Skip to content

conntrack: Demote info log on address family mismatch to debug #2005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jrajahalme wants to merge 1 commit into
base: main
Choose a base branch
from
Open

conntrack: Demote info log on address family mismatch to debug #2005

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions cilium/bpf_metadata.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,9 +399,17 @@ bool Config::exists(const std::string& pod_ip) const { return npmap_->exists(pod

absl::optional<Cilium::BpfMetadata::SocketMetadata>
Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
// connectionInfoProvider may provide original addresses as carried in PROXY protocol. Thus the
// source address may be of a different address family than the destination address.
Network::Address::InstanceConstSharedPtr src_address =
socket.connectionInfoProvider().remoteAddress();
const auto sip = src_address->ip();
// Destination address is taken from the socket, as that way we get the original/restored
// destinatino address as seen before TPROXY redirection, while the Envoy listener address may be,
// e.g., a loopback address. This is the address used as the upstream destination for non-L7LB
// cases, while L7LB listener is expected to choose a different destination address.
// The family (IPv4/IPv6) of this address is used to select the upstream source address when
// original source address is not used.
const auto dst_address = THROW_OR_RETURN_VALUE(socket.ioHandle().localAddress(),
Network::Address::InstanceConstSharedPtr);
const auto dip = dst_address->ip();
Expand Down
9 changes: 8 additions & 1 deletion cilium/conntrack.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,14 @@ uint32_t CtMap::lookupSrcIdentity(const Network::Address::Ip* sip, const Network
key6.nexthdr = 6; // TCP only for now
key6.flags = ingress ? TUPLE_F_IN : TUPLE_F_OUT;
} else {
ENVOY_LOG(info, "cilium.bpf_metadata: Address type mismatch: Source: {}, Dest: {}",
// Address family mismatch is expected when an incoming IPv6 request is forwarded as IPv4 by a
// load balancer as we use the original IPv6 source address as preserved via the PROXY protocol
// in that case.
//
// NOTE: Do not change to locate the conntrack entry based on the direct source address which in
// this case would be the address of the load balancer, as CIDR policy enforcement depends on
// the original source address.
ENVOY_LOG(debug, "cilium.bpf_metadata: Address type mismatch: Source: {}, Dest: {}",
sip->addressAsString(), dip->addressAsString());
return 0;
}
Expand Down
Loading