(usagi-users 00672) IPv6 multi-netted source address problem

[Spencer Brooks <sbrooks@xxxxxxxxxxxxxxxx>]

Hello all.  My name is Spencer Brooks.  I work at Sony Pictures
entertainment in Culver City, CA.  We have been performing as series of
tests using IPv6 auto-configuration.  We think we have discovered an IPv6
implementation problem.

If an interface is multi-netted (has 2 or more IPv6 addresses) the kernel
will lock the source address for all out bound packets to the most recently
added IPv6 address.  This can lead to routing problems.  See below for the
example.


BSD router has the following v6 addresses
3ffe:814::10
3ffe:501:ffff:40::10

Linux host has the following v6 addresses
3ffe:814::2b0:d0ff:fe4c:f8da
3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da

######################
The most recently added IP on the Linux host is
3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da.
######################

TCPDUMP of ping from Linux host to 3ffe:814::10 on BSD router...
15:20:47.593949 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da > 3ffe:814::10: icmp6:
echo request

TCPDUMP of ping from Linux host to 3ffe:501:ffff:40::10 on BSD router...
15:21:01.640628 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da > 3ffe:501:ffff:40::10:
icmp6: echo request

*notice the source for both pings is 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da*

######################
NOW I REMOVE THEN ADD THE 3ffe:814::2b0:d0ff:fe4c:f8da ADDRESS ON THE LINUX
HOST.  3ffe:814::2b0:d0ff:fe4c:f8da now becomes the most recently added
address.
######################

TCPDUMP of ping from Linux host to 3ffe:814::10 on BSD router...
15:28:40.423238 3ffe:814::2b0:d0ff:fe4c:f8da > 3ffe:814::10: icmp6: echo
request

TCPDUMP of ping from Linux host to 3ffe:501:ffff:40::10 on BSD router...
15:29:43.323832 3ffe:814::2b0:d0ff:fe4c:f8da > 3ffe:501:ffff:40::10: icmp6:
echo request

*notice the source for both pings is NOW 3ffe:814::2b0:d0ff:fe4c:f8da*

######################
When we ping FROM THE BSD ROUTER TO THE LINUX HOST we see that the BSD
router USES THE CORRECT source address.
######################

TCPDUMP of ping from BSD router to 3ffe:814::2b0:d0ff:fe4c:f8da on Linux
host...
15:58:25.050082 3ffe:814::10 > 3ffe:814::2b0:d0ff:fe4c:f8da: icmp6: echo
request
15:58:25.050197 3ffe:814::2b0:d0ff:fe4c:f8da > 3ffe:814::10: icmp6: echo
reply

TCPDUMP of ping from BSD router to 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da on
Linux host...
15:57:44.685525 3ffe:501:ffff:40::10 > 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da:
icmp6: echo request
15:57:44.685665 3ffe:501:ffff:40:2b0:d0ff:fe4c:f8da > 3ffe:501:ffff:40::10:
icmp6: echo reply

*notice that when the BSD router makes an echo request it uses the correct
source address.  The Linux host responds to this echo request properly.*


I think that this is proof enough that the Linux kernel has a source address
problem when a single interface is multinetted.  It is clear that the kernel
locks the source address to the most recently added IPv6 address.  I believe
this to be a problem.

-- 
Spencer Brooks
Sony Pictures Digital Entertainment