From owner-freebsd-net@FreeBSD.ORG Sun Dec 28 10:17:02 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4D038197 for ; Sun, 28 Dec 2014 10:17:02 +0000 (UTC) Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id EC25315FD for ; Sun, 28 Dec 2014 10:17:01 +0000 (UTC) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id B1FB725D37C3; Sun, 28 Dec 2014 10:16:57 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id 93EFBC7706D; Sun, 28 Dec 2014 10:16:56 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id zLw8KAnWvOYy; Sun, 28 Dec 2014 10:16:54 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4410:9857:437e:f6b9:544d] (unknown [IPv6:fde9:577b:c1a9:4410:9857:437e:f6b9:544d]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id 391C5C77058; Sun, 28 Dec 2014 10:16:53 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\)) Subject: Re: IPv6 routes leaking between FIBs? From: "Bjoern A. Zeeb" In-Reply-To: Date: Sun, 28 Dec 2014 10:16:21 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Jason Healy X-Mailer: Apple Mail (2.1993) Cc: freebsd-net@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Dec 2014 10:17:02 -0000 > On 28 Dec 2014, at 03:19 , Jason Healy wrote: >=20 > Hello, >=20 > Trying out FreeBSD for the first time to build a firewall box that=92s = multi-core and runs PF. I=92m very interested in the FIB code, as it = lines up well with the way my core networking equipment works and should = allow me to route traffic on an interface that=92s logically separate = from the management interfaces. >=20 > I=92ve been playing for a bit with the FIB features, but I=92m getting = hung up on IPv6. I=92m trying to set up two interfaces on my box to = each have a different FIB, and to not leak routes between the = interfaces: >=20 > # sysctl net.add_addr_allfibs=3D0 > # ifconfig em1 inet 192.0.2.1/24 fib 1 > # ifconfig em1 inet6 2001:db8:dead:beef::1/64 fib 1 > # ifconfig em2 inet 203.0.113.1/24 fib 2 > # ifconfig em2 inet6 2001:db8:cafe:babe::1/64 fib 2 >=20 > If I then check the routing tables for each FIB, here=92s what I get: >=20 > # setfib -F 1 netstat -rn >=20 > Routing tables (fib: 1) >=20 > Internet: > Destination Gateway Flags Netif Expire > 192.0.2.0/24 link#2 U em1 > 192.0.2.1 link#2 UHS lo0 >=20 > Internet6: > Destination Gateway Flags = Netif Expire > 2001:db8:cafe:babe::/64 link#3 U = em2 > 2001:db8:dead:beef::/64 link#2 U = em1 > 2001:db8:dead:beef::1 link#2 UHS = lo0 > fe80::%em1/64 link#2 U = em1 > fe80::a00:27ff:fef6:162a%em1 link#2 UHS = lo0 > fe80::%em2/64 link#3 U = em2 > fe80::%lo0/64 link#5 U = lo0 >=20 >=20 > # setfib -F 2 netstat -rn >=20 > Routing tables (fib: 2) >=20 > Internet: > Destination Gateway Flags Netif Expire > 203.0.113.0/24 link#3 U em2 > 203.0.113.1 link#3 UHS lo0 >=20 > Internet6: > Destination Gateway Flags = Netif Expire > 2001:db8:cafe:babe::/64 link#3 U = em2 > 2001:db8:cafe:babe::1 link#3 UHS = lo0 > 2001:db8:dead:beef::/64 link#2 U = em1 > fe80::%em1/64 link#2 U = em1 > fe80::%em2/64 link#3 U = em2 > fe80::a00:27ff:fe62:d267%em2 link#3 UHS = lo0 > fe80::%lo0/64 link#5 U = lo0 >=20 >=20 > Note that as expected, the IPv4 routes are constrained to their FIB = (192.0.2.0 to FIB 1 and 203.0.113.0 to FIB 2). However, the IPv6 routes = (deadbeef and cafebabe) leak between the FIBs; both prefixes that I add = are listed in both FIBs (as well as the link-local stuff). >=20 > According to: >=20 > = https://www.freebsd.org/news/status/report-2012-01-2012-03.html#Multi-FIB:= -IPv6-Support-and-Other-Enhancements >=20 > IPv6 parity is claimed for the FIB code, so I=92m not sure if I=92m = doing it wrong, or if there=92s a problem with the FIB code and IPv6 = routes. >=20 > Thanks in advance for any help or clarification! People simply broke it (again). Please file a bug report. You may = mention that there are regression test scripts in src/tools/ somewhere = to test all the cases for IPv6. =97=20 Bjoern A. Zeeb Charles Haddon Spurgeon: "Friendship is one of the sweetest joys of life. Many might have failed beneath the bitterness of their trial had they not found a friend."