sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-26 00:29:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Gate IPv6 forwarding on overlay v6 capability and preserve host RA acceptance

Browse Source
This commit is contained in:
Viktor Liu
2026-05-20 12:21:51 +02:00
parent af24fd7796
commit c46dee4e6b
10 changed files with 232 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/firewall/nftables/manager_linux.go
+18 -6
View File
@@ -105,8 +105,8 @@ func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mt
return fmt.Errorf("create v6 router: %w", err)
}
// Share the same IP forwarding state with the v4 router, since
// EnableIPForwarding controls both v4 and v6 sysctls.
// Share the per-family forwarding refcounter with the v4 router so a v4
// rule and a v6 rule against the same state machine cooperate cleanly.
m.router6.ipFwdState = m.router.ipFwdState
m.aclManager6, err = newAclManager(workTable6, wgIface, chainNameRoutingFw)
@@ -530,15 +530,27 @@ func (m *Manager) SetLogLevel(log.Level) {
}
func (m *Manager) EnableRouting() error {
if err := m.router.ipFwdState.RequestForwarding(); err != nil {
return fmt.Errorf("enable IP forwarding: %w", err)
if err := m.router.ipFwdState.RequestForwarding(false); err != nil {
return fmt.Errorf("enable IPv4 forwarding: %w", err)
}
// Only flip v6 forwarding when the WG interface actually has v6, so that
// v4-only routing setups don't disable RA acceptance on the host.
if m.router6 != nil {
if err := m.router.ipFwdState.RequestForwarding(true); err != nil {
return fmt.Errorf("enable IPv6 forwarding: %w", err)
}
}
return nil
}
func (m *Manager) DisableRouting() error {
if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
return fmt.Errorf("disable IP forwarding: %w", err)
if err := m.router.ipFwdState.ReleaseForwarding(false); err != nil {
return fmt.Errorf("disable IPv4 forwarding: %w", err)
}
if m.router6 != nil {
if err := m.router.ipFwdState.ReleaseForwarding(true); err != nil {
return fmt.Errorf("disable IPv6 forwarding: %w", err)
}
}
return nil
}