Network Packet Flow & Segmentation
Relevant source files
The following files were used as context for generating this wiki page:
The gokrazy-kernel-buggy-linux-7_0 project provides a specialized Linux 7.0 kernel for amd64 architectures. It intentionally maintains a UDP Generic Segmentation Offload (GSO) regression to facilitate testing of mitigation behaviors in network software like Tailscale. The system targets virtualized environments, specifically QEMU q35, and includes necessary drivers for network plumbing and hardware emulation.
Sources: README.md:1-10, empty.go:7-10
UDP Segmentation Offloading
The kernel manages network packet flow by delegating large packet fragmentation to the network interface card (NIC) through Segmentation Offloading. This specific kernel build preserves a regression in the UDP GSO path.
IGB Driver and Offload Advertisement
The Intel igb network driver handles packet transmission for emulated Intel NICs. During initialization, the igb interface advertises specific capabilities to the networking stack. Diagnostic tests verify these features before executing mitigation scenarios.
- tx-udp-segmentation: The driver claims the ability to segment large UDP payloads into smaller packets.
- tx-gso-partial: The driver supports partial Generic Segmentation Offload, allowing the stack to offload specific parts of the segmentation process.
Sources: README.md:14-18, config.addendum.txt:77-80
Segmentation Flow
When an application sends a large UDP datagram, the kernel networking stack determines if the hardware can handle segmentation. In this kernel, the flow proceeds through the buggy GSO diagnostic path.
The diagram shows the path from application data to hardware, highlighting the intentional use of the buggy GSO path.
Sources: README.md:4-10, config.addendum.txt:76
Networking Stack Configuration
The kernel includes a comprehensive suite of networking features to support complex routing, tunneling, and traffic control.
Core Protocols and Tunneling
The configuration enables both IPv4 and IPv6 protocols along with modern tunneling mechanisms.
| Component | Kernel Configuration | Purpose |
|---|---|---|
| IPv6 | CONFIG_IPV6 | Enables standard IPv6 networking support. |
| WireGuard | CONFIG_WIREGUARD | Provides high-performance VPN tunneling. |
| TUN/TAP | CONFIG_TUN | Creates virtual network devices for user-space networking. |
| UDP Tunnel | CONFIG_NET_UDP_TUNNEL | Supports encapsulation of packets within UDP. |
Sources: config.addendum.txt:1-3, config.addendum.txt:58-61
Filtering and NAT
The system uses nftables for packet filtering and Network Address Translation (NAT). It explicitly disables several Netfilter connection tracking helpers (e.g., FTP, SIP, IRC) to mitigate NAT slipstreaming attacks.
The diagram illustrates the packet flow through the filtering and NAT engine while highlighting the security measures taken by disabling specific helpers.
Sources: config.addendum.txt:24-55
Virtualization and Testing Infrastructure
The kernel is optimized for vmtest environments and container-style network plumbing.
Driver Support
To ensure compatibility with QEMU and modern testing frameworks, the kernel includes several virtualization drivers:
- Virtio Drivers: Supports
virtio-netfor high-speed paravirtualized networking,virtio-blkfor block storage, andvirtio-pci. - VETH and Bridge: Enables
CONFIG_VETHandCONFIG_BRIDGEto support virtual Ethernet pairs and software bridging, which are essential forruncorpodman-style network isolation. - BPF and Cgroups: Enables
CONFIG_BPF_SYSCALLandCONFIG_CGROUP_BPFfor advanced socket-level filtering and resource management.
Sources: config.addendum.txt:67-74, config.addendum.txt:83-98
Build and Deployment
The build process integrates the kernel into the gokrazy ecosystem. You execute the build-buggy-linux-7_0.bash script to download the Linux 7.0 source, apply the config.addendum.txt settings, and compile the vmlinuz image.
# From build-buggy-linux-7_0.bash
make defconfig
cat .config.addendum.txt >> .config
make olddefconfig
make bzImage "-j$(nproc)"
Sources: build-buggy-linux-7_0.bash:17-21, README.md:27-33
Boot Configuration
The kernel uses specific parameters defined in cmdline.txt to control initial behavior and error handling.
- root=/dev/sda2: Specifies the secondary partition as the root filesystem.
- init=/gokrazy/init: Directs the kernel to use the gokrazy-specific init system.
- panic=10: Sets a 10-second delay before rebooting on a kernel panic.
Sources: cmdline.txt:1