Incompatibility with Linux 6.11.{4,5} and 6.6.{57,58} due to ip6tables error #13863
Description
What is the issue?
I updated to Linux 6.11.4 (on NixOS) and now tailscale status reports the following:
# Health check:
# - adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running [/nix/store/zpl4wlvc9a4ziq7b6ccrpxzn5mwc3frn-iptables-1.8.10/bin/ip6tables -t filter -A ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000 --wait]: exit status 2: Warning: Extension MARK revision 0 not supported, missing kernel module?
ip6tables v1.8.10 (nf_tables): MARK: bad value for option "--set-mark", or out of range (0-4294967295).
Try `ip6tables -h' or 'ip6tables --help' for more information.
As a result, many things don't work correctly, in particular MagicDNS.
Steps to reproduce
- Make a NixOS system with kernel 6.11.4 (
boot.kernelPackages = pkgs.linuxPackages_latestat time of issue filing). I assume other distros with 6.11.4 would also exhibit the issue, but I haven't checked myself. - Install and configure tailscale (
services.tailscale.enable = true,tailscale upetc) - Run
tailscale status
Observed:
# Health check:
# - adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running [/nix/store/zpl4wlvc9a4ziq7b6ccrpxzn5mwc3frn-iptables-1.8.10/bin/ip6tables -t filter -A ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000 --wait]: exit status 2: Warning: Extension MARK revision 0 not supported, missing kernel module?
ip6tables v1.8.10 (nf_tables): MARK: bad value for option "--set-mark", or out of range (0-4294967295).
Try `ip6tables -h' or 'ip6tables --help' for more information.
Expected: No health check warnings.
This was the case with 6.11.3.
Are there any recent changes that introduced the issue?
The changelog for kernel 6.11.4 lists the following commits to the netfilter code.
$ git log v6.11.3..v6.11.4 --oneline | grep netfilter
339dc6c7266c netfilter: fib: check correct rtable in vrf setups
4cdc55ec6222 netfilter: xtables: avoid NFPROTO_UNSPEC where needed
915717e0bb98 netfilter: br_netfilter: fix panic with metadata_dst skb
9f5c115077d3 netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
a2c6c487ed9c netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash
Of these revisions, netfilter: xtables: avoid NFPROTO_UNSPEC where needed has been confirmed to be the source of this issue.
OS
Linux
OS version
NixOS at revision 0fe3416c7f455a1e7ca6dec3c0b2d1e2cd30d4f6
Tailscale version
1.76.1
Other software
My full NixOS configuration is at https://github.com/philiptaron/flock.nix. There's nothing fancy there, though; it's mostly a stock NixOS configuration that has run Tailscale reliably until this kernel upgrade.
Bug report
BUG-a941a9d4060b13bb02ff199d2b96deac67ccf9b681a2dfc2f5ee5576fb062a46-20241019151759Z-9ca281bdd508a563