netdev - Re: Wired behaviour with IPv6 over PPP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20080528124553.GA3252@1wt.eu>
Date:	Wed, 28 May 2008 14:45:53 +0200
From:	Willy Tarreau <w@....eu>
To:	Pascal Hambourg <pascal.mail@...uf.fr.eu.org>
Cc:	Matthias Cramer <matthias.cramer@...erway.ch>,
	James Chapman <jchapman@...alix.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	netdev@...r.kernel.org
Subject: Re: Wired behaviour with IPv6 over PPP

Hi,

On Wed, May 28, 2008 at 11:59:45AM +0200, Pascal Hambourg wrote:
> Hello all,
> 
> Willy Tarreau a écrit/wrote :
> >On Thu, May 22, 2008 at 09:05:47PM +0200, Matthias Cramer wrote:
> >
> >>James Chapman wrote:
> >>
> >>>Andrew Morton wrote:
> >>>
> >>>>On Wed, 21 May 2008 14:56:43 +0200 Matthias Cramer
> >>>><matthias.cramer@...erway.ch> wrote:
> >>>>
> >>>>>I have a very wired behaviour when doing IPv6 over PPPoE.
> >>>>>
> >>>>>The situation:
> >>>>>
> >>>>>A linux box connected to a DSL Modem, on the other side is a Cisco
> >>>>>LNS which terminates the PPP session (actually L2TP).
> >>>>>I have control over both ends.
> >>>>>
> >>>>>When I have net.ipv6.conf.all.forwarding set to 0 then the ppp
> >>>>>Interface gets a IPv6 address from the Cisco via IP6CP.
> >>>>>When I have net.ipv6.conf.all.forwarding set to 1 them the ppp
> >>>>>Interface does not get an address, it has only a normal link local
> >>>>>address.
> 
> AFAIK IPV6CP/PPP only allows to negotiate link local addresses.

right.

> So I 
> guess the global address and default route is assigned by another 
> mechanism, maybe stateless autoconfiguration using router advertisement, 
> although I was not aware it could be used on a PPP link because of the 
> absence of MAC address. Enabling global forwarding 
> (net.ipv6.conf.all.forwarding=1) disables stateless autoconfiguration 
> (see ip-sysctl.txt in kernel documentation) on all interfaces. I believe 
> this is consistent with the observed behaviour.
> 
> >>>>>When I start the ppp session with forwarding set to 0 I can ping out
> >>>>>and there exists a default route to ppp0 , then I switch forwarding to 
> >>>>>1
> >>>>>the default route disappears and therefore routing does not work any
> >>>>>longer.
> 
> I have read reports about this. I guess the logic is that enabling 
> forwarding turns the box into a router, so the default route learned 
> from another router's advertisements by autoconfiguration should be 
> deleted. Even the autoconfigured global address will eventually expire.
> 
> >Well, at least it has been working for years in kernel 2.4 for me with
> >pppd 2.4.2b3 to 2.4.4 (I've not upgraded my firewall to 2.6 yet). So
> >it has definitely been working at some point.
> 
> What exactly has been working ?

Sorry, I understood that IPv6 addresses got lost when IP forwarding was
set to 1, which sounded strange to me. I've re-read the original mail
more carefully and noticed that it was _autoconfiguration_ which does not
work. For this, I don't know as I don't use it. My bad.

> PS : Willy, do you plan to backport the security fix for the sit module 
> from 2.6.25.3 into 2.4 ?

Yes, any security fix must be backported when appropriate. I just don't
remember about this one, maybe I missed it. Care to send a pointer to
the commit in 2.6 ?

Thanks,
Willy

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html