Skip to content

Skip the default route when an interface has no gateway - #831

Open
adityasingh2400 wants to merge 1 commit into
apple:mainfrom
adityasingh2400:fix-nil-gateway-default-route-825
Open

Skip the default route when an interface has no gateway#831
adityasingh2400 wants to merge 1 commit into
apple:mainfrom
adityasingh2400:fix-nil-gateway-default-route-825

Conversation

@adityasingh2400

Copy link
Copy Markdown
Contributor

The Interface protocol documents ipv4Gateway and ipv6Gateway as the address for the default route, or nil for no default route, but setupInterface logged the nil-gateway case and then called routeAddDefault anyway. The guest ended up with default dev eth0 scope link, so route lookup treated arbitrary external destinations as directly reachable on the link and started neighbor resolution for them. This also left callers with no way to build a first interface that has no default route.

This returns early when both gateways are nil and leaves every other path untouched, so a v4-only gateway, a v6-only gateway, or a gateway outside the subnet all still install the same routes as before.

The new tests drive setupInterface through a recording VirtualMachineAgent double, which covers the routing decisions without booting a sandbox. noDefaultRouteWhenBothGatewaysAreNil fails on main and passes here, and defaultRouteInstalledForIPv6OnlyGateway pins the v6-only behavior that the existing integration test testIPv6OnlyDefaultRoute exercises against a real VM.

Fixes #825

The Interface protocol documents ipv4Gateway and ipv6Gateway as the address
for the default route, or nil for no default route. setupInterface logged
the nil-gateway case and then called routeAddDefault anyway, so the guest
received an on-link default route that made every external destination look
directly reachable on the link.

Return early instead when both gateways are nil, and cover the routing
decisions with a recording VirtualMachineAgent test double so the v4-only,
v6-only, and no-gateway cases are all asserted.
@adityasingh2400

Copy link
Copy Markdown
Contributor Author

One thing worth flagging for review: vminitd's ipRouteAddDefault has a branch that deliberately installs a gatewayless v4 default route when the request carries no v4 gateway and no v6 gateway, commented as preserving pre-IPv6 behavior. I left that guest-side branch alone on purpose, so an older host talking to a newer vminitd keeps the exact behavior it has today and the wire contract does not change. The fix is host-side only, which is also where the Interface documentation lives.

Happy to move the check into the guest instead, or to gate it behind an explicit opt-in on Interface, if you would rather the compatibility path be retired at the same time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: LinuxContainer installs a link-scope default route when ipv4Gateway is nil

1 participant