Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

4via6 routes advertised by 1.68.0 subnet routers unusable #12448

Closed
keeleysam opened this issue Jun 13, 2024 · 4 comments · Fixed by #12454
Closed

4via6 routes advertised by 1.68.0 subnet routers unusable #12448

keeleysam opened this issue Jun 13, 2024 · 4 comments · Fixed by #12454
Labels
bug Bug connectivity Issues with general connectivity with Tailscale OS-linux

Comments

@keeleysam
Copy link

keeleysam commented Jun 13, 2024 •
edited
Loading

What is the issue?

Using a 4via6 subnet route from any Tailscale client which is served by another peer running Tailscale 1.68.0, at least for HTTP/HTTPS TCP traffic, is not possible with identical configuration to 1.66.4. All attempted connections end up getting reset, though ICMP does appear to work to those endpoints. Advertised IPv4 routes work fine.

Steps to reproduce

Advertise a 4via6 route from one node, with a completely open ACL. On 1.66.4 this works fine and is usable from the second node. In this example, reaching a random google.com ipv4 endpoint via site id 123.

% curl -vI '[fd7a:115c:a1e0:b1a:0:123:8efa:bfae]'
*   Trying [fd7a:115c:a1e0:b1a:0:123:8efa:bfae]:80...
* Connected to fd7a:115c:a1e0:b1a:0:123:8efa:bfae (fd7a:115c:a1e0:b1a:0:123:8efa:bfae) port 80
> HEAD / HTTP/1.1
> Host: [fd7a:115c:a1e0:b1a:0:123:8efa:bfae]
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
< Transfer-Encoding: chunked
Transfer-Encoding: chunked
< Date: Thu, 13 Jun 2024 02:22:11 GMT
Date: Thu, 13 Jun 2024 02:22:11 GMT
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8
< 

* Connection #0 to host fd7a:115c:a1e0:b1a:0:123:8efa:bfae left intact

Update first node to 1.68.0.

Attempts to use these routes will reset in connections getting reset by peer.

% curl -vI '[fd7a:115c:a1e0:b1a:0:123:8efa:bfae]'
*   Trying [fd7a:115c:a1e0:b1a:0:123:8efa:bfae]:80...
* Connected to fd7a:115c:a1e0:b1a:0:123:8efa:bfae (fd7a:115c:a1e0:b1a:0:123:8efa:bfae) port 80
> HEAD / HTTP/1.1
> Host: [fd7a:115c:a1e0:b1a:0:123:8efa:bfae]
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
* Recv failure: Connection reset by peer
* Closing connection
curl: (56) Recv failure: Connection reset by peer

Are there any recent changes that introduced the issue?

No response

OS

Linux

OS version

Debian 13

Tailscale version

1.68.0

Other software

No response

Bug report

No response
@agottardo agottardo added connectivity Issues with general connectivity with Tailscale OS-linux labels Jun 13, 2024
@irbekrm
Copy link
Contributor

irbekrm commented Jun 13, 2024

Thank you for opening the issue.

I can reproduce this with a subnet router v1.68.0 and both with a client at 1.66 as well as with a client at 1.68
Downgrading the subnet router to 1.66.4 fixes the issue.

We'll take a look at fixing this.

@ch9hn
Copy link

ch9hn commented Jun 13, 2024

Hello,
we have similar issue, since today the Subnet Routes stopped working out of nowhere.
All Subnet Router connections are not working anymore.

irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm @andrew-d
wgengine/netstack: fix 4via6 subnet routes
b68b914 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm @andrew-d
wgengine/netstack: fix 4via6 subnet routes
abf2e95 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
@irbekrm irbekrm mentioned this issue Jun 13, 2024
Merged
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm @andrew-d
wgengine/netstack: fix 4via6 subnet routes
5d692f2 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm @andrew-d
wgengine/netstack: fix 4via6 subnet routes (#12454)
88f2d23 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm
wgengine/netstack: fix 4via6 subnet routes
dbc0f51 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
(cherry picked from commit 5d692f2)
@irbekrm irbekrm mentioned this issue Jun 13, 2024
Merged
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm
wgengine/netstack: fix 4via6 subnet routes (#12454)
e56428a 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
(cherry picked from commit 88f2d23)
irbekrm added a commit that referenced this issue Jun 13, 2024
@irbekrm
wgengine/netstack: fix 4via6 subnet routes (#12454) (#12455)
87a6138 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes #12448

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
(cherry picked from commit 88f2d23)
andrew-d added a commit that referenced this issue Jun 13, 2024
@andrew-d
wgengine/netstack: add test for #12448
eec4fc2 
This refactors the logic for determining whether a packet should be sent
to the host or not into a function, and then adds tests for it.

Updates #11304
Updates #12448

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5
@andrew-d andrew-d mentioned this issue Jun 13, 2024
Merged
andrew-d added a commit that referenced this issue Jun 13, 2024
@andrew-d
wgengine/netstack: add test for #12448
4a2cec6 
This refactors the logic for determining whether a packet should be sent
to the host or not into a function, and then adds tests for it.

Updates #11304
Updates #12448

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5
andrew-d added a commit that referenced this issue Jun 13, 2024
@andrew-d
wgengine/netstack: add test for #12448
72c8f77 
This refactors the logic for determining whether a packet should be sent
to the host or not into a function, and then adds tests for it.

Updates #11304
Updates #12448

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5
@ch9hn
Copy link

ch9hn commented Jun 15, 2024

We installed the hotfix version 1.68.1, this fixed the issue.

@irbekrm
Copy link
Contributor

irbekrm commented Jun 15, 2024

Thank you for confirming!

chen8945 pushed a commit to Ckid-Home/tailscale that referenced this issue Jul 31, 2024
@irbekrm @andrew-d @chen8945
wgengine/netstack: fix 4via6 subnet routes (tailscale#12454)
bac0fdd 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes tailscale#12448

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
chen8945 pushed a commit to Ckid-Home/tailscale that referenced this issue Jul 31, 2024
@andrew-d @chen8945
wgengine/netstack: add test for tailscale#12448
3a49d55 
This refactors the logic for determining whether a packet should be sent
to the host or not into a function, and then adds tests for it.

Updates tailscale#11304
Updates tailscale#12448

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5
Asutorufa pushed a commit to Asutorufa/tailscale that referenced this issue Aug 23, 2024
@irbekrm @andrew-d @Asutorufa
wgengine/netstack: fix 4via6 subnet routes (tailscale#12454)
43c7741 
Fix a bug where, for a subnet router that advertizes
4via6 route, all packets with a source IP matching
the 4via6 address were being sent to the host itself.
Instead, only send to host packets whose destination
address is host's local address.

Fixes tailscale#12448

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Co-authored-by: Andrew Dunham <andrew@du.nham.ca>
Asutorufa pushed a commit to Asutorufa/tailscale that referenced this issue Aug 23, 2024
@andrew-d @Asutorufa
wgengine/netstack: add test for tailscale#12448
9e03a8c 
This refactors the logic for determining whether a packet should be sent
to the host or not into a function, and then adds tests for it.

Updates tailscale#11304
Updates tailscale#12448

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Bug connectivity Issues with general connectivity with Tailscale OS-linux
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

wgengine/netstack: fix 4via6 subnet routes tailscale/tailscale
5 participants
@keeleysam @agottardo @irbekrm @ch9hn @kelivel