Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

sit: allow encapsulated IPv6 traffic to be delivered locally

While experimenting with FOU encapsulation Amir noticed that encapsulated IPv6
traffic fails to be delivered, if the peer IP address is configured locally.

It can be easily verified by creating a sit interface like below:

$ sudo ip link add name fou_test type sit remote 127.0.0.1 encap fou encap-sport auto encap-dport 1111
$ sudo ip link set fou_test up

and sending some IPv4 and IPv6 traffic to it

$ ping -I fou_test -c 1 1.1.1.1
$ ping6 -I fou_test -c 1 fe80::d0b0:dfff:fe4c:fcbc

"tcpdump -i any udp dst port 1111" will confirm that only the first IPv4 ping
was encapsulated and attempted to be delivered.

This seems like a limitation: for example, in a cloud environment the "peer"
service may be arbitrarily scheduled on any server within the cluster, where all
nodes are trying to send encapsulated traffic. And the unlucky node will not be
able to. Moreover, delivering encapsulated IPv4 traffic locally is allowed.

But I may not have all the context about this restriction and this code predates
the observable git history.

Reported-by: Amir Razmjou <arazmjou@cloudflare.com>
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220107123842.211335-1-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Ignat Korchagin and committed by
Jakub Kicinski
ed6ae5ca e179f045

+1 -1
+1 -1
net/ipv6/sit.c
··· 956 956 dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst, fl4.saddr); 957 957 } 958 958 959 - if (rt->rt_type != RTN_UNICAST) { 959 + if (rt->rt_type != RTN_UNICAST && rt->rt_type != RTN_LOCAL) { 960 960 ip_rt_put(rt); 961 961 dev->stats.tx_carrier_errors++; 962 962 goto tx_error_icmp;