On Fri, Feb 8, 2013 at 1:03 AM, Sébastien Luttringer wrote:

...

On Wed, Feb 6, 2013 at 11:48 PM, Sébastien Luttringer wrote:

...

DAD detection is detected via the presence of tentative flag in ip command. This flag can only be setted if interface is up (obviously).

So, setting an IPv6 address will fail when you: - the cable is not plugged - any interface of a bridge is not set

The code was (before rewriting of netctl) reference this bug report: https://bugs.archlinux.org/task/28887

This bug will reopen after your proposed changes. I don't think so. The bug was about DAD no waiting enough time. This

On Thu, Feb 7, 2013 at 12:36 PM, Jouke Witteveen wrote: patch drop the DAD check logic by userland (same behaviour than ipv4).

The lines you delete are exactly the lines that were added to fix the bug.

...

If the cable is not plugged there is no point in trying to connect anyway Connect, but configure? Setting a IP address to an interface doesn't mean trying to connect to anything or having an internet connection. It just mean setting an ip. Port can be up or down, or change of states every minutes. We don't care. netctl should not fail to setup a static ip on iface when no link is detected at boot. Sometimes, setting an IP on iface can be used to allow kernel to accept packet to this destination without really own it (lvs by example)

...

so it would be nice if you describe in some more detail what problem your changes solve. Imagine a router on archlinux, with a bridge of n ports. People can plug (or not) their computers when they wants. Mostly, when you boot your router, noboby is plugged. When the router starts, it defines IPv4 and IPv6 on the bridge (where all ethernet ports are added). With the current netcfg/netctl, it's impossible because when nobody is plugged, DAD cannot do is job of checking ip address, because all the underlying interface can't send icmpv6 ND messages.

I've tested to disable dad (sysctl accept_dad)[1] but interface stay in tentative mode and netctl timeout and rollback configuration.[2]

The way to prevent your interface from entering the 'tentative' state is by specifying addresses as follows: Address6=('1234:bcd::11/64 nodad') I will soon add a note on such modifiers to the manual.

Here I don't see why we *care* about DAD when setting ipv6 in _static_ mode. This is really usefull (and required) in stateless mode and was defined in ND RFC[3] for stateless autoconfig RFC[4].

If you really want check DAD, which is a completly correct behaviour in stateless, we maybe use dadfailed[5] instead of tentative[6] in our check.

Cheers,

[1] Not really surprising as parameter is about accept and not using DAD crafted ND. [2] There is currently no check in the netcfg code about activating or not the sysctl accept_dad. Should we add it as we do with accept_ra? [3] http://tools.ietf.org/html/rfc4861 look at §7 [4] http://tools.ietf.org/html/rfc4862 [5] http://git.kernel.org/?p=linux/kernel/git/shemminger/iproute2.git;a=commit;h... [6] http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=blob;f=n...

-- Sébastien "Seblu" Luttringer https://www.seblu.net GPG: 0x2072D77A

On Wed, Mar 6, 2013 at 7:20 PM, Sébastien Luttringer wrote:

On Fri, Feb 8, 2013 at 5:16 PM, Jouke Witteveen wrote:

...

On Fri, Feb 8, 2013 at 1:03 AM, Sébastien Luttringer wrote:

...

...

On Wed, Feb 6, 2013 at 11:48 PM, Sébastien Luttringer wrote:

...

DAD detection is detected via the presence of tentative flag in ip command. This flag can only be setted if interface is up (obviously).

So, setting an IPv6 address will fail when you: - the cable is not plugged - any interface of a bridge is not set

The code was (before rewriting of netctl) reference this bug report: https://bugs.archlinux.org/task/28887

This bug will reopen after your proposed changes. I don't think so. The bug was about DAD no waiting enough time. This

On Thu, Feb 7, 2013 at 12:36 PM, Jouke Witteveen wrote: patch drop the DAD check logic by userland (same behaviour than ipv4).

The lines you delete are exactly the lines that were added to fix the bug.

...

...

If the cable is not plugged there is no point in trying to connect anyway Connect, but configure? Setting a IP address to an interface doesn't mean trying to connect to anything or having an internet connection. It just mean setting an ip. Port can be up or down, or change of states every minutes. We don't care. netctl should not fail to setup a static ip on iface when no link is detected at boot. Sometimes, setting an IP on iface can be used to allow kernel to accept packet to this destination without really own it (lvs by example)

...

so it would be nice if you describe in some more detail what problem your changes solve. Imagine a router on archlinux, with a bridge of n ports. People can plug (or not) their computers when they wants. Mostly, when you boot your router, noboby is plugged. When the router starts, it defines IPv4 and IPv6 on the bridge (where all ethernet ports are added). With the current netcfg/netctl, it's impossible because when nobody is plugged, DAD cannot do is job of checking ip address, because all the underlying interface can't send icmpv6 ND messages.

I've tested to disable dad (sysctl accept_dad)[1] but interface stay in tentative mode and netctl timeout and rollback configuration.[2]

The way to prevent your interface from entering the 'tentative' state is by specifying addresses as follows:

Address6=('1234:bcd::11/64 nodad') Tested for 4 weeks and avoid netctl units to fail during tentative mode.

...

I will soon add a note on such modifiers to the manual.

Unfortunately on normal setup, where we should not disable DAD, I got a DAD failure sometimes. It append more on slow computer.

So here you say we should not disable DAD on normal setups, with which I agree and which is the default behavior of `ip`.

