Describe the bug
If an egress IP-packet reaches an LB-FE and is bigger than MTU on the external network while fragmentation is not allowed, the LB-FE must generate an ICMP reply (Frag Needed/Packet Too Big).
In order to generate said ICMP reply route lookup must succeed (dest is a VIP address), otherwise the reply will be cancelled:
https://elixir.bootlin.com/linux/v5.10/source/net/ipv6/icmp.c#L598
https://elixir.bootlin.com/linux/v5.10.194/source/net/ipv4/icmp.c#L744
Depending on the configuration of the primary k8s network, LB-FE POD might or might not have a default route for both IPv4 and IPv6.
Curently, if a default route is missing, then ICMP reply for an egress packet of the matching IP version won't be generated.
To Reproduce
Steps to reproduce the behavior:
- Deploy dualstack Trench with Conduit, Attractor etc. on a Kind cluster with IPv4 k8s networking. Use a single LB-FE.
- Start external-host to simulate router/TG.
- Make sure, MTU of external interface is lower than the cluster internal MTU.
- Start a single example-target and open a Stream to join the deployed Conduit.
- Check default routes in the LB-FE POD. For IPv6 there should be none.
- In example-target use ping to send a big packet to the TG. For IPv6, there should be no Packet Too Big reply. While in case of IPv4, Frag Needed reply should arrive to the Target.
- Run tcpdump in LB-FE to verify no reply sent in case of IPv6.
Describe the bug
If an egress IP-packet reaches an LB-FE and is bigger than MTU on the external network while fragmentation is not allowed, the LB-FE must generate an ICMP reply (Frag Needed/Packet Too Big).
In order to generate said ICMP reply route lookup must succeed (dest is a VIP address), otherwise the reply will be cancelled:
https://elixir.bootlin.com/linux/v5.10/source/net/ipv6/icmp.c#L598
https://elixir.bootlin.com/linux/v5.10.194/source/net/ipv4/icmp.c#L744
Depending on the configuration of the primary k8s network, LB-FE POD might or might not have a default route for both IPv4 and IPv6.
Curently, if a default route is missing, then ICMP reply for an egress packet of the matching IP version won't be generated.
To Reproduce
Steps to reproduce the behavior: