fix(ebpf): Restore the uSID datapath on nodes that load it without full root - #536
Merged
Merged
Conversation
The GRO-merged length check stepped a packet pointer past the inner IPv4 header by its IHL-derived length. The verifier only allows a variable packet pointer offset for a loader holding CAP_PERFMON. galactic-cni holds BPF, NET_ADMIN, and NET_RAW, so every node rejected the datapath and galactic-cni crash-looped. CI loaded as full root and never saw the rule. The transport header is now read by offset instead, which keeps the per-segment MTU check unchanged for both families. Each datapath now also has a load test that runs with only the capabilities its DaemonSet grants, taken from the manifest, so a program the verifier rejects for that loader fails CI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
scotwells
force-pushed
the
fix/usid-ingress-unprivileged-load
branch
from
September 13, 2026 04:06
50cd477 to
e4ef05c
Compare
privateip
approved these changes
Sep 13, 2026
ecv
approved these changes
Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every node that picks up the build with the GRO-merged return traffic fix (#535) rejects the eBPF uSID datapath at load time, so galactic-cni crash-loops and the node stops forwarding Instance traffic. This change makes the datapath load again with the capabilities galactic-cni actually runs with, and adds a CI check so this class of failure cannot reach a node again.
What went wrong
The kernel's eBPF verifier applies stricter rules to a loader that lacks CAP_PERFMON. One of those rules forbids moving a packet pointer by a variable amount. The new length check did exactly that to locate the inner TCP header past an IPv4 header of variable length. galactic-cni deliberately holds only BPF, NET_ADMIN, and NET_RAW, so the verifier rejected the datapath. CI and local tests loaded the datapath as full root, where the rule does not apply.
What changes
Verification
Fixes the rollout regression from #535. Related: #534, #532.
🤖 Generated with Claude Code