Bug 2223204

Summary:	Rootful IPv6 masquerade does not route packets
Product:	[Fedora] Fedora	Reporter:	François Rigault <francois.rigault>
Component:	podman	Assignee:	Matthew Heon <mheon>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	39	CC:	bbaude, container-sig, debarshir, dwalsh, go-sig, jnovy, lsm5, mheon, patrick, rh.container.bot, santiago
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://github.com/containers/netavark/issues/636
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description François Rigault 2023-07-16 14:13:13 UTC

when publishing a port on an IPv6 network, packets from host to container are routed fine but the response is met with a "ICMP6, destination unreachable, unreachable route" 

seems similar to https://github.com/containers/netavark/issues/636

This is on rawhide with 
kernel 6.5.0-0.rc1.11.fc39.aarch64
iptables iptables-libs-1.8.9-4.fc39.aarch64
podman-4.5.1-1.fc39.aarch64

originally experienced while investigating an issue with Kubernetes Kind.

Reproducible: Always

Steps to Reproduce:
1. sudo -s
2. podman network create --ipv6  podman6
3. podman run --name n  --network podman6 --rm -ti --publish '8080:80' nginx
4. curl '[::1]:8080' -vvv
Actual Results:  
curl timeout

conntrack in SYN_RECV:

tcp      6 57 SYN_RECV src=::1 dst=::1 sport=38334 dport=8080 src=fd2d:a39e:3104:3725::3 dst=fd2d:a39e:3104:3725::1 sport=80 dport=38334 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1

tcpdump: shows routing error:
14:08:42.582710 IP6 rawhide.38334 > fd2d:a39e:3104:3725::3.http: Flags [S], seq 119954706, win 65476, options [mss 65476,sackOK,TS val 3462719948 ecr 0,nop,wscale 7], length 0
14:08:42.582739 IP6 fd2d:a39e:3104:3725::3.http > rawhide.38334: Flags [S.], seq 2002668927, ack 119954707, win 64260, options [mss 1440,sackOK,TS val 2023408809 ecr 3462719948,nop,wscale 7], length 0
14:08:42.582753 IP6 rawhide > fd2d:a39e:3104:3725::3: ICMP6, destination unreachable, unreachable route rawhide, length 88



Expected Results:  
connection established

Comment 1 Matthew Heon 2023-07-17 16:28:55 UTC

This is a known problem specific to localhost. Localhost masquerade with IPv4 is allowed by the kernel, but not localhost IPv6 masquerade (my understanding is that this is for security reasons, but I'm not entirely familiar with why it is a security issue).

We've considered ways around this (which mostly amount to opening the sockets ourselves and forwarding traffic manually) but such a fix is currently low priority given that the forwarding does function correctly aside from localhost issues and the implications of having to maintain our own local forwarder.

Comment 2 François Rigault 2023-07-17 16:58:42 UTC

ok thanks for the feedback. 
For my particular use case I could use Kind apiServerAddress option, so I am not impacted by this behavior at all.


https://github.com/kubernetes-sigs/kind/blob/3610f606516ccaa88aa098465d8c13af70937050/site/content/docs/user/configuration.md?plain=1#L161

Comment 3 Fedora Release Engineering 2023-08-16 08:12:57 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.