Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

netdog: set IPv6 accept-ra for primary interface via config rather than sysctl #3159

Merged
merged 2 commits into from
Jun 6, 2023

Conversation

zmrow
Copy link
Contributor

@zmrow zmrow commented Jun 1, 2023

Issue number:
Related to #3143

A separate PR will be opened by @markusboehme for the related patches to wicked

Description of changes:

    netdog: Add wicked IPv6 config structures to support RA
    
    This change adds the necessary structures to wicked in order to support
    setting the `accept_ra` IPv6 option via interface config.
    netdog: Set default accept-ra setting via config rather than sysctl
    
    Previously, we set the IPv6 accept-ra setting for the primary interface
    via `systemd-sysctl` during the wicked "install" helper.  Setting this
    sysctl via the helper can cause a race condition between the kernel and
    wicked.  The kernel sets a flag indicating a router advertisement has
    been received (`IF_RA_RCVD`), but only after it completes duplicate
    address detection and decides whether to send a router solicitation.  If
    the sysctl isn't set by the time duplicate address detection completes,
    the solicitation doesn't happen and the `IF_RA_RCVD` flag doesn't get
    set.  wicked uses this flag to decide whether or not to kick off the
    state machine that handles DHCP6.
    
    This change adds the accept-ra setting to the interface config if the
    primary interface is set up via kernel command line.  The primary
    interface is supplied via kernel command line for AWS and VMware
    variants.  This change also removes the accept-ra setting from the
    `systemd-sysctl` config.  Allowing wicked to manage this setting
    eliminates any chance of races between sysctl/kernel/wicked.

In the future we will support a network config setting that sets this in config for any interface specified.
Testing done:

  • All unit tests continue to pass
  • Launch 6,000 AWS instances (in batches of 2,000) including these fixes and the aforementioned pending wicked patches (thanks @markusboehme! ) into an IPv6 EKS cluster. Observe all instances join the cluster, indicating they all received an IPv6 address successfully.
  • Also launched an aws-k8s-1.24 instance into a "normal" IPv4 cluster successfully.
  • Launch a vmware-k8s-1.24 VM and observe it join my cluster successfully.
  • Observe the proper config being set for eth0:
<interface><name>eth0</name>...<ipv6><accept-ra>router</accept-ra></ipv6></interface>
  • Ovserve the proper sysctls being set via systemd-sysctl and from wicked
bash-5.1# cat /etc/sysctl.d/90-primary_interface.conf 
-net.ipv4.conf.eth0.rp_filter = 2

bash-5.1# sysctl net.ipv6.conf.eth0.accept_ra
net.ipv6.conf.eth0.accept_ra = 2

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

Copy link
Contributor

@stmcginnis stmcginnis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good, and coverage appears thorough enough.

Copy link
Contributor

@bcressey bcressey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM overall, but if you have a chance to clean up the commits so that all the necessary modifications to wicked/mod.rs happen together, that seems like a more logical sequence.

zmrow added 2 commits June 5, 2023 22:25
This change adds the necessary structures to wicked in order to support
setting the `accept_ra` IPv6 option via interface config.  Doing this
in config allows wicked to manage this option and avoids any race
conditions that may occur between wicked and the kernel when attempting
to set this via sysctl.
Previously, we set the IPv6 accept-ra setting for the primary interface
via `systemd-sysctl` during the wicked install helper.  Setting this
sysctl via the helper can cause a race condition between the kernel and
wicked.  The kernel sets a flag indicating a router advertisement has
been received (`IF_RA_RCVD`), but only after it completes duplicate
address detection and decides whether to send a router solicitation.  If
the sysctl isn't set by the time duplicate address detection completes,
the solicitation doesn't happen and the `IF_RA_RCVD` flag doesn't get
set.  wicked uses this flag to decide whether or not to kick off the
state machine that handles DHCP6.

This change adds the accept-ra setting to the interface config if the
primary interface is set up via kernel command line.  The primary
interface is supplied via kernel command line for AWS and VMware
variants.  This change also removes the accept-ra setting from the
`systemd-sysctl` config.  Allowing wicked to manage this setting
eliminates any chance of races between sysctl/kernel/wicked.
@zmrow
Copy link
Contributor Author

zmrow commented Jun 5, 2023

^ Fixed up the commits per @bcressey

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants