Fix forwarding refcount lifecycle, VLAN accept_ra escaping, and hotplug RA coverage

client/internal/routemanager/ipfwdstate/ipfwdstate.go

@@ -17,6 +17,13 @@ type IPForwardingState struct {
 	v4Count int
 	v6Count int
 
+	// routingV4/routingV6 track whether the routing path currently holds a
+	// reference, so repeated EnableRouting calls (one per network-map update)
+	// hold at most one reference per family and an unpaired DisableRouting
+	// can't release references held by DNAT rules.
+	routingV4 bool
+	routingV6 bool
+
 	wgIfaceName string
 	v6Saved     map[string]int
 }
@@ -33,6 +40,51 @@ func (f *IPForwardingState) Counts() (v4, v6 int) {
 	return f.v4Count, f.v6Count
 }
 
+// RequestRouting takes the forwarding references for the routing path. It is
+// idempotent: while routing already holds a reference, further calls don't
+// increment the refcounts. A v6 sysctl failure is logged and not returned so
+// it can't take down v4 routing (the sysctl may be unwritable, e.g. read-only
+// /proc/sys or IPv6 disabled on the kernel command line); v6 is retried on the
+// next call.
+func (f *IPForwardingState) RequestRouting(v6 bool) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	if !f.routingV4 {
+		if err := f.requestV4(); err != nil {
+			return err
+		}
+		f.routingV4 = true
+	}
+
+	if !v6 || f.routingV6 {
+		return nil
+	}
+	if err := f.requestV6(); err != nil {
+		log.Warnf("enable IPv6 forwarding for routing: %v", err)
+		return nil
+	}
+	f.routingV6 = true
+	return nil
+}
+
+// ReleaseRouting releases the references RequestRouting holds. Calls without a
+// held reference are no-ops.
+func (f *IPForwardingState) ReleaseRouting() error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	if f.routingV4 {
+		f.routingV4 = false
+		f.releaseV4()
+	}
+	if f.routingV6 {
+		f.routingV6 = false
+		return f.releaseV6()
+	}
+	return nil
+}
+
 // RequestForwarding enables the family's forwarding sysctl on first request.
 func (f *IPForwardingState) RequestForwarding(v6 bool) error {
 	f.mu.Lock()
@@ -84,7 +136,17 @@ func (f *IPForwardingState) requestV6() error {
 			}
 			return fmt.Errorf("enable IPv6 forwarding: %w", err)
 		}
-		f.v6Saved = saved
+		// A failed restore on a previous release keeps its saved values; those
+		// are the true originals, so keep them over what this enable captured.
+		if f.v6Saved == nil {
+			f.v6Saved = saved
+		} else {
+			for k, v := range saved {
+				if _, ok := f.v6Saved[k]; !ok {
+					f.v6Saved[k] = v
+				}
+			}
+		}
 		log.Info("IPv6 forwarding enabled")
 	}
 	f.v6Count++
@@ -100,11 +162,13 @@ func (f *IPForwardingState) releaseV6() error {
 		return nil
 	}
 
-	saved := f.v6Saved
-	f.v6Saved = nil
-	if err := systemops.DisableV6IPForwarding(saved); err != nil {
+	// Keep the saved values on failure so a later release or enable/release
+	// cycle can still restore them; re-restoring an already-restored key is a
+	// no-op since the sysctl already holds the desired value.
+	if err := systemops.DisableV6IPForwarding(f.v6Saved); err != nil {
 		return fmt.Errorf("disable IPv6 forwarding: %w", err)
 	}
+	f.v6Saved = nil
 	log.Info("IPv6 forwarding disabled")
 	return nil
 }

client/internal/routemanager/sysctl/sysctl_linux.go

@@ -58,11 +58,7 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
-		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
-		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
-
-		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
+		i := fmt.Sprintf(rpFilterInterfacePath, EscapeInterfaceName(intf.Name))
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -74,6 +70,13 @@ func Setup(wgIface iface) (map[string]int, error) {
 	return keys, nberrors.FormatErrorOrNil(result)
 }
 
+// EscapeInterfaceName escapes '%' and '.' in an interface name (e.g. VLANs
+// like eth0.100) so the name survives the dot-to-slash conversion in Set.
+func EscapeInterfaceName(name string) string {
+	safe := strings.ReplaceAll(name, "%", percentEscape)
+	return strings.ReplaceAll(safe, ".", dotEscape)
+}
+
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
 	path := strings.ReplaceAll(key, ".", "/")

client/internal/routemanager/systemops/v6forwarding_linux.go

@@ -19,6 +19,7 @@ const (
 	// acceptance on regardless, so RA-installed host defaults survive our
 	// v6 forwarding flip.
 	acceptRAInterfacePath  = "net.ipv6.conf.%s.accept_ra"
+	acceptRADefaultPath    = "net.ipv6.conf.default.accept_ra"
 	acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
 )
 
@@ -51,6 +52,10 @@ func DisableV6IPForwarding(saved map[string]int) error {
 }
 
 func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
+	// Also bump conf.default so interfaces created while forwarding is on
+	// (hotplug, new Wi-Fi/dock) inherit accept_ra=2 and keep accepting RAs.
+	bumpAcceptRAKey(saved, acceptRADefaultPath)
+
 	interfaces, err := net.Interfaces()
 	if err != nil {
 		log.Warnf("list interfaces for accept_ra: %v", err)
@@ -65,18 +70,23 @@ func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
 }
 
 func bumpAcceptRAForInterface(saved map[string]int, name string) {
-	key := fmt.Sprintf(acceptRAInterfacePath, name)
 	// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
 	if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
 		return
 	}
+	bumpAcceptRAKey(saved, fmt.Sprintf(acceptRAInterfacePath, sysctl.EscapeInterfaceName(name)))
+}
+
+func bumpAcceptRAKey(saved map[string]int, key string) {
 	// onlyIfOne=true: leave admin overrides (0, 2) alone.
 	oldVal, err := sysctl.Set(key, 2, true)
 	if err != nil {
 		log.Warnf("bump %s: %v", key, err)
 		return
 	}
-	if oldVal != 2 {
+	// With onlyIfOne, a write only happened when the old value was 1; values
+	// left untouched (0, 2) must not be recorded for restore.
+	if oldVal == 1 {
 		saved[key] = oldVal
 	}
 }