Deleting IPv4 iface-routes from extra FIBs

[Harald Schmalzbauer]

 Bezüglich Julian Elischer's Nachricht vom 23.04.2014 09:55 (localtime):
> On 4/23/14, 4:38 AM, Nikolay Denev wrote:
>> On Tue, Apr 22, 2014 at 5:37 PM, Harald Schmalzbauer
>> <h.schmalzbauer at omnilan.de> wrote:
>>> Hello,
>>>
>>> here, http://svnweb.freebsd.org/base?view=revision&revision=248895
>>> interface route protection was added (so the following problem arose
>>> with 9.2).
>>>
>>> Unfortunately, in my case, I must be able to delete these routes;
>>> not in
>>> the default FIB, but in jail's fibs, because:
>>> · Host is multihomed with multiple nics in different subnets.
>>> · Jail's IP (no vnet) is from a different subnet than host's
>>> default-router subnet – jail has no ip in the range of host's
>>> default-router!!!
>>> · FIB used by jail contains valid default-router.
>>>
>>> Problem:
>>> If iface-routes exist in jail's FIB, answer-packets take the
>>> iface-shortcut, not trespassing the router (default gateway); hence
>>> 3way-handshake never finishes and firewall terminates (half-opened) TCP
>>> sessions.
>>>
>>> Workarround:
>>> · Abuse packet filter doing some kind of route-to…
>>> · Revert r248895, to be able to delete v4-iface-routes (inet6-routes
>>> can
>>> be deleted without any hack)
>>>
>>> Desired solution:
>>> · Allow deletion of v4-iface-routes if FIB!=0.
>>>
>>> Unfortunately my C skills don't allow me to implement this myself :-(
>>> I can't even follow the code, I guess that was originally considered,
>>> but possibly doesn't work bacause of a simple bug?!? I took the lazy
>>> way
>>> and simply reverted r248895 instead of trying to understand
>>> rtrequest1_fib(). I wish I had the time to learn…
>>>
>>> Thanks for any help,
>>>
>>> -Harry
>>>
>> Hi,
>>
>> As it was suggested before as immediate workaround you can set
>> net.add_addr_allfibs=0 so that the interface routes are added only in
>> the default FIB.
>
> yes, we made two behaviours.
> Add interface routes to all active FIBS or only add them to the first
> fib and let the user populate other fibs as needed.
> It appears you want the second behaviour, so I suggest you use that
> option and set up all your routes manually.

Hello,

last time I had the iface-route problem, I just reverted r248895 (for
9.3). There was inconsitent behaviour with v6 iface routes and
net.add_addr_allfibs=0.
Now I checked with 10.1 ans it seems net.add_addr_allfibs=0 doesn't work
any more:
netstat -f inet -nr
Routing tables

Internet:
Destination        Gateway            Flags      Netif Expire
default            172.21.32.1        UGS         egn
127.0.0.1          link#2             UH          lo0
172.21.32.0/19     link#1             U           egn
172.21.35.1        link#1             UHS         lo0

netstat -F 1 -f inet -nr
Routing tables (fib: 1)

Internet:
Destination        Gateway            Flags      Netif Expire
127.0.0.1          link#2             UH          lo0
172.21.32.0/19     link#1             U           egn

'sysctl net.add_addr_allfibs'
net.add_addr_allfibs: 0

Shouldn't the routing table for fib1 stay empty? Can't remember the
result when I testet that with 9.3 :-(

Thanks,

-Harry


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20141013/62649c12/attachment.sig>