Page MenuHomeVyOS Platform
Create Task
Maniphest T1000

Broken 6rd tunnel implementation
Resolved (N/A)PublicBUG
Actions

Description

Hi all!
I've found, that implementation of 6rd tunnels is broken. Here is a list of a founded bugs:

  1. 6rd options can be set for any type of tunnel. Must be limited to "sit" only. We must add two checks:
    1. If encapsulation is already set and it is not "sit" then deny to use 6rd options.
    2. And vice versa - if "6rd" options is already set, deny to set any encapsulations, except "sit".
  2. Following to RFC5969, we must able to configure:
    1. IPv4MaskLen (presented, but not functional). IPv4MaskLen can be calculated from 6rd-relay_prefix but VyOS trying to validate it as IP host address (must be network address). Due this ip tunnel command can't configure 6rd options property.
    2. 6rdPrefix (presented)
    3. 6rdPrefixLen (presented)
    4. 6rdBRIPv4Address (not presented, but can be configured through routes)
  3. Configuration allow to create tunnel with 6rd-prefix with length different, than 32 without 6rd-relay_prefix option. Due to 6rd implementation in iproute2 this will not work.
  4. Tunnel configuration allow to add more than one 6rd-prefix. This is not allowed by RFC.
  5. Tunnel can't be created without remote-ip option. This option not required for 6rd-tunnels.

I think, that we must rework this 6rd tunnels implementation and test it again.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0-rolling+201811111746
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

zsdc created this task.Nov 11 2018, 11:15 PM
syncer triaged this task as Low priority.Nov 13 2018, 3:51 AM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc8); removed VyOS 1.2 Crux.
dmbaturin added a subscriber: dmbaturin.Nov 18 2018, 5:59 PM

I think I've fixed it enough to give it meaningful testing.

Apparently iproute2 itself doesn't allow creation of SIT tunnels without a remote address, 6rd or not. If you know the procedure to get around it, please share.

dmbaturin changed the task status from Open to In progress.Nov 18 2018, 6:00 PM
pasik added a subscriber: pasik.Nov 20 2018, 8:20 AM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc9); removed VyOS 1.2 Crux (VyOS 1.2.0-rc8).Nov 20 2018, 12:44 PM
zsdc added a comment.Nov 20 2018, 9:44 PM

I will check fix soon.
By creating tunnels without remote side I mean something like:

ip tunnel add sit1 mode sit local 192.168.20.20 ttl 64

This is "vanilla way", as I understand.

syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc10); removed VyOS 1.2 Crux (VyOS 1.2.0-rc9).Nov 27 2018, 12:03 AM
zsdc added a comment.EditedDec 4 2018, 3:24 PM

Tested with 1.2.0-rolling+201812010337. Still many bugs, very hard to diagnostic it properly.
Minimal list TODO, for we can continue testing:

  1. Need to add additional check. Prefix length of 6rd-prefix + 32 - prefix length of 6rd-relay-prefix must be equal to 64. Example:

6rd-prefix = 2001:0db8:0:70::/60
6rd-relay-prefix = 192.168.1.0/28
60 + 32 - 28 = 64
If this is not true, iproute2 can't set 6rd parameters (limitation in iproute2).

  1. After creating 6rd tunnel we need to add route to 6rd-prefix through this tunnel automatically.

At VyOS side configuration must be:

ip tunnel add [tun-device-name] mode sit local [local-ip] remote 0.0.0.0 ttl 64
ip tunnel 6rd dev [tun-device-name] 6rd-prefix [6rd-prefix] 6rd-relay_prefix [6rd-relay_prefix]
ip l set [tun-device-name] up
ip -6 route add [6rd-prefix] dev [tun-device-name]
vyos@vyos# show interfaces tunnel 
+tunnel tun1 {
+    6rd-prefix [6rd-prefix]
+    6rd-relay-prefix [6rd-relay_prefix]
+    encapsulation sit
+    local-ip [local-ip]
+    remote-ip 0.0.0.0
+}
[edit]
vyos@vyos# show protocols static interface-route6 
+  interface-route6 [6rd-prefix] {
+      next-hop-interface tun1 {
+     }
+  }

But, now system ignore local-ip:

Dec 04 17:21:34 vyos sudo[3265]: vyos : TTY=pts/0 ; PWD=/home/vyos ; USER=root ; COMMAND=/sbin/ip tunnel add tun1 remote 0.0.0.0 mode sit
syncer edited projects, added VyOS 1.2 Crux ( VyOS 1.2.0-rc11); removed VyOS 1.2 Crux (VyOS 1.2.0-rc10).Dec 5 2018, 11:58 PM
syncer edited projects, added VyOS 1.2 Crux ( VyOS 1.2.0-EPA); removed VyOS 1.2 Crux ( VyOS 1.2.0-rc11).Dec 21 2018, 10:07 AM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-EPA2); removed VyOS 1.2 Crux ( VyOS 1.2.0-EPA).Jan 1 2019, 6:10 PM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-EPA3); removed VyOS 1.2 Crux (VyOS 1.2.0-EPA2).Jan 3 2019, 1:54 PM
syncer edited projects, added VyOS 1.3 Equuleus; removed VyOS 1.2 Crux (VyOS 1.2.0-EPA3).Feb 8 2019, 12:16 AM
ruliane added a subscriber: ruliane.Feb 12 2020, 3:15 PM
shaferstockton added a subscriber: shaferstockton.Oct 3 2020, 5:23 PM
danielpo added a subscriber: danielpo.Jan 20 2021, 7:05 AM
This comment was removed by danielpo.
dmbaturin added a project: test.Jul 29 2021, 12:56 PM
dmbaturin set Is it a breaking change? to Unspecified (possibly destroys the router).
erkin set Issue type to Bug (incorrect behavior).Aug 31 2021, 7:23 PM
syncer edited projects, added VyOS 1.3 Equuleus (1.3.0); removed VyOS 1.3 Equuleus.Nov 6 2021, 11:25 AM
dmbaturin edited projects, added VyOS 1.4 Sagitta; removed VyOS 1.3 Equuleus (1.3.0).Nov 9 2021, 4:54 AM
dmbaturin closed this task as Resolved N/A.Feb 10 2024, 8:44 PM
dmbaturin removed projects: VyOS 1.4 Sagitta, test.

The code in question has been rewritten so if there are bugs, they are likely different. ;)