Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gnrc_ipv6: only discard invalid source when assigned to interface #12442

Merged

Conversation

miri64
Copy link
Member

@miri64 miri64 commented Oct 14, 2019

Contribution description

While it is correct to not use an invalid address as a source address, it is incorrect to assume that addresses not assigned to the interface (idx == -1 in the respective piece of code) are invalid: Other than classic forwarding via a FIB, forwarded packets utilizing a IPv6 routing header will pass this check, like any other packet sent by this node. The source address for these is not on the given node, so e.g. source routing is not possible at the moment.

Testing procedure

Testing procedures from #11970 should still work (was unable to test this atm due to lacking hardware).

With #12440 merged tests/gnrc_rpl_srh passes (requires dist/tools/tapsetup/tapsetup to be called before and also must be called with sudo).

Issues/PRs references

Follow-up to #11970
Fixes parts of #12436
Accompanies #12440

@miri64 miri64 added Type: bug The issue reports a bug / The PR fixes a bug (including spelling errors) Area: network Area: Networking Process: needs backport Integration Process: The PR is required to be backported to a release or feature branch labels Oct 14, 2019
@miri64 miri64 added this to the Release 2019.10 milestone Oct 14, 2019
While it is correct to not use an invalid address as a source address,
it is incorrect to assume that addresses not assigned to the interface
(`idx == -1` in the respective piece of code) are invalid: Other than
classic forwarding via a FIB, forwarded packets utilizing a IPv6
routing header will pass this check, like any other packet sent by this
node. The source address for these is not on the given node, so e.g.
source routing is not possible at the moment.
@miri64 miri64 force-pushed the gnrc_ipv6/fix/only-local-invalid-src branch from 95a6ea9 to b5b52c7 Compare October 14, 2019 13:43
@miri64
Copy link
Member Author

miri64 commented Oct 14, 2019

Rebased to current master to include now merged #12440.

@miri64 miri64 added the CI: ready for build If set, CI server will compile all applications for all available boards for the labeled PR label Oct 14, 2019
@kb2ma
Copy link
Member

kb2ma commented Oct 14, 2019

At this point, tests/gnrc_rpl_srh should work, correct? Instead b5b52c7 results like below for me:

Traceback (most recent call last):
  File "/home/kbee/dev/riot/repo/tests/gnrc_rpl_srh/tests/01-run.py", line 384, in <module>
    sys.exit(run(testfunc, timeout=1, echo=False))
  File "/home/kbee/dev/riot/repo/dist/pythonlibs/testrunner/__init__.py", line 29, in run
    testfunc(child)
  File "/home/kbee/dev/riot/repo/tests/gnrc_rpl_srh/tests/01-run.py", line 368, in testfunc
    run(test_forward_uncomp)
  File "/home/kbee/dev/riot/repo/tests/gnrc_rpl_srh/tests/01-run.py", line 361, in run
    raise e
  File "/home/kbee/dev/riot/repo/tests/gnrc_rpl_srh/tests/01-run.py", line 357, in run
    func(child, tap, hwaddr_dst, lladdr_dst, lladdr_src)
  File "/home/kbee/dev/riot/repo/tests/gnrc_rpl_srh/tests/01-run.py", line 265, in test_forward_uncomp
    assert(IPv6ExtHdrRouting in p)
AssertionError

@cgundogan
Copy link
Member

Interestingly, 7 out of 10 times I get a SUCCESS. However, the other 3 times I see the same error described by @kb2ma

@cgundogan
Copy link
Member

Sometimes, I even hit another assert:

Traceback (most recent call last):
  File "/tmp/RIOT/tests/gnrc_rpl_srh/tests/01-run.py", line 384, in <module>
    sys.exit(run(testfunc, timeout=1, echo=False))
  File "/tmp/RIOT/dist/pythonlibs/testrunner/__init__.py", line 29, in run
    testfunc(child)
  File "/tmp/RIOT/tests/gnrc_rpl_srh/tests/01-run.py", line 366, in testfunc
    run(test_multicast_addr)
  File "/tmp/RIOT/tests/gnrc_rpl_srh/tests/01-run.py", line 361, in run
    raise e
  File "/tmp/RIOT/tests/gnrc_rpl_srh/tests/01-run.py", line 357, in run
    func(child, tap, hwaddr_dst, lladdr_dst, lladdr_src)
  File "/tmp/RIOT/tests/gnrc_rpl_srh/tests/01-run.py", line 227, in test_multicast_addr
    assert(len(p) == 0)
AssertionError

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

Ok, then it is still flakey. I will have another look if it is related or yet another regression introduced since last release.

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

Ok, a quick sniff with Wireshark during a test run confirmed to me, that this is the same sniffer syncing issue I already described in the testing procedures of #10392 (the packets are forwarded as they should, but they are not picked up by the scapy sniffer). So this is a bug in the test, not in the network stack. If I find the time, I will port these tests to scapy automata, similar as I did for emcute in #11823, but for this release I think we can go as is.

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

For the other observation by @cgundogan, I think it picks up a packet previously on the medium, so a syncing issue again.

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

(I don't see any ICMPv6 error messages nor second UDP packet on the TAP interface during the run of those specific tests, even when they fail)

Copy link
Member

@cgundogan cgundogan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix is sensible and tests/gnrc_rpl_srh runs successful (excluding the sporadic failures due to scapy sniffer running out-of-sync)

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

Testing procedures from #11970 should still work (was unable to test this atm due to lacking hardware).

Has someone retested this as well?

@cgundogan
Copy link
Member

From #11970:

Classic ND should work as expected. To test this I used radvd on my host system with the following config

interface tapbr0 {
    AdvSendAdvert on;
    prefix 2001:db8:0:1::/64
    {
         AdvOnLink on;
         AdvAutonomous on;
    };
};

If using native (with dist/tools/tapsetup/tapsetup to create the TAP interfaces) the 2001:db8:0:1:: address of the node should become valid a few seconds after the node started.

The address is still set to VAL on native for me.

I try to get my hands on a pi for the 6lo-nd test

@cgundogan
Copy link
Member

I confirm now that this PR does not change the following behaviour:

  • RasPi BR announces ABROs. RIOT node configures a global address with TNT[3] set. Ping does not work.
  • Pinging in above setup works, when compiling with GNRC_IPV6_NIB_CONF_SLAAC=1

@cgundogan cgundogan merged commit 626f68c into RIOT-OS:master Oct 15, 2019
@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

Thanks for the review and testing!

@miri64
Copy link
Member Author

miri64 commented Oct 15, 2019

Backport provided in #12458

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area: network Area: Networking CI: ready for build If set, CI server will compile all applications for all available boards for the labeled PR Process: needs backport Integration Process: The PR is required to be backported to a release or feature branch Type: bug The issue reports a bug / The PR fixes a bug (including spelling errors)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants