{"action":"created","issue":{"url":"https://api.github.com/repos/cilium/cilium/issues/8639","repository_url":"https://api.github.com/repos/cilium/cilium","labels_url":"https://api.github.com/repos/cilium/cilium/issues/8639/labels{/name}","comments_url":"https://api.github.com/repos/cilium/cilium/issues/8639/comments","events_url":"https://api.github.com/repos/cilium/cilium/issues/8639/events","html_url":"https://github.com/cilium/cilium/pull/8639","id":471318526,"node_id":"MDExOlB1bGxSZXF1ZXN0MzAwMDMwNDI3","number":8639,"title":"bpf: Avoid redirect in bpf_netdev for NodePort","user":{"login":"brb","id":122571,"node_id":"MDQ6VXNlcjEyMjU3MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/122571?v=4","gravatar_id":"","url":"https://api.github.com/users/brb","html_url":"https://github.com/brb","followers_url":"https://api.github.com/users/brb/followers","following_url":"https://api.github.com/users/brb/following{/other_user}","gists_url":"https://api.github.com/users/brb/gists{/gist_id}","starred_url":"https://api.github.com/users/brb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brb/subscriptions","organizations_url":"https://api.github.com/users/brb/orgs","repos_url":"https://api.github.com/users/brb/repos","events_url":"https://api.github.com/users/brb/events{/privacy}","received_events_url":"https://api.github.com/users/brb/received_events","type":"User","site_admin":false},"labels":[{"id":721252768,"node_id":"MDU6TGFiZWw3MjEyNTI3Njg=","url":"https://api.github.com/repos/cilium/cilium/labels/area/datapath","name":"area/datapath","color":"bfdadc","default":false},{"id":403149902,"node_id":"MDU6TGFiZWw0MDMxNDk5MDI=","url":"https://api.github.com/repos/cilium/cilium/labels/pending-review","name":"pending-review","color":"fbca04","default":false},{"id":562648678,"node_id":"MDU6TGFiZWw1NjI2NDg2Nzg=","url":"https://api.github.com/repos/cilium/cilium/labels/priority/release-blocker","name":"priority/release-blocker","color":"b60205","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2019-07-22T20:40:02Z","updated_at":"2019-07-23T18:33:12Z","closed_at":"2019-07-23T18:17:04Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/cilium/cilium/pulls/8639","html_url":"https://github.com/cilium/cilium/pull/8639","diff_url":"https://github.com/cilium/cilium/pull/8639.diff","patch_url":"https://github.com/cilium/cilium/pull/8639.patch"},"body":"This commit makes bpf_netdev to return a packet to the stack if it is destined to a local endpoint instead of redirecting it to the endpoint's iface in the host netns.\r\n\r\nWe cannot redirect the packet, as then the packet bypasses `nf_conntrack` table which makes a second reply from the endpoint to be MASQUERADEd by the `CILIUM_POST` masquerade non-cluster rule or to be dropped by the k8s `--ctstate INVALID -j DROP` rule, depending on an input interface of the reply (`lxc_$ENDPOINT_ID`, `cilium_net`).\r\n\r\nSo, instead of adding more complexity to the rules, just `TC_ACT_OK` a request.\r\n\r\nAlso, get rid of `MARK_MAGIC_REPLY` as the problem it solves is no longer present when a `nf_conntrack` entry is created.\r\n\r\nWe will be able to do the redirect again once the `veth` mode gets a support for BPF NAT.\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.io/reviews/cilium/cilium/8639)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/cilium/cilium/issues/comments/514330488","html_url":"https://github.com/cilium/cilium/pull/8639#issuecomment-514330488","issue_url":"https://api.github.com/repos/cilium/cilium/issues/8639","id":514330488,"node_id":"MDEyOklzc3VlQ29tbWVudDUxNDMzMDQ4OA==","user":{"login":"borkmann","id":677393,"node_id":"MDQ6VXNlcjY3NzM5Mw==","avatar_url":"https://avatars1.githubusercontent.com/u/677393?v=4","gravatar_id":"","url":"https://api.github.com/users/borkmann","html_url":"https://github.com/borkmann","followers_url":"https://api.github.com/users/borkmann/followers","following_url":"https://api.github.com/users/borkmann/following{/other_user}","gists_url":"https://api.github.com/users/borkmann/gists{/gist_id}","starred_url":"https://api.github.com/users/borkmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/borkmann/subscriptions","organizations_url":"https://api.github.com/users/borkmann/orgs","repos_url":"https://api.github.com/users/borkmann/repos","events_url":"https://api.github.com/users/borkmann/events{/privacy}","received_events_url":"https://api.github.com/users/borkmann/received_events","type":"User","site_admin":false},"created_at":"2019-07-23T18:33:12Z","updated_at":"2019-07-23T18:33:12Z","author_association":"MEMBER","body":"(As discussed today with Martynas, tunnel mode does not need changes here since it's flying under the radar with netfilter conntrack due to the way we redirect, so conntrack never sees tunnel traffic for masquerading.)"}}
{"actor":{"display_login":"borkmann"}}