Enforce delegated-prefix ownership and bidirectional traffic policy #979

Activity

1. privateip

   added

   enhancementNew feature or requestNew feature or request

   on Oct 22, 2026
2. privateip

   added a parent issue on Oct 22, 2026

   • MASQUE Connector for gVPC #970
3. privateip

   changed the title [-]MASQUE: enforce delegated-prefix ownership and bidirectional traffic policy[/-] [+]Enforce delegated-prefix ownership and bidirectional traffic policy[/+] on Oct 22, 2026
4. privateip

   added the

   Task

   issue type on Oct 22, 2026
5. privateip

   self-assigned this

   on Oct 28, 2026
6. privateip commented on Oct 28, 2026

   

   privateip

   on Oct 28, 2026

   CollaboratorAuthor

   More actions

   Verdict: valid. Reproduced on main at 2dcdb3e.

   The CONNECT-IP proxy runs no packet checks of its own. It relies on connect-ip-go v0.6.0, which checks a packet's source against the assigned /96 and its destination against the advertised routes. The library does not apply the parsing profile in the MASQUE contract, and it counts no drops.

   A test in internal/edge/connectip sent raw datagrams over an admitted request with the test fixture's addresses. All three of these packets got through:

   1. A client packet with an atomic Fragment header reached the gVPC backend.
   2. A client ICMPv6 Destination Unreachable with a source outside the connector's /96 reached the gVPC. The library accepts any source on an ICMP error as long as the quoted packet could have crossed the tunnel, so a client can inject packets with a spoofed source.
   3. A gVPC packet with a Fragment header reached the client.

   Other findings:

   • Drops are reported only through the library's log.Printf, with no reason counter.
   • The library checks the upper-layer protocol, not each extension header. Nothing limits the header count or length, and a Routing header with segments left is evaluated against its next hop instead of its final destination.
   • The server accepts a grant whose routes include IPv4 prefixes and advertises them, which implies IPv4 support that the packet path does not have.
   • The TUN backend drops IPv4 and unmatched packets from the device without counting them.
7. privateip commented on Oct 28, 2026

   

   privateip

   on Oct 28, 2026

   CollaboratorAuthor

   More actions

   Approved fix plan.

   Root cause. Server.proxySession in internal/edge/connectip/server.go moves packets between the CONNECT-IP stream and the backend with no checks of its own. connect-ip-go v0.6.0 accepts an ICMP error from any source, does not walk extension headers or refuse fragments, and logs drops instead of counting them.

   Fix.

   1. A session packet policy in internal/edge/connectip, built from the lease's /96 and routes:
      • Parsing: IPv6 only, with IPv4 refused under its own reason. The payload length must match exactly. At most 8 extension headers and 256 header bytes. Hop-by-Hop only first. Every Fragment header is refused, as is any Routing header with segments left, and any unknown extension header.
      • Toward the gVPC: the source must be in the connector's /96, ICMP errors included, and the destination must be in an advertised route.
      • Toward the client: the destination must be in the /96. The source must be in a route, unless the packet is an ICMPv6 error quoting a packet from this /96 to a route, which keeps Packet Too Big from gVPC routers working.
   2. proxySession applies it in both directions, and to the Packet Too Big the library composes for the client.
   3. galactic_connectip_packets_denied_total{direction,reason} counts every refusal, including IPv4 and unmatched packets the TUN backend reads from its device.
   4. A grant with an IPv4 route is refused, so IPv4 is never advertised.
   5. docs/edge/masque-provider.md documents the policy, its reasons and the metric.

   A grant refresh that changes the routes already ends the session, so MASQUE-side policy updates reach live sessions. gVPC traffic policy stays with the foundation (#999).

   Tests. A table test for every reason in both directions. The reproduction becomes a server test that fails on main: spoofed and cross-connector sources, fragments in both directions, the refusal counters, and the IPv4 route grant. A socketpair TUN test shows two VPCs holding the same /96 never receive each other's packets.

   Risk. Stricter than RFC 9484 for client ICMP errors: a client must send its errors from its own /96. Fragmented inner packets are refused, as the contract already states. HTTP/2 (#981) and the lab rows (#985) are out of scope.
8. privateip

   closed this as completedin #1200on Oct 28, 2026