Add support for IPv6 networks (on Linux clients) (#1459)

* Feat add basic support for IPv6 networks

Newly generated networks automatically generate an IPv6 prefix of size
64 within the ULA address range, devices obtain a randomly generated
address within this prefix.

Currently, this is Linux only and does not yet support all features
(routes currently cause an error).

* Fix firewall configuration for IPv6 networks

* Fix routing configuration for IPv6 networks

* Feat provide info on IPv6 support for specific client to mgmt server

* Feat allow configuration of IPv6 support through API, improve stability

* Feat add IPv6 support to new firewall implementation

* Fix peer list item response not containing IPv6 address

* Fix nftables breaking on IPv6 address change

* Fix build issues for non-linux systems

* Fix intermittent disconnections when IPv6 is enabled

* Fix test issues and make some minor revisions

* Fix some more testing issues

* Fix more CI issues due to IPv6

* Fix more testing issues

* Add inheritance of IPv6 enablement status from groups

* Fix IPv6 events not having associated messages

* Address first review comments regarding IPv6 support

* Fix IPv6 table being created even when IPv6 is disabled

Also improved stability of IPv6 route and firewall handling on client side

* Fix IPv6 routes not being removed

* Fix DNS IPv6 issues, limit IPv6 nameservers to IPv6 peers

* Improve code for IPv6 DNS server selection, add AAAA custom records

* Ensure IPv6 routes can only exist for IPv6 routing peers

* Fix IPv6 network generation randomness

* Fix a bunch of compilation issues and test failures

* Replace method calls that are unavailable in Go 1.21

* Fix nil dereference in cleanUpDefaultForwardRules6

* Fix nil pointer dereference when persisting IPv6 network in sqlite

* Clean up of client-side code changes for IPv6

* Fix nil dereference in rule mangling and compilation issues

* Add a bunch of client-side test cases for IPv6

* Fix IPv6 tests running on unsupported environments

* Fix import cycle in tests

* Add missing method SupportsIPv6() for windows

* Require IPv6 default route for IPv6 tests

* Fix panics in routemanager tests on non-linux

* Fix some more route manager tests concerning IPv6

* Add some final client-side tests

* Add IPv6 tests for management code, small fixes

* Fix linting issues

* Fix small test suite issues

* Fix linter issues and builds on macOS and Windows again

* fix builds for iOS because of IPv6 breakage

management/server/network.go

@@ -1,13 +1,13 @@
 package server
 
 import (
+	crand "crypto/rand"
+	"encoding/binary"
+	"github.com/c-robinson/iplib"
+	"github.com/rs/xid"
 	"math/rand"
 	"net"
 	"sync"
-	"time"
-
-	"github.com/c-robinson/iplib"
-	"github.com/rs/xid"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
@@ -20,11 +20,21 @@ const (
 	SubnetSize = 16
 	// NetSize is a global network size 100.64.0.0/10
 	NetSize = 10
+	// Subnet6Size is the size of an IPv6 subnet (in Bytes, not Bits)
+	Subnet6Size = 8
 
 	// AllowedIPsFormat generates Wireguard AllowedIPs format (e.g. 100.64.30.1/32)
 	AllowedIPsFormat = "%s/32"
+
+	// AllowedIP6sFormat generates Wireguard AllowedIPs format (e.g. 2001:db8::dead:beef/128)
+	AllowedIP6sFormat = "%s/128"
 )
 
+// Global random number generator for IP addresses
+// Accesses to the RNG must always be protected using rngLock (RNG sources are not thread-safe)
+var rng = initializeRng()
+var rngLock = sync.Mutex{}
+
 type NetworkMap struct {
 	Peers         []*nbpeer.Peer
 	Network       *Network
@@ -37,6 +47,7 @@ type NetworkMap struct {
 type Network struct {
 	Identifier string    `json:"id"`
 	Net        net.IPNet `gorm:"serializer:json"`
+	Net6       *net.IPNet `gorm:"serializer:json"` // Can't use gob serializer, as it cannot encode nil values.
 	Dns        string
 	// Serial is an ID that increments by 1 when any change to the network happened (e.g. new peer has been added).
 	// Used to synchronize state to the client apps.
@@ -45,24 +56,54 @@ type Network struct {
 	mu sync.Mutex `json:"-" gorm:"-"`
 }
 
