netdev - Re: Bridge stays down until a port is added

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110821121305.GA22232@torres.zugschlus.de>
Date:	Sun, 21 Aug 2011 14:13:05 +0200
From:	Marc Haber <mh+netdev@...schlus.de>
To:	Stephen Hemminger <shemminger@...tta.com>
Cc:	netdev@...r.kernel.org, Sven-Haegar Koch <haegar@...net.de>
Subject: Re: Bridge stays down until a port is added

On Sat, Aug 20, 2011 at 09:30:59AM -0700, Stephen Hemminger wrote:
> The problem is that IPv6 Duplicate Address Detection needs to
> work. This is not a simple problem.  If the bridge asserted
> carrier with no ports then:
> 
> 1. IPv6 address assigned and IPv6 decides it is okay.
> 2. Port added later
> 3. Another system has the same address.
> *broke*

Same situation when a system-to-system-link is added after bringing up
an interface. I agree that the issue is not an issue if a real switch
is being used.

> If you want to avoid DAD, then you can configure disable DAD
> by setting /proc/sys/net/ipv6/conf/br0/accept_dad to 0

I'd like to avoid that.

2001:db8::1

Would it acceptable (and clean!) to have:

eth0: 2001:db8:1::100/64 default gw to the internet is 2001:db8:1::1
lo: 127.0.0.1/8, ::1/128, 2001:db8:2::100/64
br0: 2001:db8:2::1/64 (being default gw for the VMs connected to br0,
routing 2001:db8:2::/64 to the Internet)

Note 2001:db8:2::/64 being used both on lo and br0, with 2001:db8:2::100 meant
to be reachable from the Internet even if no VM is already up. my
hostname will be A-Recorded to 2001:db8:2::100 with proper reverse
DNS. The background for doing so is that I cannot control the reverse
DNS for the IP addresses inside 200a:db8:1::/64 in a lot of my setups
(for example, if my IPv6 comes in via Sixxs).

Is this going to work in a clean way?

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 3221 2323190
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html