You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: eBPF ingress/egress TC program for cilium external LB (#2710)
* tc egress + ingress bpf program for external lb dualstack svcs
* changes work with ip -6 neigh add for LL
* adding README and updated printk
* use helper func to compare IPs
* fix checksum
* prep makefile changes for future image installs
* remove generated files, update paths, addressing comments
* remove old path
* update dockerfile for bpf-tc
* implement zap logging
* update dockerfile
* create qdisc before cilium so initcontainer can start bpf-tc to attach filters
* addressing comments and change use debug macro for prints
* remove checksum flag
* logs to outfile
* reduce image size, run nft delete in main.go, delete filters if they exist before adding on restart
* rename to ipv6-hp-bpf
* reorder load_bytes
* delete filter by name
`ipv6-hp-bpf` is a project that leverages eBPF (Extended Berkeley Packet Filter) technology for traffic control in Linux kernel. This is a POC to fix external load balancer services in cilium dualstack clusters.
4
+
5
+
## Description
6
+
7
+
The goal of this bpf program is to fix the issue described [here](https://github.com/cilium/cilium/issues/31326). It includes both egress and ingress TC programs. These programs are meant to replace the nftable rules since they don't work on cilium clusters.
8
+
The egress bpf code converts the destination IPv6 of the packet from global unicast to link local, and ingress converts the source IPv6 from link local to global unicast.
9
+
10
+
## Usage
11
+
12
+
Follow the steps below to compile the program and install it onto your node:
13
+
14
+
1. Use the make command to build the binary or follow the steps below.
15
+
```bash
16
+
make ipv6-hp-bpf-binary
17
+
```
18
+
19
+
2. Copy the new binary to your node(s).
20
+
21
+
3. Remove the nftable rules for ipv6 with the following commands:
22
+
```bash
23
+
nft delete chain ip6 azureSLBProbe postrouting
24
+
nft delete chain ip6 azureSLBProbe prerouting
25
+
nft -n list table ip6 azureSLBProbe
26
+
```
27
+
28
+
4. Start the program with:
29
+
```bash
30
+
./ipv6-hp-bpf
31
+
```
32
+
5. Debugging logs can be seen in the node under `/sys/kernel/debug/traceing/trace_pipe`
33
+
34
+
## Manual Compilation
35
+
For testing purposes you can compile the bpf program without go, and attach it to the interface yourself. This is how you would do it for egress:
36
+
```bash
37
+
clang -O2 -g -target bpf -c egress.c -o egress.o
38
+
```
39
+
40
+
This will generate the egress.o file, which you can copy over to your cluster's node.
41
+
To copy to the node you need to create a node-shell instance
42
+
```bash
43
+
kubectl cp egress.o nsenter-xxxxx:<path-in-node>
44
+
```
45
+
46
+
Since this is for cilium clusters, cilium already creates a qdisc on eth0 of type clsact (which allows both ingress and egress filters to be attached). If cilium is not installed, you would have to create the qdisc on your own by doing the following:
47
+
```bash
48
+
tc qdisc add dev eth0 clsact
49
+
```
50
+
51
+
## Attach the filter
52
+
```bash
53
+
tc filter add dev eth0 egress prio 1 bpf da obj egress.o sec classifier
0 commit comments