Add support for IPv6 networks (on Linux clients) (#1459)

* Feat add basic support for IPv6 networks

Newly generated networks automatically generate an IPv6 prefix of size
64 within the ULA address range, devices obtain a randomly generated
address within this prefix.

Currently, this is Linux only and does not yet support all features
(routes currently cause an error).

* Fix firewall configuration for IPv6 networks

* Fix routing configuration for IPv6 networks

* Feat provide info on IPv6 support for specific client to mgmt server

* Feat allow configuration of IPv6 support through API, improve stability

* Feat add IPv6 support to new firewall implementation

* Fix peer list item response not containing IPv6 address

* Fix nftables breaking on IPv6 address change

* Fix build issues for non-linux systems

* Fix intermittent disconnections when IPv6 is enabled

* Fix test issues and make some minor revisions

* Fix some more testing issues

* Fix more CI issues due to IPv6

* Fix more testing issues

* Add inheritance of IPv6 enablement status from groups

* Fix IPv6 events not having associated messages

* Address first review comments regarding IPv6 support

* Fix IPv6 table being created even when IPv6 is disabled

Also improved stability of IPv6 route and firewall handling on client side

* Fix IPv6 routes not being removed

* Fix DNS IPv6 issues, limit IPv6 nameservers to IPv6 peers

* Improve code for IPv6 DNS server selection, add AAAA custom records

* Ensure IPv6 routes can only exist for IPv6 routing peers

* Fix IPv6 network generation randomness

* Fix a bunch of compilation issues and test failures

* Replace method calls that are unavailable in Go 1.21

* Fix nil dereference in cleanUpDefaultForwardRules6

* Fix nil pointer dereference when persisting IPv6 network in sqlite

* Clean up of client-side code changes for IPv6

* Fix nil dereference in rule mangling and compilation issues

* Add a bunch of client-side test cases for IPv6

* Fix IPv6 tests running on unsupported environments

* Fix import cycle in tests

* Add missing method SupportsIPv6() for windows

* Require IPv6 default route for IPv6 tests

* Fix panics in routemanager tests on non-linux

* Fix some more route manager tests concerning IPv6

* Add some final client-side tests

* Add IPv6 tests for management code, small fixes

* Fix linting issues

* Fix small test suite issues

* Fix linter issues and builds on macOS and Windows again

* fix builds for iOS because of IPv6 breakage

management/server/peer.go

@@ -3,6 +3,7 @@ package server
 import (
 	"fmt"
 	"net"
+	"slices"
 	"strings"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/status"
+	nbroute "github.com/netbirdio/netbird/route"
 )
 
 // PeerSync used as a data object between the gRPC API and AccountManager on Sync request.
@@ -140,7 +142,66 @@ func (am *DefaultAccountManager) MarkPeerConnected(peerPubKey string, connected
 	return nil
 }
 
