Date: Mon, 29 Dec 2014 09:03:21 -0700 From: Alan Somers <asomers@freebsd.org> To: "Bjoern A. Zeeb" <bz@freebsd.org> Cc: FreeBSD Net <freebsd-net@freebsd.org>, Jason Healy <jhealy@logn.net> Subject: Re: IPv6 routes leaking between FIBs? Message-ID: <CAOtMX2ggWDRFiksdyP1n=CLVXCNXvA8kstn4pRLOMZ1KxfxViw@mail.gmail.com> In-Reply-To: <CC09274B-2A1A-4672-AF08-5752DB7B5AB0@FreeBSD.org> References: <C2295EFD-C052-438B-8524-974C17E1FBB6@logn.net> <CC09274B-2A1A-4672-AF08-5752DB7B5AB0@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Dec 28, 2014 at 3:16 AM, Bjoern A. Zeeb <bz@freebsd.org> wrote:
>
>> On 28 Dec 2014, at 03:19 , Jason Healy <jhealy@logn.net> wrote:
>>
>> Hello,
>>
>> Trying out FreeBSD for the first time to build a firewall box that=E2=80=
=99s multi-core and runs PF. I=E2=80=99m very interested in the FIB code, =
as it lines up well with the way my core networking equipment works and sho=
uld allow me to route traffic on an interface that=E2=80=99s logically sepa=
rate from the management interfaces.
>>
>> I=E2=80=99ve been playing for a bit with the FIB features, but I=E2=80=
=99m getting hung up on IPv6. I=E2=80=99m trying to set up two interfaces =
on my box to each have a different FIB, and to not leak routes between the =
interfaces:
>>
>> # sysctl net.add_addr_allfibs=3D0
>> # ifconfig em1 inet 192.0.2.1/24 fib 1
>> # ifconfig em1 inet6 2001:db8:dead:beef::1/64 fib 1
>> # ifconfig em2 inet 203.0.113.1/24 fib 2
>> # ifconfig em2 inet6 2001:db8:cafe:babe::1/64 fib 2
>>
>> If I then check the routing tables for each FIB, here=E2=80=99s what I g=
et:
>>
>> # setfib -F 1 netstat -rn
>>
>> Routing tables (fib: 1)
>>
>> Internet:
>> Destination Gateway Flags Netif Expire
>> 192.0.2.0/24 link#2 U em1
>> 192.0.2.1 link#2 UHS lo0
>>
>> Internet6:
>> Destination Gateway Flags =
Netif Expire
>> 2001:db8:cafe:babe::/64 link#3 U =
em2
>> 2001:db8:dead:beef::/64 link#2 U =
em1
>> 2001:db8:dead:beef::1 link#2 UHS =
lo0
>> fe80::%em1/64 link#2 U =
em1
>> fe80::a00:27ff:fef6:162a%em1 link#2 UHS =
lo0
>> fe80::%em2/64 link#3 U =
em2
>> fe80::%lo0/64 link#5 U =
lo0
>>
>>
>> # setfib -F 2 netstat -rn
>>
>> Routing tables (fib: 2)
>>
>> Internet:
>> Destination Gateway Flags Netif Expire
>> 203.0.113.0/24 link#3 U em2
>> 203.0.113.1 link#3 UHS lo0
>>
>> Internet6:
>> Destination Gateway Flags =
Netif Expire
>> 2001:db8:cafe:babe::/64 link#3 U =
em2
>> 2001:db8:cafe:babe::1 link#3 UHS =
lo0
>> 2001:db8:dead:beef::/64 link#2 U =
em1
>> fe80::%em1/64 link#2 U =
em1
>> fe80::%em2/64 link#3 U =
em2
>> fe80::a00:27ff:fe62:d267%em2 link#3 UHS =
lo0
>> fe80::%lo0/64 link#5 U =
lo0
>>
>>
>> Note that as expected, the IPv4 routes are constrained to their FIB (192=
.0.2.0 to FIB 1 and 203.0.113.0 to FIB 2). However, the IPv6 routes (deadb=
eef and cafebabe) leak between the FIBs; both prefixes that I add are liste=
d in both FIBs (as well as the link-local stuff).
>>
>> According to:
>>
>> https://www.freebsd.org/news/status/report-2012-01-2012-03.html#Multi-F=
IB:-IPv6-Support-and-Other-Enhancements
>>
>> IPv6 parity is claimed for the FIB code, so I=E2=80=99m not sure if I=E2=
=80=99m doing it wrong, or if there=E2=80=99s a problem with the FIB code a=
nd IPv6 routes.
>>
>> Thanks in advance for any help or clarification!
>
>
> People simply broke it (again). Please file a bug report. You may ment=
ion that there are regression test scripts in src/tools/ somewhere to test =
all the cases for IPv6.
Sounds like those tests need to be merged into the ATF tests at
tests/sys/netinet/fibs_test.sh so they'll run continuously.
-Alan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAOtMX2ggWDRFiksdyP1n=CLVXCNXvA8kstn4pRLOMZ1KxfxViw>