netdev - Problem with IPv6 Route Cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130111185126.56cababe@natsu>
Date:	Fri, 11 Jan 2013 18:51:26 +0600
From:	Roman Mamedov <rm@...anrm.ru>
To:	<netdev@...r.kernel.org>
Subject: Problem with IPv6 Route Cache

Hello,

I am trying to set up a VPN (tinc) connection and add a route to an ULA subnet
via another host on it.

My VPN setup script basically does:

  ip addr add fd39:20::3/64 dev tun-rm
  ip route add fd39::/64 via fd39:20::39 dev tun-rm
  ip link set tun-rm up

And then I have:

root@...u:~# ip -6 route
2a02:e00:ffff:56::/64 dev eth0  proto kernel  metric 256 
fd39::/64 via fd39:20::39 dev tun-rm  metric 1024 
fd39:20::/64 dev tun-rm  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev tun-rm  proto kernel  metric 256 
default via 2a02:e00:ffff:56::1 dev eth0  metric 1 

root@...u:~# ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fe17:4a21/64 scope link 
       valid_lft forever preferred_lft forever
26: tun-rm: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 500
    inet6 fd39:20::3/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::40f7:7eff:fe6a:3901/64 scope link 
       valid_lft forever preferred_lft forever

The problem is, at some point presumably while the VPN interface is being and
at the same time the destination ULA subnet is being actively communicated
with, a wrong route entry (over the main default g/w) gets into the routing
cache, so despite the above table, I have for example:

# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache


And even flushing the route cache does not help to get rid of it:

root@...u:~# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache 
root@...u:~# ip -6 route flush cache
root@...u:~# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache


This is on kernel version 3.7.1 inside a Xen VPS (if this matters).

Can anyone advice how to deal with this problem?
Can I disable/remove the IPv6 route cache?
I know the IPv4 route cache was recently removed from the kernel.

Things I tried so far to mitigate this:

1) ip6tables -I OUTPUT -d fc00::/7 -o eth0 -j REJECT --reject-with icmp6-no-route
2)  ip -6 route add unreachable fc00::/7 dev eth0

=> but both simply make the desired subnet completely unreachable in their own ways,
rather than solving the issue.

3) adding my route to "fd39::/64 via fd39:20::39" with metric 1 (can't add with
metric 0, it changes to 1024)

=> no effect.

-- 
With respect,
Roman

~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Stallman had a printer,
with code he could not see.
So he began to tinker,
and set the software free."

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)