From 70ee85c3fa290bb775832b5f95005434c8a6f664 Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Tue, 18 Aug 2026 12:33:14 +0200 Subject: [PATCH] conntrack: Demote info log on address family mismatch to debug Demote info log on address family mismatch to debug as an address family mismatch is expected when an incoming IPv6 request is forwarded as IPv4 by a load balancer as we use the original IPv6 source address as preserved via the PROXY protocol in that case. Signed-off-by: Jarno Rajahalme --- cilium/bpf_metadata.cc | 8 ++++++++ cilium/conntrack.cc | 9 ++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/cilium/bpf_metadata.cc b/cilium/bpf_metadata.cc index cfd1d6673..1dddaafda 100644 --- a/cilium/bpf_metadata.cc +++ b/cilium/bpf_metadata.cc @@ -399,9 +399,17 @@ bool Config::exists(const std::string& pod_ip) const { return npmap_->exists(pod absl::optional Config::extractSocketMetadata(Network::ConnectionSocket& socket) { + // connectionInfoProvider may provide original addresses as carried in PROXY protocol. Thus the + // source address may be of a different address family than the destination address. Network::Address::InstanceConstSharedPtr src_address = socket.connectionInfoProvider().remoteAddress(); const auto sip = src_address->ip(); + // Destination address is taken from the socket, as that way we get the original/restored + // destinatino address as seen before TPROXY redirection, while the Envoy listener address may be, + // e.g., a loopback address. This is the address used as the upstream destination for non-L7LB + // cases, while L7LB listener is expected to choose a different destination address. + // The family (IPv4/IPv6) of this address is used to select the upstream source address when + // original source address is not used. const auto dst_address = THROW_OR_RETURN_VALUE(socket.ioHandle().localAddress(), Network::Address::InstanceConstSharedPtr); const auto dip = dst_address->ip(); diff --git a/cilium/conntrack.cc b/cilium/conntrack.cc index abd6284e7..040ee6104 100644 --- a/cilium/conntrack.cc +++ b/cilium/conntrack.cc @@ -142,7 +142,14 @@ uint32_t CtMap::lookupSrcIdentity(const Network::Address::Ip* sip, const Network key6.nexthdr = 6; // TCP only for now key6.flags = ingress ? TUPLE_F_IN : TUPLE_F_OUT; } else { - ENVOY_LOG(info, "cilium.bpf_metadata: Address type mismatch: Source: {}, Dest: {}", + // Address family mismatch is expected when an incoming IPv6 request is forwarded as IPv4 by a + // load balancer as we use the original IPv6 source address as preserved via the PROXY protocol + // in that case. + // + // NOTE: Do not change to locate the conntrack entry based on the direct source address which in + // this case would be the address of the load balancer, as CIDR policy enforcement depends on + // the original source address. + ENVOY_LOG(debug, "cilium.bpf_metadata: Address type mismatch: Source: {}, Dest: {}", sip->addressAsString(), dip->addressAsString()); return 0; }