Subject: Re: [vserver] IPv6 source address selection
From: Vincent Bernat <bernat@luffy.cx>
Date: Sun, 06 Feb 2011 09:15:07 +0100

 Sun, 06 Feb 2011 09:15:07 +0100
OoO  En cette nuit  nuageuse du  dimanche 06  février 2011,  vers 00:57,
Bruno Prémont <bonbons@linux-vserver.org> disait :

> What kernel&linux-vserver patch versions are you running on?

I am currently using the kernel from Debian Lenny. This is a 2.6.26 with
2.3.0.35 patch for vserver.

>> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER UP> mtu 1500 qlen 1000
>> inet6 X::5/64 scope global 
>> valid lft forever preferred lft forever
>> inet6 X::10/64 scope global 
>> valid lft forever preferred lft forever
>> inet6 X::7/64 scope global 
>> valid lft forever preferred lft forever
>> inet6 X::11/64 scope global 
>> valid lft forever preferred lft forever
>> inet6 X::2/64 scope global 
>> valid lft forever preferred lft forever
>> 
>> On guest:
>> 
>> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER UP> mtu 1500 qlen 1000
>> inet6 X::7/64 scope global 
>> valid lft forever preferred lft forever
>> 
>> /etc/vservers/AAA/interfaces/1/dev   is  set  to   "eth0",  and   I  use
>> /etc/vservers/AAA/interfaces/1/prefix to tell that the prefix is /64.
>> 
>> Now,  if  X::7 initiate  a  connection  to  ipv6.google.com, the  source
>> address is X::5 (the first IPv6  address on the host). And this does not
>> work.

> How many interfaces with IPv6 addresses do you have on your host, what
> does the routing look like?

On the  guest, only eth0 has  IPv6 interface (ip  -6 a l gives  only one
IPv6 address). On the host, I also have :
 - the loopback with ::1
 - eth0 also has a link address (fe80::....) and I need it
 - dummy0 has a link address (fe80::) and I don't need it

The routing table is :
 ip -6 route add Y::1/128 dev eth0
 ip route add default via Y::1

Y::1 is not in the same network as X::/64.

> It should definitely only take one of the addresses available to guest and
> none of the others that may exist on host (though for a multi-homed system
> this may cause routing via wrong outbound interface, work-around is to trigger
> rerouting via ip6tables). If no guest address is available it is expected to
> fail with no route to host.

I will try to reproduce the problem on a small virtual machine.
-- 
BOFH excuse #210:
We didn't pay the Internet bill and it's been cut off.