8000 [v1.16] bpf: wireguard: avoid ipcache lookup for source's security identity by julianwiedmann · Pull Request #38683 · cilium/cilium · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[v1.16] bpf: wireguard: avoid ipcache lookup for source's security identity #38683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 6 commits into from
Closed

[v1.16] bpf: wireguard: avoid ipcache lookup for source's security identity #38683

wants to merge 6 commits into from

Conversation

julianwiedmann
Copy link
Member
@julianwiedmann julianwiedmann commented Apr 2, 2025 •
edited
Loading

@maintainer-s-little-helper maintainer-s-little-helper bot added backport/1.16 This PR represents a backport for Cilium 1.16.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master. labels Apr 2, 2025
@julianwiedmann
Copy link
Member Author

/test

julianwiedmann and others added 6 commits April 3, 2025 09:12
@julianwiedmann
bpf: wireguard: simplify overlay path
a989910 
[ upstream commit 979f335 ]

Pull the goto statement up to clean up an extra level of indirection.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@smagnani96 @julianwiedmann
moving MARK_MAGIC_WG_ENCRYPTED check into a separate function
db27d7e 
[ upstream commit 98f25f3 ]

This commit refactors into a separate function `ctx_mark_is_wireguard` the
check whether the packet mark contains the`MARK_MAGIC_WG_ENCRYPTED` or not.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@smagnani96 @julianwiedmann
bpf:nat: skip SNAT in to-netdev for WireGuard traffic
58e9852 
[ upstream commit ca18209 ]

This commit adds a check to skip SNAT in case of WireGuard traffic. For
certain configs, such as when the node-to-node IPv4 address is equal to
IPV4_MASQUERADE or IPV4_DIRECT_ROUTING, our engine detects that it
potentially conflicts with, for instance, masqueraded traffic.

Creating SNAT entries for WireGuard makes little sense, especially
considering that replies will be addressed by the WG_PORT.

Avoiding such SNAT tracking slightly reduces the pressure on the CT
and NAT maps. Here there's and example of the content of the `nat` map
before applying this patch (note the two WireGuard-related entries):

```bash
UDP OUT 172.18.0.4:51871 -> 172.18.0.3:51871 XLATE_SRC 172.18.0.4:51871 Created=13606sec ago NeedsCT=1
UDP IN 172.18.0.3:51871 -> 172.18.0.4:51871 XLATE_DST 172.18.0.4:51871 Created=13606sec ago NeedsCT=1
```

Part of: cilium#34089

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@julianwiedmann
bpf: host: identify Cilium's Wireguard traffic as from HOST
e17bee0 
[ upstream commit a321ba4 ]

This improves the information in the trace notifications, and allows us to
skip the EgressGW policy handling. It also matches the expected security
identity when performing an ipcache lookup for the source IP.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@julianwiedmann
bpf: let MARK_MAGIC_EGW_DONE carry source identity
d7dda8b 
[ upstream commit 19c6d09 ]

This might help to improve the to-netdev program in a future release,
once we can trust that bpf_overlay has been re-generated.

While at it also document that MARK_MAGIC_OVERLAY carries the identity.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@julianwiedmann
bpf: wireguard: avoid ipcache lookup for source's security identity
37c870c 
[ upstream commit e8543ee ]

When the wireguard hook in to-netdev decides whether the packet should be
encrypted, it considers the source's security identity. For this it
currently looks up the source IP in the ipcache.

But for a typical packet that exited a local pod, the from-container
program also provides the source identity through the skb->mark. And the
to-netdev program already extracts this identity - so we just need to pass
this through to the wireguard hook.

This in particular helps for packets where the source endpoint has already
been torn down by the time that the packet reaches the to-netdev program
at a native network interface. Currently the source identity for such a
packet is selected as WORLD_ID, and the packet therefore skips encryption.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@julianwiedmann
Copy link
Member Author

/test

@julianwiedmann
Copy link
Member Author
julianwiedmann commented Apr 4, 2025 •
edited
Loading

switching to a branch in the repo: #38747

@julianwiedmann julianwiedmann deleted the v1.16-wg-identity branch April 4, 2025 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
backport/1.16 This PR represents a backport for Cilium 1.16.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@julianwiedmann @smagnani96
0