[PATCH network v5 03/10] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets

[Lukas Sichert <l.sichert@proxmox.com>]

EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
interface and a VRF bridge. Until now, this depended on global IPv6
forwarding state, which also changes Router Advertisement handling for
the whole host.

Enable 'force_forwarding' explicitly on the Subnet and VRF bridge using
the 'ip6-force-forward' ifupdown2 flag.

Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm                   | 8 +++++++-
 .../exitnode_local_routing_ipv6/expected_sdn_interfaces   | 2 ++
 src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces | 2 ++
 .../zones/evpn/exitnodenullroute/expected_sdn_interfaces  | 2 ++
 src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces      | 2 ++
 src/test/zones/evpn/ipv6/expected_sdn_interfaces          | 2 ++
 src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces  | 2 ++
 7 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 8a45c51..1bec8c2 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -308,7 +308,12 @@ sub generate_sdn_config {
     push @iface_config, "mtu $mtu" if $mtu;
     push @iface_config, "alias $alias" if $alias;
     push @iface_config, "ip-forward on" if $enable_forward_v4;
-    push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+    if ($enable_forward_v6) {
+        push @iface_config, "ip6-forward on";
+        push @iface_config, "ip6-force-forward on";
+    }
+
     push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
     push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
@@ -354,6 +359,7 @@ sub generate_sdn_config {
             push @forward_opts, 'ip-forward on' if $enable_forward_v4;
             if ($enable_forward_v6) {
                 push @forward_opts, 'ip6-forward on';
+                push @forward_opts, 'ip6-force-forward on';
             }
             for my $opt (@forward_opts) {
                 my $opt_absent = !grep { $_ eq $opt } @{ $config->{$brvrf} };
diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
index 02b52c1..97e0e06 100644
--- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
@@ -8,6 +8,7 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -24,6 +25,7 @@ iface vrfbr_myzone
 	mtu 1450
 	vrf vrf_myzone
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index 522a54e..ce7f86f 100644
--- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -27,6 +27,7 @@ iface myvnet2
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -44,6 +45,7 @@ iface vrfbr_myzone
 	vrf vrf_myzone
 	ip-forward on
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
index 6878397..88bb214 100644
--- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
@@ -14,6 +14,7 @@ iface myvnet
 	mtu 1450
 	ip-forward on
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -49,6 +50,7 @@ iface vrfbr_myzone
 	vrf vrf_myzone
 	ip-forward on
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfbr_myzone2
 iface vrfbr_myzone2
diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
index 0bde7a1..45d8e63 100644
--- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
@@ -11,6 +11,7 @@ iface myvnet
 	mtu 1450
 	ip-forward on
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -28,6 +29,7 @@ iface vrfbr_myzone
 	vrf vrf_myzone
 	ip-forward on
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
index 98793a1..882dd72 100644
--- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
@@ -9,6 +9,7 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -25,6 +26,7 @@ iface vrfbr_myzone
 	mtu 1450
 	vrf vrf_myzone
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
index 62f05df..98cd43f 100644
--- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
@@ -9,6 +9,7 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	ip6-force-forward on
 	arp-accept on
 	vrf vrf_myzone
 
@@ -25,6 +26,7 @@ iface vrfbr_myzone
 	mtu 1450
 	vrf vrf_myzone
 	ip6-forward on
+	ip6-force-forward on
 
 auto vrfvx_myzone
 iface vrfvx_myzone
-- 
2.47.3