From owner-freebsd-net@freebsd.org Tue Dec 12 11:06:06 2017 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1F818E94501 for ; Tue, 12 Dec 2017 11:06:06 +0000 (UTC) (envelope-from crest@rlwinm.de) Received: from mail.rlwinm.de (mail.rlwinm.de [IPv6:2a01:4f8:171:f902::5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C71937670D for ; Tue, 12 Dec 2017 11:06:05 +0000 (UTC) (envelope-from crest@rlwinm.de) Received: from crest.bultmann.eu (unknown [IPv6:2a00:c380:c0d5:1:800e:6d0f:1c1c:48f2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.rlwinm.de (Postfix) with ESMTPSA id EEF0745B2 for ; Tue, 12 Dec 2017 11:06:01 +0000 (UTC) Subject: Re: Changes to route(8) or routing between r325235 and r326782? To: freebsd-net@freebsd.org References: From: Jan Bramkamp Message-ID: <2c4c5a4a-fd7c-9787-567d-a6e14e780e4c@rlwinm.de> Date: Tue, 12 Dec 2017 12:05:59 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Dec 2017 11:06:06 -0000 On 12.12.17 03:31, Thomas Steen Rasmussen wrote: > Hello list :) > > "Something" which changes how routing works has landed in 11-STABLE > between r325235 and r326782. > > Until now I have had a script which deletes routing table entries which > point to lo0, in order to keep traffic from "shortcutting" over lo0, to > make it possible to use pf to filter traffic between jails. This script > has worked for years, but has now stopped working after upgrading from > r325235 to r326782. Can someone enlighten me as to what changed, and why? > > Background/example: I add 185.96.180.10/32 as an alias on an interface, > lagg0.1171. This creates two routing table entries: > > 185.96.180.10      link#11            UHS         lo0 > 185.96.180.10/32   link#11            U      lagg0.1171 > > If I leave this as-is the traffic from other jails use lo0 to reach > 185.96.180.10 meaning they bypass pf entirely. To avoid this I simply > delete the route on lo0, which makes stuff behave as I would expect - > traffic to 185.96.180.10 goes via lagg0.1171 meaning I can filter in pf > as needed. > > After upgrading to r326782 I get the following error when trying to > delete the lo0 entry (I have an rc.d script to do it): > > $ sudo route delete 185.96.180.10 > route: writing to routing socket: Address already in use > delete host 185.96.180.10 fib 0: gateway uses the same route > $ > > What gives? What do I do now? :) The FreeBSD kernel had a bug that you relied on. The bug got fixed and the fix broke your script. The proper solution is to filter on lo0. I suspect that your pf.conf includes "skip on lo0" replace this by the filtering you want to apply to traffic on lo0. Putting those rules in an anchor block probably will make your ruleset a lot easier to maintain.