Merge pull request #959 from kernelkit/ipv6-fwd

2026-08-01 21:33:02 +02:00 · 2025-02-25 18:42:32 +01:00
parent 888f0c4207 b9f3254ba7
commit a960267c40
4 changed files with 74 additions and 26 deletions
@@ -2,10 +2,15 @@
 net.ipv6.route.max_size=131072
 net.ipv6.conf.all.ignore_routes_with_linkdown=1

-# IP Routing
-net.ipv6.conf.all.forwarding=1
+# IP Routing is disabled by default, enabled globally, and per
+# interface, for each interface in confd.  See also accept_ra.
+net.ipv6.conf.all.forwarding=0
 net.ipv6.conf.default.forwarding=0

+# Accept router advertisements even when forwarding is enabled
+net.ipv6.conf.all.accept_ra=2
+net.ipv6.conf.default.accept_ra=2
+
 # IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
@@ -14,6 +14,8 @@ All notable changes to the project are documented in this file.
 - Add support for the [i.MX 8M Plus EVK][EVK]
 - YANG type change for SSH private/public keys, from ietf-crypto-types
   to infix-crypto-types
+ - Disable global IPv6 forwarding by default, enable by per-interface
+   setting.  Note, route advertisements are always accepted.  Issue #785
 - Drop automatic default route (interface route) for IPv4 autoconf, not
   necessary and causes more confusion than good.  Issue #923

@@ -1059,7 +1059,7 @@ The resulting address (10.1.2.100/24) is of type *dhcp*.
 The (only) way to disable IPv6 link-local addresses is by disabling IPv6
 on the interface.

-```(disabling
+```
 admin@example:/> configure
 admin@example:/config/> edit interface eth0 ipv6
 admin@example:/config/interface/eth0/ipv6/> set enabled false
@@ -1173,33 +1173,38 @@ have changed type to *random*.
 To be able to route (static or dynamic) on the interface it is
 required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
-   ```
-   admin@example:/config/> edit interface eth0
-   admin@example:/config/interface/eth0/> set ipv4 forwarding
-   admin@example:/config/interface/eth0/> leave
-   admin@example:/>
-   ```
+
+```
+admin@example:/config/> edit interface eth0
+admin@example:/config/interface/eth0/> set ipv4 forwarding
+admin@example:/config/interface/eth0/> leave
+admin@example:/>
+```


 ### IPv6 forwarding

-This flag behaves totally different than for IPv4. For IPv6 the
-ability to route between interfaces is always enabled, instead this
-flag controls if the interface will be in host/router mode.
+Due to how the Linux kernel manages IPv6 forwarding, we can not fully
+control it per interface via this setting like how IPv4 works.  Instead,
+IPv6 forwarding is globally enabled when at least one interface enable
+forwarding, otherwise it is disabled.

-| **Feature**                              | **Forward enabled** | **Forward disabled** |
-|:-----------------------------------------|:--------------------|:---------------------|
-| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
-| Transmit Router Solicitations            | No                  | Yes                  |
-| Router Advertisements are ignored        | No                  | Yes                  |
-| Accept Redirects                         | No                  | Yes                  |
+The following table shows the system IPv6 features that the `forwarding`
+setting control when it is *Enabled* or *Disabled:

-   ```
-   admin@example:/config/> edit interface eth0
-   admin@example:/config/interface/eth0/> set ipv6 forwarding
-   admin@example:/config/interface/eth0/> leave
-   admin@example:/>
-   ```
+| **IPv6 Feature**                         | **Enabled** | **Disabled** |
+|:-----------------------------------------|:------------|:-------------|
+| IsRouter set in Neighbour Advertisements | Yes         | No           |
+| Transmit Router Solicitations            | No          | Yes          |
+| Router Advertisements are ignored        | Yes         | Yes          |
+| Accept Redirects                         | No          | Yes          |
+
+```
+admin@example:/config/> edit interface eth0
+admin@example:/config/interface/eth0/> set ipv6 forwarding
+admin@example:/config/interface/eth0/> leave
+admin@example:/>
+```


 ## Routing support
@@ -350,6 +350,39 @@ skip_mtu:
 	return err;
 }

+/*
+ * The global IPv6 forwarding lever is off by default, enabled when any
+ * interface has IPv6 forwarding enabled.
+ */
+static int netdag_ipv6_forwarding(struct lyd_node *cifs, struct dagger *net)
+{
+	struct lyd_node *cif;
+	FILE *sysctl = NULL;
+	int ena = 0;
+
+	LYX_LIST_FOR_EACH(cifs, cif, "interface")
+		ena |= lydx_is_enabled(lydx_get_child(cif, "ipv6"), "forwarding");
+
+	if (ena)
+		sysctl = dagger_fopen_next(net, "init", "@post", NETDAG_INIT_POST, "ipv6.sysctl");
+	else
+		sysctl = dagger_fopen_current(net, "exit", "@pre", NETDAG_EXIT_PRE, "ipv6.sysctl");
+	if (!sysctl) {
+		/*
+		 * Cannot create exit code in gen: -1.  Safe to ignore
+		 * since ipv6 forwarding is disabled by default.
+		 */
+		if (dagger_is_bootstrap(net) && !ena)
+			return 0;
+		return -EIO;
+	}
+
+	fprintf(sysctl, "net.ipv6.conf.all.forwarding = %d\n", ena);
+	fclose(sysctl);
+
+	return 0;
+}
+
 static int dummy_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
 {
 	const char *ifname = lydx_get_cattr(cif, "name");
@@ -707,7 +740,10 @@ static sr_error_t netdag_init(sr_session_ctx_t *session, struct dagger *net,
 static sr_error_t ifchange_post(sr_session_ctx_t *session, struct dagger *net,
 				struct lyd_node *cifs, struct lyd_node *difs)
 {
-	int err;
+	int err = 0;
+
+	/* Figure out value of global IPv6 forwarding flag. Issue #785 */
+	err |= netdag_ipv6_forwarding(cifs, net);

 	/* For each configured bridge, the corresponding multicast
 	 * querier settings depend on both the bridge config and on
@@ -717,7 +753,7 @@ static sr_error_t ifchange_post(sr_session_ctx_t *session, struct dagger *net,
 	 * regenerate the full config for mcd every time by walking
 	 * the full configuration.
 	 */
-	err = bridge_mcd_gen(cifs);
+	err |= bridge_mcd_gen(cifs);

 	/* Whenever at least one bridge has spanning tree enabled,
 	 * start mstpd; otherwise, stop it.