ip-neighbor: do not use sas to determine NS source address 75/39675/5
authorOle Troan <otroan@employees.org>
Fri, 13 Oct 2023 07:19:45 +0000 (09:19 +0200)
committerAndrew Yourtchenko <ayourtch@gmail.com>
Mon, 16 Oct 2023 14:48:46 +0000 (14:48 +0000)
commitdbeb56d2dab0a5c86b4b61b5dccdcb997cdaef1f
tree52bd509f77f23975a2de6a7c12cc07b8f611059a
parentf68afe85a6e4d5e00fdad1af19a76eb40fdfa388
ip-neighbor: do not use sas to determine NS source address

Using the source address selection algorithm to determine the best source
of an NS for address resolution risks incompatible behavior.
It may choose a source address that is off-link to the other host.
Which may drop it.

A safer approach is to always use the link-local address as the SA.
It's recommended to pick a source that an application will later use,
as VPP is mostly a router, that rarely applies. And regardlessly we have
no mechanism to signal from an application that triggered address resolutiuon
what source address it intends to use.

Type: fix
Change-Id: I3c5de66e41505f3682767706ef1195a20e4f0e54
Signed-off-by: Ole Troan <otroan@employees.org>
src/vnet/ip-neighbor/ip6_neighbor.c
test/test_ip6.py
test/test_ip6_nd_mirror_proxy.py
test/test_nat64.py