Skip to content

datapath/linux/route: Fix Delete#40653

Merged
pchaigno merged 1 commit intocilium:mainfrom
pippolo84:pr/pippolo84/fix-route-delete
Jul 22, 2025
Merged

datapath/linux/route: Fix Delete#40653
pchaigno merged 1 commit intocilium:mainfrom
pippolo84:pr/pippolo84/fix-route-delete

Conversation

@pippolo84
Copy link
Copy Markdown
Member

@pippolo84 pippolo84 commented Jul 22, 2025

Since the deletion of routes with the Nexthop or the Local field set fails (see the current comment in the code), the Delete function cannot call the getNetlinkRoute helper. But since it is not using that helper, Delete lacks the copy of several important fields in the route to be deleted, like the source, the priority, the protocol and so on. This can lead to errors while deleting stale route inserted with the Upsert function. As an example, let's consider the deletion of the routes added in the IPSec specific routing table in multi-pool IPAM mode (to be added soon in a subsequent PR). In that case, with the previous version of the Delete function, the following error is returned:

msg="Unable to delete the IPsec route IN from the host routing table" error="no such process"

and the stale route is not deleted.

The commit fixes the Delete implementation to copy additional fields from the route.Route internal representation.

Related: #40460

Fix a bug where Cilium leaks stale routes when IPsec is enabled.

Since the deletion of routes with the Nexthop or the Local field set
fails (see the current comment in the code), the Delete function cannot
call the getNetlinkRoute helper.  But since it is not using that helper,
Delete lacks the copy of several important fields in the route to be
deleted, like the source, the priority, the protocol and so on. This can
lead to errors while deleting stale route inserted with the Upsert
function. As an example, let's consider the deletion of the routes added
in the IPSec specific routing table in multi-pool IPAM mode (to be added
soon in a subsequent PR). In that case, with the previous version of the
Delete function, the following error is returned:

`msg="Unable to delete the IPsec route IN from the host routing table" error="no such process"`

and the stale route is not deleted.

The commit fixes the Delete implementation to copy additional fields
from the route.Route internal representation.

Signed-off-by: Fabio Falzoi <[email protected]>
@pippolo84 pippolo84 requested a review from a team as a code owner July 22, 2025 15:27
@pippolo84 pippolo84 added kind/bug This is a bug in the Cilium logic. area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. labels Jul 22, 2025
@pippolo84 pippolo84 requested a review from YutaroHayakawa July 22, 2025 15:27
@pippolo84 pippolo84 added release-note/bug This PR fixes an issue in a previous release of Cilium. affects/v1.15 This issue affects v1.15 branch needs-backport/1.16 needs-backport/1.17 This PR / issue needs backporting to the v1.17 branch needs-backport/1.18 This PR / issue needs backporting to the v1.18 branch labels Jul 22, 2025
Copy link
Copy Markdown
Member

@pchaigno pchaigno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. However I don't think this matches backport criterias for v1.16.

@pchaigno pchaigno removed the request for review from YutaroHayakawa July 22, 2025 15:56
@pchaigno
Copy link
Copy Markdown
Member

/test

@pchaigno pchaigno enabled auto-merge July 22, 2025 15:56
@pippolo84
Copy link
Copy Markdown
Member Author

Tracked ci-e2e-upgrade failure in #40659, rerunning

@pippolo84 pippolo84 removed needs-backport/1.16 affects/v1.15 This issue affects v1.15 branch labels Jul 22, 2025
@pchaigno pchaigno added this pull request to the merge queue Jul 22, 2025
@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 22, 2025
Merged via the queue into cilium:main with commit 35ca979 Jul 22, 2025
74 checks passed
@YutaroHayakawa YutaroHayakawa mentioned this pull request Jul 22, 2025
4 tasks
@YutaroHayakawa YutaroHayakawa added backport-pending/1.17 The backport for Cilium 1.17.x for this PR is in progress. and removed needs-backport/1.17 This PR / issue needs backporting to the v1.17 branch labels Jul 22, 2025
@YutaroHayakawa YutaroHayakawa mentioned this pull request Jul 22, 2025
10 tasks
@YutaroHayakawa YutaroHayakawa added backport-pending/1.18 The backport for Cilium 1.18.x for this PR is in progress. and removed needs-backport/1.18 This PR / issue needs backporting to the v1.18 branch labels Jul 22, 2025
@github-actions github-actions bot added backport-done/1.17 The backport for Cilium 1.17.x for this PR is done. and removed backport-pending/1.17 The backport for Cilium 1.17.x for this PR is in progress. labels Jul 23, 2025
@github-actions github-actions bot added backport-done/1.18 The backport for Cilium 1.18.x for this PR is done. and removed backport-pending/1.18 The backport for Cilium 1.18.x for this PR is in progress. labels Jul 24, 2025
@cilium-release-bot cilium-release-bot bot moved this to Released in cilium v1.19.0 Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. backport-done/1.17 The backport for Cilium 1.17.x for this PR is done. backport-done/1.18 The backport for Cilium 1.18.x for this PR is done. kind/bug This is a bug in the Cilium logic. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/bug This PR fixes an issue in a previous release of Cilium.

Projects

No open projects
Status: Released

Development

Successfully merging this pull request may close these issues.

4 participants