Add support for IPv6 networks (on Linux clients) (#1459)

* Feat add basic support for IPv6 networks

Newly generated networks automatically generate an IPv6 prefix of size
64 within the ULA address range, devices obtain a randomly generated
address within this prefix.

Currently, this is Linux only and does not yet support all features
(routes currently cause an error).

* Fix firewall configuration for IPv6 networks

* Fix routing configuration for IPv6 networks

* Feat provide info on IPv6 support for specific client to mgmt server

* Feat allow configuration of IPv6 support through API, improve stability

* Feat add IPv6 support to new firewall implementation

* Fix peer list item response not containing IPv6 address

* Fix nftables breaking on IPv6 address change

* Fix build issues for non-linux systems

* Fix intermittent disconnections when IPv6 is enabled

* Fix test issues and make some minor revisions

* Fix some more testing issues

* Fix more CI issues due to IPv6

* Fix more testing issues

* Add inheritance of IPv6 enablement status from groups

* Fix IPv6 events not having associated messages

* Address first review comments regarding IPv6 support

* Fix IPv6 table being created even when IPv6 is disabled

Also improved stability of IPv6 route and firewall handling on client side

* Fix IPv6 routes not being removed

* Fix DNS IPv6 issues, limit IPv6 nameservers to IPv6 peers

* Improve code for IPv6 DNS server selection, add AAAA custom records

* Ensure IPv6 routes can only exist for IPv6 routing peers

* Fix IPv6 network generation randomness

* Fix a bunch of compilation issues and test failures

* Replace method calls that are unavailable in Go 1.21

* Fix nil dereference in cleanUpDefaultForwardRules6

* Fix nil pointer dereference when persisting IPv6 network in sqlite

* Clean up of client-side code changes for IPv6

* Fix nil dereference in rule mangling and compilation issues

* Add a bunch of client-side test cases for IPv6

* Fix IPv6 tests running on unsupported environments

* Fix import cycle in tests

* Add missing method SupportsIPv6() for windows

* Require IPv6 default route for IPv6 tests

* Fix panics in routemanager tests on non-linux

* Fix some more route manager tests concerning IPv6

* Add some final client-side tests

* Add IPv6 tests for management code, small fixes

* Fix linting issues

* Fix small test suite issues

* Fix linter issues and builds on macOS and Windows again

* fix builds for iOS because of IPv6 breakage

management/server/group.go

@@ -149,6 +149,35 @@ func (am *DefaultAccountManager) SaveGroup(accountID, userID string, newGroup *n
 	oldGroup, exists := account.Groups[newGroup.ID]
 	account.Groups[newGroup.ID] = newGroup
 
+	// Determine peer difference for group.
+	addedPeers := make([]string, 0)
+	removedPeers := make([]string, 0)
+	if exists {
+		addedPeers = difference(newGroup.Peers, oldGroup.Peers)
+		removedPeers = difference(oldGroup.Peers, newGroup.Peers)
+	} else {
+		addedPeers = append(addedPeers, newGroup.Peers...)
+	}
+
+	// Need to check whether IPv6 status has changed for all potentially affected peers.
+	peersToUpdate := make([]string, 0)
+	// If group previously had IPv6 enabled, need to check all old peers for changes in IPv6 status.
+	if exists && oldGroup.IPv6Enabled {
+		peersToUpdate = removedPeers
+	}
+	// If group IPv6 status changed, need to check all current peers, if it did not, but IPv6 is enabled, only check
+	// added peers, otherwise check no peers (as group can not affect IPv6 state).
+	if exists && oldGroup.IPv6Enabled != newGroup.IPv6Enabled {
+		peersToUpdate = append(peersToUpdate, newGroup.Peers...)
+	} else if newGroup.IPv6Enabled {
+		peersToUpdate = append(peersToUpdate, addedPeers...)
+	}
+
+	_, err = am.updatePeerIPv6Status(account, userID, newGroup, peersToUpdate)
+	if err != nil {
+		return err
+	}
+
 	account.Network.IncSerial()
 	if err = am.Store.SaveAccount(account); err != nil {
 		return err
@@ -158,13 +187,7 @@ func (am *DefaultAccountManager) SaveGroup(accountID, userID string, newGroup *n
 
