Automated cherry pick of #5880: Fix incorrect MTU configurations (#5880) #5926: Ensure MTU is set correctly when WireGuard interface already #5997: Use 65000 MTU upper bound for interfaces in encap mode #6145
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The commit fixes 3 incorrect MTU configurations: 1. When using the WireGuard encryption mode, the Pod eth0's MTU was not correct. The MTU deducted Geneve overhead because the default tunnel type is Geneve while it should deduct the WireGuard overhead as traffic will be encrypted instead of encapsulated. 2. When using the GRE tunnel type, the Pod eth0's MTU was not correct. The actual overhead is 14 outer MAC, 20 outer IP, and 8 GRE header (4 standard header + 4 key field), summing up to 42 bytes. 3. When enabling Wireguard for Multicluster, the MTU of all Pod interfaces and wireguard interface were reduced 130 bytes (50 for geneve + 80 for wireguard), however, cross-cluster traffic sent from Pods were not forwarded by wireguard interface. This is because traffic originated from Pods will be encapsulated on gateway Node, and it's the encapsulated packet which will be encrypted. If the wireguard interface is set with the same MTU as the Pod interface, the encapsulated packet will exceed wireguard interface's MTU. Signed-off-by: Jiajing Hu <[email protected]> Signed-off-by: Quan Tian <[email protected]> Co-authored-by: Quan Tian <[email protected]>
…ntrea-io#5926) In ce46eb1 ("Fix incorrect MTU configurations"), we changed WireGuard interface's MTU in IPv4 case. However, if a cluster already enables WireGuard, the WireGuard interface's MTU would remain unchanged while new Pod would use a higher MTU, causing problems. Signed-off-by: Quan Tian <[email protected]>
tnqn
added
the
kind/cherry-pick
OVS configures the MTU for tunnel ports to 65000. In some cases (e.g., Kind clusters), the MTU of the transport interface can be larger than that, and so can be the calculated MTU of antrea-gw0 and of Pod interfaces. When this happens, packets can be dropped. To handle this edge case (real clusters are unlikely to use that kind of MTU), we set an upper bound of 65000 for the calculated MTU. Note that setting the tunnel port's MTU to 65535, or even to the calculated MTU, is not an option, as it may not work on all systems. An alternative would be to find the MTU for the tunnel interface dynamically and use that as an upper bound, rather than rely on this hardcoded constant (65000). However, that constant has remained unchanged for 7 years, and finding the MTU dynamically would require re-organizing the Agent initialization code, as we currently caclulate the MTU before creating the OVS tunnel port. So the current solution seems lower risk. Even if the constant is changed in OVS, it should not have any real impact on Antrea. Fixes antrea-io#5940 Signed-off-by: Antonin Bas <[email protected]>
tnqn
force-pushed
the
automated-cherry-pick-of-#5880-#5926-#5997-upstream-release-1.13
branch
from
f0fbff7
to
728aa36
Compare
|
/test-all |
antoninbas
approved these changes
Mar 25, 2024
tnqn
deleted the
automated-cherry-pick-of-#5880-#5926-#5997-upstream-release-1.13
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry pick of #5880 #5926 #5997 on release-1.13.
#5880: Fix incorrect MTU configurations (#5880)
#5926: Ensure MTU is set correctly when WireGuard interface already
#5997: Use 65000 MTU upper bound for interfaces in encap mode
For details on the cherry pick process, see the cherry pick requests page.