XPost: linux.debian.bugs.dist   
   From: g.djavadyan@gmail.com   
      
   Package: linux-image-amd64   
   Version: 6.12.48-1   
      
   Dear Debian Linux Kernel Maintainers,   
      
   I noticed that the ipv6_route flags RTF_ADDRCONF and RTF_PREFIX_RT are   
   not cleared when static on-link routes are added during IPv6 address   
   configuration, and it leads to situations when the kernel updates the   
   static on-link routes with expiration time.   
      
   To replicate the problem I used the latest Debian 13.1 distribution   
   with the kernel 6.12.48-1 and radvd (on the second machine) with the   
   following configuration:   
      
   root@localhost:~# cat /etc/debian_version   
   13.1   
      
   root@localhost:~# uname -a   
   Linux localhost 6.12.48+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian   
   6.12.48-1 (2025-09-20) x86_64 GNU/Linux   
      
   radvd.conf (on a directly connected machine):   
   interface veth1   
   {   
           AdvSendAdvert on;   
           MinRtrAdvInterval 45;   
           MaxRtrAdvInterval 60;   
           AdvDefaultLifetime 0;   
           AdvDefaultPreference low;   
           AdvHomeAgentFlag off;   
           prefix fd00::/64   
           {   
                   AdvOnLink on;   
                   AdvAutonomous on;   
                   AdvRouterAddr off;   
                   AdvPreferredLifetime 60;   
                   AdvValidLifetime 120;   
           };   
   };   
      
      
   When I first add a manual IPv6 address to the interface receiving   
   ICMPv6 RA packets and then receive an ICMPv6 RA with the same on-link   
   prefix, the packet is silently ignored and no ipv6_route flags,   
   including RTF_EXPIRES, get set on the static route. Everything works as   
   expected.   
      
   However, if an ICMPv6 RA is received before a manual IPv6 address is   
   set on the interface, and the RA route is installed in the IPv6 route   
   table, along with the ipv6_route flags RTF_ADDRCONF, RTF_PREFIX_RT, and   
   RTF_EXPIRES, only the flag RTF_EXPIRES gets cleared when a manual IPv6   
   address is configured on the interface later. As a result, after   
   configuring the IPv6 address, it does not have any associated   
   expiration time, but the kernel still treats it as an RA-learned route,   
   so the next received RA packet sets the expiration time again.   
      
   Below are the steps leading to the described issue:   
      
      
   # RAs are accepted by the inteface ens4   
   root@localhost:~# cat /proc/sys/net/ipv6/conf/ens4/accept_ra   
   1   
      
      
   # Nothing is assigned to ens4 yet   
   root@localhost:~# ip -6 addr show dev ens4   
   root@localhost:~# ip -6 ro show dev ens4   
   root@localhost:~#   
      
      
   # No fd00::/64 routes are present in the IPv6 route table   
   root@localhost:~# egrep '^fd0+\ ' /proc/net/ipv6_route   
   root@localhost:~#   
      
      
   # Received on-link prefix fd00::/64 from the router   
   root@localhost:~# tcpdump -vi ens4 'icmp6[0] = 134'   
   tcpdump: listening on ens4, link-type EN10MB (Ethernet), snapshot   
   length 262144 bytes   
      
   20:41:57.733151 IP6 (flowlabel 0x15aa0, hlim 255, next-header ICMPv6   
   (58) payload length: 56) fe80::f83a:f0ff:fe69:27d2 > ip6-allnodes:   
   [icmp6 sum ok] ICMP6, router advertisement, length 56   
           hop limit 64, Flags [none], pref low, router lifetime 0s,   
   reachable time 0ms, retrans timer 0ms   
             prefix info option (3), length 32 (4): fd00::/64, Flags   
   [onlink, auto], valid time 120s, pref. time 60s   
             source link-address option (1), length 8 (1):   
   fa:3a:f0:69:27:d2   
          
              
   # The RA route is installed in the ipv6_route structure with the flags   
   0x004c0001   
   # 0x4c: RTF_ADDRCONF, RTF_PREFIX_RT, and RTF_EXPIRES   
   root@localhost:~# egrep '^fd0+\ ' /proc/net/ipv6_route   
   fd000000000000000000000000000000 40 00000000000000000000000000000000 00   
   00000000000000000000000000000000 00000100 00000002 00000000 004c0001     
   ens4   
      
      
   # The route has an expiration time assigned as expected   
   root@localhost:~# ip -6 ro show dev ens4   
   fd00::/64 proto kernel metric 256 expires 88sec pref medium   
      
      
   # Now, the manual IPv6 address from the subnet fd00::/64 is configured   
   on the interface   
   root@localhost:~# ip addr add fd00::2/64 dev ens4   
   root@localhost:~# ip -6 addr show dev ens4   
   3: ens4:  mtu 1500 qdisc fq_codel   
   state UP group default qlen 1000   
       altname enp0s4   
       altname enx525400123457   
       inet6 fd00::2/64 scope global   
          valid_lft forever preferred_lft forever   
       inet6 fd00::5054:ff:fe12:3457/64 scope global dynamic mngtmpaddr   
   proto kernel_ra   
          valid_lft 88sec preferred_lft 28sec   
      
      
   # The ipv6_route entry for fd00::/64 gets updated: the flags are   
   changed to 0x000c0001.   
   # 0x0c: RTF_ADDRCONF, RTF_PREFIX_RT   
   # The flag RTF_EXPIRES is removed but the RA-specific flags   
   RTF_ADDRCONF, RTF_PREFIX_RT are still set.   
   root@localhost:~# egrep '^fd0+\ ' /proc/net/ipv6_route   
   fd000000000000000000000000000000 40 00000000000000000000000000000000 00   
   00000000000000000000000000000000 00000100 00000001 00000000 000c0001     
   ens4   
      
      
   # From user's perspective the on-link route looks permanent, no   
   expiration time is present   
   root@localhost:~# ip -6 ro show dev ens4   
   fd00::/64 proto kernel metric 256 pref medium   
      
      
   # Next RA packet has come at this point   
      
      
   # And the permanent route turned into a temporary one again   
   (0x004c0001)   
   root@localhost:~# egrep '^fd0+\ ' /proc/net/ipv6_route   
      
   [continued in next message]   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)