Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

missing k8s default route leads to egress PMTUD problem #456

Open
zolug opened this issue Sep 20, 2023 · 0 comments
Open

missing k8s default route leads to egress PMTUD problem #456

zolug opened this issue Sep 20, 2023 · 0 comments

Comments

@zolug
Copy link
Collaborator

zolug commented Sep 20, 2023

Describe the bug
If an egress IP-packet reaches an LB-FE and is bigger than MTU on the external network while fragmentation is not allowed, the LB-FE must generate an ICMP reply (Frag Needed/Packet Too Big).

In order to generate said ICMP reply route lookup must succeed (dest is a VIP address), otherwise the reply will be cancelled:
https://elixir.bootlin.com/linux/v5.10/source/net/ipv6/icmp.c#L598
https://elixir.bootlin.com/linux/v5.10.194/source/net/ipv4/icmp.c#L744

Depending on the configuration of the primary k8s network, LB-FE POD might or might not have a default route for both IPv4 and IPv6.
Curently, if a default route is missing, then ICMP reply for an egress packet of the matching IP version won't be generated.

To Reproduce
Steps to reproduce the behavior:

  1. Deploy dualstack Trench with Conduit, Attractor etc. on a Kind cluster with IPv4 k8s networking. Use a single LB-FE.
  2. Start external-host to simulate router/TG.
  3. Make sure, MTU of external interface is lower than the cluster internal MTU.
  4. Start a single example-target and open a Stream to join the deployed Conduit.
  5. Check default routes in the LB-FE POD. For IPv6 there should be none.
  6. In example-target use ping to send a big packet to the TG. For IPv6, there should be no Packet Too Big reply. While in case of IPv4, Frag Needed reply should arrive to the Target.
  7. Run tcpdump in LB-FE to verify no reply sent in case of IPv6.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: 📋 To Do
Development

No branches or pull requests

1 participant