Hi all, We hit an IPv6 ND problem on 26.06 that is also in master. Fix: https://gerrit.fd.io/r/c/vpp/+/47102
*What happened.* Two linux-cp routers (DPDK, OSPFv3 over a BondEthernet) each learned their own link-local as a dynamic neighbour on the bond, with their own MAC. Most likely a layer-2 loop reflected their own NA back. After that, NS for the router's link-local were dropped as "neighbor solicitations for unknown targets". NAs sent to it went to glean instead of icmp6-neighbor-advertisement, so nothing new resolved on that link. *Why.* * In ip6_nd.c, the NA path calls ip6_nd_learn() on the target without checking whether the target is one of our own addresses. * ip_neighbor_adj_fib_add() installs a link-local neighbour with ip6_ll_table_entry_update(). That uses the same FIB source ( FIB_SOURCE_IP6_ND ) as the interface's own link-local receive, so it replaces the dpo-receive with an adjacency to our own MAC. * Deleting the bogus neighbour then removes the /128 entirely. * Global addresses aren't hit the same way, because their adj-fib source has lower priority than the interface source. The workaround is set interface ip address <itf> <own-LL>/128. That re-installs the receive without a restart. *The fix* checks the NA target the same way the NS path validates its target. If the target matches a local entry, VPP doesn't learn it and counts it as "neighbor advertisements for local targets". Forwarding of the NA and DAD handling are unchanged. It includes test_ip6.TestIPv6.test_na_for_own_address ; the test fails without the fix. We also tested it on a 26.06 linux-cp lab router: we injected NAs for the router's own link-local from a neighbour. With the fix the counter increments, nothing is learned and ND keeps working. A 24 h soak was clean. It applies cleanly to stable/2606 as well. *Two notes.* * The counter is incremented explicitly rather than through b->error. NAs continue to ip6-punt, and with a punt redirect (linux-cp) the buffer goes to the host without b->error being counted. The existing neighbor_advertisements_rx counter has the same blind spot on linux-cp routers. * Should ip_neighbor_add() also refuse a static or API neighbour for one of our own link-locals? Going by the code it would overwrite the receive the same way, but I haven't tested it, so I left it out. Thanks, Pieter Meyer Converged Group
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#27279): https://lists.fd.io/g/vpp-dev/message/27279 Mute This Topic: https://lists.fd.io/mt/121755936/21656 Group Owner: [email protected] Unsubscribe: https://lists.fd.io/g/vpp-dev/leave/14379924/21656/631435203/xyzzy [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
