Skip to content

feat(gateway): add fib_multipath_hash_policy support for L4-aware ECMP flow distribution#3229

Merged
adamjensenbot merged 1 commit intoliqotech:masterfrom
MircoBarone:PR5-multitunnel-enable-multipath-hash-support
Apr 21, 2026
Merged

feat(gateway): add fib_multipath_hash_policy support for L4-aware ECMP flow distribution#3229
adamjensenbot merged 1 commit intoliqotech:masterfrom
MircoBarone:PR5-multitunnel-enable-multipath-hash-support

Conversation

@MircoBarone
Copy link
Copy Markdown
Contributor

@MircoBarone MircoBarone commented Mar 22, 2026 •
edited
Loading

Description

Part of the multi-tunnel WireGuard implementation. This is the second PR related to issue #3225.

This PR adds the enable-multipath-hash-policy flag to the gateway. When set to true, the gateway writes 1 to /proc/sys/net/ipv4/fib_multipath_hash_policy, enabling 5-tuple (src/dst IP, src/dst port, protocol) hashing for multipath routing instead of L3-only (src/dst IP) hashing.

This is necessary to properly exploit ECMP across multiple WireGuard tunnels: without this setting, traffic between the same src/dst IP pair will always hash to the same tunnel regardless of the port, limiting the effectiveness of ECMP for those flows.

The flag defaults to false. The intended usage is to set it to true via a proper template when the number of interfaces specified in the GatewayClient or GatewayServer CRD is greater than one.

Since /proc/sys/net/ipv4/fib_multipath_hash_policy is namespaced, this setting only affects the network namespace of the gateway pod and has no impact on the host node.

If the write fails, the gateway returns an error and stops the execution to ensure the policy is strictly applied

A new file pkg/utils/kernel/multipathpolicy.go was added to implement the low-level write.

@adamjensenbot
Copy link
Copy Markdown
Collaborator

adamjensenbot commented Mar 22, 2026

Hi @MircoBarone. Thanks for your PR!

I am @adamjensenbot.
You can interact with me issuing a slash command in the first line of a comment.
Currently, I understand the following commands:

  • /rebase: Rebase this PR onto the master branch (You can add the option test=true to launch the tests
    when the rebase operation is completed)
  • /merge: Merge this PR into the master branch
  • /build Build Liqo components
  • /test Launch the E2E and Unit tests
  • /hold, /unhold Add/remove the hold label to prevent merging with /merge

Make sure this PR appears in the liqo changelog, adding one of the following labels:

  • feat: 🚀 New Feature
  • fix: 🐛 Bug Fix
  • refactor: 🧹 Code Refactoring
  • docs: 📝 Documentation
  • style: 💄 Code Style
  • perf: 🐎 Performance Improvement
  • test: ✅ Tests
  • chore: 🚚 Dependencies Management
  • build: 📦 Builds Management
  • ci: 👷 CI/CD
  • revert: ⏪ Reverts Previous Changes

@github-actions github-actions Bot added the feat Adds a new feature to the codebase label Mar 22, 2026
@MircoBarone MircoBarone mentioned this pull request Mar 22, 2026
Open
20 tasks
@MircoBarone MircoBarone changed the title add fib_multipath_hash_policy support for L4-aware ECMP flow distribution feat(gateway): add fib_multipath_hash_policy support for L4-aware ECMP flow distribution Mar 22, 2026
@github-actions github-actions Bot added the style Changes related to code formatting, whitespace, or linting, without affecting functionality label Mar 22, 2026
@cheina97
Copy link
Copy Markdown
Member

cheina97 commented Mar 23, 2026

Can you temporarily enable the flag? Then I will run the e2e tests

@MircoBarone
Copy link
Copy Markdown
Contributor Author

MircoBarone commented Mar 24, 2026

Can you temporarily enable the flag? Then I will run the e2e tests

@cheina97 Do you mean I should add a commit temporarily setting the default value of enable-multipath-hash-policy to true
?

@cheina97
Copy link
Copy Markdown
Member

cheina97 commented Mar 24, 2026

Can you temporarily enable the flag? Then I will run the e2e tests

@cheina97 Do you mean I should add a commit temporarily setting the default value of enable-multipath-hash-policy to true
?

Yep

@github-actions github-actions Bot added the test Adds or updates tests for the codebase label Mar 25, 2026
@MircoBarone
Copy link
Copy Markdown
Contributor Author

MircoBarone commented Mar 25, 2026

Can you temporarily enable the flag? Then I will run the e2e tests

@cheina97 Do you mean I should add a commit temporarily setting the default value of enable-multipath-hash-policy to true
?

Yep

@cheina97 done

@MircoBarone MircoBarone force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from 2fe170f to b856f81 Compare April 1, 2026 08:57
@cheina97
Copy link
Copy Markdown
Member

cheina97 commented Apr 10, 2026

/rebase test=true

@adamjensenbot adamjensenbot force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from b856f81 to b0db305 Compare April 10, 2026 13:23
fra98
fra98 reviewed Apr 16, 2026
View reviewed changes
Comment thread pkg/gateway/flags.go
Comment thread cmd/gateway/main.go
Comment thread pkg/utils/kernel/multipathpolicy.go Outdated
@MircoBarone MircoBarone force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from b0db305 to 2617856 Compare April 16, 2026 21:43
@github-actions github-actions Bot added the refactor Reorganizes or optimizes code without changing its behavior label Apr 16, 2026
@cheina97
Copy link
Copy Markdown
Member

cheina97 commented Apr 20, 2026

/rebase test=true

@adamjensenbot adamjensenbot force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from 813e90e to 11a5eaf Compare April 20, 2026 08:16
@fra98
Copy link
Copy Markdown
Member

fra98 commented Apr 20, 2026

/rebase test=true

@fra98
Copy link
Copy Markdown
Member

fra98 commented Apr 20, 2026

@MircoBarone test passed!

Can you switch flag to false and squash all commits? After that I will merge it

@MircoBarone MircoBarone force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from 11a5eaf to 85b018a Compare April 20, 2026 21:56
@github-actions github-actions Bot removed style Changes related to code formatting, whitespace, or linting, without affecting functionality refactor Reorganizes or optimizes code without changing its behavior test Adds or updates tests for the codebase labels Apr 20, 2026
@fra98
Copy link
Copy Markdown
Member

fra98 commented Apr 21, 2026

/test

@fra98
Copy link
Copy Markdown
Member

fra98 commented Apr 21, 2026

/rebase test=true

@adamjensenbot adamjensenbot force-pushed the PR5-multitunnel-enable-multipath-hash-support branch from 85b018a to 7c0860a Compare April 21, 2026 09:04
@fra98
Copy link
Copy Markdown
Member

fra98 commented Apr 21, 2026

/merge

@adamjensenbot adamjensenbot added the merge-requested Request bot merging (automatically managed) label Apr 21, 2026
@adamjensenbot adamjensenbot merged commit ed3da91 into liqotech:master Apr 21, 2026
14 checks passed
@adamjensenbot adamjensenbot removed the merge-requested Request bot merging (automatically managed) label Apr 21, 2026
@MircoBarone MircoBarone mentioned this pull request Apr 22, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cheina97 cheina97 cheina97 approved these changes

@fra98 fra98 fra98 approved these changes

Assignees

No one assigned

Labels

feat Adds a new feature to the codebase size/M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@MircoBarone @adamjensenbot @cheina97 @fra98