bpf: service loopback for ipv6 by saiaunghlyanhtet · Pull Request #39594 · cilium/cilium

saiaunghlyanhtet · 2025-05-17T12:29:30Z

Service Loopback IPv6

IPv6 support for pods connecting to themselves via a k8s service ("service loopback").

bpf/lib/lb.h

pkg/node/local_node_store.go

bpf/include/bpf/config/node.h

saiaunghlyanhtet · 2025-06-08T08:12:47Z

@jrife I have changed to serivce_loopback_ipv6. If you have free time, can you have a look at it?. Currently, I am stuck at the condition in which source ip is not translated back to the service cluster IP. I think that the reverse NAT for the reply path is not being applied correctly. But, I have no idea which is going wrong.

The logs show multiple SYN packets from [fd00:10:244:1::dc8e]:53060 to [fd00:10:96::cd54]:80, indicating that the client is retransmitting SYN packets, likely because it is not receiving properly formatted replies.

$ k exec -ti -n kube-system cilium-qz7tt -- cilium-dbg monitor --related-to 542

Listening for events on 8 CPUs with 64x4096 of shared memory
Press Ctrl-C to quit
time=2025-06-08T07:43:34.15455902Z level=info msg="Initializing dissection cache..."
<- endpoint 542 flow 0x70e2ab0d , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:53060 -> [fd00:10:96::cd54]:80 tcp SYN
-> endpoint 542 flow 0x70e2ab0d , identity 20084->20084 state new ifindex lxc14f4f090a3e0 orig-ip fd00::1: [fd00::1]:53060 -> [fd00:10:244:1::dc8e]:80 tcp SYN
<- endpoint 542 flow 0xcfd94455 , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0xcfd94455 , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0xc34aebbb , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:53060 -> [fd00:10:96::cd54]:80 tcp SYN
-> endpoint 542 flow 0xc34aebbb , identity 20084->20084 state established ifindex lxc14f4f090a3e0 orig-ip fd00::1: [fd00::1]:53060 -> [fd00:10:244:1::dc8e]:80 tcp SYN
<- endpoint 542 flow 0x8c902078 , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0x8c902078 , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0x15fde42f , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0x15fde42f , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0xfb86fd56 , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:53060 -> [fd00:10:96::cd54]:80 tcp SYN
-> endpoint 542 flow 0xfb86fd56 , identity 20084->20084 state established ifindex lxc14f4f090a3e0 orig-ip fd00::1: [fd00::1]:53060 -> [fd00:10:244:1::dc8e]:80 tcp SYN
<- endpoint 542 flow 0xf6a6963b , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0xf6a6963b , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0x3f4fed5 , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:53060 -> [fd00:10:96::cd54]:80 tcp SYN
-> endpoint 542 flow 0x3f4fed5 , identity 20084->20084 state established ifindex lxc14f4f090a3e0 orig-ip fd00::1: [fd00::1]:53060 -> [fd00:10:244:1::dc8e]:80 tcp SYN
<- endpoint 542 flow 0xce35e2bf , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0xce35e2bf , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0x72c6a27e , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
-> endpoint 542 flow 0x72c6a27e , identity 20084->20084 state reply ifindex lxc14f4f090a3e0 orig-ip fd00:10:244:1::dc8e: [fd00:10:244:1::dc8e]:80 -> [fd00::1]:53060 tcp SYN, ACK
<- endpoint 542 flow 0x0 , identity 20084->unknown state unknown ifindex 0 orig-ip 0.0.0.0: fe80::8034:dfff:fe01:1dbf -> fd00:10:244:1::6ec8 icmp NeighborSolicitation

Documentation/cmdref/cilium-agent.md

bpf/bpf_lxc.c

bpf/lib/lb.h

bpf/tests/tc_nodeport_test.c

pkg/datapath/loader/config.go

jrife · 2025-06-09T19:45:11Z

Currently, I am stuck at the condition in which source ip is not translated back to the service cluster IP. I think that the reverse NAT for the reply path is not being applied correctly. But, I have no idea which is going wrong.