+func initializeRng() *rand.Rand {
+	seed := make([]byte, 8)
+	_, err := crand.Read(seed)
+	if err != nil {
+		return nil
+	}
+	s := rand.NewSource(int64(binary.LittleEndian.Uint64(seed)))
+	return rand.New(s)
+}
+
 // NewNetwork creates a new Network initializing it with a Serial=0
 // It takes a random /16 subnet from 100.64.0.0/10 (64 different subnets)
-func NewNetwork() *Network {
+func NewNetwork(enableV6 bool) *Network {
 
 	n := iplib.NewNet4(net.ParseIP("100.64.0.0"), NetSize)
 	sub, _ := n.Subnet(SubnetSize)
+	rngLock.Lock()
+	intn := rng.Intn(len(sub))
+	rngLock.Unlock()
 
-	s := rand.NewSource(time.Now().Unix())
-	r := rand.New(s)
-	intn := r.Intn(len(sub))
+	var n6 *net.IPNet = nil
+	if enableV6 {
+		n6 = GenerateNetwork6()
+	}
 
 	return &Network{
 		Identifier: xid.New().String(),
 		Net:        sub[intn].IPNet,
+		Net6:       n6,
 		Dns:        "",
 		Serial:     0}
 }
 
+func GenerateNetwork6() *net.IPNet {
+	addrbuf := make([]byte, 16)
+	addrbuf[0] = 0xfd
+	addrbuf[1] = 0x00
+	addrbuf[2] = 0xb1
+	addrbuf[3] = 0x4d
+
+	rngLock.Lock()
+	_, _ = rng.Read(addrbuf[4:Subnet6Size])
+	rngLock.Unlock()
+
+	n6 := iplib.NewNet6(addrbuf, Subnet6Size*8, 0).IPNet
+	return &n6
+}
+
 // IncSerial increments Serial by 1 reflecting that the network state has been changed
 func (n *Network) IncSerial() {
 	n.mu.Lock()
@@ -81,6 +122,7 @@ func (n *Network) Copy() *Network {
 	return &Network{
 		Identifier: n.Identifier,
 		Net:        n.Net,
+		Net6:       n.Net6,
 		Dns:        n.Dns,
 		Serial:     n.Serial,
 	}
@@ -103,13 +145,38 @@ func AllocatePeerIP(ipNet net.IPNet, takenIps []net.IP) (net.IP, error) {
 	}
 
 	// pick a random IP
-	s := rand.NewSource(time.Now().Unix())
-	r := rand.New(s)
-	intn := r.Intn(len(ips))
+	rngLock.Lock()
+	intn := rng.Intn(len(ips))
+	rngLock.Unlock()
 
 	return ips[intn], nil
 }
 
+// AllocatePeerIP6 pics an available IPv6 from an net.IPNet.
+// This method considers already taken IPs and reuses IPs if there are gaps in takenIps.
+func AllocatePeerIP6(ipNet net.IPNet, takenIps []net.IP) (net.IP, error) {
+
+	takenIPMap := make(map[string]struct{})
+	takenIPMap[ipNet.IP.String()] = struct{}{}
+	for _, ip := range takenIps {
+		takenIPMap[ip.String()] = struct{}{}
+	}
+
+	maskSize, _ := ipNet.Mask.Size()
+
+	// TODO for small subnet sizes, randomly generating values until we don't get a duplicate is inefficient and could
+	// 		lead to many loop iterations, using a method similar to IPv4 would be preferable here.
+
+	addrbuf := make(net.IP, 16)
+	copy(addrbuf, ipNet.IP.To16())
+	for duplicate := true; duplicate; _, duplicate = takenIPMap[addrbuf.String()] {
+		rngLock.Lock()
+		_, _ = rng.Read(addrbuf[(maskSize / 8):16])
+		rngLock.Unlock()
+	}
+	return addrbuf, nil
+}
+
 // generateIPs generates a list of all possible IPs of the given network excluding IPs specified in the exclusion list
 func generateIPs(ipNet *net.IPNet, exclusions map[string]struct{}) ([]net.IP, int) {