From owner-freebsd-stable@FreeBSD.ORG  Mon Oct 13 08:43:58 2014
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 38DDB600;
 Mon, 13 Oct 2014 08:43:58 +0000 (UTC)
Received: from mail.ipfw.ru (mail.ipfw.ru [IPv6:2a01:4f8:120:6141::2])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id EBC9F33B;
 Mon, 13 Oct 2014 08:43:57 +0000 (UTC)
Received: from [2a02:6b8:0:401:222:4dff:fe50:cd2f] (helo=ptichko.yndx.net)
 by mail.ipfw.ru with esmtpsa (TLSv1:DHE-RSA-AES128-SHA:128)
 (Exim 4.82 (FreeBSD)) (envelope-from <melifaro@FreeBSD.org>)
 id 1XdXEm-000EED-6I; Mon, 13 Oct 2014 08:28:00 +0400
Message-ID: <543B9075.2000102@FreeBSD.org>
Date: Mon, 13 Oct 2014 12:42:29 +0400
From: "Alexander V. Chernikov" <melifaro@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:31.0) Gecko/20100101 Thunderbird/31.1.2
MIME-Version: 1.0
To: Harald Schmalzbauer <h.schmalzbauer@omnilan.de>, 
 Julian Elischer <julian@freebsd.org>
Subject: Re: Deleting IPv4 iface-routes from extra FIBs
References: <53569ABA.60007@omnilan.de>
 <CA+P_MZH_iScuJ4S=xiKocnEwTzT1eRJPNpJKbboZDfG3B=TBzA@mail.gmail.com>
 <535771F3.4070007@freebsd.org> <543B8ED5.6040206@omnilan.de>
In-Reply-To: <543B8ED5.6040206@omnilan.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>,
 FreeBSD <freebsd-stable@freebsd.org>
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Oct 2014 08:43:58 -0000

On 13.10.2014 12:35, Harald Schmalzbauer wrote:
>   Bezüglich Julian Elischer's Nachricht vom 23.04.2014 09:55 (localtime):
>> On 4/23/14, 4:38 AM, Nikolay Denev wrote:
>>> On Tue, Apr 22, 2014 at 5:37 PM, Harald Schmalzbauer
>>> <h.schmalzbauer@omnilan.de> wrote:
>>>> Hello,
>>>>
>>>> here, http://svnweb.freebsd.org/base?view=revision&revision=248895
>>>> interface route protection was added (so the following problem arose
>>>> with 9.2).
>>>>
>>>> Unfortunately, in my case, I must be able to delete these routes;
>>>> not in
>>>> the default FIB, but in jail's fibs, because:
>>>> · Host is multihomed with multiple nics in different subnets.
>>>> · Jail's IP (no vnet) is from a different subnet than host's
>>>> default-router subnet – jail has no ip in the range of host's
>>>> default-router!!!
>>>> · FIB used by jail contains valid default-router.
>>>>
>>>> Problem:
>>>> If iface-routes exist in jail's FIB, answer-packets take the
>>>> iface-shortcut, not trespassing the router (default gateway); hence
>>>> 3way-handshake never finishes and firewall terminates (half-opened) TCP
>>>> sessions.
>>>>
>>>> Workarround:
>>>> · Abuse packet filter doing some kind of route-to…
>>>> · Revert r248895, to be able to delete v4-iface-routes (inet6-routes
>>>> can
>>>> be deleted without any hack)
>>>>
>>>> Desired solution:
>>>> · Allow deletion of v4-iface-routes if FIB!=0.
>>>>
>>>> Unfortunately my C skills don't allow me to implement this myself :-(
>>>> I can't even follow the code, I guess that was originally considered,
>>>> but possibly doesn't work bacause of a simple bug?!? I took the lazy
>>>> way
>>>> and simply reverted r248895 instead of trying to understand
>>>> rtrequest1_fib(). I wish I had the time to learn…
>>>>
>>>> Thanks for any help,
>>>>
>>>> -Harry
>>>>
>>> Hi,
>>>
>>> As it was suggested before as immediate workaround you can set
>>> net.add_addr_allfibs=0 so that the interface routes are added only in
>>> the default FIB.
>> yes, we made two behaviours.
>> Add interface routes to all active FIBS or only add them to the first
>> fib and let the user populate other fibs as needed.
>> It appears you want the second behaviour, so I suggest you use that
>> option and set up all your routes manually.
> Hello,
>
> last time I had the iface-route problem, I just reverted r248895 (for
> 9.3). There was inconsitent behaviour with v6 iface routes and
> net.add_addr_allfibs=0.
> Now I checked with 10.1 ans it seems net.add_addr_allfibs=0 doesn't work
> any more:
> netstat -f inet -nr
> Routing tables
>
> Internet:
> Destination        Gateway            Flags      Netif Expire
> default            172.21.32.1        UGS         egn
> 127.0.0.1          link#2             UH          lo0
> 172.21.32.0/19     link#1             U           egn
> 172.21.35.1        link#1             UHS         lo0
>
> netstat -F 1 -f inet -nr
> Routing tables (fib: 1)
>
> Internet:
> Destination        Gateway            Flags      Netif Expire
> 127.0.0.1          link#2             UH          lo0
> 172.21.32.0/19     link#1             U           egn
>
> 'sysctl net.add_addr_allfibs'
> net.add_addr_allfibs: 0
Are you sure net.add_addr_allfibs was applied before interface address 
added?
Can you check recent 10-STABLE code? It might have more fixes related to 
allfibs.
>
> Shouldn't the routing table for fib1 stay empty? Can't remember the
> result when I testet that with 9.3 :-(
Yes, it should. We're slowly moving to this direction
>
> Thanks,
>
> -Harry
>
>