search

openziti / ziti-tunnel-sdk-c

Apache License 2.0
43 stars 17 forks source link

"ziti-edge-tunnel run" command tries to set an invalid route prefix #374

Closed qrkourier closed 1 year ago

qrkourier commented 2 years ago

This error message

Error: Invalid prefix for given prefix length

Is typical of the ip route add command when the prefix is not a network address, and the log line that follows does indeed contain a prefix that is not a network address. I believe this should be ip route add 100.64.0.0/10 dev tun0.

Jun 05 20:37:46 k8sw1 systemd[1]: Started Ziti Edge Tunnel.
Jun 05 20:37:46 k8sw1 ziti-edge-tunnel[1067]: [        0.000]    INFO ziti_log_set_level set log level: ziti_log_lvl=2 &ziti_log_lvl = 0x5566e24d5350
Jun 05 20:37:46 k8sw1 ziti-edge-tunnel[1077]: Error: Invalid prefix for given prefix length.
Jun 05 20:37:46 k8sw1 ziti-edge-tunnel[1067]: [        0.000]   ERROR ziti-edge-tunnel:utils.c:30 run_command_va() cmd{ip route add 100.64.0.1/10 dev tun0} failed: 512/17/File exists
Jun 05 20:37:46 k8sw1 ziti-edge-tunnel[1067]: [        0.034]    INFO ziti_log_set_level set log level: ziti_log_lvl=2 &ziti_log_lvl = 0x5566e24d5350

This bug is preventing ziti-edge-tunnel run v0.18.6 from installing the 100.64/10 route which is necessary to intercept packets that are destined for the IP addresses in answers from the Ziti domain name resolver.

qrkourier commented 2 years ago 
kb@k8sw1:~$ ip route sh|grep 100.64
100.64.0.3 dev tun0 scope link 
kb@k8sw1:~$ sudo ip route add 100.64.0.1/10 dev tun0
Error: Invalid prefix for given prefix length.
kb@k8sw1:~$ sudo ip route add 100.64.0.0/10 dev tun0
kb@k8sw1:~$ ip route sh|grep 100.64
100.64.0.0/10 dev tun0 scope link 
100.64.0.3 dev tun0 scope link
qrkourier commented 2 years ago

Also, ziti-edge-tunnel run should not fail silently when unable to install this critical IP route.

sabedevops commented 2 years ago

This relates to the discussion I brought up in: https://github.com/openziti/ziti-tunnel-sdk-c/pull/346#discussion_r864406740

qrkourier commented 2 years ago

This relates to the discussion I brought up in: #346 (comment)

@sabedevops I see that now, thanks. Do you believe that means the fix is forthcoming? Based on a general sense of the timing I would expect any changes from that thread to have been present in the 0.18.6 tag.

sabedevops commented 2 years ago

That's something @scareything would need to answer.

scareything commented 2 years ago

relates to and mentioned in #419. fixes coming soon.

qrkourier commented 1 year ago

closing as duplicate