Merge pull request #3874 from stgraber/network

Support disabling IPv6 RA on Incus managed networks

Author: bensmrs

doc/api-extensions.md

@@ -3391,3 +3391,8 @@ sustained counterparts and define the rate the device may reach while bursting.
 The new `limits.read.burst.length`, `limits.write.burst.length` and
 `limits.max.burst.length` keys define how long the burst rate may be
 sustained for, defaulting to one second.
+
+## `network_ipv6_ra`
+
+Adds a new `ipv6.ra` configuration key to both `bridge` and `ovn` networks,
+controlling whether IPv6 router advertisements are sent on the network.

doc/config_options.txt

@@ -3844,6 +3844,14 @@ User keys can be used in search.
 
 ```
 
+```{config:option} ipv6.ra network_bridge-common
+:condition: "IPv6 address"
+:default: "`true`"
+:shortdesc: "Whether to send IPv6 router advertisements"
+:type: "bool"
+
+```
+
 ```{config:option} ipv6.routes network_bridge-common
 :condition: "IPv6 address"
 :default: "-"
@@ -4330,6 +4338,14 @@ User keys can be used in search.
 
 ```
 
+```{config:option} ipv6.ra network_ovn-common
+:condition: "IPv6 address"
+:default: "`true`"
+:shortdesc: "Whether to send IPv6 router advertisements"
+:type: "bool"
+
+```
+
 ```{config:option} network network_ovn-common
 :shortdesc: "Uplink network to use for external network access or `none` to keep isolated"
 :type: "string"

internal/server/metadata/configuration.json

@@ -4269,6 +4269,15 @@
 							"type": "string"
 						}
 					},
+					{
+						"ipv6.ra": {
+							"condition": "IPv6 address",
+							"default": "`true`",
+							"longdesc": "",
+							"shortdesc": "Whether to send IPv6 router advertisements",
+							"type": "bool"
+						}
+					},
 					{
 						"ipv6.routes": {
 							"condition": "IPv6 address",
@@ -4837,6 +4846,15 @@
 							"type": "string"
 						}
 					},
+					{
+						"ipv6.ra": {
+							"condition": "IPv6 address",
+							"default": "`true`",
+							"longdesc": "",
+							"shortdesc": "Whether to send IPv6 router advertisements",
+							"type": "bool"
+						}
+					},
 					{
 						"network": {
 							"longdesc": "",

internal/server/network/driver_bridge.go

@@ -473,6 +473,15 @@ func (n *bridge) Validate(config map[string]string, clientType request.ClientTyp
 		//  shortdesc: Comma-separated list of IPv6 ranges to use for DHCP (FIRST-LAST format)
 		"ipv6.dhcp.ranges": validate.Optional(validate.IsListOf(validate.IsNetworkRangeV6)),
 
+		// gendoc:generate(entity=network_bridge, group=common, key=ipv6.ra)
+		//
+		// ---
+		//  type: bool
+		//  condition: IPv6 address
+		//  default: `true`
+		//  shortdesc: Whether to send IPv6 router advertisements
+		"ipv6.ra": validate.Optional(validate.IsBool),
+
 		// gendoc:generate(entity=network_bridge, group=common, key=ipv6.routes)
 		//
 		// ---
@@ -1624,7 +1633,11 @@ func (n *bridge) setup(oldConfig map[string]string) error {
 		}
 
 		// Update the dnsmasq config.
-		dnsmasqCmd = append(dnsmasqCmd, []string{fmt.Sprintf("--listen-address=%s", ipAddress.String()), "--enable-ra"}...)
+		dnsmasqCmd = append(dnsmasqCmd, fmt.Sprintf("--listen-address=%s", ipAddress.String()))
+		if util.IsTrueOrEmpty(n.config["ipv6.ra"]) {
+			dnsmasqCmd = append(dnsmasqCmd, "--enable-ra")
+		}
+
 		if n.DHCPv6Subnet() != nil {
 			if n.hasIPv6Firewall() {
 				fwOpts.FeaturesV6.ICMPDHCPDNSAccess = true
@@ -1649,10 +1662,10 @@ func (n *bridge) setup(oldConfig map[string]string) error {
 				} else {
 					dnsmasqCmd = append(dnsmasqCmd, []string{"--dhcp-range", fmt.Sprintf("%s,%s,%d,%s", dhcpalloc.GetIP(subnet, 2), dhcpalloc.GetIP(subnet, -1), subnetSize, expiry)}...)
 				}
-			} else {
+			} else if util.IsTrueOrEmpty(n.config["ipv6.ra"]) {
 				dnsmasqCmd = append(dnsmasqCmd, []string{"--dhcp-range", fmt.Sprintf("::,constructor:%s,ra-stateless,ra-names", n.name)}...)
 			}
-		} else {
+		} else if util.IsTrueOrEmpty(n.config["ipv6.ra"]) {
 			dnsmasqCmd = append(dnsmasqCmd, []string{"--dhcp-range", fmt.Sprintf("::,constructor:%s,ra-only", n.name)}...)
 		}
 

internal/server/network/driver_ovn.go

@@ -616,6 +616,15 @@ func (n *ovn) Validate(config map[string]string, clientType request.ClientType)
 		//  default: `false`
 		"ipv6.dhcp.stateful": validate.Optional(validate.IsBool),
 
+		// gendoc:generate(entity=network_ovn, group=common, key=ipv6.ra)
+		//
+		// ---
+		//  type: bool
+		//  condition: IPv6 address
+		//  default: `true`
+		//  shortdesc: Whether to send IPv6 router advertisements
+		"ipv6.ra": validate.Optional(validate.IsBool),
+
 		// gendoc:generate(entity=network_ovn, group=common, key=ipv4.nat)
 		//
 		// ---
@@ -3371,7 +3380,7 @@ func (n *ovn) setup(update bool) error {
 	}
 
 	// Set IPv6 router advertisement settings.
-	if routerIntPortIPv6Net != nil {
+	if routerIntPortIPv6Net != nil && util.IsTrueOrEmpty(n.config["ipv6.ra"]) {
 		adressMode := networkOVN.OVNIPv6AddressModeSLAAC
 		if dhcpV6Subnet != nil {
 			adressMode = networkOVN.OVNIPv6AddressModeDHCPStateless

internal/version/api.go

@@ -568,6 +568,7 @@ var APIExtensions = []string{
 	"image_locations",
 	"network_ovn_multicast",
 	"device_burst_limits",
+	"network_ipv6_ra",
 }
 
 // APIExtensionsCount returns the number of available API extensions.