Page MenuHomeVyOS Platform

'set system option performance throughput' enables IPv6 forwarding even if it's explicitly disabled with 'set system ipv6 disable-forwarding'
In progress, NormalPublicBUG

Description

Commands 'set system ipv6 disable-forwarding' and 'set system option performance throughput' are mutually exclusive

At first

set system ipv6 disable-forwarding

Result from sysctl

net.ipv6.conf.all.forwarding = 0

Next

set system option performance throughput

Result from sysctl

net.ipv6.conf.all.forwarding = 1

From my investigation command 'set system option performance throughput' runs 'tuned-adm profile network-throughput'. It enables ipv6 forwarding.

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.4-rolling-202309040919
Why the issue appeared?
Issues in third-party code
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

Related task T2133
I guess we should drop this option ipv6 disable-forwarding

I think that would be a bad idea comparing to other vendors where you can select if you want to do IPv4 routing and/or IPv6 routing. If both are disabled the device will only do switching/bridging.

For example in a IPv4 only environment you want to disable IPv6 forwarding (aka routing) to block any devices who by default (today) have both IPv4 and IPv6 enabled.

A workaround is of course to add firewall rules to block one or the other but the kernel setting net.ipv4.conf.all.forwarding and net.ipv6.conf.all.forwarding enable/disable this at the kernel level.

Question is rather why tuned-adm profile network-throughput is enabling IPv6 routing?

That is what should be dropped instead.

Viacheslav triaged this task as Normal priority.Jan 20 2024, 1:18 PM

I agree with @Apachez: people should be able to disable IPv4 or IPv6 forwarding if they feel like it. For example, a router used exclusively as a looking glass or a load balancer arguably shouldn't forward any packets on L3.

Can we fix tuned-adm profile without forking tuned?

dmbaturin renamed this task from Commands 'set system ipv6 disable-forwarding' and 'set system option performance throughput' are mutually exclusive to 'set system option performance throughput' enabled IPv6 forwarding even if it's explicitly disabled with 'set system ipv6 disable-forwarding'.Wed, Jul 3, 6:15 PM
dmbaturin renamed this task from 'set system option performance throughput' enabled IPv6 forwarding even if it's explicitly disabled with 'set system ipv6 disable-forwarding' to 'set system option performance throughput' enables IPv6 forwarding even if it's explicitly disabled with 'set system ipv6 disable-forwarding'.
dmbaturin assigned this task to natali-rs1985.
dmbaturin changed Why the issue appeared? from Will be filled on close to Issues in third-party code.
natali-rs1985 changed the task status from Open to In progress.Thu, Jul 4, 8:26 AM