Skip to content

missing k8s default route leads to egress PMTUD problem #456

@zolug

Description

@zolug

Describe the bug
If an egress IP-packet reaches an LB-FE and is bigger than MTU on the external network while fragmentation is not allowed, the LB-FE must generate an ICMP reply (Frag Needed/Packet Too Big).

In order to generate said ICMP reply route lookup must succeed (dest is a VIP address), otherwise the reply will be cancelled:
https://elixir.bootlin.com/linux/v5.10/source/net/ipv6/icmp.c#L598
https://elixir.bootlin.com/linux/v5.10.194/source/net/ipv4/icmp.c#L744

Depending on the configuration of the primary k8s network, LB-FE POD might or might not have a default route for both IPv4 and IPv6.
Curently, if a default route is missing, then ICMP reply for an egress packet of the matching IP version won't be generated.

To Reproduce
Steps to reproduce the behavior:

  1. Deploy dualstack Trench with Conduit, Attractor etc. on a Kind cluster with IPv4 k8s networking. Use a single LB-FE.
  2. Start external-host to simulate router/TG.
  3. Make sure, MTU of external interface is lower than the cluster internal MTU.
  4. Start a single example-target and open a Stream to join the deployed Conduit.
  5. Check default routes in the LB-FE POD. For IPv6 there should be none.
  6. In example-target use ping to send a big packet to the TG. For IPv6, there should be no Packet Too Big reply. While in case of IPv4, Frag Needed reply should arrive to the Target.
  7. Run tcpdump in LB-FE to verify no reply sent in case of IPv6.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    Status
    📋 To Do

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions