Problem with IPv6 Route Cache

Problem with IPv6 Route Cache

[Roman Mamedov]

[-- Attachment #1: Type: text/plain, Size: 3004 bytes --]

Hello,

I am trying to set up a VPN (tinc) connection and add a route to an ULA subnet
via another host on it.

My VPN setup script basically does:

  ip addr add fd39:20::3/64 dev tun-rm
  ip route add fd39::/64 via fd39:20::39 dev tun-rm
  ip link set tun-rm up

And then I have:

root@neru:~# ip -6 route
2a02:e00:ffff:56::/64 dev eth0  proto kernel  metric 256 
fd39::/64 via fd39:20::39 dev tun-rm  metric 1024 
fd39:20::/64 dev tun-rm  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev tun-rm  proto kernel  metric 256 
default via 2a02:e00:ffff:56::1 dev eth0  metric 1 

root@neru:~# ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fe17:4a21/64 scope link 
       valid_lft forever preferred_lft forever
26: tun-rm: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 500
    inet6 fd39:20::3/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::40f7:7eff:fe6a:3901/64 scope link 
       valid_lft forever preferred_lft forever

The problem is, at some point presumably while the VPN interface is being and
at the same time the destination ULA subnet is being actively communicated
with, a wrong route entry (over the main default g/w) gets into the routing
cache, so despite the above table, I have for example:

# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache


And even flushing the route cache does not help to get rid of it:

root@neru:~# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache 
root@neru:~# ip -6 route flush cache
root@neru:~# ip -6 route get fd39::100
fd39::100 from :: via 2a02:e00:ffff:56::1 dev eth0  src 2a02:e00:ffff:56:ffff:ffff:xxxx:xxxx  metric 0 
    cache


This is on kernel version 3.7.1 inside a Xen VPS (if this matters).

Can anyone advice how to deal with this problem?
Can I disable/remove the IPv6 route cache?
I know the IPv4 route cache was recently removed from the kernel.

Things I tried so far to mitigate this:

1) ip6tables -I OUTPUT -d fc00::/7 -o eth0 -j REJECT --reject-with icmp6-no-route
2)  ip -6 route add unreachable fc00::/7 dev eth0

=> but both simply make the desired subnet completely unreachable in their own ways,
rather than solving the issue.

3) adding my route to "fd39::/64 via fd39:20::39" with metric 1 (can't add with
metric 0, it changes to 1024)

=> no effect.

-- 
With respect,
Roman

~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Stallman had a printer,
with code he could not see.
So he began to tinker,
and set the software free."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Problem with IPv6 Route Cache

[Roman Mamedov]

[-- Attachment #1: Type: text/plain, Size: 473 bytes --]

On Fri, 11 Jan 2013 18:51:26 +0600
Roman Mamedov <rm@romanrm.ru> wrote:

> The problem is, at some point presumably while the VPN interface is being and
> at the same time the destination ULA subnet is being actively communicated
> with

Sorry, "while the VPN interface is being _restarted_ and".

-- 
With respect,
Roman

~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Stallman had a printer,
with code he could not see.
So he began to tinker,
and set the software free."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Problem with IPv6 Route Cache

[Hannes Frederic Sowa]

On Fri, Jan 11, 2013 at 06:51:26PM +0600, Roman Mamedov wrote:
> This is on kernel version 3.7.1 inside a Xen VPS (if this matters).
> 
> Can anyone advice how to deal with this problem?
> Can I disable/remove the IPv6 route cache?
> I know the IPv4 route cache was recently removed from the kernel.

There is no IPv6 route cache as there was one for IPv4. The routes are
"merely" cloned directly into the fib tree.

Re: Problem with IPv6 Route Cache

[Roman Mamedov]

[-- Attachment #1: Type: text/plain, Size: 1006 bytes --]

Hello,

I have discovered that when the problem is occuring, I have:

root@neru:~# ip -6 neigh
fd39:20::39 dev tun-rm  FAILED
fe80::20b:45ff:fe80:c000 dev eth0 lladdr 00:0b:45:80:c0:00 router REACHABLE
2a02:e00:ffff:56::1 dev eth0 lladdr 00:0b:45:80:c0:00 router REACHABLE

Launching "ping6 fd39:20::39" turns fd39:20::39 from FAILED to REACHABLE.
After that, "ip -6 route flush cache" actually succeeds in removing the route
via default gateway, and I then get the proper route entry:

root@neru:~# ip -6 route get fd39::100
fd39::100 from :: via fd39:20::39 dev tun-rm  src fd39:20::3  metric 0 
    cache

So I conclude that my issue is very similar to [1] mentioned in a Bugzilla
entry [2] linked here just today.

  [1] https://lkml.org/lkml/2012/5/25/96
  [2] https://bugzilla.kernel.org/show_bug.cgi?id=42991

-- 
With respect,
Roman

~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Stallman had a printer,
with code he could not see.
So he began to tinker,
and set the software free."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]