From owner-freebsd-stable@FreeBSD.ORG Mon Oct 13 08:35:47 2014 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E57F3439; Mon, 13 Oct 2014 08:35:47 +0000 (UTC) Received: from mx0.gentlemail.de (mx0.gentlemail.de [IPv6:2a00:e10:2800::a130]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6B73623E; Mon, 13 Oct 2014 08:35:47 +0000 (UTC) Received: from mh0.gentlemail.de (mh0.gentlemail.de [78.138.80.135]) by mx0.gentlemail.de (8.14.5/8.14.5) with ESMTP id s9D8ZZZT041611; Mon, 13 Oct 2014 10:35:35 +0200 (CEST) (envelope-from h.schmalzbauer@omnilan.de) Received: from titan.inop.mo1.omnilan.net (titan.inop.mo1.omnilan.net [IPv6:2001:a60:f0bb:1::3:1]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mh0.gentlemail.de (Postfix) with ESMTPSA id ABB9F3037; Mon, 13 Oct 2014 10:35:34 +0200 (CEST) Message-ID: <543B8ED5.6040206@omnilan.de> Date: Mon, 13 Oct 2014 10:35:33 +0200 From: Harald Schmalzbauer Organization: OmniLAN User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; de-DE; rv:1.9.2.8) Gecko/20100906 Lightning/1.0b2 Thunderbird/3.1.2 MIME-Version: 1.0 To: Julian Elischer Subject: Re: Deleting IPv4 iface-routes from extra FIBs References: <53569ABA.60007@omnilan.de> <535771F3.4070007@freebsd.org> In-Reply-To: <535771F3.4070007@freebsd.org> X-Enigmail-Version: 1.1.2 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig6230EC5227E68E506CAFA445" X-Greylist: ACL 119 matched, not delayed by milter-greylist-4.2.7 (mx0.gentlemail.de [78.138.80.130]); Mon, 13 Oct 2014 10:35:35 +0200 (CEST) X-Milter: Spamilter (Reciever: mx0.gentlemail.de; Sender-ip: 78.138.80.135; Sender-helo: mh0.gentlemail.de; ) Cc: "freebsd-net@freebsd.org" , FreeBSD X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 08:35:48 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig6230EC5227E68E506CAFA445 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Bez=C3=BCglich Julian Elischer's Nachricht vom 23.04.2014 09:55 (localti= me): > On 4/23/14, 4:38 AM, Nikolay Denev wrote: >> On Tue, Apr 22, 2014 at 5:37 PM, Harald Schmalzbauer >> wrote: >>> Hello, >>> >>> here, http://svnweb.freebsd.org/base?view=3Drevision&revision=3D24889= 5 >>> interface route protection was added (so the following problem arose >>> with 9.2). >>> >>> Unfortunately, in my case, I must be able to delete these routes; >>> not in >>> the default FIB, but in jail's fibs, because: >>> =C2=B7 Host is multihomed with multiple nics in different subnets. >>> =C2=B7 Jail's IP (no vnet) is from a different subnet than host's >>> default-router subnet =E2=80=93 jail has no ip in the range of host's= >>> default-router!!! >>> =C2=B7 FIB used by jail contains valid default-router. >>> >>> Problem: >>> If iface-routes exist in jail's FIB, answer-packets take the >>> iface-shortcut, not trespassing the router (default gateway); hence >>> 3way-handshake never finishes and firewall terminates (half-opened) T= CP >>> sessions. >>> >>> Workarround: >>> =C2=B7 Abuse packet filter doing some kind of route-to=E2=80=A6 >>> =C2=B7 Revert r248895, to be able to delete v4-iface-routes (inet6-ro= utes >>> can >>> be deleted without any hack) >>> >>> Desired solution: >>> =C2=B7 Allow deletion of v4-iface-routes if FIB!=3D0. >>> >>> Unfortunately my C skills don't allow me to implement this myself :-(= >>> I can't even follow the code, I guess that was originally considered,= >>> but possibly doesn't work bacause of a simple bug?!? I took the lazy >>> way >>> and simply reverted r248895 instead of trying to understand >>> rtrequest1_fib(). I wish I had the time to learn=E2=80=A6 >>> >>> Thanks for any help, >>> >>> -Harry >>> >> Hi, >> >> As it was suggested before as immediate workaround you can set >> net.add_addr_allfibs=3D0 so that the interface routes are added only i= n >> the default FIB. > > yes, we made two behaviours. > Add interface routes to all active FIBS or only add them to the first > fib and let the user populate other fibs as needed. > It appears you want the second behaviour, so I suggest you use that > option and set up all your routes manually. Hello, last time I had the iface-route problem, I just reverted r248895 (for 9.3). There was inconsitent behaviour with v6 iface routes and net.add_addr_allfibs=3D0. Now I checked with 10.1 ans it seems net.add_addr_allfibs=3D0 doesn't wor= k any more: netstat -f inet -nr Routing tables Internet: Destination Gateway Flags Netif Expire default 172.21.32.1 UGS egn 127.0.0.1 link#2 UH lo0 172.21.32.0/19 link#1 U egn 172.21.35.1 link#1 UHS lo0 netstat -F 1 -f inet -nr Routing tables (fib: 1) Internet: Destination Gateway Flags Netif Expire 127.0.0.1 link#2 UH lo0 172.21.32.0/19 link#1 U egn 'sysctl net.add_addr_allfibs' net.add_addr_allfibs: 0 Shouldn't the routing table for fib1 stay empty? Can't remember the result when I testet that with 9.3 :-( Thanks, -Harry --------------enig6230EC5227E68E506CAFA445 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (FreeBSD) iEYEARECAAYFAlQ7jtYACgkQLDqVQ9VXb8gJHQCfQKViwDAMUH8tgn4hfo0G93k3 mhUAoKjj8OX/wKIwfyQmvAwCWEfJdOja =zn/y -----END PGP SIGNATURE----- --------------enig6230EC5227E68E506CAFA445--