Re: [PATCH bpf-next v2 1/5] netkit: Add option for scrubbing skb meta data

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (net)
by Martin KaFai Lau <martin.lau@kernel.org>:

On Fri,  4 Oct 2024 12:13:31 +0200 you wrote:
> Jordan reported that when running Cilium with netkit in per-endpoint-routes
> mode, network policy misclassifies traffic. In this direct routing mode
> of Cilium which is used in case of GKE/EKS/AKS, the Pod's BPF program to
> enforce policy sits on the netkit primary device's egress side.
> 
> The issue here is that in case of netkit's netkit_prep_forward(), it will
> clear meta data such as skb->mark and skb->priority before executing the
> BPF program. Thus, identity data stored in there from earlier BPF programs
> (e.g. from tcx ingress on the physical device) gets cleared instead of
> being made available for the primary's program to process. While for traffic
> egressing the Pod via the peer device this might be desired, this is
> different for the primary one where compared to tcx egress on the host
> veth this information would be available.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/5] netkit: Add option for scrubbing skb meta data
    https://git.kernel.org/bpf/bpf-next/c/83134ef46093
  - [bpf-next,v2,2/5] netkit: Simplify netkit mode over to use NLA_POLICY_MAX
    https://git.kernel.org/bpf/bpf-next/c/0ebe224ffce8
  - [bpf-next,v2,3/5] netkit: Add add netkit scrub support to rt_link.yaml
    https://git.kernel.org/bpf/bpf-next/c/7b9b713b8ef3
  - [bpf-next,v2,4/5] tools: Sync if_link.h uapi tooling header
    https://git.kernel.org/bpf/bpf-next/c/107525833bce
  - [bpf-next,v2,5/5] selftests/bpf: Extend netkit tests to validate skb meta data
    https://git.kernel.org/bpf/bpf-next/c/716fa7dadf11

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html