linux-kernel - Re: Wrong source address selection in arp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aPetQ3LZo0Uikke5@shredder>
Date: Tue, 21 Oct 2025 18:56:51 +0300
From: Ido Schimmel <idosch@...sch.org>
To: g.goller@...xmox.com
Cc: davem@...emloft.net, dsahern@...nel.org, edumazet@...gle.com,
	kuba@...nel.org, pabeni@...hat.com, horms@...nel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: Wrong source address selection in arp_solicit for forwarded
 packets

On Tue, Oct 21, 2025 at 02:31:51PM +0200, Gabriel Goller wrote:
> Hmm I don't know how this would help? There is a link-local address set
> on the interface, but we would have to add a ipv6 source address to the
> arp packet which wouldn't be right?

There are no ARP packets. Neighbour resolution is performed via IPv6
NA/NS messages. The script below [1] replicates your setup as I
understand, but it uses IPv6 link-local addresses for the nexthops.

[1]
#!/bin/bash

cleanup() {
	for i in {1..3}; do
		ip netns del node${i} &> /dev/null
	done
}

trap cleanup EXIT

cleanup

for i in {1..3}; do
	ip netns add node${i}
	ip netns exec node${i} sysctl -wq net.ipv4.conf.all.forwarding=1
	ip netns exec node${i} sysctl -wq net.ipv4.conf.all.rp_filter=2
	ip -n node${i} link set dev lo up
	ip -n node${i} link add name dummy up type dummy
	ip -n node${i} address add 10.0.1.${i}/32 dev dummy
done

ip -n node1 link add name veth1 type veth peer name veth2 netns node2
ip -n node2 link add name veth3 type veth peer name veth4 netns node3

ip -n node1 link set dev veth1 up
ip -n node2 link set dev veth2 up
ip -n node2 link set dev veth3 up
ip -n node3 link set dev veth4 up

ip -n node1 address add fe80::1/64 dev veth1 nodad
ip -n node2 address add fe80::2/64 dev veth2 nodad
ip -n node2 address add fe80::3/64 dev veth3 nodad
ip -n node3 address add fe80::4/64 dev veth4 nodad

ip -n node1 route add 10.0.1.2/32 src 10.0.1.1 nexthop via inet6 fe80::2 dev veth1
ip -n node1 route add 10.0.1.3/32 src 10.0.1.1 nexthop via inet6 fe80::2 dev veth1
ip -n node2 route add 10.0.1.1/32 src 10.0.1.2 nexthop via inet6 fe80::1 dev veth2
ip -n node2 route add 10.0.1.3/32 src 10.0.1.2 nexthop via inet6 fe80::4 dev veth3
ip -n node3 route add 10.0.1.1/32 src 10.0.1.3 nexthop via inet6 fe80::3 dev veth4
ip -n node3 route add 10.0.1.2/32 src 10.0.1.3 nexthop via inet6 fe80::3 dev veth4

ip netns exec node1 ping 10.0.1.3 -c 5
ip netns exec node1 ping 10.0.1.2 -c 5