-// UpdatePeer updates peer. Only Peer.Name, Peer.SSHEnabled, and Peer.LoginExpirationEnabled can be updated.
+// Determines the current IPv6 status of the peer (including checks for inheritance) and generates a new or removes an
+// existing IPv6 address if necessary.
+// Additionally, disables IPv6 routes if peer no longer has an IPv6 address.
+// Note that this change does not get persisted here.
+//
+// Returns a boolean that indicates whether the peer and/or the account changed and needs to be updated in the data
+// source.
+func (am *DefaultAccountManager) DeterminePeerV6(account *Account, peer *nbpeer.Peer) (bool, error) {
+	v6Setting := peer.V6Setting
+	if peer.V6Setting == nbpeer.V6Auto {
+		if peer.Meta.Ipv6Supported {
+			for _, group := range account.Groups {
+				if group.IPv6Enabled && slices.Contains(group.Peers, peer.ID) {
+					v6Setting = nbpeer.V6Enabled
+					break
+				}
+			}
+			if v6Setting == nbpeer.V6Auto {
+				for _, route := range account.Routes {
+					if route.Peer == peer.ID && route.NetworkType == nbroute.IPv6Network {
+						v6Setting = nbpeer.V6Enabled
+						break
+					}
+				}
+			}
+		}
+
+		if v6Setting == nbpeer.V6Auto {
+			v6Setting = nbpeer.V6Disabled
+		}
+	}
+
+	if v6Setting == nbpeer.V6Enabled && peer.IP6 == nil {
+		if !peer.Meta.Ipv6Supported {
+			return false, status.Errorf(status.PreconditionFailed, "failed allocating new IPv6 for peer %s - peer does not support IPv6", peer.Name)
+		}
+		if account.Network.Net6 == nil {
+			account.Network.Net6 = GenerateNetwork6()
+		}
+		v6tmp, err := AllocatePeerIP6(*account.Network.Net6, account.getTakenIP6s())
+		if err != nil {
+			return false, err
+		}
+		peer.IP6 = &v6tmp
+		return true, nil
+	} else if v6Setting == nbpeer.V6Disabled && peer.IP6 != nil {
+		peer.IP6 = nil
+
+		for _, route := range account.Routes {
+			if route.NetworkType == nbroute.IPv6Network {
+				route.Enabled = false
+				account.Routes[route.ID] = route
+			}
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// UpdatePeer updates peer. Only Peer.Name, Peer.SSHEnabled, Peer.V6Setting and Peer.LoginExpirationEnabled can be updated.
 func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
 	unlock := am.Store.AcquireAccountWriteLock(accountID)
 	defer unlock()
@@ -160,6 +221,20 @@ func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nb
 		return nil, err
 	}
 
+	if peer.V6Setting != update.V6Setting {
+		peer.V6Setting = update.V6Setting
+		prevV6 := peer.IP6
+		v6StatusChanged, err := am.DeterminePeerV6(account, peer)
+		if err != nil {
+			return nil, err
+		}
+		if v6StatusChanged && peer.IP6 != nil {
+			am.StoreEvent(userID, peer.IP6.String(), account.Id, activity.PeerIPv6Enabled, peer.EventMeta(am.GetDNSDomain()))
+		} else if v6StatusChanged && peer.IP6 == nil {
+			am.StoreEvent(userID, prevV6.String(), account.Id, activity.PeerIPv6Disabled, peer.EventMeta(am.GetDNSDomain()))
+		}
+	}
+
 	if peer.SSHEnabled != update.SSHEnabled {
 		peer.SSHEnabled = update.SSHEnabled
 		event := activity.PeerSSHEnabled
@@ -431,6 +506,7 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		Key:                    peer.Key,
 		SetupKey:               upperKey,
 		IP:                     nextIp,
+		IP6:                    nil,
 		Meta:                   peer.Meta,
 		Name:                   peer.Meta.Hostname,
 		DNSLabel:               newLabel,
@@ -443,6 +519,7 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		LoginExpirationEnabled: addedByUser,
 		Ephemeral:              ephemeral,
 		Location:               peer.Location,
+		V6Setting:              peer.V6Setting, // empty string "" corresponds to "auto"
 	}
 
 	// add peer to 'All' group
@@ -475,6 +552,11 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 
 	newPeer = am.integratedPeerValidator.PreparePeer(account.Id, newPeer, account.GetPeerGroupsList(newPeer.ID), account.Settings.Extra)
 
+	_, err = am.DeterminePeerV6(account, newPeer)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	if addedByUser {
 		user, err := account.FindUser(userID)
 		if err != nil {
@@ -676,6 +758,14 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 		shouldStoreAccount = true
 	}
 
+	updated, err = am.DeterminePeerV6(account, peer)
+	if err != nil {
+		return nil, nil, err
+	}
+	if updated {
+		shouldStoreAccount = true
+	}
+
 	peer, err = am.checkAndUpdatePeerSSHKey(peer, account, login.SSHKey)
 	if err != nil {
 		return nil, nil, err