Add support for IPv6 networks (on Linux clients) (#1459)

* Feat add basic support for IPv6 networks

Newly generated networks automatically generate an IPv6 prefix of size
64 within the ULA address range, devices obtain a randomly generated
address within this prefix.

Currently, this is Linux only and does not yet support all features
(routes currently cause an error).

* Fix firewall configuration for IPv6 networks

* Fix routing configuration for IPv6 networks

* Feat provide info on IPv6 support for specific client to mgmt server

* Feat allow configuration of IPv6 support through API, improve stability

* Feat add IPv6 support to new firewall implementation

* Fix peer list item response not containing IPv6 address

* Fix nftables breaking on IPv6 address change

* Fix build issues for non-linux systems

* Fix intermittent disconnections when IPv6 is enabled

* Fix test issues and make some minor revisions

* Fix some more testing issues

* Fix more CI issues due to IPv6

* Fix more testing issues

* Add inheritance of IPv6 enablement status from groups

* Fix IPv6 events not having associated messages

* Address first review comments regarding IPv6 support

* Fix IPv6 table being created even when IPv6 is disabled

Also improved stability of IPv6 route and firewall handling on client side

* Fix IPv6 routes not being removed

* Fix DNS IPv6 issues, limit IPv6 nameservers to IPv6 peers

* Improve code for IPv6 DNS server selection, add AAAA custom records

* Ensure IPv6 routes can only exist for IPv6 routing peers

* Fix IPv6 network generation randomness

* Fix a bunch of compilation issues and test failures

* Replace method calls that are unavailable in Go 1.21

* Fix nil dereference in cleanUpDefaultForwardRules6

* Fix nil pointer dereference when persisting IPv6 network in sqlite

* Clean up of client-side code changes for IPv6

* Fix nil dereference in rule mangling and compilation issues

* Add a bunch of client-side test cases for IPv6

* Fix IPv6 tests running on unsupported environments

* Fix import cycle in tests

* Add missing method SupportsIPv6() for windows

* Require IPv6 default route for IPv6 tests

* Fix panics in routemanager tests on non-linux

* Fix some more route manager tests concerning IPv6

* Add some final client-side tests

* Add IPv6 tests for management code, small fixes

* Fix linting issues

* Fix small test suite issues

* Fix linter issues and builds on macOS and Windows again

* fix builds for iOS because of IPv6 breakage

management/server/route.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"net/netip"
 	"unicode/utf8"
 
@@ -180,6 +181,25 @@ func (am *DefaultAccountManager) CreateRoute(accountID, network, peerID string,
 
 	account.Routes[newRoute.ID] = &newRoute
 
+	// IPv6 route must only be created with IPv6 enabled peers, creating an IPv6 enabled route may enable IPv6 for
+	// peers with V6Setting = Auto.
+	if peerID != "" && prefixType == route.IPv6Network && newRoute.Enabled {
+		peer := account.GetPeer(peerID)
+		if peer.V6Setting == nbpeer.V6Disabled || !peer.Meta.Ipv6Supported {
+			return nil, status.Errorf(
+				status.InvalidArgument,
+				"IPv6 must be enabled for peer %s to be used in route %s",
+				peer.Name, newPrefix.String())
+		} else if peer.IP6 == nil {
+			_, err = am.DeterminePeerV6(account, peer)
+			if err != nil {
+				return nil, err
+			}
+			account.UpdatePeer(peer)
+		}
+
+	}
+
 	account.Network.IncSerial()
 	if err = am.Store.SaveAccount(account); err != nil {
 		return nil, err
@@ -222,6 +242,16 @@ func (am *DefaultAccountManager) SaveRoute(accountID, userID string, routeToSave
 		return status.Errorf(status.InvalidArgument, "peer with ID and peer groups should not be provided at the same time")
 	}
 
+	if routeToSave.Peer != "" {
+		peer := account.GetPeer(routeToSave.Peer)
+		if peer == nil {
+			return status.Errorf(status.InvalidArgument, "provided peer does not exist")
+		}
+		if routeToSave.NetworkType == route.IPv6Network && routeToSave.Enabled && (!peer.Meta.Ipv6Supported || peer.V6Setting == nbpeer.V6Disabled) {
+			return status.Errorf(status.InvalidArgument, "peer with IPv6 disabled can't be used for IPv6 route")
+		}
+	}
+
 	if len(routeToSave.PeerGroups) > 0 {
 		err = validateGroups(routeToSave.PeerGroups, account.Groups)
 		if err != nil {
@@ -239,8 +269,49 @@ func (am *DefaultAccountManager) SaveRoute(accountID, userID string, routeToSave
 		return err
 	}
 
+	oldRoute := account.Routes[routeToSave.ID]
+
 	account.Routes[routeToSave.ID] = routeToSave
 
+	// Check if old peer's IPv6 status needs to be recalculated.
+	// Must happen if route is an IPv6 route, and either:
+	// - The routing peer has changed
+	// - The route has been disabled
+	// - (the route has been enabled) => caught in the next if-block
+	if oldRoute.Peer != "" && routeToSave.NetworkType == route.IPv6Network && ((oldRoute.Enabled && !routeToSave.Enabled) || oldRoute.Peer != routeToSave.Peer) {
+		oldPeer := account.GetPeer(oldRoute.Peer)
+		if oldPeer.V6Setting == nbpeer.V6Auto {
+			changed, err := am.DeterminePeerV6(account, oldPeer)
+			if err != nil {
+				return err
+			}
+			if changed {
+				account.UpdatePeer(oldPeer)
+			}
+		}
+	}
+	// Check if new peer's IPv6 status needs to be recalculated.
+	// Must happen if route is an IPv6 route, and either:
+	// - The routing peer has changed
+	// - The route has been enabled
+	// - (The route has been disabled) => caught in previous if-block
+	if oldRoute.Peer != "" && routeToSave.NetworkType == route.IPv6Network && routeToSave.Enabled && (!oldRoute.Enabled || oldRoute.Peer != routeToSave.Peer) {
+		newPeer := account.GetPeer(routeToSave.Peer)
+		if newPeer.V6Setting == nbpeer.V6Disabled || !newPeer.Meta.Ipv6Supported {
+			return status.Errorf(
+				status.InvalidArgument,
+				"IPv6 must be enabled for peer %s to be used in route %s",
+				newPeer.Name, routeToSave.Network.String())
+		} else if newPeer.IP6 == nil {
+			_, err = am.DeterminePeerV6(account, newPeer)
+			if err != nil {
+				return err
+			}
+			account.UpdatePeer(newPeer)
+		}
+
+	}
+
 	account.Network.IncSerial()
 	if err = am.Store.SaveAccount(account); err != nil {
 		return err
@@ -269,6 +340,21 @@ func (am *DefaultAccountManager) DeleteRoute(accountID string, routeID route.ID,
 	}
 	delete(account.Routes, routeID)
 
+	// If the route was an IPv6 route, deleting it may update the automatic IPv6 enablement status of its routing peers,
+	// check if this is the case and update accordingly.
+	if routy.Peer != "" && routy.Enabled && routy.NetworkType == route.IPv6Network {
+		oldPeer := account.GetPeer(routy.Peer)
+		if oldPeer.V6Setting == nbpeer.V6Auto {
+			changed, err := am.DeterminePeerV6(account, oldPeer)
+			if err != nil {
+				return err
+			}
+			if changed {
+				account.UpdatePeer(oldPeer)
+			}
+		}
+	}
+
 	account.Network.IncSerial()
 	if err = am.Store.SaveAccount(account); err != nil {
 		return err