search

oofnikj / docker-openwrt

OpenWrt running in Docker
GNU General Public License v2.0
310 stars 63 forks source link

Macvlan for lan #4

Closed oofnikj closed 4 years ago

oofnikj commented 4 years ago

Hi @v01ded, I finally figured out the issue I had with macvlan networking for LAN.

The issue I was having is related to an old kernel bug (feature?) that disables checksumming for UDP packets on virtual interfaces. The assumption is that there is no value in computing a UDP checksum for a virtual interface since there is no physical transmission occurring, thus no chance of packet corruption. However, this does not play nice with DHCP/BOOTP clients.

You can see the bad UDP checksum error in tcpdump:

$ tcpdump -Xvveni eth0
...
08:31:25.305099 02:42:c0:a8:12:02 > 5a:d7:6a:e4:4c:b5, ethertype IPv4 (0x0800), length 342: (tos 0xc0, ttl 64, id 49467, offset 0, flags [none], proto UDP (17), length 328)
    192.168.18.2.67 > 192.168.18.150.68: [bad udp cksum 0xa72e -> 0xdee9!] BOOTP/DHCP, Reply, length 300, xid 0xe33873cf, secs 12, Flags [none] (0x0000)

This issue was mostly resolved upstream for things like QEMU / KVM where virtual interfaces are extensively used.

I managed to fix this in @d26a0a6 by adding an iptables rule to force a checksum on outgoing DHCP packets, overriding the default kernel behavior on virtual interfaces.

Some references: https://lorinstechblog.wordpress.com/2013/06/05/the-infamous-checksum-bug/ https://git.devuan.org/gregolsen/lxc-devuan/issues/1 https://github.com/projectcalico/felix/issues/40 https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/930962 https://tools.ietf.org/html/rfc768