[draft] [v3.29] fix for issues on ipv6 enabled clusters#834
Closed
sknat wants to merge 12 commits intorelease/v3.29.0from
Closed
[draft] [v3.29] fix for issues on ipv6 enabled clusters#834sknat wants to merge 12 commits intorelease/v3.29.0from
sknat wants to merge 12 commits intorelease/v3.29.0from
Conversation
aritrbas
changed the title
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
3 times, most recently
from
d70ee5c to
326b60f
Compare
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
from
326b60f to
cab1a3c
Compare
aritrbas
changed the title
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
12 times, most recently
from
a72d00a to
86f489e
Compare
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
2 times, most recently
from
8d985ce to
838d59d
Compare
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
2 times, most recently
from
ece4d90 to
90c11d4
Compare
Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Signed-off-by: Aritra Basu <aritrbas@cisco.com>
This patch removes the nodeIP from the tap0 interface in VPP.
With this patch, for each uplink interface eth0 with IP 192.168.0.1/24
we create a corresponding tap0 set up the following way:
* In VRF:0
* we create the af_packet interface with IP 192.168.0.1/24
* we receive 192.168.0.1/32 locally, traffic to 192.168.0.1 without listeners
will end up in punt
* In the punt table
* we route 192.168.0.1/24 via tap0 192.168.0.1
* In linux
* tap0 has the 192.168.0.1/24 address
* tap0 will respond to ARPs as VPP has arp proxy enabled
* In a host-tap-eth0-v4 VRF
* we place the tap0 interface
* we give it the 169.254.0.1/32 address, overridable with CALICOVPP_TAP0_ADDR
* we enable IP6 without setting an address
* we add a static neighbor for 192.168.0.1 to the MAC of the linux side of the tap
* If we specify a rule in redirectToHostRules (e.g. for DNS in kind)
* we will have the classifier entry redirect to tap0 192.168.0.1
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
IPv6 gateway traffic (DHCPv6/ICMP) fails when VPP takes over the uplink. - Without gateway ND proxy, host NS for the default gateway is dropped by VPP with "neighbor solicitations for unknown targets" error due to missing /128 target entry in the tap FIB. Fix: - Enable ND proxy for the gateway on the tap so the host can resolve the gateway via VPP. Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
Configure ip6tables mangle rule to set hop limit to 2 for DHCPv6 OUTPUT traffic from client (sport 546) to server (dport 547). This prevents VPP from dropping DHCPv6 SOLICIT/REQUEST packets when it decrements hop-limit by 1 during forwarding. Since clients generate SOLICIT/REQUEST with hop-limit=1, without this rule VPP drops the packet (ip6 ttl <= 1) with ICMP time exceeded, causing DHCPv6 lease negotiation to fail. The rule is checked for existence before adding to prevent duplicates since ip6tables does not auto-dedupe rules. The rule is also cleaned up during configuration restoration. Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Link-local addresses are not routable. When synchronizing Linux routes to VPP's uplink interface, filter out link-local addresses so that they are not added to VPP's main VRF routing table. Signed-off-by: Aritra Basu <aritrbas@cisco.com>
Capture ID_NET_NAME_* properties before VPP driver unbind and restore them via udev rules after VPP creates host-facing tap/tun interface. This is needed for IAID generation by DHCPv6 client in systemd-networkd to be consistent across VPP lifecycle on the node. Key changes: - Add new CAPTURE_HOST_UDEV_PROPS hook that runs before PreconfigureLinux() - Store ID_NET_NAME_* values and MAC address while interface still has original driver - Create udev rules for the interface to restore ID_NET_NAME_* values after VPP runs - Cleanup udev rules on VPP shutdown - CAPTURE_HOST_UDEV_PROPS → capture, VPP_DONE_OK/ERRORED → cleanup Signed-off-by: Aritra Basu <aritrbas@cisco.com>
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
from
90c11d4 to
d05da9d
Compare
IPv6 ping between nodes fails with "l3 mac mismatch" error in VPP's ethernet-input node. Packets arriving on tap0 with destination MAC set to the infrastructure gateway's MAC are dropped. - IPv4 (ARP Proxy): Host sends ARP request, VPP responds with its own tap interface MAC. All subsequent IPv4 packets use VPP's MAC as the destination, passing VPP's L3 MAC filter check. - IPv6 (ND Proxy + Neighbor Advertisement): While VPP's ND proxy responds to Neighbor Solicitations with the tap interface MAC, the host also receives Neighbor Advertisement (NA) packets from the real gateway. These RA packets contain the Target Link-Layer Address Option (TLLAO) with the real gateway's MAC address. The host overwrites its neighbor cache with this information and sends IPv6 packets to the real gateway MAC instead of VPP's tap MAC. Capture the gateway's MAC address from Linux neighbor cache before VPP takes over the interface, then add it as a secondary MAC address on the tap interface using VPP's existing sw_interface_add_del_mac_address API. VPP's ethernet-input node accepts packets with either the primary MAC or any configured secondary MAC addresses, allowing traffic to flow regardless of which MAC address the host learned (from ND proxy or NA). This is a control plane only fix that requires no VPP patches. Signed-off-by: Aritra Basu <aritrbas@cisco.com>
aritrbas
force-pushed
the
abasu-dhcp6-fix-v329
branch
from
d05da9d to
325659e
Compare
Collaborator
Author
|
closing in favor of #864 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[WIP] cherry-pick of fixes from
masterfor issues on ipv6 enabled clusters