RTNETLINK answers: Permission denied

RTNETLINK answers: Permission denied

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 316 bytes --]

What are the possible causes of:

# ip route get 2001:4860:4860::8844
RTNETLINK answers: Permission denied

when

# ip route get fd31:aeb1:48df::99
fd31:aeb1:48df::99 from :: dev br-lan proto static src fd31:aeb1:48df::1 metric 1024 pref medium

works just fine?

Using iproute2 5.0.0.

Cheers,
b.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: RTNETLINK answers: Permission denied

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 488 bytes --]

On Tue, 2020-09-22 at 15:04 -0400, Brian J. Murrell wrote:
> What are the possible causes of:
> 
> # ip route get 2001:4860:4860::8844
> RTNETLINK answers: Permission denied
> 
> when
> 
> # ip route get fd31:aeb1:48df::99
> fd31:aeb1:48df::99 from :: dev br-lan proto static src
> fd31:aeb1:48df::1 metric 1024 pref medium
> 
> works just fine?
> 
> Using iproute2 5.0.0.

No-one with any thoughts on this?  Is there a better place I should be
asking?

Cheers,
b.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: RTNETLINK answers: Permission denied

[David Ahern]

On 9/24/20 5:09 AM, Brian J. Murrell wrote:
> On Tue, 2020-09-22 at 15:04 -0400, Brian J. Murrell wrote:
>> What are the possible causes of:
>>
>> # ip route get 2001:4860:4860::8844
>> RTNETLINK answers: Permission denied
>>
>> when
>>
>> # ip route get fd31:aeb1:48df::99
>> fd31:aeb1:48df::99 from :: dev br-lan proto static src
>> fd31:aeb1:48df::1 metric 1024 pref medium
>>
>> works just fine?
>>
>> Using iproute2 5.0.0.
> 
> No-one with any thoughts on this?  Is there a better place I should be
> asking?
> 

check your routes for a prohibit entry:

$ sudo ip -6 ro add prohibit 2001:4860:4860::8844

$ ip -6 ro ls
::1 dev lo proto kernel metric 256 pref medium
prohibit 2001:4860:4860::8844 dev lo metric 1024 pref medium
...

$ ip -6 ro get 2001:4860:4860::8844
RTNETLINK answers: Permission denied

Re: RTNETLINK answers: Permission denied

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]

On Thu, 2020-09-24 at 10:15 -0600, David Ahern wrote:
> 
> check your routes for a prohibit entry:

I don't have any prohibit entries

# ip -6 route ls table 5 | grep prohib
# ip -6 rule ls
0:	from all lookup local 
1003:	from all iif 6in4-henet lookup 3 
1005:	from all iif pppoe-wan1 lookup 5 
2003:	from all fwmark 0x300/0x3f00 lookup 3 
2005:	from all fwmark 0x500/0x3f00 lookup 5 
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
32766:	from all lookup main 
32767:	from all lookup default 
4200000000:	from 2001:123:ab:123::1/64 iif br-lan unreachable
4200000000:	from 2607:abcd:9876:5432::1/60 iif br-lan unreachable
4200000001:	from all iif lo failed_policy
4200000006:	from all iif br-guest failed_policy
4200000008:	from all iif br-lan failed_policy
4200000008:	from all iif br-lan failed_policy
4200000008:	from all iif br-lan failed_policy
4200000010:	from all iif eth0.3 failed_policy
4200000091:	from all iif eth0.2 failed_policy
4200000097:	from all iif pppoe-wan1 failed_policy
4200000097:	from all iif pppoe-wan1 failed_policy
4200000098:	from all iif 6in4-henet failed_policy
# ip -6 route ls table local | grep prohib
# ip -6 route ls table 3 | grep prohib
# ip -6 route ls table 5 | grep prohib

Cheers,
b.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: RTNETLINK answers: Permission denied

[David Ahern]

On 9/24/20 10:26 AM, Brian J. Murrell wrote:
> On Thu, 2020-09-24 at 10:15 -0600, David Ahern wrote:
>>
>> check your routes for a prohibit entry:
> 
> I don't have any prohibit entries
> 

perf record -e fib6:* -g --  ip route get 2001:4860:4860::8844
perf script

It's a config problem somewhere.