On Tue, Aug 16, 2022 at 05:07:27PM +0200, Paul Chaignon wrote:
On Tue, Aug 16, 2022 at 04:47:30PM +0200, Greg Kroah-Hartman wrote:
On Tue, Aug 16, 2022 at 04:35:54PM +0200, Paul Chaignon wrote:
On Mon, Aug 15, 2022 at 07:58:13PM +0200, Greg Kroah-Hartman wrote:
From: Paul Chaignon paul@isovalent.com
[ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]
Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"") added support for getting and setting the outer source IP of encapsulated packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change allows BPF programs to set any IP address as the source, including for example the IP address of a container running on the same host.
In that last case, however, the encapsulated packets are dropped when looking up the route because the source IP address isn't assigned to any interface on the host. To avoid this, we need to set the FLOWI_FLAG_ANYSRC flag.
This fix will also require upstream commits 861396ac0b47 ("geneve: Use ip_tunnel_key flow flags in route lookups") and 7e2fb8bc7ef6 ("vxlan: Use ip_tunnel_key flow flags in route lookups") to have the intended effect. In short, these two commits "consume" the new field introduced in 451ef36bd229 ("ip_tunnels: Add new flow flags field to ip_tunnel_key") and populated in the present commit.
Ick. Is it better to just drop this commit instead? Or is it ok to also backport those 2 patches to 5.19.y?
It should be okay to backport those additional 2 patches to 5.19.y.
Thanks, both queued up now.
greg k-h