Subject: Multiple default routes: expectations vs real life

From: Jen Linkova <[email-masked]>
Date: Fri, 23 Feb 2018 08:01:45 +1100

Hello,

The network topology: a host is connected to a network where two
routers are present, R1 (with LLA1) and R2 (with LLA2). Both routers
send RAs.

RFC4861 says:

"On receipt of a valid Router Advertisement, a host extracts the
   source address of the packet and does the following:

      - If the address is not already present in the host's Default
        Router List, and the advertisement's Router Lifetime is non-
        zero, create a new entry in the list, and initialize its
        invalidation timer value from the advertisement's Router
        Lifetime field.
....

To limit the storage needed for the Default Router List, a host MAY
   choose not to store all of the router addresses discovered via
   advertisements.  However, a host MUST retain at least two router
   addresses and SHOULD retain more."

What I'd expect: the host should install two default route in its routing table.
(RFC8028-compliant host should also take into account which router
advertises which PIO but it would be too optimistic to expect it from
real hosts yet).

What I'm observing: the host picks up the first RA and installs *one*
default route only.  The default router information in any subsequent
RAs coming from another router is ignored (however the host seems to
use PIOs from those RAs to configure its addresses).

Am I right that host violates RFC4861 'MUST' (wow!)? Or am I missing
anything here and it's allowed somehow?

-- 
SY, Jen Linkova aka Furry

---

From: Enno Rey <[email-masked]>
Date: Thu, 22 Feb 2018 22:12:42 +0100

Hi Jen,

which OS is $HOST running?
Can you provide additional information (like "netstat -rn6" or similar) or specifics/attributes of the involved RAs?

I've seen a variety of hosts (mostly Windows and different flavors of Linux) behave in the "correct"/expected way (installing two default routes, even with different metrics when router preference differed in RAs).

best

Enno

On Fri, Feb 23, 2018 at 08:01:45AM +1100, Jen Linkova wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Matthias Luft, Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================

---

From: 神明達哉 <[email-masked]>
Date: Thu, 22 Feb 2018 13:58:04 -0800

At Fri, 23 Feb 2018 08:01:45 +1100,
Jen Linkova <[email-masked]> wrote:

> RAs coming from another router is ignored

Specifically what do you mean by this?  If you mean packets to
off-link destinations from the host are always sent to the first
default router, that does not necessarily mean the host only maintains
the first router in its (conceptual) default router list.

--
JINMEI, Tatuya

---

From: Jen Linkova <[email-masked]>
Date: Fri, 23 Feb 2018 09:54:14 +1100

On Fri, Feb 23, 2018 at 8:58 AM, 神明達哉 <[email-masked]> wrote:
> Specifically what do you mean by this?

I mean that the host routing table contains one default route only,
with the nexthop set to the LLA from the first RA received.
All subsequent RAs coming from another routers do not create other
default routes (but PIOs from them are used for configuring IP
addresses).

>  If you mean packets to

No, it's not what I mean. I'm talking about the host routing table
(netstat/route/whatever command is used on that system output).

---

From: Jen Linkova <[email-masked]>
Date: Fri, 23 Feb 2018 10:19:10 +1100

Hi Enno,

> Can you provide additional information (like "netstat -rn6" or similar) or specifics/attributes of the involved RAs?

I do not have the output handy right now but let's assume I've
confirmed that the host just ignores all RAs ex. the very first one ;)
My question to the group is 'do I read the standards right? Does such
behavior violate MUST?'.
If it does, the bug report will be filled ASAP, I just wanted to make
sure I'm not insane and the standards do require the host to keep at
least two default routers.

> I've seen a variety of hosts (mostly Windows and different flavors of Linux) behave in the "correct"/expected way

That's a good news, at least some systems are doing the right thing ;)

>(installing two default routes, even with different metrics when router preference differed in RAs).

Wow, it's even more than I'd expect from the real world ;)

---

From: 神明達哉 <[email-masked]>
Date: Thu, 22 Feb 2018 15:23:45 -0800

At Fri, 23 Feb 2018 09:54:14 +1100,

> (netstat/route/whatever command is used on that system output).

Okay, but actually that's just a variant of what I guessed.  And no,
in my understanding this behavior does not necessarily mean it breaks
the MUST of RFC4861.  The default router list is a conceptual data
structure; it may or may not be represented as host's routing table
entries for ::/0.  In fact BSD variants maintain a separate list for
IPv6 default router than the kernel routing table.  You can use 'ndp
-r' to see the list entries (while you use 'netstat -r' to see the
kernel routing table).

The behavior you showed simply means the host implementation does not
(seem to) support ECMP (for the default route).  As far as I know
RFC4861 doesn't require it.  At the very least "a host MUST retain at
least two router addresses (in the default router list)" doesn't mean
the host must support ECMP.

To confirm the host really doesn't hold these two router addresses as
an external observer (i.e., in a way not specific to a particular host
implementation), you'll need to do something like this:

- send RA from both router A and B
- see the host uses only one of the routers (assume it's A) to forward
  packets to off-link destinations
- send RA from router A with router lifetime 0 (while suspending RAs
  from router B)
- see what the host does for subsequent packets to off-link
  destinations.  if it now forward packets to router B, it means the
  host actually has maintained router B in the default router list and
  correctly switches to it from router A when it sees 0-lifetime for
  router A.  Otherwise, you can reasonably say the host implementation
  is likely to break RFC4861 (regarding the capacity of the default
  router list).

--
JINMEI, Tatuya

---

From: Michael Richardson <[email-masked]>
Date: Thu, 22 Feb 2018 18:36:17 -0500

Enno Rey <[email-masked]> wrote:
    > Can you provide additional information (like "netstat -rn6" or similar)
    > or specifics/attributes of the involved RAs?

    > I've seen a variety of hosts (mostly Windows and different flavors of
    > Linux) behave in the "correct"/expected way (installing two default
    > routes, even with different metrics when router preference differed in
    > RAs).

Yes, I see the same thing.
Install two default routes, and then consistently use the wrong one for a
given PIO and get BCP38 filtered and fall of the network.

Very annoying.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Jen Linkova <[email-masked]>
Date: Fri, 23 Feb 2018 11:56:10 +1100

> the host must support ECMP.

Very interesting point, thanks a lot!

>   is likely to break RFC4861 (regarding the capacity of the default

Good idea, I'll test this, thanks!

---

From: Jen Linkova <[email-masked]>
Date: Fri, 23 Feb 2018 12:02:51 +1100

> given PIO and get BCP38 filtered and fall of the network.

Well, this is just either 'not implementing the optional Rule 5.5. of
the address selection' or 'not implementing SHOULD of RFC8028',
depending on how you'd prefer to call such behaviour..

---

From: Fernando Gont <[email-masked]>
Date: Fri, 23 Feb 2018 22:23:58 -0300

> anything here and it's allowed somehow?

That's what I seem to remember experiencing on FreeBSD, at the very least.

-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1