TPROXY support with eBPF

[tgraf]

• [x] Linux kernel support to work around skb_orphan()
  • [x] Add tests
  • [x] Validate against Cilium
  • [x] Submit upstream
  • v1: lore, git tree
  • v2: lore, git tree
  • v3: lore, git tree
  • v4: lore, git tree
  • v5: lore, git tree
  • [x] Work through upstream feedback
  • Will be part of Linux 5.7 release
• [x] Linux support for UDP listen socket lookup
  • [x] Add tests
  • [x] Validate against Cilium
  • [x] Submit upstream (part of complete set above)
• [x] Debug pod->proxy->proxy->pod connectivity issue
  • RCA'd: Socket assign fails for traffic from the host (including egress proxy) towards ingress proxy due to restriction on sk_assign that it must execute on TC ingress.
• [x] Cilium feature detection
• [x] Cilium datapath support
• [x] Extend connectivity test to validate proxy paths
• [x] Fix endpoint routes mode
• [ ] Replace xt_socket rule with eBPF implementation
• [ ] Validate with host firewall enabled (+policy)
• [x] Support SO_REUSEPORT sockets
  • Additional kernel work required
  • v1: lore
  • v2: lore
  • Merged: lore, bpf-next git
  • [ ] Add userspace feature detection for SO_REUSEPORT bpf socket lookup to enable the feature

[joestringer]

Related upstream community discussion occurred as part of Linux Plumbers Conference `19: https://linuxplumbersconf.org/event/4/contributions/464/

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[lmb]

The patchset to support SO_REUSEPORT was just merged: https://lore.kernel.org/bpf/169032002180.5361.5393311754104928741.git-patchwork-notify@kernel.org/

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.