[PATCH many v5 00/10] sdn: enable force_forwarding for ipv6 forwarding

[Lukas Sichert <l.sichert@proxmox.com>]

Gabriel's upstream kernel patch [1] added
net.ipv6.conf.<iface>.force_forwarding. This allows enabling IPv6
forwarding on selected interfaces without requiring
net.ipv6.conf.all.forwarding.

This is useful for SDN setups because all.forwarding has host-wide side
effects. In particular, it disables Router Advertisement processing by
default, which can break SLAAC on unrelated interfaces.

This series introduces the force_forwarding kernel flag to ifupdown2,
where it mimics the activation behaviour of the classic forwarding flag.
This means force_forwarding is only turned off for a bridge if all of
the following hold:
  - it has no upper interfaces, such as an SVI or VLAN slave interface
  - it has no address configured
  - its address method is set and it is not auto or dhcp
This is consistent with current behaviour and important for the bridges
created manually as their flags are not set by the ifupdown2 configs
generated in pve-network. This also means for a lot of bridges in the
SDN stack force_forwarding is enabled by default, still the
ip6-force-forward stanzas will be written to interfaces.d/sdn to
activate it explicitly.

The series also adds missing stanzas for ipv4 and ipv6 forwarding, where
the enabling came from ifupdown2 default behaviour only.

The tests are adjusted for the generated /etc/network/interfaces.d/sdn
output. Also the series rewrites the documentation to reflect the
updated behaviour and removes the UI warning to enable 'all.forwarding'.

Note: ifupdown2 needs to be applied first, then perl-rs, then network
(its tests render fabrics via perl-rs). Needs kernel >= 6.17, older
kernels ignore 'ip6-force-forward' with a warning.

[1] lkml.org/lkml/2025/7/7/577

Changes from v4 to v5 (thanks @Hannes):

-add flags and automated behaviour for activation of force_forwarding
  in ifupdown2
-remove the post-up/post down stanzas and use the ifupdown2 flags to 
  explicitly enable forwarding instead

changes from v3 to v4 (thanks @Stefan):
-wrap resolving outgoing interface in eval block
-remove unnecessary 'ip6-forward' for vrfbr interface
-Drop the fabric edit GUI hint that told users to enable
net.ipv6.conf.all.forwarding
-remove whitespace formatting changes

changes from v2 to v3 (thanks @Gabriel):
-Move the IPv6 force_forwarding post-up/post-down commands out of the
subnet loop, so they are generated only once for the VNet instead of
once per subnet.
-Enable ip6-forward and force_forwarding on EVPN L3VNI VRF bridge
interfaces, fixing IPv6 forwarding when traffic exits through another
node.

changes from v1 to v2 (thanks @Gabriel, @Hannes):
-add force_forwarding also to bgp fabrics
-explicitly mention the force_forwarding flag in the documentation
-add a reference link to the sysctl documentation
-mention bgp as a fabric with ipv6 support


ifupdown2:

Lukas Sichert (1):
  d/patches: add ipv6 force_forwarding for bridges

 ...set-ipv6-force_forwarding-on-bridges.patch | 197 ++++++++++++++++++
 debian/patches/series                         |   1 +
 2 files changed, 198 insertions(+)
 create mode 100644 debian/patches/pve/0017-addons-address-set-ipv6-force_forwarding-on-bridges.patch


network:

Lukas Sichert (4):
  sdn: evpn: enable ip forwarding on the vrf bridge interface
  sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
  sdn: simple: enable force_forwarding for ipv6 forwarding to subnets
  tests: sdn: update fabric expectations for explicit ipv6 forwarding

 src/PVE/Network/SDN/Zones/EvpnPlugin.pm        | 18 +++++++++++++++++-
 src/PVE/Network/SDN/Zones/SimplePlugin.pm      |  6 +++++-
 .../advertise_subnets/expected_sdn_interfaces  |  1 +
 .../evpn/auto_mode/expected_sdn_interfaces     |  1 +
 .../evpn/bgp_ebgp/expected_sdn_interfaces      |  1 +
 .../bgp_ebgp_multihop/expected_sdn_interfaces  |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../evpn/bgp_fabric/expected_sdn_interfaces    |  3 +++
 .../evpn/bgp_loopback/expected_sdn_interfaces  |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../combined_bgp_isis/expected_sdn_interfaces  |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../zones/evpn/ebgp/expected_sdn_interfaces    |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../expected_sdn_interfaces                    |  2 ++
 .../evpn/ebgp_loopback/expected_sdn_interfaces |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../expected_sdn_interfaces                    |  2 ++
 .../evpn/exitnode/expected_sdn_interfaces      |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../expected_sdn_interfaces                    |  3 +++
 .../exitnode_primary/expected_sdn_interfaces   |  1 +
 .../evpn/exitnode_snat/expected_sdn_interfaces |  4 ++++
 .../exitnodenullroute/expected_sdn_interfaces  |  5 +++++
 .../frr_local_merge/expected_sdn_interfaces    |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../zones/evpn/ipv4/expected_sdn_interfaces    |  1 +
 .../evpn/ipv4ipv6/expected_sdn_interfaces      |  4 ++++
 .../zones/evpn/ipv6/expected_sdn_interfaces    |  3 +++
 .../evpn/ipv6underlay/expected_sdn_interfaces  |  3 +++
 .../zones/evpn/isis/expected_sdn_interfaces    |  1 +
 .../evpn/isis_loopback/expected_sdn_interfaces |  1 +
 .../multipath_relax/expected_sdn_interfaces    |  1 +
 .../evpn/multiplezones/expected_sdn_interfaces |  2 ++
 .../openfabric_fabric/expected_sdn_interfaces  |  1 +
 .../expected_sdn_interfaces                    |  3 +++
 .../expected_sdn_interfaces                    |  7 +++++++
 .../evpn/ospf_fabric/expected_sdn_interfaces   |  1 +
 .../evpn/routemap/expected_sdn_interfaces      |  1 +
 .../routemap_exit_node/expected_sdn_interfaces |  1 +
 .../expected_sdn_interfaces                    |  1 +
 .../evpn/rt_import/expected_sdn_interfaces     |  1 +
 .../evpn/vxlanport/expected_sdn_interfaces     |  1 +
 .../simple/ipv4v6/expected_sdn_interfaces      |  1 +
 .../simple/ipv6snat/expected_sdn_interfaces    |  1 +
 47 files changed, 96 insertions(+), 2 deletions(-)


perl-rs:

Lukas Sichert (3):
  openfabric: set ip6-forward explicitly
  fabrics: openfabric: enable force_forwarding for ipv6 transit traffic
  fabrics: bgp: enable force_forwarding for ipv6 transit traffic

 pve-rs/src/bindings/sdn/fabrics.rs | 5 +++++
 1 file changed, 5 insertions(+)


manager:

Lukas Sichert (1):
  ui: sdn: remove IPv6 forwarding hint from fabric edit window

 www/manager6/sdn/fabrics/FabricEdit.js | 59 +++++++++-----------------
 1 file changed, 20 insertions(+), 39 deletions(-)


docs:

Lukas Sichert (1):
  sdn: drop global ipv6 forwarding workaround from docs

 pvesdn.adoc | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)


Summary over all repositories:
  52 files changed, 326 insertions(+), 61 deletions(-)

-- 
Generated by murpp 0.12.0