Marek, I think I have made the necessary changes and I can see vif-route-qubes works the new way. Before sharing the result, I need to have something clarified, please.
Currently, 'ip a' shows that all interfaces have both an IPv4 and an IPv6 address. The current ruleset, through chain 'antispoof' in table 'ip6 qubes' drops all IPv6 traffic for the particular interface. Example packet: IN=vif32.0 OUT= MAC=33:33:00:00:00:16:00:16:3e:5e:6c:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=76 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 According to RFC 4890, type 143 is "traffic that must not be dropped", but it is dropped. There are other such ICMPv6 packets with different codes - also types which must not dropped but do get dropped. It is not clear how these will be handled in case one enables IPv6. I also can't figure where the DST address in the above packet comes from, as neither of the 2 qubes, between which I am testing, has that. While I am aware of https://www.qubes-os.org/doc/networking/#ipv6, it still not clear: - If IPv6 is disabled by default, why in-qube interfaces have IPv6 addresses too? - Looking at the check on line 208: does it mean that if one enables IPv6, the IPv4 antispoof chain will start dropping instead, i.e. that the IPv6 antispoof and IPv4 antispoof will "switch roles"? More specifically: is this expected and intentional? I am asking because the ingress dropping, which I implemented, is based on the same check and the result is the same (just dropped earlier, as discussed), but the concern regarding RFC 4890 remains. - Actually, I am also working separately on ICMPv6 as per RFC 4890 (which is currently not the case). Would you be interested to have a look at it too when I have it ready? I hope you can shed some light, so that I know how to proceed. -- You received this message because you are subscribed to the Google Groups "qubes-devel" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/20240426192838.739e5f75%40localhost.
