[PR #5698] [MERGED] [management] Add IPv6 overlay addressing and capability gating #26516

Open
opened 2026-08-05 07:07:26 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/5698
Author: @lixmal
Created: 3/25/2026
Status: Merged
Merged: 4/8/2026
Merged by: @lixmal

Base: proto-ipv6-overlayHead: mgmt-ipv6-addressing


📝 Commits (9)

  • 0d4d99d Add IPv6 overlay addressing to management server
  • be08692 Fix review findings: Equal, capability set comparison, source prefix extraction, effective ranges
  • 3346cef Fix Sonar complexity, test fixtures, duplicate IPv6, and group membership check on UpdatePeerIPv6
  • e308794 Fix review findings: source-level IPv6 gating, pgx loader, settings drift, test accuracy
  • 76d722c Fix IPv6 allocation fallback escape and incremental route firewall family matching
  • e7c96e4 Remove stale RouteFirewallRule.IPv6 field references in route_test
  • 956b1d5 Merge remote-tracking branch 'origin/proto-ipv6-overlay' into mgmt-ipv6-addressing
  • b425ec6 Fix CodeRabbit review findings: route ID mismatch, empty sources, error handling
  • b46c7ea Fix lint: dead code, predeclared identifiers, impossible nil check

📊 Changes

51 files changed (+2621 additions, -393 deletions)

View changed files

📝 .gitignore (+1 -0)
📝 management/internals/modules/reverseproxy/service/manager/l4_port_test.go (+3 -2)
📝 management/internals/modules/reverseproxy/service/manager/manager.go (+1 -1)
📝 management/internals/modules/reverseproxy/service/manager/manager_test.go (+7 -4)
📝 management/internals/shared/grpc/conversion.go (+75 -13)
📝 management/internals/shared/grpc/server.go (+11 -1)
📝 management/server/account.go (+307 -5)
📝 management/server/account/manager.go (+1 -0)
📝 management/server/account/manager_mock.go (+12 -0)
📝 management/server/account_test.go (+182 -25)
📝 management/server/activity/codes.go (+7 -0)
📝 management/server/group_test.go (+4 -5)
📝 management/server/http/handlers/accounts/accounts_handler.go (+71 -9)
📝 management/server/http/handlers/accounts/accounts_handler_test.go (+30 -0)
📝 management/server/http/handlers/groups/groups_handler_test.go (+3 -3)
📝 management/server/http/handlers/peers/peers_handler.go (+38 -0)
📝 management/server/http/handlers/peers/peers_handler_test.go (+11 -6)
📝 management/server/http/testing/testing_tools/tools.go (+2 -2)
📝 management/server/mock_server/account_mock.go (+8 -0)
📝 management/server/peer.go (+55 -9)

...and 31 more files

📄 Description

Describe your changes

  • Add addrFamily abstraction encapsulating IPv4/IPv6 header offsets, address lengths, set key types, and ICMP protocol numbers
  • Create parallel ip6 netbird table with its own router and ACL manager when the interface has IPv6
  • Route all firewall operations to the correct table by address family
  • Split UpdateSet prefixes by family for dynamic DNS route sets
  • Add IPv6 interval set tests (TestNftablesCreateIpSet_IPv6) and calculateLastIP tests covering both families
  • MSS clamping uses correct overhead per family (40 for v4, 60 for v6)

Stacked on #5706.

Stack

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

  • I added/updated documentation for this change
  • Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/667

Summary by CodeRabbit

  • New Features

    • Added broad IPv6 overlay support: account/network settings, per-peer IPv6 addresses, allocation, group-based IPv6 enablement, dual-stack network maps, DNS AAAA records, and IPv6-aware firewall & routing.
  • API / Docs

    • Management API and OpenAPI spec expose IPv6 fields for account settings and peer payloads.
  • Tests

    • Expanded unit/integration tests covering IPv6 allocation, routing, firewall rules, groups, and encoding.
  • Chores

