atunnel: support IPv6 original destination lookup - #18
Open
ygao-g wants to merge 2 commits into
Open
Conversation
TCPOriginalDestination only ever asked for SO_ORIGINAL_DST at SOL_IP. On a pure IPv6 socket that builds a PF_INET conntrack tuple from a zeroed address pair, so the lookup misses and an IPv6 actor connection has no destination to tunnel to. The socket option is now chosen from the connection's local address, reading IP6T_SO_ORIGINAL_DST at SOL_IPV6 when that address is not v4-mapped, and the resulting errno reaches the caller labelled with the family whose lookup ran. Dispatching on the local address rather than the socket domain keeps a v4-mapped connection on a dual-stack listener using the IPv4 option, where the IPv6 one would return EOPNOTSUPP and mask the real error.
Nothing exercised the socket-option path itself: the formatting test cannot tell whether the kernel was asked the right question. These tests build an actor-like network namespace joined by a veth, install an nftables PREROUTING REDIRECT, and assert the pre-redirect destination on both families, along with the ENOENT an unredirected connection must still report. The worker side runs in a private namespace so that a host default-deny INPUT policy cannot drop the redirected SYN, and so that conntrack in the ambient namespace cannot answer the lookup that is supposed to miss.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A commit-history proposal for agent-substrate#753. Not for merge.
The tree here is byte-identical to agent-substrate#753's head
b97ab7c9, rebased ontoupstream/mainfe9013a4;git diffbetween the two is empty. Only the history differs: agent-substrate#753's eightcommits are re-cut as two.
atunnel: look up the original destination on IPv6original_dst_linux.go,original_dst_format_linux_test.goatunnel: test original destination against REDIRECT rulesoriginal_dst_linux_test.goagent-substrate#753's history records the review conversation rather than the change: seven of its eight
commits have no body, and
select original destination by familyreplaces the ENOENT-retrydispatch introduced two commits earlier, so a bisector can land on an approach that was
abandoned. The split above puts the ~40-line behavior change and the test that runs on any
machine in one commit, and the privileged netns/nftables harness in another, so the part
worth scrutinising is not buried under scaffolding.
Both commits were checked independently on Linux 6.17 / arm64 —
go vetclean,gofmtclean, and
go test ./internal/atunnel/passing at each one (the second undersudo, whichis where the four root-gated tests actually run).
🤖 Generated with Claude Code