Off the top of my head, I'm not sure. I may have some time later this week to look at it in a bit more detail. In the meantime, I left a few comments. I'd recommend fixing whatever unit tests and checkpatch checks are failing and try testing again. The checkpatch stuff is likely similar to some of the formatting stuff I commented on.

bpf/bpf_lxc.c

pkg/monitor/datapath_debug.go

api/v1/flow/flow.proto

ti-mo

Thanks!

gandro

Thanks for the PR. Unfortunately I think there are some minor changes needed

bpf/lib/dbg.h

- add DebugEventType DBG_LB6_LOOPBACK_SNAT, DBG_LB6_LOOPBACK_SNAT_REV - regenerate flow.pb.go Signed-off-by: saiaunghlyanhtet <[email protected]>

Add agent-side support to enable IPv6 service loopback handling so that connections to a service’s own ClusterIP from a backend pod loop back correctly. Summary of changes: - Extend service / LB logic to recognize and mark IPv6 loopback scenarios - Introduce service_loopback_ipv6 runtime variable for IPv6 service loopback support Signed-off-by: saiaunghlyanhtet <[email protected]>

Introduce datapath logic to support IPv6 service loopback so that packets originating from a pod targeting its own service ClusterIP are correctly short-circuited and subject to the standard LB/rev-NAT path without external detours. Adjust service lookup / backend selection and reverse NAT handling for IPv6 loopback. Signed-off-by: saiaunghlyanhtet <[email protected]>

hairpin_flow_1_forward_v6: Test that sending a packet from a pod to its own IPv6 service gets source NAT-ed with the service loopback IPv6 address and is correctly forwarded to the pod's veth interface. Verifies SNAT behavior and connection tracking entries for IPv6 hairpin traffic. hairpin_flow_2_forward_ingress_v6: Test the ingress path for IPv6 hairpin flows where a packet from the service loopback address to a pod creates the appropriate connection tracking entry on the ingress side with the loopback flag. hairpin_flow_3_reverse_v6: Test that return traffic in an IPv6 hairpin flow (from pod back to service loopback address) is correctly handled and forwarded without any address translation, maintaining the original flow semantics. hairpin_flow_4_reverse_ingress_v6: Test the reverse direction ingress path for IPv6 hairpin flows where return traffic gets NAT-ed back to the original service IP address, completing the hairpin loop and ensuring the client sees responses from the expected service address. tc_drop_no_backend_v6: Test that IPv6 packets destined to a service with no available backends are correctly dropped with TC_ACT_SHOT, ensuring proper error handling for unavailable IPv6 services. Signed-off-by: saiaunghlyanhtet <[email protected]>

gandro

Thanks!

pchaigno · 2025-09-04T10:02:48Z

/test

julianwiedmann · 2025-09-04T12:20:55Z

great stuff @saiaunghlyanhtet, glad to see this finally land! 🚀

I added a release-note stanza to the PR description, so that this shows up properly in the releases notes for v1.19. Feel free to polish the wording as you see fit :).

pchaigno · 2025-09-04T12:57:08Z

Congrats on getting this in @saiaunghlyanhtet! Your swift iterations on reviews made a big difference, especially for the details at the end 🙂 Don't hesitate to reach out if you need help on anything else!

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 17, 2025

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch 2 times, most recently from c6b7c0b to 1052f70 Compare May 17, 2025 14:18

julianwiedmann reviewed May 19, 2025

View reviewed changes

bpf/lib/lb.h Outdated Show resolved Hide resolved

bpf/lib/lb.h Outdated Show resolved Hide resolved

pkg/node/local_node_store.go Outdated Show resolved Hide resolved

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch 7 times, most recently from b91865f to 62fa8cf Compare May 27, 2025 14:22

julianwiedmann added release-note/minor This PR changes functionality that users may find relevant to operating Cilium. feature/ipv6 Relates to IPv6 protocol support area/loadbalancing Impacts load-balancing and Kubernetes service implementations labels May 28, 2025

maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 28, 2025

julianwiedmann added area/loader Impacts the loading of BPF programs into the kernel. area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. labels May 28, 2025

jrife reviewed May 28, 2025

View reviewed changes

bpf/include/bpf/config/node.h Outdated Show resolved Hide resolved

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch 5 times, most recently from b16a408 to f056282 Compare June 1, 2025 09:10

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch 2 times, most recently from 31b0c2e to cb050e5 Compare June 8, 2025 01:24

saiaunghlyanhtet requested a review from jrife June 8, 2025 08:13

jrife reviewed Jun 9, 2025

View reviewed changes

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch from cb050e5 to 0850415 Compare June 14, 2025 09:16

pchaigno reviewed Sep 3, 2025

View reviewed changes

bpf/bpf_lxc.c Outdated Show resolved Hide resolved

joamaki approved these changes Sep 3, 2025

View reviewed changes

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch from ea79b53 to 663eadc Compare September 3, 2025 11:31

This comment was marked as outdated.

Sign in to view

julianwiedmann self-requested a review September 3, 2025 12:44

pchaigno reviewed Sep 3, 2025

View reviewed changes

pkg/monitor/datapath_debug.go Outdated Show resolved Hide resolved

saiaunghlyanhtet force-pushed the pr/ipv6-service-loopback branch from 663eadc to 3c14b86 Compare September 3, 2025 13:37

saiaunghlyanhtet requested a review from a team as a code owner September 3, 2025 13:37

saiaunghlyanhtet requested review from glibsm and pchaigno September 3, 2025 13:37

This comment was marked as outdated.

Sign in to view

pchaigno reviewed Sep 3, 2025

View reviewed changes

api/v1/flow/flow.proto Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

jrife approved these changes Sep 3, 2025

View reviewed changes

ti-mo approved these changes Sep 4, 2025

View reviewed changes

gandro requested changes Sep 4, 2025

View reviewed changes

bpf/lib/dbg.h Outdated Show resolved Hide resolved

saiaunghlyanhtet added 4 commits September 4, 2025 18:46

api: hubble: regenerate flow.pb.go for IPv6 service loopback

79ab377

- add DebugEventType DBG_LB6_LOOPBACK_SNAT, DBG_LB6_LOOPBACK_SNAT_REV - regenerate flow.pb.go Signed-off-by: saiaunghlyanhtet <[email protected]>

gandro approved these changes Sep 4, 2025

View reviewed changes

julianwiedmann mentioned this pull request Sep 4, 2025

bpf: lb: fix LRP loopback check in IPv6 path #39081

Closed

julianwiedmann mentioned this pull request Oct 28, 2025

test: ginkgo: enable loopback testing for IPv6 ClusterIPs #42439

Closed

This was referenced Oct 29, 2025

Service loopback fails because of ip used for service loopback (fe80::1) #42460

Closed

bpf: adding a special case for service loopback IPv6 during icmp routing #42497

Merged

cilium-cli: add connectivity test for service loopback #42590

Merged

Jack-R-lantern mentioned this pull request Dec 28, 2025

CFP: Ability to disable SocketLB on per-pod basis #34225

Open

Conversation

saiaunghlyanhtet commented May 17, 2025 • edited by julianwiedmann Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saiaunghlyanhtet commented Jun 8, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jrife commented Jun 9, 2025

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

ti-mo left a comment

Choose a reason for hiding this comment

Uh oh!

gandro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gandro left a comment

Choose a reason for hiding this comment

Uh oh!

pchaigno commented Sep 4, 2025

Uh oh!

julianwiedmann commented Sep 4, 2025

Uh oh!

pchaigno commented Sep 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

saiaunghlyanhtet commented May 17, 2025 •

edited by julianwiedmann

Loading