From owner-freebsd-net@FreeBSD.ORG Mon Dec 29 16:03:23 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B46F5D36; Mon, 29 Dec 2014 16:03:23 +0000 (UTC) Received: from mail-wg0-x22c.google.com (mail-wg0-x22c.google.com [IPv6:2a00:1450:400c:c00::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 490CE64B78; Mon, 29 Dec 2014 16:03:23 +0000 (UTC) Received: by mail-wg0-f44.google.com with SMTP id b13so19251990wgh.3; Mon, 29 Dec 2014 08:03:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=KMu8GeBgovWQGaDxF5gLmrBLloTIHkb/LVqhqH8QlJA=; b=xuMKleET1eSK7J9Rnn5hUqV/Qci2xPQVxS2G3QsHI3SQUsU7+P2px/95EYoPDnIpCU EA/YJFwfsrMgUkBwYxL5qvufJ9rE3erAxQJ1Q6uhqT77A2jvBNBwEm9DeEi60pFj5msJ F4wdX7w5yIhkro8TlqRVBFEuwe4ly3ils3tDeVEA4ClVy1tpdjZFDviIPJHr7s5SipKy uS3VmAUM5brDXL1/5sLnNpHFtNB26xpEf6Pm3SZYR2SyVV8kMXAEkp1+xlmS/t+x2YMs Ehfhy37u8ZUOD1zefcHVBThp+j7Ye6LPjg8sNtxoxCH7BVAmhrv7nbWn0ysU1X0Gj6P/ 3HcA== MIME-Version: 1.0 X-Received: by 10.194.201.137 with SMTP id ka9mr114341265wjc.66.1419869001724; Mon, 29 Dec 2014 08:03:21 -0800 (PST) Sender: asomers@gmail.com Received: by 10.194.17.129 with HTTP; Mon, 29 Dec 2014 08:03:21 -0800 (PST) In-Reply-To: References: Date: Mon, 29 Dec 2014 09:03:21 -0700 X-Google-Sender-Auth: JkbB3dSmz4MjomxTmhBXfFfmSh8 Message-ID: Subject: Re: IPv6 routes leaking between FIBs? From: Alan Somers To: "Bjoern A. Zeeb" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: FreeBSD Net , Jason Healy X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Dec 2014 16:03:23 -0000 On Sun, Dec 28, 2014 at 3:16 AM, Bjoern A. Zeeb wrote: > >> On 28 Dec 2014, at 03:19 , Jason Healy wrote: >> >> Hello, >> >> Trying out FreeBSD for the first time to build a firewall box that=E2=80= =99s multi-core and runs PF. I=E2=80=99m very interested in the FIB code, = as it lines up well with the way my core networking equipment works and sho= uld allow me to route traffic on an interface that=E2=80=99s logically sepa= rate from the management interfaces. >> >> I=E2=80=99ve been playing for a bit with the FIB features, but I=E2=80= =99m getting hung up on IPv6. I=E2=80=99m trying to set up two interfaces = on my box to each have a different FIB, and to not leak routes between the = interfaces: >> >> # sysctl net.add_addr_allfibs=3D0 >> # ifconfig em1 inet 192.0.2.1/24 fib 1 >> # ifconfig em1 inet6 2001:db8:dead:beef::1/64 fib 1 >> # ifconfig em2 inet 203.0.113.1/24 fib 2 >> # ifconfig em2 inet6 2001:db8:cafe:babe::1/64 fib 2 >> >> If I then check the routing tables for each FIB, here=E2=80=99s what I g= et: >> >> # setfib -F 1 netstat -rn >> >> Routing tables (fib: 1) >> >> Internet: >> Destination Gateway Flags Netif Expire >> 192.0.2.0/24 link#2 U em1 >> 192.0.2.1 link#2 UHS lo0 >> >> Internet6: >> Destination Gateway Flags = Netif Expire >> 2001:db8:cafe:babe::/64 link#3 U = em2 >> 2001:db8:dead:beef::/64 link#2 U = em1 >> 2001:db8:dead:beef::1 link#2 UHS = lo0 >> fe80::%em1/64 link#2 U = em1 >> fe80::a00:27ff:fef6:162a%em1 link#2 UHS = lo0 >> fe80::%em2/64 link#3 U = em2 >> fe80::%lo0/64 link#5 U = lo0 >> >> >> # setfib -F 2 netstat -rn >> >> Routing tables (fib: 2) >> >> Internet: >> Destination Gateway Flags Netif Expire >> 203.0.113.0/24 link#3 U em2 >> 203.0.113.1 link#3 UHS lo0 >> >> Internet6: >> Destination Gateway Flags = Netif Expire >> 2001:db8:cafe:babe::/64 link#3 U = em2 >> 2001:db8:cafe:babe::1 link#3 UHS = lo0 >> 2001:db8:dead:beef::/64 link#2 U = em1 >> fe80::%em1/64 link#2 U = em1 >> fe80::%em2/64 link#3 U = em2 >> fe80::a00:27ff:fe62:d267%em2 link#3 UHS = lo0 >> fe80::%lo0/64 link#5 U = lo0 >> >> >> Note that as expected, the IPv4 routes are constrained to their FIB (192= .0.2.0 to FIB 1 and 203.0.113.0 to FIB 2). However, the IPv6 routes (deadb= eef and cafebabe) leak between the FIBs; both prefixes that I add are liste= d in both FIBs (as well as the link-local stuff). >> >> According to: >> >> https://www.freebsd.org/news/status/report-2012-01-2012-03.html#Multi-F= IB:-IPv6-Support-and-Other-Enhancements >> >> IPv6 parity is claimed for the FIB code, so I=E2=80=99m not sure if I=E2= =80=99m doing it wrong, or if there=E2=80=99s a problem with the FIB code a= nd IPv6 routes. >> >> Thanks in advance for any help or clarification! > > > People simply broke it (again). Please file a bug report. You may ment= ion that there are regression test scripts in src/tools/ somewhere to test = all the cases for IPv6. Sounds like those tests need to be merged into the ATF tests at tests/sys/netinet/fibs_test.sh so they'll run continuously. -Alan