Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do wep rpf and natOutgoing SNAT only for icmpv6 only if src is not link local #8679

Merged
merged 2 commits into from
Apr 2, 2024
Merged

Do wep rpf and natOutgoing SNAT only for icmpv6 only if src is not link local #8679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9cf643f
Do wep rpf check for icmpv6 if src is not link local
sridhartigera Apr 1, 2024
9555d01
Add FV test
sridhartigera Apr 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion felix/bpf-gpl/ip_addr.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ static CALI_BPF_INLINE int ipv6_addr_t_cmp(ipv6_addr_t *x, ipv6_addr_t *y)
}

#define ip_void(ip) ((ip).a == 0 && (ip).b == 0 && (ip).c == 0 && (ip).d == 0)
#define ip_link_local(ip) (bpf_htonl((ip).a) == 0xfe800000)
#define ip_link_local(ip) ((bpf_htonl((ip).a) & (0xffc00000)) == 0xfe800000)
#define VOID_IP ({ipv6_addr_t x = {}; x;})
#define ip_set_void(ip) do { \
(ip).a = 0; \
Expand Down
2 changes: 1 addition & 1 deletion felix/bpf-gpl/tc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,7 +456,7 @@ static CALI_BPF_INLINE void calico_tc_process_ct_lookup(struct cali_tc_ctx *ctx)

if (CALI_F_FROM_WEP
#ifdef IPVER6
&& ctx->state->ip_proto != IPPROTO_ICMPV6
&& !(ctx->state->ip_proto == IPPROTO_ICMPV6 && ip_link_local(ctx->state->ip_src))
#endif
) {
struct cali_rt *r = cali_rt_lookup(&ctx->state->ip_src);
Expand Down
25 changes: 25 additions & 0 deletions felix/fv/bpf_dual_stack_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
"context"
"fmt"
"net"
"regexp"
"strconv"

v1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -377,6 +378,30 @@ func describeBPFDualStackTests(ctlbEnabled, ipv6Dataplane bool) bool {
cc.Expect(Some, w[1][1], w[0][0], ExpectWithIPVersion(6))
cc.CheckConnectivity()
})

It("should be able to ping external client from w[0][0]", func() {
tc.TriggerDelayedStart()
externalClient := infrastructure.RunExtClient("ext-client")
_ = externalClient
ensureRightIFStateFlags(tc.Felixes[0], ifstate.FlgIPv4Ready|ifstate.FlgIPv6Ready)
ensureRightIFStateFlags(tc.Felixes[1], ifstate.FlgIPv4Ready|ifstate.FlgIPv6Ready)

tcpdump := externalClient.AttachTCPDump("any")
tcpdump.SetLogEnabled(true)
matcher := fmt.Sprintf("IP6 %s > %s: ICMP6, echo request",
felixIP6(0), externalClient.IPv6)

tcpdump.AddMatcher("ICMP", regexp.MustCompile(matcher))
tcpdump.Start()
defer tcpdump.Stop()

_, err := w[0][0].ExecCombinedOutput("ping6", "-c", "2", externalClient.IPv6)
Expect(err).NotTo(HaveOccurred())
Eventually(func() int { return tcpdump.MatchCount("ICMP") }).
Should(BeNumerically(">", 0), matcher)
externalClient.Stop()

})
}
} else {
JustBeforeEach(func() {
Expand Down