mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
0ccd4bbf24
In CI, eBPF in driver mode actually functions just fine with no changes to our existing tests, given we apply a few workarounds and bugfixes: - The interface learning mechanism had two flaws: (1) it only learned per-CPU, which meant the risk for a missing entry grew as the core count of the relay host grew, and (2) it did not filter for unicast IPs, so it picked up broadcast and link-local addresses, causing cross-relay paths to fail occasionally - The `relay-relay` candidate where the two relays are the same relay causes packet drops / loops in the Docker bridge setup, and possibly in GCP too. I'm not sure this is a valid path that solves a real connectivity issue in the wild. I can understand relay-relay paths where two relays are different hosts, and the client and gateway both talk over their TURN channel to each other (i.e. WireGuard is blocked in each of their networks), but I can't think of an advantage for a relay-relay candidate where the traffic simply hairpins (or is dropped) off the nearest switch. This has been now detected with a new `PacketLoop` error that triggers whenever source_ip == dest_ip. - The relays in CI need a common next-hop to talk to for the MAC address swapping to work. A simple router service is added which functions as a basic L3 router (no NAT) that allows the MAC swapping to work. - The `veth` driver has some peculiar requirements to allow it to function with XDP_TX. If you send a packet out of one interface of a veth pair with XDP_TX, you need to either make sure both interfaces have GRO enabled, or you need to attach a dummy XDP program that simply does XDP_PASS to the other interface so that the sk_buff is allocated before going up the stack to the Docker bridge. The GRO method was unreliable and didn't work in our case, causing massive packet delays and unpredictable bursts that prevented ICE from working, so we use the XDP_PASS method instead. A simple docker image is built and lives at https://github.com/firezone/xdp-pass to handle this. Related: #10138 Related: #10260
20 lines
439 B
Bash
Executable File
20 lines
439 B
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euox pipefail
|
|
|
|
source "./scripts/tests/lib.sh"
|
|
force_relayed_connections ipv4 ipv6
|
|
|
|
docker compose exec --env RUST_LOG=info -it client /bin/sh -c 'iperf3 \
|
|
--time 30 \
|
|
--reverse \
|
|
--udp \
|
|
--bandwidth 300M \
|
|
--client 172.20.0.110 \
|
|
--json' >>"${TEST_NAME}.json"
|
|
|
|
assert_process_state "relay-1" "S"
|
|
assert_process_state "relay-2" "S"
|
|
assert_process_state "gateway" "S"
|
|
assert_process_state "client" "S"
|