vyos-build.git/scripts/package-build/linux-kernel/patches/kernel/0004-l2tp-defer-route-at-tunnel-create.patch, branch rollingVyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git)
https://git.amelek.net/vyos/vyos-build.git/atom?h=rolling2026-07-08T18:38:55+00:00Kernel: T9067: Update Linux Kernel to 6.18.382026-07-08T18:38:55+00:00Christian Breunigchristian@breunig.cc2026-07-08T18:38:55+00:00urn:sha1:9ab08c84d113aec00c5114721d87cdcda46f187dKernel: T8605: net/l2tp: allow unmanaged tunnel setup without route to peer2026-05-08T20:53:39+00:00Christian Breunigchristian@breunig.cc2026-05-08T20:53:39+00:00urn:sha1:8c4d602b3f2513d928fa4f67d4c26545c879b7f8
Kernel-created L2TPv3 tunnels (genetlink L2TP_CMD_TUNNEL_CREATE without
L2TP_ATTR_FD) used udp_sock_create() and kernel_connect(), which invoke
__ip4_datagram_connect() / __ip6_datagram_connect(). Those paths insist on
a successful FIB lookup at connect time. If no route to the configured
remote existed yet, tunnel and interface creation failed.
The data path already resolves routes on transmit (e.g. __ip_queue_xmit(),
inet6_csk_route_socket()). This change defers requiring a route until
packets are sent.
Details:
- UDP encapsulation: bind with udp_sock_create() after zeroing peer_udp_port,
then l2tp_udp_sk_set_peer() sets daddr/dport and socket "connected" state
without caching sk_dst from connect.
- IPv4 L2TP/IP (l2tp_ip): on -ENETUNREACH / -EHOSTUNREACH from
__ip4_datagram_connect(), l2tp_ip_connect_deferred() installs peer and
bind-table updates without a connect-time route.
- IPv6 L2TP/IP (l2tp_ip6): same for __ip6_datagram_connect(), including
IPv4-mapped peers and scope / bound-device checks aligned with the normal
connect path.
Forwarding still only happens once the FIB can reach the peer. Until then
outgoing packets follow the existing no-route drop path.
Assisted-by: Cursor:claude-4.6-opus
Signed-off-by: Christian Breunig <christian@breunig.cc>