    • Ignored generated testdata directory in VCS.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/5698 **Author:** [@lixmal](https://github.com/lixmal) **Created:** 3/25/2026 **Status:** ✅ Merged **Merged:** 4/8/2026 **Merged by:** [@lixmal](https://github.com/lixmal) **Base:** `proto-ipv6-overlay` ← **Head:** `mgmt-ipv6-addressing` --- ### 📝 Commits (9) - [`0d4d99d`](https://github.com/netbirdio/netbird/commit/0d4d99d12df33a26767c4be3f8467cf70bbb536b) Add IPv6 overlay addressing to management server - [`be08692`](https://github.com/netbirdio/netbird/commit/be0869267b0b61be80b533edca42f6819a4058b3) Fix review findings: Equal, capability set comparison, source prefix extraction, effective ranges - [`3346cef`](https://github.com/netbirdio/netbird/commit/3346cefd913f86d2fef50abd555c1633998123bc) Fix Sonar complexity, test fixtures, duplicate IPv6, and group membership check on UpdatePeerIPv6 - [`e308794`](https://github.com/netbirdio/netbird/commit/e308794a7699b926d7fa703f8e81c1f1016998d6) Fix review findings: source-level IPv6 gating, pgx loader, settings drift, test accuracy - [`76d722c`](https://github.com/netbirdio/netbird/commit/76d722cc3bc78b492ce2cee1846cf5068649a4ce) Fix IPv6 allocation fallback escape and incremental route firewall family matching - [`e7c96e4`](https://github.com/netbirdio/netbird/commit/e7c96e46b848b17e25037ac2f2213dbd983f6054) Remove stale RouteFirewallRule.IPv6 field references in route_test - [`956b1d5`](https://github.com/netbirdio/netbird/commit/956b1d55cbe47dfebebcc0957d09041214f1ae9c) Merge remote-tracking branch 'origin/proto-ipv6-overlay' into mgmt-ipv6-addressing - [`b425ec6`](https://github.com/netbirdio/netbird/commit/b425ec67fca2f851e393e569a89e905aa66ec750) Fix CodeRabbit review findings: route ID mismatch, empty sources, error handling - [`b46c7ea`](https://github.com/netbirdio/netbird/commit/b46c7ea4bf47653d0a8743a3d4ff42337f522615) Fix lint: dead code, predeclared identifiers, impossible nil check ### 📊 Changes **51 files changed** (+2621 additions, -393 deletions) <details> <summary>View changed files</summary> 📝 `.gitignore` (+1 -0) 📝 `management/internals/modules/reverseproxy/service/manager/l4_port_test.go` (+3 -2) 📝 `management/internals/modules/reverseproxy/service/manager/manager.go` (+1 -1) 📝 `management/internals/modules/reverseproxy/service/manager/manager_test.go` (+7 -4) 📝 `management/internals/shared/grpc/conversion.go` (+75 -13) 📝 `management/internals/shared/grpc/server.go` (+11 -1) 📝 `management/server/account.go` (+307 -5) 📝 `management/server/account/manager.go` (+1 -0) 📝 `management/server/account/manager_mock.go` (+12 -0) 📝 `management/server/account_test.go` (+182 -25) 📝 `management/server/activity/codes.go` (+7 -0) 📝 `management/server/group_test.go` (+4 -5) 📝 `management/server/http/handlers/accounts/accounts_handler.go` (+71 -9) 📝 `management/server/http/handlers/accounts/accounts_handler_test.go` (+30 -0) 📝 `management/server/http/handlers/groups/groups_handler_test.go` (+3 -3) 📝 `management/server/http/handlers/peers/peers_handler.go` (+38 -0) 📝 `management/server/http/handlers/peers/peers_handler_test.go` (+11 -6) 📝 `management/server/http/testing/testing_tools/tools.go` (+2 -2) 📝 `management/server/mock_server/account_mock.go` (+8 -0) 📝 `management/server/peer.go` (+55 -9) _...and 31 more files_ </details> ### 📄 Description ## Describe your changes - Add `addrFamily` abstraction encapsulating IPv4/IPv6 header offsets, address lengths, set key types, and ICMP protocol numbers - Create parallel `ip6 netbird` table with its own router and ACL manager when the interface has IPv6 - Route all firewall operations to the correct table by address family - Split `UpdateSet` prefixes by family for dynamic DNS route sets - Add IPv6 interval set tests (`TestNftablesCreateIpSet_IPv6`) and `calculateLastIP` tests covering both families - MSS clamping uses correct overhead per family (40 for v4, 60 for v6) Stacked on #5706. ## Issue ticket number and link ## Stack - #5631 - #5698 :point_left: ### Checklist - [ ] Is it a bug fix - [ ] Is a typo/documentation fix - [x] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [x] I added/updated documentation for this change - [ ] Documentation is **not needed** for this change (explain why) ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: https://github.com/netbirdio/docs/pull/667 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added broad IPv6 overlay support: account/network settings, per-peer IPv6 addresses, allocation, group-based IPv6 enablement, dual-stack network maps, DNS AAAA records, and IPv6-aware firewall & routing. * **API / Docs** * Management API and OpenAPI spec expose IPv6 fields for account settings and peer payloads. * **Tests** * Expanded unit/integration tests covering IPv6 allocation, routing, firewall rules, groups, and encoding. * **Chores** * Ignored generated testdata directory in VCS. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 07:07:26 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#26516