Re: IPv6 VIPs and deprecated flag

On Fri, Jun 24, 2016 at 08:39:57AM -0500, Ryan O'Hara wrote:
> On Thu, Jun 23, 2016 at 10:46:59PM +0100, John Sullivan wrote:
> > On Thursday, June 23, 2016, 8:52:45 PM, Ryan O'Hara wrote:
> > > I agree -- it is weird. Not only does the 'deprecated' flag get
> > > removed when the netlink reflector is triggered, but the 'nodad' flag
> > > remains intact. I would've guessed it would lose them both. I'll look
> > 
> > Deprecated isn't really a flag though. Well, it kind of is, that's how
> > Linux at least implements it, but you can never set it directly. The
> > value you set is the preferred lifetime ("ip addr show" shows it as
> > "preferred_lft", the underlying kernel variable is called prefered_lft
> > (go figure), it is the time remaining for which this address is
> > "preferred", that is it will be used as a potential source address for
> > unbound outgoing connections). If the preferred lifetime expired in
> > the past, deprecated automatically gets set, if the preferred lifetime
> > expires in the future, deprecated is automatically cleared.
> > 
> > You can set this manually using the preferred_lft argument to "ip addr
> > add/change/replace", specifying 0 for deprecated, but the default is
> > "forever" for manually added addresse. And any software which uses the
> > same underlying kernel interface can do the same of course.
> 
> I understand.
> 
> > The other kind of thing that can change this value automatically are
> > router advertisements, which if they're not actually changing your
> > automatically assigned prefix/address are expected to keep moving
> > the preferred lifetime into the future.
> 
> That is interesting.
> 
> > nodad on the other hand is definitely manual-only configuration and
> > should never be set automatically for a normal address. (Addresses
> > such as we have here that are known to be shared and thus would
> > definitely fail duplicate address detection don't count!)
> 
> Two things:
> 
> 1. The reason I said I was surprised that 'nodad' remained intact and
> 'deprecated' is remove is because, if I recall correctly, keepalied
> sets both of these when an IPv6 VIP is added to an interface.
> 
> 2. Actually, I do typically disable DAD by setting accept_dad and
> dad_transmit (sysctl settings) to 0 for the loopback device on the
> real servers, but to be honest I don't know this is this required.
> 
> If anyone is interested in reproducing this problem with SLAAC (or
> attempting, anyway) let me know. I could use a sanity check.

Just a follow-up regarding this odd IPv6 behavior I was seeing. It
turns out to be unrelated to keepalived.

I noticed that the IPv6 VIP had the preferred_lft change from 0 to
'forever' when a router advertisement was received some time after it
was created on the interface. I decided to take keepalived out of the
picture, add a VIP to the interface manually with preferred_lft set to
0 and watch. Same thing happened -- RA came in, preferred_lft goes
from 0 to forever and thus deprecated flag is lost.

By the way, NetworkManager was configured and managing the interface
in question, but it does not seem to be the sole reason for this odd
behavior.

So far I came up with two solutions:

1. Set IPV6_AUTOCONF=no in the ifcfg file, but leave
NM_CONTROLLED=yes. This will cause the interface to *not* get an IPV6
address via SLAAC, so I had to setup a static IPv6 address. Router
advertisements are still received, but the VIP is not reconfigured
with the information in the RA, so the VIP remains deprecated.

2. Turn off NetworkManager (NM_CONTROLLED=no in ifcfg file), keep
IPV6_AUTOCONF=yes for SLAAC. Again, this seems to keep preferred_lft 0
even when router advertisements are received.

I've got some other ideas and need to read some NetworkManager code,
but wanted to follow-up since this was driving me crazy for several
days.

Ryan


------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape