diff options
| author | James Tucker <james@tailscale.com> | 2025-03-26 15:59:51 -0700 |
|---|---|---|
| committer | James Tucker <james@tailscale.com> | 2025-03-27 15:40:38 -0700 |
| commit | e27a60265cdb385522fb922503eb832033482140 (patch) | |
| tree | b386f6d9f9ee507dfd01a0fa077b1d9431691e9d | |
| parent | e9324236e83e78e8fe588e38166d466a80aff150 (diff) | |
| download | tailscale-raggi/iptables-kernel-bug-message.tar.xz tailscale-raggi/iptables-kernel-bug-message.zip | |
util/linuxfw: add improved health message for bad kernelsraggi/iptables-kernel-bug-message
Based on recent bug activity it appears a good number of major distros
have just shipped Linux 6.8.0, a no longer maintained branch, with
backports from other branches but not their corresponding fixes.
Add an explicit check for this output, including a pointer to the
relevant kernel commit, and the suggested workaround.
Updates #13863
Signed-off-by: James Tucker <james@tailscale.com>
| -rw-r--r-- | util/linuxfw/iptables_runner.go | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/util/linuxfw/iptables_runner.go b/util/linuxfw/iptables_runner.go index 9a6fc0224..5ef1e59a4 100644 --- a/util/linuxfw/iptables_runner.go +++ b/util/linuxfw/iptables_runner.go @@ -455,7 +455,14 @@ func (i *iptablesRunner) addBase6(tunname string) error { args = []string{"-i", tunname, "-j", "MARK", "--set-mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask} if err := i.ipt6.Append("filter", "ts-forward", args...); err != nil { - return fmt.Errorf("adding %v in v6/filter/ts-forward: %w", args, err) + if strings.Contains(err.Error(), "MARK: bad value for option \"--set-mark\", or out of range (0-4294967295)") { + err = fmt.Errorf( + "The Linux kernel release you are running contains a bug that prevents setting packet marks via iptables in IPv6\n" + + "Please upgrade your kernel / seek a fix from your kernel vendor.\n" + + "See https://github.com/torvalds/linux/commit/306ed1728e8438caed30332e1ab46b28c25fe3d8\n" + + "To work around this issue, you can set TS_DEBUG_FIREWALL_MODE=nftables in /etc/default/tailscale") + } + return err } args = []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "ACCEPT"} if err := i.ipt6.Append("filter", "ts-forward", args...); err != nil { |