Re: IPv6 VIPs and deprecated flag

On Thu, Jun 23, 2016 at 10:46:59PM +0100, John Sullivan wrote:
> On Thursday, June 23, 2016, 8:52:45 PM, Ryan O'Hara wrote:
> > I agree -- it is weird. Not only does the 'deprecated' flag get
> > removed when the netlink reflector is triggered, but the 'nodad' flag
> > remains intact. I would've guessed it would lose them both. I'll look
> 
> Deprecated isn't really a flag though. Well, it kind of is, that's how
> Linux at least implements it, but you can never set it directly. The
> value you set is the preferred lifetime ("ip addr show" shows it as
> "preferred_lft", the underlying kernel variable is called prefered_lft
> (go figure), it is the time remaining for which this address is
> "preferred", that is it will be used as a potential source address for
> unbound outgoing connections). If the preferred lifetime expired in
> the past, deprecated automatically gets set, if the preferred lifetime
> expires in the future, deprecated is automatically cleared.
> 
> You can set this manually using the preferred_lft argument to "ip addr
> add/change/replace", specifying 0 for deprecated, but the default is
> "forever" for manually added addresse. And any software which uses the
> same underlying kernel interface can do the same of course.

I understand.

> The other kind of thing that can change this value automatically are
> router advertisements, which if they're not actually changing your
> automatically assigned prefix/address are expected to keep moving
> the preferred lifetime into the future.

That is interesting.

> nodad on the other hand is definitely manual-only configuration and
> should never be set automatically for a normal address. (Addresses
> such as we have here that are known to be shared and thus would
> definitely fail duplicate address detection don't count!)

Two things:

1. The reason I said I was surprised that 'nodad' remained intact and
'deprecated' is remove is because, if I recall correctly, keepalied
sets both of these when an IPv6 VIP is added to an interface.

2. Actually, I do typically disable DAD by setting accept_dad and
dad_transmit (sysctl settings) to 0 for the loopback device on the
real servers, but to be honest I don't know this is this required.

If anyone is interested in reproducing this problem with SLAAC (or
attempting, anyway) let me know. I could use a sanity check.

Ryan

> > into the connection manager (NetworkManager) side of things, but I am
> > certain that my deployment scripts disable NM -- which I've been doing
> > for years.
> 
> > The VIP is definitely not the same address as the node would
> > self-assigned. FYI, I am using 4 VMs under libvirt in F23 with a
> > simple SLAAC setup for IPv6 address assignment. 
> 
> > Ryan
> 
> 
> > ------------------------------------------------------------------------------
> > Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> > Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> > present their vision of the future. This family event has something for
> > everyone, including kids. Get more information and register today.
> > http://sdm.link/attshape
> > _______________________________________________
> > Keepalived-devel mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/keepalived-devel
> 
> 
> 
> 
> John
> -- 
> Dead stars still burn
> 

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape