BPF: Allows users to set DSCP on traffic toward hosts/hostendpoints by mazdakn · Pull Request #10997 · projectcalico/calico

mazdakn · 2025-09-11T22:22:36Z

Description

Allow users to set DSCP on traffic destined host endpoints and hosts. This change makes the default behavior similar NAT outgoing.
This change is made as requested by PM here: https://tigera.atlassian.net/browse/PMREQ-736

Related issues/PRs

Similar change for iptables/Nftables #10995

Todos

Tests
Documentation
Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

docs-pr-required: This change requires a change to the documentation that has not been completed yet.
docs-completed: This change has all necessary documentation completed.
docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

release-note-required: This PR has user-facing changes. Most PRs should have this label.
release-note-not-required: This PR has no user-facing changes.

Other optional labels:

cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

Copilot

Pull Request Overview

This PR modifies the eBPF dataplane's cluster boundary detection logic to exclude hosts from the cluster boundary for DSCP marking purposes. The change allows DSCP to be set on traffic destined to host endpoints and hosts, aligning the default behavior with NAT outgoing functionality.

Key changes:

Updates the external address detection function to accept an exclude_hosts parameter
Modifies cluster external traffic detection logic to use the new parameterized function
Updates test cases to reflect the new behavior where host-to-host traffic is now considered external

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
felix/bpf-gpl/routes.h	Refactors external address detection functions to support host exclusion parameter
felix/bpf-gpl/tc.c	Updates cluster boundary detection logic to use new parameterized external address function
felix/bpf/ut/qos_test.go	Updates test cases to reflect new host-to-host traffic behavior and route flags

felix/bpf-gpl/tc.c

mazdakn · 2025-09-11T22:29:33Z

felix/bpf-gpl/tc.c

 			CALI_DEBUG("Source " IP_FMT " not in IP pool", debug_ip(ctx->state->ip_src));
-			if (rt_addr_is_external(&ctx->state->post_nat_ip_dst)) {
+			r = cali_rt_lookup(&ctx->state->post_nat_ip_dst);
+			if (!r || !(r->flags & (CALI_RT_WORKLOAD | CALI_RT_HOST))) {


This is basically reverting the change made in the previous PR here: #10934

Copilot

Pull Request Overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

felix/bpf-gpl/routes.h

tomastigera · 2025-09-12T16:47:09Z

felix/bpf-gpl/routes.h

    return true;
 }
+
+static CALI_BPF_INLINE bool rt_addr_is_external(ipv46_addr_t *addr, bool exclude_hosts)


this is weird API. Host as not external, right?

tomastigera · 2025-09-12T16:49:32Z

felix/bpf-gpl/tc.c

-			if (rt) {
-				flags = rt->flags;
-			}
-			bool exclude_hosts = (GLOBAL_FLAGS & CALI_GLOBALS_NATOUTGOING_EXCLUDE_HOSTS);


The original idea here was that you should do nat outgoing if you are going out of a pool and that includes hosts. But we have a config option now that excludes hosts from nat outgoing.

tomastigera · 2025-09-12T16:50:13Z

felix/bpf-gpl/tc.c

-				ctx->state->flags |= CALI_ST_NAT_OUTGOING;
-			}
+		if ((r->flags & CALI_RT_NAT_OUT) &&
+			(rt_addr_is_external(&ctx->state->post_nat_ip_dst, GLOBAL_FLAGS & CALI_GLOBALS_NATOUTGOING_EXCLUDE_HOSTS))) {


no it read like ... do nat outgoing of dest it outsife of the cluster ... and btw exclude hosts ... but hold on, they are in the cluster 🤔

tomastigera · 2025-09-12T16:58:40Z

felix/bpf-gpl/routes.h

 // - packet is destined to local host; or
 // - packet is destined to a host and the CALI_GLOBALS_NATOUTGOING_EXCLUDE_HOSTS global flag is set
-static CALI_BPF_INLINE bool rt_flags_should_perform_nat_outgoing(enum cali_rt_flags flags, bool exclude_hosts)
+static CALI_BPF_INLINE bool rt_flags_external(enum cali_rt_flags flags, bool exclude_hosts)


external should return whatever is external

Suggested change

static CALI_BPF_INLINE bool rt_flags_external(enum cali_rt_flags flags, bool exclude_hosts)

static CALI_BPF_INLINE bool rt_flags_external(enum cali_rt_flags flags)

felix/bpf-gpl/routes.h

tomastigera · 2025-09-12T17:54:40Z

felix/bpf-gpl/tc.c

 		}
 		// Check if traffic is leaving cluster. We might need to set DSCP later.
-		if (cali_rt_flags_is_in_pool(r->flags) && rt_addr_is_external(&ctx->state->post_nat_ip_dst)) {
+		if (cali_rt_flags_is_in_pool(r->flags) && rt_addr_is_external(&ctx->state->post_nat_ip_dst, false)) {


Wouldn't this do something similar?

Suggested change

if (cali_rt_flags_is_in_pool(r->flags) && rt_addr_is_external(&ctx->state->post_nat_ip_dst, false)) {

if (cali_rt_flags_is_in_pool(r->flags) && !cali_rt_workload(&ctx->state->post_nat_ip_dst)) {

tomastigera · 2025-09-12T17:55:39Z

felix/bpf-gpl/tc.c

 	// If either source or destination is outside cluster, set flag as might need to update DSCP later.
 	if ((CALI_F_TO_HEP) && (rt_addr_is_local_host(&ctx->state->ip_src)) &&
-		(rt_addr_is_external(&ctx->state->post_nat_ip_dst))) {
+		(rt_addr_is_external(&ctx->state->post_nat_ip_dst, false))) {


testing for workload would do but then the flag name is weird

As we may lookup src and dst route on some path multiple times, better to make the lookup just once once. In some cases we may lookup unnecessarily, but it is the first step to consolidate the route lookups in general.

First commit

0fee45a

Copilot AI review requested due to automatic review settings September 11, 2025 22:22

mazdakn requested a review from a team as a code owner September 11, 2025 22:22

mazdakn added docs-not-required Docs not required for this change release-note-not-required Change has no user-facing impact labels Sep 11, 2025

marvin-tigera added this to the Calico v3.31.0 milestone Sep 11, 2025

Copilot AI reviewed Sep 11, 2025

View reviewed changes

felix/bpf-gpl/tc.c Outdated Show resolved Hide resolved

mazdakn changed the title ~~BPF: Exclude host from cluster boundary~~ BPF: Allows users to set DSCP on traffic toward hosts/hostendpoints Sep 11, 2025

mazdakn added 2 commits September 11, 2025 15:26

fix merge

7ecfecc

cleanup

5eddd50

mazdakn commented Sep 11, 2025

View reviewed changes

mazdakn requested a review from Copilot September 11, 2025 22:30

Copilot AI reviewed Sep 11, 2025

View reviewed changes

felix/bpf-gpl/routes.h Outdated Show resolved Hide resolved

tomastigera reviewed Sep 12, 2025

View reviewed changes

markup

f3752c9

mazdakn requested a review from tomastigera September 12, 2025 19:03

tomastigera and others added 2 commits September 12, 2025 16:35

[BPF] make as few route lookups as possible

f726794

As we may lookup src and dst route on some path multiple times, better to make the lookup just once once. In some cases we may lookup unnecessarily, but it is the first step to consolidate the route lookups in general.

fix bpf ut

037e455

tomastigera approved these changes Sep 15, 2025

View reviewed changes

mazdakn merged commit ccb0bbf into projectcalico:master Sep 15, 2025
3 checks passed

mazdakn deleted the dscp-bpf-exclude-hosts branch September 15, 2025 20:52

mazdakn mentioned this pull request Sep 19, 2025

Set DSCP for workload's egress traffic leaving cluster #10718

Merged

3 tasks

mazdakn mentioned this pull request Oct 6, 2025

eBPF: Rename ClusterExternal flag to SetDSCP #11134

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BPF: Allows users to set DSCP on traffic toward hosts/hostendpoints#10997

BPF: Allows users to set DSCP on traffic toward hosts/hostendpoints#10997
mazdakn merged 6 commits intoprojectcalico:masterfrom
mazdakn:dscp-bpf-exclude-hosts

mazdakn commented Sep 11, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

mazdakn Sep 11, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

tomastigera Sep 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	static CALI_BPF_INLINE bool rt_flags_external(enum cali_rt_flags flags, bool exclude_hosts)
	static CALI_BPF_INLINE bool rt_flags_external(enum cali_rt_flags flags)

	if (cali_rt_flags_is_in_pool(r->flags) && rt_addr_is_external(&ctx->state->post_nat_ip_dst, false)) {
	if (cali_rt_flags_is_in_pool(r->flags) && !cali_rt_workload(&ctx->state->post_nat_ip_dst)) {

Conversation

mazdakn commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related issues/PRs

Todos

Release Note

Reminder for the reviewer

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

mazdakn Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

tomastigera Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mazdakn commented Sep 11, 2025 •

edited

Loading