 	// the following snippet tracks the activity and stores the group events in the event store.
 	// It has to happen after all the operations have been successfully performed.
-	addedPeers := make([]string, 0)
-	removedPeers := make([]string, 0)
-	if exists {
-		addedPeers = difference(newGroup.Peers, oldGroup.Peers)
-		removedPeers = difference(oldGroup.Peers, newGroup.Peers)
-	} else {
-		addedPeers = append(addedPeers, newGroup.Peers...)
+	if !exists {
 		am.StoreEvent(userID, newGroup.ID, accountID, activity.GroupCreated, newGroup.EventMeta())
 	}
 
@@ -314,6 +337,14 @@ func (am *DefaultAccountManager) DeleteGroup(accountId, userId, groupID string)
 
 	delete(account.Groups, groupID)
 
+	// Update IPv6 status of all group members if necessary.
+	if g.IPv6Enabled {
+		_, err = am.updatePeerIPv6Status(account, userId, g, g.Peers)
+		if err != nil {
+			return err
+		}
+	}
+
 	account.Network.IncSerial()
 	if err = am.Store.SaveAccount(account); err != nil {
 		return err
@@ -345,6 +376,7 @@ func (am *DefaultAccountManager) ListGroups(accountID string) ([]*nbgroup.Group,
 }
 
 // GroupAddPeer appends peer to the group
+// TODO Question for devs: Is this method dead code? I can't seem to find any usages outside of tests...
 func (am *DefaultAccountManager) GroupAddPeer(accountID, groupID, peerID string) error {
 	unlock := am.Store.AcquireAccountWriteLock(accountID)
 	defer unlock()
@@ -368,6 +400,14 @@ func (am *DefaultAccountManager) GroupAddPeer(accountID, groupID, peerID string)
 	}
 	if add {
 		group.Peers = append(group.Peers, peerID)
+
+		if group.IPv6Enabled {
+			// Update IPv6 status of added group member.
+			_, err = am.updatePeerIPv6Status(account, "", group, []string{peerID})
+			if err != nil {
+				return err
+			}
+		}
 	}
 
 	account.Network.IncSerial()
@@ -381,6 +421,7 @@ func (am *DefaultAccountManager) GroupAddPeer(accountID, groupID, peerID string)
 }
 
 // GroupDeletePeer removes peer from the group
+// TODO Question for devs: Same as above, this seems like dead code
 func (am *DefaultAccountManager) GroupDeletePeer(accountID, groupID, peerID string) error {
 	unlock := am.Store.AcquireAccountWriteLock(accountID)
 	defer unlock()
@@ -399,6 +440,15 @@ func (am *DefaultAccountManager) GroupDeletePeer(accountID, groupID, peerID stri
 	for i, itemID := range group.Peers {
 		if itemID == peerID {
 			group.Peers = append(group.Peers[:i], group.Peers[i+1:]...)
+
+			if group.IPv6Enabled {
+				// Update IPv6 status of deleted group member.
+				_, err = am.updatePeerIPv6Status(account, "", group, []string{peerID})
+				if err != nil {
+					return err
+				}
+			}
+
 			if err := am.Store.SaveAccount(account); err != nil {
 				return err
 			}
@@ -409,3 +459,24 @@ func (am *DefaultAccountManager) GroupDeletePeer(accountID, groupID, peerID stri
 
 	return nil
 }
+
+func (am *DefaultAccountManager) updatePeerIPv6Status(account *Account, userID string, group *nbgroup.Group, peersToUpdate []string) (bool, error) {
+	updated := false
+	for _, peer := range peersToUpdate {
+		peerObj := account.GetPeer(peer)
+		update, err := am.DeterminePeerV6(account, peerObj)
+		if err != nil {
+			return false, err
+		}
+		if update {
+			updated = true
+			account.UpdatePeer(peerObj)
+			if peerObj.IP6 != nil {
+				am.StoreEvent(userID, group.ID, account.Id, activity.PeerIPv6InheritEnabled, group.EventMeta())
+			} else {
+				am.StoreEvent(userID, group.ID, account.Id, activity.PeerIPv6InheritDisabled, group.EventMeta())
+			}
+		}
+	}
+	return updated, nil
+}