netdev - Re: VRF notes when using ipv6 and flushing tables.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Aug 2019 23:02:57 -0400
From:   David Ahern <dsahern@...il.com>
To:     Ben Greear <greearb@...delatech.com>,
        netdev <netdev@...r.kernel.org>
Subject: Re: VRF notes when using ipv6 and flushing tables.

On 8/20/19 2:27 PM, Ben Greear wrote:
> I recently spend a few days debugging what in the end was user error on
> my part.
> 
> Here are my notes in hope they help someone else.
> 
> First, 'ip -6 route show vrf vrfX' will not show some of the
> routes (like local routes) that will show up with
> 'ip -6 route show table X', where X == vrfX's table-id
> 
> If you run 'ip -6 route flush table X', then you will loose all of the auto
> generated routes, including anycast, ff00::/8, and local routes.
> 
> ff00::/8 is needed for neigh discovery to work (probably among other
> things)
> 
> local route is needed or packets won't actually be accepted up the stack
> (I think that is the symptom at least)
> 
> Not sure exactly what anycast does, but I'm guessing it is required for
> something useful.
> 
> You must manually re-add those to the table unless you for certain know
> that
> you do not need them for whatever reason.
> 

sorry you went through such a long and painful debugging session.

yes, the kernel doc for VRF needs to be updated that 'ip route show vrf
X' and 'ip route show table X' are different ('show vrf' mimics the main
table in not showing local, broadcast, anycast; 'table vrf' shows all).

A suggestion for others: the documentation and selftests directory have
a lot of VRF examples now. If something basic is not working (e.g., arp
or neigh discovery), see if it works there and if so compare the outputs
of the route table along the way.