Page MenuHomePhabricator

Broken 6rd tunnel implementation
In progress, LowPublicBUG

Description

Hi all!
I've found, that implementation of 6rd tunnels is broken. Here is a list of a founded bugs:

  1. 6rd options can be set for any type of tunnel. Must be limited to "sit" only. We must add two checks:
    1. If encapsulation is already set and it is not "sit" then deny to use 6rd options.
    2. And vice versa - if "6rd" options is already set, deny to set any encapsulations, except "sit".
  2. Following to RFC5969, we must able to configure:
    1. IPv4MaskLen (presented, but not functional). IPv4MaskLen can be calculated from 6rd-relay_prefix but VyOS trying to validate it as IP host address (must be network address). Due this ip tunnel command can't configure 6rd options property.
    2. 6rdPrefix (presented)
    3. 6rdPrefixLen (presented)
    4. 6rdBRIPv4Address (not presented, but can be configured through routes)
  3. Configuration allow to create tunnel with 6rd-prefix with length different, than 32 without 6rd-relay_prefix option. Due to 6rd implementation in iproute2 this will not work.
  4. Tunnel configuration allow to add more than one 6rd-prefix. This is not allowed by RFC.
  5. Tunnel can't be created without remote-ip option. This option not required for 6rd-tunnels.

I think, that we must rework this 6rd tunnels implementation and test it again.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0-rolling+201811111746
Why the issue appeared?
Will be filled on close
zsdc created this task.Sun, Nov 11, 11:15 PM
syncer triaged this task as Low priority.Tue, Nov 13, 3:51 AM
syncer edited projects, added VyOS 1.2.x (VyOS 1.2.0-rc8); removed VyOS 1.2.x.

I think I've fixed it enough to give it meaningful testing.

Apparently iproute2 itself doesn't allow creation of SIT tunnels without a remote address, 6rd or not. If you know the procedure to get around it, please share.

dmbaturin changed the task status from Open to In progress.Sun, Nov 18, 6:00 PM
zsdc added a comment.Tue, Nov 20, 9:44 PM

I will check fix soon.
By creating tunnels without remote side I mean something like:

ip tunnel add sit1 mode sit local 192.168.20.20 ttl 64

This is "vanilla way", as I understand.

zsdc added a comment.EditedTue, Dec 4, 3:24 PM

Tested with 1.2.0-rolling+201812010337. Still many bugs, very hard to diagnostic it properly.
Minimal list TODO, for we can continue testing:

  1. Need to add additional check. Prefix length of 6rd-prefix + 32 - prefix length of 6rd-relay-prefix must be equal to 64. Example:

6rd-prefix = 2001:0db8:0:70::/60
6rd-relay-prefix = 192.168.1.0/28
60 + 32 - 28 = 64
If this is not true, iproute2 can't set 6rd parameters (limitation in iproute2).

  1. After creating 6rd tunnel we need to add route to 6rd-prefix through this tunnel automatically.

At VyOS side configuration must be:

ip tunnel add [tun-device-name] mode sit local [local-ip] remote 0.0.0.0 ttl 64
ip tunnel 6rd dev [tun-device-name] 6rd-prefix [6rd-prefix] 6rd-relay_prefix [6rd-relay_prefix]
ip l set [tun-device-name] up
ip -6 route add [6rd-prefix] dev [tun-device-name]
vyos@vyos# show interfaces tunnel 
+tunnel tun1 {
+    6rd-prefix [6rd-prefix]
+    6rd-relay-prefix [6rd-relay_prefix]
+    encapsulation sit
+    local-ip [local-ip]
+    remote-ip 0.0.0.0
+}
[edit]
vyos@vyos# show protocols static interface-route6 
+  interface-route6 [6rd-prefix] {
+      next-hop-interface tun1 {
+     }
+  }

But, now system ignore local-ip:

Dec 04 17:21:34 vyos sudo[3265]: vyos : TTY=pts/0 ; PWD=/home/vyos ; USER=root ; COMMAND=/sbin/ip tunnel add tun1 remote 0.0.0.0 mode sit