Ian Wienand d9ee51ef46 network: Only check kernel added routes in virNetDevIPCheckIPv6Forwarding
The original motivation for adding virNetDevIPCheckIPv6Forwarding
(commit 00d28a78b5) was that networking routes would disappear when
ipv6 forwarding was enabled for an interface.

This is a fairly undocumented side-effect of the "accept_ra" sysctl
for an interface.  1 means the interface will accept_ra's if not
forwarding, 2 means always accept_RAs; but it is not explained that
enabling forwarding when accept_ra==1 will also clear any kernel RA
assigned routes, very likely breaking your networking.

The check to warn about this currently uses netlink to go through all
the routes and then look at the accept_ra status of the interfaces.

However, it has been noticed that this problem does not affect systems
where IPv6 RA configuration is handled in userspace, e.g. via tools
such as NetworkManager.  In this case, the error message from libvirt
is spurious, and modifying the forwarding state will not affect the RA
state or disable your networking.

If you refer to the function rt6_purge_dflt_routers() in the kernel,
we can see that the routes being purged are only those with the
kernel's RTF_ADDRCONF flag set; that is, routes added by the kernel's
RA handling.  Why does it do this?  I think this is a Linux
implementation decision; it has always been like that and there are
some comments suggesting that it is because a router should be
statically configured, rather than accepting external configurations.

The solution implemented here is to convert the existing check into a
walk of /proc/net/ipv6_route (because RTF_ADDRCONF is apparently not
exposed in netlink) and look for routes with this flag set.  We then
check the accept_ra status for the interface, and if enabling
forwarding would break things raise an error.

This should hopefully avoid "interactive" users, who are likely to be
using NetworkManager and the like, having false warnings when enabling
IPv6, but retain the error check for users relying on kernel-based
IPv6 interface auto-configuration.

Signed-off-by: Ian Wienand <iwienand@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
Reviewed-by: Cedric Bosdonnat <CBosdonnat@suse.com>
2020-09-13 13:35:05 -04:00
..
2020-09-11 18:19:59 +02:00
2020-09-01 21:58:45 +02:00
2019-10-16 12:06:44 +02:00
2020-02-03 19:44:38 +01:00
2020-07-09 10:01:41 +02:00
2020-07-09 10:01:41 +02:00
2020-03-13 17:26:55 +01:00
2019-10-16 12:06:44 +02:00
2020-02-24 23:15:49 +01:00
2020-02-24 17:25:07 +00:00
2020-08-03 15:19:28 +02:00
2020-08-03 15:30:40 +02:00
2020-02-24 20:25:48 +01:00
2019-12-17 10:04:43 +01:00
2020-08-25 19:03:11 +02:00
2020-02-24 23:15:49 +01:00
2019-10-16 12:06:44 +02:00
2020-08-03 15:37:36 +02:00
2020-07-09 10:01:41 +02:00
2019-10-16 12:06:44 +02:00
2020-03-05 12:23:02 +00:00
2020-05-05 13:08:57 +02:00
2020-07-09 10:01:41 +02:00
2020-02-24 23:15:49 +01:00
2019-10-16 12:06:44 +02:00