The change looks good.
Out of curiosity, was there a real use-case where this happened?
|
@aspsk not yet since we are still developing the 'VRF' isolation. But in non-production testing this case has came up. Traffic we expected to get dropped when we flushed the VRF specific table was still traversing the host and going out the wrong link. |
julianwiedmann
left a comment
There was a problem hiding this comment.
Traffic we expected to get dropped when we flushed the VRF specific table was still traversing the host and going out the wrong link.
Ah, I was wondering about that. Was expecting that such a dedicated routing table would always contain at least one default route that drops all matching traffic, so we don't leak into the regular routing setup. But that won't help if the whole dedicated table is flushed ...
Do not drop `BPF_FIB_LKUP_RET_NOT_FWDED` traffic when tbid is explicitly set. When tbid is explicitly set, we are forcing the pod's egress routing to be part of a specific routing domain. If this routing domain does not have a specific route toward the destination we must drop it, not push it to stack. A push to stack here would cause the egress packet to leak into the stack's routing domain and potentially take an unexpected next hop to the destination. Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>
b900240 to
d02705c
Compare
|
/test |
1 similar comment
|
/test |
Do not drop
BPF_FIB_LKUP_RET_NOT_FWDEDtraffic when tbid is explicitlyset.
When tbid is explicitly set, we are forcing the pod's egress routing to
be part of a specific routing domain.
If this routing domain does not have a specific route toward the
destination we must drop it, not push it to stack.
A push to stack here would cause the egress packet to leak into the
stack's routing domain and potentially take an unexpected next hop to
the destination.