sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-27 06:49:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Address review: VLAN-safe procfs path, rollback partial v6 enable, aggregate routing errors

Browse Source
This commit is contained in:
Viktor Liu
2026-05-20 13:15:15 +02:00
parent c46dee4e6b
commit c761d0d1cd
7 changed files with 50 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/routemanager/systemops/systemops_linux.go
+12 -22
View File
@@ -9,7 +9,6 @@ import (
"net"
"net/netip"
"os"
"strings"
"syscall"
"github.com/hashicorp/go-multierror"
@@ -56,11 +55,11 @@ const (
ipv4ForwardingPath = "net.ipv4.ip_forward"
// ipv6ForwardingPath is the path to the file containing the IPv6 forwarding setting.
ipv6ForwardingPath = "net.ipv6.conf.all.forwarding"
// acceptRAInterfacePath toggles per-interface IPv6 RA acceptance.
// 1 (kernel default) accepts RAs only when forwarding is off; 2 keeps
// RA processing enabled even when forwarding is on, so RA-installed host
// defaults survive our v6 forwarding flip.
acceptRAInterfacePath = "net.ipv6.conf.%s.accept_ra"
// 1 (default) accepts RAs only while forwarding is off; 2 keeps RA
// acceptance on regardless, so RA-installed host defaults survive our
// v6 forwarding flip.
acceptRAInterfacePath = "net.ipv6.conf.%s.accept_ra"
acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
)
var ErrTableIDExists = errors.New("ID exists with different name")
@@ -776,14 +775,9 @@ func EnableV4IPForwarding() error {
return nil
}
// EnableV6IPForwarding bumps accept_ra=2 on every non-loopback v6 interface
// before flipping forwarding=1, so RA-installed host defaults survive the flip.
// wgIfaceName is excluded since the overlay interface doesn't carry upstream RAs.
//
// The returned map records prior sysctl values for entries we actually changed
// (forwarding + per-interface accept_ra); DisableV6IPForwarding restores from
// it. Entries we found already at the target value are omitted so another
// process's sysctls aren't reset by our cleanup.
// EnableV6IPForwarding bumps accept_ra=2 on host v6 interfaces before flipping
// forwarding=1, so RA-installed host defaults survive. Returns the prior values
// of sysctls we actually changed; entries already at the target are omitted.
func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
saved := map[string]int{}
bumpAcceptRA(saved, wgIfaceName)
@@ -798,9 +792,7 @@ func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
return saved, nil
}
// DisableV6IPForwarding restores every sysctl value EnableV6IPForwarding
// captured. v4 is intentionally not disabled: net.ipv4.ip_forward is a global
// knob other tools (docker, k8s, libvirt) co-own.
// DisableV6IPForwarding restores what EnableV6IPForwarding captured.
func DisableV6IPForwarding(saved map[string]int) error {
var result *multierror.Error
for key, value := range saved {
@@ -827,13 +819,11 @@ func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
func bumpAcceptRAForInterface(saved map[string]int, name string) {
key := fmt.Sprintf(acceptRAInterfacePath, name)
procPath := "/proc/sys/" + strings.ReplaceAll(key, ".", "/")
if _, err := os.Stat(procPath); err != nil {
// No IPv6 stack on this interface.
// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
return
}
// onlyIfOne=true: only bump from the kernel default; preserves admin
// overrides of 0 (don't accept RAs) or 2 (already what we want).
// onlyIfOne=true: leave admin overrides (0, 2) alone.
oldVal, err := sysctl.Set(key, 2, true)
if err != nil {
log.Warnf("bump %s: %v", key, err)