It's a bit rude to fail the network, sometimes the only way to connect to the computer, because dad is not finished. Up the value of the timeout is a quick workaround, but a good value is difficult to guess and can let us without network if hardware lag. Why not reverse the logic and check for the dadfailed flag (with a TIMEOUT) and only consider the network failed with this flag?

Here you state the reverse: we should disable DAD by default. The timeout isn't really a workaround, it depends on your network setup what timeouts are to be expected. Lets just stick with the iproute2 default, which is to do DAD by default (note that this is completely irrelevant for IPv4 addresses).

# LC_ALL=C journalctl -b -u netcfg@lan.service -- Logs begin at Sat 2012-12-08 02:58:37 CET, end at Mon 2013-02-25 01:17:36 CET. -- Feb 23 10:20:03 thunder netcfg[284]: :: lan up Duplicate Address Detection is taking too long Feb 23 10:20:03 thunder netcfg[284]: [fail] Feb 23 10:38:43 thunder netcfg[2137]: :: lan up [done]

-- Sébastien "Seblu" Luttringer https://www.seblu.net GPG: 0x2072D77A

On Sat, Mar 9, 2013 at 3:11 PM, Sébastien Luttringer wrote:

On Sat, Mar 9, 2013 at 2:07 PM, Jouke Witteveen wrote:

...

On Wed, Mar 6, 2013 at 7:20 PM, Sébastien Luttringer wrote:

...

On Fri, Feb 8, 2013 at 5:16 PM, Jouke Witteveen wrote:

...

On Fri, Feb 8, 2013 at 1:03 AM, Sébastien Luttringer wrote:

...

...

On Wed, Feb 6, 2013 at 11:48 PM, Sébastien Luttringer wrote: > DAD detection is detected via the presence of tentative flag in ip command. > This flag can only be setted if interface is up (obviously). > > So, setting an IPv6 address will fail when you: > - the cable is not plugged > - any interface of a bridge is not set > > The code was (before rewriting of netctl) reference this bug report: > https://bugs.archlinux.org/task/28887

This bug will reopen after your proposed changes. I don't think so. The bug was about DAD no waiting enough time. This

On Thu, Feb 7, 2013 at 12:36 PM, Jouke Witteveen wrote: patch drop the DAD check logic by userland (same behaviour than ipv4).

The lines you delete are exactly the lines that were added to fix the bug.

...

...

If the cable is not plugged there is no point in trying to connect anyway Connect, but configure? Setting a IP address to an interface doesn't mean trying to connect to anything or having an internet connection. It just mean setting an ip. Port can be up or down, or change of states every minutes. We don't care. netctl should not fail to setup a static ip on iface when no link is detected at boot. Sometimes, setting an IP on iface can be used to allow kernel to accept packet to this destination without really own it (lvs by example)

...

so it would be nice if you describe in some more detail what problem your changes solve. Imagine a router on archlinux, with a bridge of n ports. People can plug (or not) their computers when they wants. Mostly, when you boot your router, noboby is plugged. When the router starts, it defines IPv4 and IPv6 on the bridge (where all ethernet ports are added). With the current netcfg/netctl, it's impossible because when nobody is plugged, DAD cannot do is job of checking ip address, because all the underlying interface can't send icmpv6 ND messages.

I've tested to disable dad (sysctl accept_dad)[1] but interface stay in tentative mode and netctl timeout and rollback configuration.[2]

The way to prevent your interface from entering the 'tentative' state is by specifying addresses as follows:

Address6=('1234:bcd::11/64 nodad') Tested for 4 weeks and avoid netctl units to fail during tentative mode.

...

I will soon add a note on such modifiers to the manual.

Unfortunately on normal setup, where we should not disable DAD, I got a DAD failure sometimes. It append more on slow computer.

So here you say we should not disable DAD on normal setups, with which I agree and which is the default behavior of `ip`.

...

It's a bit rude to fail the network, sometimes the only way to connect to the computer, because dad is not finished. Up the value of the timeout is a quick workaround, but a good value is difficult to guess and can let us without network if hardware lag. Why not reverse the logic and check for the dadfailed flag (with a TIMEOUT) and only consider the network failed with this flag?

Here you state the reverse: we should disable DAD by default. The timeout isn't really a workaround, it depends on your network setup what timeouts are to be expected.

I don't state the reverse. We should always let DAD enabled (in the kernel) as RFC recommend. My point is to avoid disabling of kernel DAD handling because netctl make it difficult to let it enabled because it fails randomly based on meaningless timeout.

The kernel is in charge of DAD, and advertise us by being in tentative mode and then dadfailed if an address is already taken. Here netctl try to guess if there is a conflict by looking tentative flag, which doesn't means there is a conflict or not. It only tells us if kernel as finished its job.

My suggestion, if we want to keeps the timeout logic on ip6 static address, we can try to really detect failure and not guess there is an ip conflict whereas the DAD process is still ongoing. With the both approach, on the network layer, they will never have conflict on ip, as DAD is done by kernel. The only difference is netctl will not mark interface failed if the result of DAD is not available before the timeout. This will save us of a lot of false positive DAD failure, as conflict in ipv6 is less frequent.

Cheers,

-- Sébastien "Seblu" Luttringer https://www.seblu.net GPG: 0x2072D77A

The time needed for DAD is not determined by the kernel, but by the network. As far as I know there is no (easy) better way to determine whether DAD is done than what we do now. We do need DAD to be finished before continuing in many cases. Just waiting for it to 'really' fail might mean we wait extremely long. If that is okay with you, just set the timeout to some very large number :-). Regards, - Jouke