ab/tsunagi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Report an allocated IPv4 address that is not on the host

Browse Source 
IPv6 works end to end between two machines; IPv4 silently did not, and the
agent said nothing useful about why.

Allocation moved the address from something derivable before startup to
something agreed at run time, so an interface configured by an earlier
`tun-setup` carries a different address than the one allocated. The kernel
then sends packets with that stale source and every peer drops them as not
belonging to us — correct behaviour, invisible cause. Meanwhile pings to
our own allocated address fall into the tunnel and land in the "nobody
owns this" counter.

The agent now checks whether its allocated address is assigned anywhere on
the host — by binding a UDP socket to it, which needs no privileges and no
platform code — and reports the exact `ip address add` command until it
is, mentioning that another address of the range has to go.

`tun-setup` no longer prints a derived IPv4 address, because that number
is now wrong by construction. It says the agent will print the real one.

The unroutable counter keeps one destination as a sample, in status output
too. A bare count says something is wrong; the address says what.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
tsunagi
2026-09-21 13:53:42 +01:00
co-authored by Claude Opus 5
parent 84c06c6cac
commit 8b333455f1
9 changed files with 162 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bin/tsunagi.rs
+8 -13
View File
@@ -378,7 +378,6 @@ async fn status(args: StatusArgs) -> Result<(), Box<dyn std::error::Error>> {
async fn tun_setup(args: TunSetupArgs) -> Result<(), Box<dyn std::error::Error>> {
use tsunagi::dataplane::wireguard::{
DEFAULT_MTU, OVERLAY_PREFIX_LEN, WgKeyStore, interface_name, overlay_address,
overlay_address_v4,
};
use tsunagi::identity::NetworkKeys;
@@ -407,10 +406,12 @@ async fn tun_setup(args: TunSetupArgs) -> Result<(), Box<dyn std::error::Error>>
println!("# Network {name} ({network})");
println!("# Interface {interface}, address {address}/{OVERLAY_PREFIX_LEN}, mtu {mtu}");
if let Some(range) = ipv4_range
&& let Some(v4) = overlay_address_v4(network, &key.public(), range)
{
println!("# IPv4 overlay address {v4}/{}", range.prefix_len);
if ipv4_range.is_some() {
println!(
"# IPv4 is allocated once the agent runs and agrees with its peers, so it\n\
# cannot be printed here. Start `tsunagi up`; it prints the exact\n\
# `ip address add` command for the address it was given."
);
}
println!("# Run once as root; then run `tsunagi up` as {user}.");
println!(
@@ -425,14 +426,7 @@ async fn tun_setup(args: TunSetupArgs) -> Result<(), Box<dyn std::error::Error>>
println!("sudo ip link set dev {interface} mtu {mtu} up");
println!("sudo sysctl -qw net.ipv6.conf.{interface}.keep_addr_on_down=1");
println!("sudo ip -6 address add {address}/{OVERLAY_PREFIX_LEN} dev {interface} nodad");
if let Some(range) = ipv4_range
&& let Some(v4) = overlay_address_v4(network, &key.public(), range)
{
println!(
"sudo ip address add {v4}/{} dev {interface}",
range.prefix_len
);
}
println!("\n# To check it afterwards:");
println!("ip -6 addr show dev {interface}");
println!("\n# To remove it again:");
@@ -728,6 +722,7 @@ async fn build_report(
.collect(),
unroutable_packets: view.unroutable_packets,
multicast_packets: view.multicast_packets,
unroutable_sample: view.unroutable_sample.map(|address| address.to_string()),
});
NetworkReport {