IPoE session replies to IPv6 ICMP echo-request for non-assigned addresses.

[jcpvdm]

Describe the bug

IPoE session replies to IPv6 ICMP echo-request for non-assigned addresses.

To Reproduce

Version (bngblaster -v):

Version: DEV
Compiler: GNU (11.4.0)
IO Modes: packet_mmap_raw (default), packet_mmap, raw

JSON configuration:

{
    "interfaces": {
        "access": [
            {
                "interface": "vethb",
                "type": "ipoe",
                "stream-group-id": 1,
                "vlan-mode": "N:1"
            }
        ]
    },
    "access-line": {
        "agent-remote-id": "DEU.RTBRICK.{session-global}",
        "agent-circuit-id": "0.0.0.0/0.0.0.0 eth 0:{session-global}"
    },
    "dhcp": {
        "enable": true,
        "release-retry": 0,
        "keep-address": true
    },
    "dhcpv6": {
        "enable": true,
        "ia-pd": false,
        "ia-na": true
    },
    "sessions": {
        "count": 1,
        "reconnect": true
    },
    "ipoe": {
        "ipv6": true,
        "ipv4": false
    }
}

Steps to reproduce the behavior:

1. run bngblaster. wait for session to establish.
2. perform session-restart, so a different lease is obtained: bngblaster-cli /run.sock session-restart
3. observe the previously assigned ipv6 is still reachable for a brief time (until ND entry expires on the host).
4. another way to see the issue is to configure a static ND to a non-assigned ipv6 address pointing to the session mac-address. sudo ip -6 neighbor add 2001:db8:1::123 lladdr 02:00:00:00:00:01 dev vetha. ping always succeed.

Expected behavior

session should not reply to icmp echo requests for non-assigned addresses.

[GIC-de]

This is actually the expected behavior required to test framed-routes, which are typically not signaled and therefore we accept all requests as long as MAC address is correct.

We could add an optional feature/configuration to respond only on assigned addresses.