google / google/gvisor

ICMPv6 neighbor discovery between network namespaces does not work in sandbox networking mode

Open
#7,228 9 comments 0 reactions 0 assignees View on GitHub
area: networking status: help wanted type: bug
Dominant language
Go
Stars
19.3k
Forks
2k
Avg merge
3d 5h
Merged PRs (30d)
264

Description

### Description

My setup is the following:
- two runsc containers
- each container is in a different network namespace
- each network namespace has a macvlan interface in bridge mode with the same host parent interface
- each macvlan interface has a link local address set up in the fe80::/64 range

From each container, I'd expect ICMPv6 neighbor discovery to work and be able to ping the link local ip of the other container.
ICMPv6 neighbor discovery works in host networking mode but does not work in the default sandbox/netstack networking mode.

Please see minimal reproduction steps below.
Let me know if there is anything else I can provide to help diagnose the issue.

### Steps to reproduce

Here are minimal reproduction steps to reproduce the issue:

### Bundle setup
```
# create bundle
mkdir -p bundle/rootfs
cd bundle
docker export $(docker create debian) | tar -xf - -C rootfs
runsc spec -netns /run/netns/ctr -- sleep 10000
```

### Container in sandbox networking mode, ICMPv6 neighbor discovery fails
```
# clean up
sudo runsc kill ip6nd
sudo runsc delete ip6nd
sudo ip netns delete ctr
sudo ip netns delete testing

# create macvlan iface in ctr netns used by the runsc container
sudo ip link add link wlp0s20f3 dev ctr0 type macvlan mode bridge
sudo ip netns add ctr
sudo ip link set ctr0 netns ctr
sudo ip netns exec ctr ip a a fe80::f00/64 dev ctr0
sudo ip netns exec ctr ip l set up dev ctr0 up

# start the container in sandbox networking mode and wait 10s for it to start
sudo runsc run -detach -bundle . ip6nd
sleep 10

# create macvlan iface in testing netns
sudo ip link add link wlp0s20f3 dev tst0 type macvlan mode bridge
sudo ip netns add testing
sudo ip link set tst0 netns testing
sudo ip netns exec testing ip l set up dev tst0 up

# ping from testing netns to ctr netns fails
sudo ip netns exec testing ping fe80::f00
PING fe80::f00(fe80::f00) 56 data bytes
^C
--- fe80::f00 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2037ms
```

### Container in host networking mode, ICMPv6 neighbor discovery succeeds
```
# clean up
sudo runsc kill ip6nd
sudo runsc delete ip6nd
sudo ip netns delete ctr
sudo ip netns delete testing

# create macvlan iface in ctr netns used by the runsc container
sudo ip link add link wlp0s20f3 dev ctr0 type macvlan mode bridge
sudo ip netns add ctr
sudo ip link set ctr0 netns ctr
sudo ip netns exec ctr ip a a fe80::f00/64 dev ctr0
sudo ip netns exec ctr ip l set up dev ctr0 up

# start the container in host networking mode and wait 10s for it to start
sudo runsc --network=host run -detach -bundle . ip6nd
sleep 10

# create macvlan iface in testing netns
sudo ip link add link wlp0s20f3 dev tst0 type macvlan mode bridge
sudo ip netns add testing
sudo ip link set tst0 netns testing
sudo ip netns exec testing ip l set up dev tst0 up

# ping from testing netns to ctr netns succeeds
sudo ip netns exec testing ping fe80::f00
PING fe80::f00(fe80::f00) 56 data bytes
64 bytes from fe80::f00%tst0: icmp_seq=1 ttl=64 time=0.106 ms
64 bytes from fe80::f00%tst0: icmp_seq=2 ttl=64 time=0.057 ms
64 bytes from fe80::f00%tst0: icmp_seq=3 ttl=64 time=0.073 ms
^C
--- fe80::f00 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2049ms
rtt min/avg/max/mdev = 0.057/0.078/0.106/0.020 ms
```

### runsc version

```shell
$ runsc --version
runsc version release-20220222.0
spec: 1.0.2-dev
```

### docker version (if using docker)

```shell
$ docker version
Client:
Version: 20.10.7
API version: 1.41
Go version: go1.13.8
Git commit: 20.10.7-0ubuntu5.1
Built: Mon Nov 1 00:33:40 2021
OS/Arch: linux/amd64
Context: default
Experimental: true

Server:
Engine:
Version: 20.10.7
API version: 1.41 (minimum version 1.12)
Go version: go1.13.8
Git commit: 20.10.7-0ubuntu5.1
Built: Thu Oct 21 23:58:58 2021
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.5.5-0ubuntu3
GitCommit:
runc:
Version: 1.0.1-0ubuntu2
GitCommit:
docker-init:
Version: 0.19.0
GitCommit:
```

### uname

```$ uname -a
Linux tlefebvre-Latitude-7420 5.13.0-30-generic #33-Ubuntu SMP Fri Feb 4 17:03:31 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
```

### kubectl (if using Kubernetes)

_No response_

### repo state (if built from source)

_No response_

### runsc debug logs (if available)

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.