Merge pull request #9159 from tomastigera/tomas-bpf-fix-notrack

[BPF] disable conntrack bypass, exclude link-local
projectcalico · Oct 18, 2024 · dfc45a0 · dfc45a0
2 parents c5b4ffe + 02a1c33
commit dfc45a0
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 1 deletion.
diff --git a/felix/config/config_params.go b/felix/config/config_params.go
@@ -196,7 +196,7 @@ type Config struct {
 	BPFMapSizeConntrack                int               `config:"int;512000;non-zero"`
 	BPFMapSizeIPSets                   int               `config:"int;1048576;non-zero"`
 	BPFMapSizeIfState                  int               `config:"int;1000;non-zero"`
-	BPFHostConntrackBypass             bool              `config:"bool;true"`
+	BPFHostConntrackBypass             bool              `config:"bool;false"`
 	BPFEnforceRPF                      string            `config:"oneof(Disabled,Strict,Loose);Loose;non-zero"`
 	BPFPolicyDebugEnabled              bool              `config:"bool;true"`
 	BPFForceTrackPacketsFromIfaces     []string          `config:"iface-filter-slice;docker+"`

diff --git a/felix/fv/bpf_test.go b/felix/fv/bpf_test.go
@@ -5576,6 +5576,12 @@ func conntrackFlushWorkloadEntries(felixes []*infrastructure.Felix) func() {
 }
 
 func conntrackChecks(felixes []*infrastructure.Felix) []interface{} {
+	if felixes[0].ExpectedIPIPTunnelAddr != "" ||
+		felixes[0].ExpectedWireguardTunnelAddr != "" ||
+		felixes[0].ExpectedWireguardV6TunnelAddr != "" {
+		return nil
+	}
+
 	return []interface{}{
 		CheckWithInit(conntrackFlushWorkloadEntries(felixes)),
 		CheckWithFinalTest(conntrackCheck(felixes)),

diff --git a/felix/rules/static.go b/felix/rules/static.go
@@ -1207,6 +1207,25 @@ func (r *DefaultRuleRenderer) StaticBPFModeRawChains(ipVersion uint8,
 			}
 		}
 
+		switch ipVersion {
+		case 4:
+			bpfUntrackedFlowRules = append(bpfUntrackedFlowRules,
+				generictables.Rule{
+					Match:   r.NewMatch().DestNet("169.254.0.0/16"),
+					Action:  r.Return(),
+					Comment: []string{"link-local"},
+				},
+			)
+		case 6:
+			bpfUntrackedFlowRules = append(bpfUntrackedFlowRules,
+				generictables.Rule{
+					Match:   r.NewMatch().DestNet("fe80::/10"),
+					Action:  r.Return(),
+					Comment: []string{"link-local"},
+				},
+			)
+		}
+
 		bpfUntrackedFlowRules = append(bpfUntrackedFlowRules,
 			generictables.Rule{
 				Match:   r.NewMatch().MarkMatchesWithMask(tcdefs.MarkSeenSkipFIB, tcdefs.MarkSeenSkipFIB),

diff --git a/felix/rules/static_test.go b/felix/rules/static_test.go
@@ -1832,6 +1832,11 @@ var _ = Describe("Static", func() {
 
 	Describe("with BPF mode raw chains", func() {
 		staticBPFModeRawRules := []generictables.Rule{
+			{
+				Match:   Match().DestNet("169.254.0.0/16"),
+				Action:  ReturnAction{},
+				Comment: []string{"link-local"},
+			},
 			{
 				Match:   Match().MarkMatchesWithMask(0x1100000, 0x1100000),
 				Action:  ReturnAction{},