]> git.ipfire.org Git - thirdparty/linux.git/commit
ipv6: add `force_forwarding` sysctl to enable per-interface forwarding
authorGabriel Goller <g.goller@proxmox.com>
Tue, 22 Jul 2025 08:18:45 +0000 (10:18 +0200)
committerJakub Kicinski <kuba@kernel.org>
Fri, 25 Jul 2025 20:06:19 +0000 (13:06 -0700)
commitf24987ef6959a7efaf79bffd265522c3df18d431
tree69e5a8eb353caac1921f8a64fec640e7087f785d
parent9312ee76490df61491fee19b5ce71f71b6de908c
ipv6: add `force_forwarding` sysctl to enable per-interface forwarding

It is currently impossible to enable ipv6 forwarding on a per-interface
basis like in ipv4. To enable forwarding on an ipv6 interface we need to
enable it on all interfaces and disable it on the other interfaces using
a netfilter rule. This is especially cumbersome if you have lots of
interfaces and only want to enable forwarding on a few. According to the
sysctl docs [0] the `net.ipv6.conf.all.forwarding` enables forwarding
for all interfaces, while the interface-specific
`net.ipv6.conf.<interface>.forwarding` configures the interface
Host/Router configuration.

Introduce a new sysctl flag `force_forwarding`, which can be set on every
interface. The ip6_forwarding function will then check if the global
forwarding flag OR the force_forwarding flag is active and forward the
packet.

To preserve backwards-compatibility reset the flag (on all interfaces)
to 0 if the net.ipv6.conf.all.forwarding flag is set to 0.

Add a short selftest that checks if a packet gets forwarded with and
without `force_forwarding`.

[0]: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
Link: https://patch.msgid.link/20250722081847.132632-1-g.goller@proxmox.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Documentation/networking/ip-sysctl.rst
include/linux/ipv6.h
include/uapi/linux/ipv6.h
include/uapi/linux/netconf.h
include/uapi/linux/sysctl.h
net/ipv6/addrconf.c
net/ipv6/ip6_output.c
tools/testing/selftests/net/Makefile
tools/testing/selftests/net/ipv6_force_forwarding.sh [new file with mode: 0755]