-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix potential blackholing/looping traffic when link-local was used and refresh ipv6 neighbor to avoid CPU hit #1904
Changes from all commits
7ab439f
ca0f9ef
6f25dff
d7baed2
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,10 +1,28 @@ | ||
#!/bin/bash | ||
# | ||
# usage: | ||
# arp_update: Send gratuitous ARP requests to VLAN member neighbors to refresh | ||
# the neighbors state. | ||
# arp_update: | ||
# Send ipv6 multicast pings to all "UP" L3 interfaces including vlan interfaces to | ||
# refresh link-local addresses from neighbors. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. is there a concern if the vlan have many neighbors? one multicast ping will get reply from all neighbors? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. yes, by standard all neighbors should reply to ff02::1, so it will get reply from all neighbors. |
||
# Send gratuitous ARP/NDP requests to VLAN member neighbors to refresh | ||
# the ipv4/ipv6 neighbors state. | ||
|
||
while /bin/true; do | ||
# find L3 interfaces which are UP, send ipv6 multicast pings | ||
echo "{% for (name, prefix) in INTERFACE %} {{name}} {% endfor %}" > /tmp/intf_tmp.j2 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We would need to handle PORTCHANNEL_INTERFACE as well There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Done. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks Zhen. Can we concatenate INTERFACE and PC_INTERFACE and do one for-loop. It will avoid the duplicate code. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done |
||
INTERFACE=`sonic-cfggen -d -t /tmp/intf_tmp.j2` | ||
echo "{% for (name, prefix) in PORTCHANNEL_INTERFACE %} {{name}} {% endfor %}" > /tmp/pc_intf_tmp.j2 | ||
PC_INTERFACE=`sonic-cfggen -d -t /tmp/pc_intf_tmp.j2` | ||
|
||
ALL_INTERFACE="$INTERFACE $PC_INTERFACE" | ||
for intf in $ALL_INTERFACE; do | ||
ping6cmd="ping6 -I $intf -n -q -i 0 -c 1 -W 0 ff02::1 >/dev/null" | ||
intf_up=$(ip link show $intf | grep "state UP") | ||
if [[ -n "$intf_up" ]]; then | ||
eval $ping6cmd | ||
fi | ||
done | ||
|
||
VLAN=`sonic-cfggen -d -v 'VLAN.keys() | join(" ") if VLAN'` | ||
for vlan in $VLAN; do | ||
# generate a list of arping commands: | ||
|
@@ -15,6 +33,18 @@ while /bin/true; do | |
ipcmd="ip -4 neigh show | grep $vlan | cut -d ' ' -f 1,3 | $arpingcmd" | ||
|
||
eval `eval $ipcmd` | ||
|
||
# send ipv6 multicast pings to Vlan interfaces to get/refresh link-local addrs | ||
ping6cmd="ping6 -I $vlan -n -q -i 0 -c 1 -W 0 ff02::1 >/dev/null" | ||
eval $ping6cmd | ||
|
||
# generate a list of ndisc6 commands (exclude link-local addrs since it is done above): | ||
# ndisc6 -q -w 0 -1 <IP 1> <VLAN interface>; | ||
# ndisc6 -q -w 0 -1 <IP 2> <VLAN interface>; | ||
# ... | ||
ndisc6cmd="sed -e 's/^/ndisc6 -q -w 0 -1 /' -e 's/$/;/'" | ||
ip6cmd="ip -6 neigh show | grep -v fe80 | grep $vlan | cut -d ' ' -f 1,3 | $ndisc6cmd" | ||
eval `eval $ip6cmd` | ||
done | ||
sleep 300 | ||
done |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you add this into vs docker? we need to replicate same env in the vs.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done.