Re: bridge(4) and IPv6 broken?

From: Alexander Leidinger <Alexander_at_Leidinger.net>
Date: Tue, 02 Jan 2024 07:51:34 UTC
Am 2024-01-02 00:40, schrieb Lexi Winter:
> hello,
> 
> i'm having an issue with bridge(4) and IPv6, with a configuration which
> is essentially identical to a working system running releng/14.0.
> 
> ifconfig:
> 
> lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 
> 16384
> 	options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
> 	inet 127.0.0.1 netmask 0xff000000
> 	inet6 ::1 prefixlen 128
> 	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
> 	groups: lo
> 	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
> pflog0: flags=1000141<UP,RUNNING,PROMISC,LOWER_UP> metric 0 mtu 33152
> 	options=0
> 	groups: pflog
> alc0: 
> flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> 
> metric 0 mtu 1500
> 	options=c3098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,LINKSTATE>
> 	ether 30:9c:23:a8:89:a0
> 	inet6 fe80::329c:23ff:fea8:89a0%alc0 prefixlen 64 scopeid 0x3
> 	media: Ethernet autoselect (1000baseT <full-duplex>)
> 	status: active
> 	nd6 options=1<PERFORMNUD>
> wg0: flags=10080c1<UP,RUNNING,NOARP,MULTICAST,LOWER_UP> metric 0 mtu 
> 1420
> 	options=80000<LINKSTATE>
> 	inet 172.16.145.21 netmask 0xffffffff
> 	inet6 fd00:0:1337:cafe:1111:1111:829a:595e prefixlen 128
> 	groups: wg
> 	tunnelfib: 1
> 	nd6 options=101<PERFORMNUD,NO_DAD>
> bridge0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> 
> metric 0 mtu 1500
> 	options=0
> 	ether 58:9c:fc:10:ff:b6
> 	inet 10.1.4.101 netmask 0xffffff00 broadcast 10.1.4.255
> 	inet6 2001:8b0:aab5:104:3::101 prefixlen 64
> 	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
> 	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
> 	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
> 	member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
> 	        ifmaxaddr 0 port 6 priority 128 path cost 2000000
> 	member: alc0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
> 	        ifmaxaddr 0 port 3 priority 128 path cost 55
> 	groups: bridge
> 	nd6 options=1<PERFORMNUD>
> tap0: flags=9903<UP,BROADCAST,PROMISC,SIMPLEX,LINK0,MULTICAST> metric 0 
> mtu 1500
> 	options=80000<LINKSTATE>
> 	ether 58:9c:fc:10:ff:89
> 	groups: tap
> 	media: Ethernet 1000baseT <full-duplex>
> 	status: no carrier
> 	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
> 
> the issue is that the bridge doesn't seem to respond to IPv6 ICMP
> Neighbour Solicitation.  for example, while running ping, tcpdump shows
> this:
> 
> 23:30:16.567071 58:9c:fc:10:ff:b6 > 1e:ab:48:c1:f6:62, ethertype IPv6 
> (0x86dd), length 70: 2001:8b0:aab5:104:3::101 > 2001:8b0:aab5:106::12: 
> ICMP6, echo request, id 34603, seq 13, length 16
> 23:30:16.634860 1e:ab:48:c1:f6:62 > 33:33:ff:00:01:01, ethertype IPv6 
> (0x86dd), length 86: fe80::1cab:48ff:fec1:f662 > ff02::1:ff00:101: 
> ICMP6, neighbor solicitation, who has 2001:8b0:aab5:104:3::101, length 
> 32
> 23:30:17.567080 58:9c:fc:10:ff:b6 > 1e:ab:48:c1:f6:62, ethertype IPv6 
> (0x86dd), length 70: 2001:8b0:aab5:104:3::101 > 2001:8b0:aab5:106::12: 
> ICMP6, echo request, id 34603, seq 14, length 16
> 23:30:17.674842 1e:ab:48:c1:f6:62 > 33:33:ff:00:01:01, ethertype IPv6 
> (0x86dd), length 86: fe80::1cab:48ff:fec1:f662 > ff02::1:ff00:101: 
> ICMP6, neighbor solicitation, who has 2001:8b0:aab5:104:3::101, length 
> 32
> 23:30:17.936956 1e:ab:48:c1:f6:62 > 33:33:00:00:00:01, ethertype IPv6 
> (0x86dd), length 166: fe80::1cab:48ff:fec1:f662 > ff02::1: ICMP6, 
> router advertisement, length 112
> 23:30:18.567093 58:9c:fc:10:ff:b6 > 1e:ab:48:c1:f6:62, ethertype IPv6 
> (0x86dd), length 70: 2001:8b0:aab5:104:3::101 > 2001:8b0:aab5:106::12: 
> ICMP6, echo request, id 34603, seq 15, length 16
> 23:30:19.567104 58:9c:fc:10:ff:b6 > 1e:ab:48:c1:f6:62, ethertype IPv6 
> (0x86dd), length 70: 2001:8b0:aab5:104:3::101 > 2001:8b0:aab5:106::12: 
> ICMP6, echo request, id 34603, seq 16, length 16
> 23:30:19.567529 1e:ab:48:c1:f6:62 > 33:33:ff:00:01:01, ethertype IPv6 
> (0x86dd), length 86: fe80::1cab:48ff:fec1:f662 > ff02::1:ff00:101: 
> ICMP6, neighbor solicitation, who has 2001:8b0:aab5:104:3::101, length 
> 32
> 
> fe80::1cab:48ff:fec1:f662 is the subnet router; it's sending
> solicitations but FreeBSD doesn't send a response,
> 
> if i remove alc0 from the bridge and configure the IPv6 address 
> directly
> on alc0 instead, everything works fine.
> 
> i'm testing without any packet filter (ipfw/pf) in the kernel.
> 
> it's possible i'm missing something obvious here; does anyone have an
> idea?

Just an idea. I'm not sure if it is the right track...

There is code in the kernel which is ignoring NS stuff from "non-valid" 
sources (security / spoofing reasons). The NS request is from a link 
local address. Your bridge has no link local address (and your tap has 
the auto linklocal flag set which I would have expected to be on the 
bridge instead). I'm not sure but I would guess it could be because of 
this.

If my guess is not too far off, I would suggest to try:
  - remove auto linklocal from tap0 (like for alc0)
  - add auto linklocal to bridge0

If this doesn't help, there is the sysctl 
net.inet6.icmp6.nd6_onlink_ns_rfc4861 which you could try to set to 1. 
Please read 
https://www.freebsd.org/security/advisories/FreeBSD-SA-08:10.nd6.asc 
before you do that.

Bye,
Alexander.

-- 
http://www.Leidinger.net Alexander@Leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    netchild@FreeBSD.org  : PGP 0x8F31830F9F2772BF