Support outputting and filtering by vxlan/geneve tunnel data#494
Support outputting and filtering by vxlan/geneve tunnel data#494smagnani96 merged 2 commits intocilium:mainfrom
Conversation
e757528 to
698e31d
Compare
smagnani96
left a comment
There was a problem hiding this comment.
Great contrib, I really like to filter by vxlan/geneve.
I mostly left nits and questions for my understanding, but the PR LGTM.
I'm almost sure the IPv4/IPv6-related questions are because we don't support the ip6 filter in pwru. In that case, its support is out-of-scope for this PR as it is a more general concern. But I might be wrong, so please let met know 🙏
6628f53 to
6363aaf
Compare
smagnani96
left a comment
There was a problem hiding this comment.
Thanks! Looks all good except one last bit concerning the l4_off computation in case of an IPv6 packet.
I've also added some non-blocking comments for potential improvements by using skb->inner_X and skb->encapsulation bit.
7e52831 to
6c2ff6e
Compare
smagnani96
left a comment
There was a problem hiding this comment.
Tom, many thanks for the PR!
I very much like the way it is, BPF changes are clean and very readable.
(CI broken?)
I'm leaving this pointer (cilium/cilium#38374) just for future reference: skb->inner_X seems to work even when skb->encapsulation is erroneously not set. If this will not be true anymore in future, we'll have to manually check UDP ports.
|
@smagnani96 |
b704a7e to
8b6a01c
Compare
If the flag is enabled, packets that appear to be vxlan encapsulated will have the filtering function applied. Note: Therefore, to avoid getting non-vxlan traffic you will want to apply a general pcap filter on the vxlan udp ports. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Trying to use a l2 based expression such as 'host ether xx-xx-xx-xx-xx-xx' results in a error as it is not a valid l3 expression (thus compilation fails) however, in order to be able to have both l2&l3 expressions we need to seperate out the flags and pass them seperately. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
8b6a01c to
1d9a4d0
Compare
If the flag is enabled, packets that appear to be vxlan encapsulated will have the filtering function applied. Note: Therefore, to avoid getting non-vxlan traffic you will want to apply a general pcap filter on the vxlan udp ports.
As well, the flag --output-tunnel will result in output of vxlan header data (i.e. flag/vin) as well as inner address tuple.
Example Output
Follow up work