github / github/glb-director

6to4 traffic on sit tunnel is dropped as spoofed

Open
#64 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
2.5k
Forks
239
PR merge metrics
No merged PRs in 30d

Description

We're seeing the following in dmesg:
```
[Thu Apr 11 13:22:44 2019] sit: Src spoofed 108.X.X.X/2002::Z -> 108.Y.Y.Y/2606::Q
```

As far as we can tell, this is because the encapsulated source IP uses the 6to4 prefix, presumably this is a legit client. We traced this to https://elixir.bootlin.com/linux/v4.19.6/source/net/ipv6/sit.c#L622, which means that the packet is dropped after this message is logged.

The configuration for our tunnel:
```
11: sit1@ethX: mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/sit 108.Y.Y.Y brd 0.0.0.0
```

It seems like it might be possible to work around this using `ip tunnel 6rd dev sit1 6rd-prefix fc00::/32` (see https://elixir.bootlin.com/linux/v4.19.6/source/net/ipv6/sit.c#L771), but that seems hacky.

cc @arthurfabre who did the debugging on this.

Have you encountered this issue as well? Is there a better way to fix this / are we doing something wrong?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.