"unconfigured" NIC can still get IPv6 addresses via RA

[Andreas Hasenack]

[Impact]
Some users omit configuration for some interfaces, and expect that the lack of configuration translates to "no IP address" on the interface, as per netplan documentation.

[Test case]
/!\ Requires an IPv6-capable network.
1) Update nplan.
2) Ensure the nplan configure includes the 'accept-ra: no' option.
3) Run 'netplan apply'
4) Verify that there is no IPv6 address set for the interface where 'accept-ra: no is set; using 'ip -6 addr'.

[Regression potential]
Incorrect configuration of the IPv6 addresses on a device would consistute a regression: for instance, getting an IPv6 SLAAC address when 'accept-ra: no' is set; or no IPv6 address when RAs are being received and 'accept-ra' is not set. Furthermore, possible regressions may look like incorrect IPv6 configuration or missing options on IPv6 or IPv4 setups, in the form of not retrieving an IP address or getting the wrong IP.

---

TL;DR A MAAS NIC that is set to "unconfigured" (or "link up") will get no IPv4 address, but it might still get an IPv6 address via router advertisements (RA), if there is such a service in that network segment.

Whether this is a bug or not is up for discussion. That's the point of this ticket, actually, so that this discussion can be had and be recorded.

We found out about this when we couldn't get any connectivity to instances of an openstack cloud deployed by the autopilot.

After much debugging, we found that the problem was with the br-data bridge on the neutron-gateway node: it didn't have the external NIC (eth1) as part of the bridge.

The neutron-gateway charm, before adding any NIC to a bridge, performs certain checks to see if it's really unused. One of these checks looks for IP addresses on the NIC, both IPv4 and IPv6. In MAAS, that node had eth1 set to "unconfigured", so that eth1 is just "up", but has no IP (v4) address. Turns out this NIC had gotten an IPv6 ULA from an openwrt router in that network segment. That was enough for the charm to not add it to the br-data bridge, thus breaking connectivity to openstack instances that were later brought up.

We shut down the RA service on the openwrt router and then everything worked as expected.

[Mike Pontillo (mpontillo)]

This is an Ubuntu default setting, and MAAS does not currently change operating-system-specific settings upon deployment. This could be rendered in a pre-up script for ifupdown, but my understanding is that pre-up scripts will not be available under netplan and networkd.

In order for us to disable the acceptance of IPv6 router advertisements, we would either need to disable IPv6 completely, such as by modifying this sysctl:

net.ipv6.conf.<all|ifname>.disable_ipv6

... or disable just the acceptance of IPv6 router advertisements using this sysctl:

net.ipv6.conf.<all|ifname>.accept_ra

I think it seems reasonable that MAAS should be able to configure these settings. However, this is a decision that goes beyond just MAAS. (I'll add curtin to this bug.)

[Mike Pontillo (mpontillo)]

Also adding 'netplan'; from what I've seen so far, this is not yet possible to configure.

[Mike Pontillo (mpontillo)]

For the record, there is a workaround in MAAS if you want your deployed nodes to be IPv6-free: use the "ipv6.disable=1" kernel parameter. This can be done as a tag if you want it to happen on a per-machine basis, or you can use the settings page to create a global default kernel setting.

Related is bug #1663340, however; MAAS itself currently uses IPv4-mapped IPv6 addresses in its operation, so is not able to operate in such an environment.

[Mathieu Trudel-Lapierre (cyphermox)]

Please avoid disabling IPv6 using "ipv6.disable=1". This breaks socket() AF_INET6, which can cripple other software depending on the ability to open sockets() of the AF_INET6 family, even if the system should not use IPv6. It is usually safer to use "ipv6.disable_ipv6=1" instead, which will avoid setting addresses to the interfaces but still not break AF_INET6.

We can look into toggling receiving RAs as IPv6-specific settings.

[Mike Pontillo (mpontillo)]

Indeed, this workaround also breaks the MAAS region itself. ;-)

+1 to ipv6.disable_ipv6 if this is necessary, just note that this allows IPv6 to be enabled without a reboot via sysctl (which apparantly isn't acceptable in some highly-strict environments).

[Launchpad Janitor (janitor)]

This bug was fixed in the package nplan - 0.25

---------------
nplan (0.25) artful; urgency=medium

  * tests/generate.py: add a test to validate that correct blacklist entries
    are added when creating virtual devices.
  * tests/integration.py: clean up after br0 in networkd's test_bridge_mac; as
    the remaining interface and udev configuration can confuse NetworkManager
    now that it seems to manage random devices it did not create again.
    (LP: #1699371)
  * src/nm.c: set the MTU even though we also specify it in systemd-networkd
    for consumption by udev. NetworkManager will try to set it and might
    otherwise default to the wrong value.
  * src/networkd.c: Set IPv6AcceptRA=no anytime we don't do DHCPv6 (or by the
    same config, SLAAC), and don't have static addresses set. This should fix
    the cases where unconfigured devices still get an IPv6 address.
    (LP: #1655440)
  * src/nm.c: Explicitly set IPv6 method=ignore when IPv6 is otherwise not
    configured; this follows the same logic as setting IPv6AcceptRA=no in
    networkd, with the exception that NM does not currently disable RAs. When
    it does, an unconfigured device for IPv6 will truly be left with no config.

 -- Mathieu Trudel-Lapierre <email address hidden> Thu, 13 Jul 2017 16:22:18 -0400

[Mathieu Trudel-Lapierre (cyphermox)]

Uploaded in nplan 0.25 to artful, so it's Fix Released upstream as well...

[Mathieu Trudel-Lapierre (cyphermox)]

After much thought, I think it's better to keep the default as being as "open" as possible, and taking any step we can to provide some working network by default (that is, accepting RAs by default).

I'll be adding a key in netplan to allow disabling RAs independently.

[Brian Murray (brian-murray)]

Hello Andreas, or anyone else affected,

Accepted nplan into zesty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nplan/0.29~17.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-zesty to verification-done-zesty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-zesty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello Andreas, or anyone else affected,

Accepted nplan into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nplan/0.29~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!