Enable global IPv6 forwarding

[kyrtapz]

Global forwarding works differently for IPv6:

  conf/all/forwarding - BOOLEAN
   Enable global IPv6 forwarding between all interfaces.
	  IPv4 and IPv6 work differently here; e.g. netfilter must be used
	  to control which interfaces may forward packets and which not.

https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

It is not possible to configure the IPv6 forwarding per interface by setting the net.ipv6.conf.IFNAME.forwarding sysctl (it just configures the interface-specific Host/Router behaviour). Instead, the opposite approach is required where the global forwarding is enabled and traffic is restricted through iptables.

To ensure consistent behavior between IPv4/IPv6 and to limit the forwarding scope for IPv4 networks this PR configures the default DROP policy for both IP families.

---

Issue reproducer:

1. Setup ipv6 lgw cluster:
   ./kind.sh -ic -ds -gm local -i6 -n4 -df
2. Disable ipv6 global forwarding (by default it gets enabled by docker and by kind) on worker nodes and restart ovnkube-node

 docker exec -it ovn-worker2 sysctl -w net.ipv6.conf.all.forwarding=0
 docker exec -it ovn-worker sysctl -w net.ipv6.conf.all.forwarding=0
 kubectl -n ovn-kubernetes delete pod -lapp=ovnkube-node

4. Create a test pod:
   kubectl run test_pod --image=quay.io/openshift/origin-network-tools -- sleep 9999
5. Test cluster-networked pod connectivity to the API server:

  ctrl_ip=$(kubectl get node ovn-control-plane -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')
  kubectl exec -it test_pod -- curl "https://[${ctrl_ip}]:6443"

The request times out.
tcpdump on the node shows that the traffic is not being forwarded between ovn-k8s-mp0 and breth0

sudo nsenter -t $(docker inspect -f '{{ .State.Pid }}' ovn-worker2) -n tcpdump -i any port 6443 and host fc00:f853:ccd:e793::3  -nne
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
12:42:55.643841 f54f5a905b74252 P   ifindex 7 0a:58:09:f2:f4:29 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820216298 ecr 0,nop,wscale 7], length 0
12:42:55.644362 ovn-k8s-mp0 In  ifindex 4 0a:58:71:75:e6:87 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820216298 ecr 0,nop,wscale 7], length 0
12:42:56.707374 f54f5a905b74252 P   ifindex 7 0a:58:09:f2:f4:29 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820217362 ecr 0,nop,wscale 7], length 0
12:42:56.707391 ovn-k8s-mp0 In  ifindex 4 0a:58:71:75:e6:87 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820217362 ecr 0,nop,wscale 7], length 0
12:42:57.731385 f54f5a905b74252 P   ifindex 7 0a:58:09:f2:f4:29 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820218386 ecr 0,nop,wscale 7], length 0
12:42:57.731402 ovn-k8s-mp0 In  ifindex 4 0a:58:71:75:e6:87 ethertype IPv6 (0x86dd), length 100: fd00:10:244:3::3.35852 > fc00:f853:ccd:e793::3.6443: Flags [S], seq 1156978119, win 32160, options [mss 1340,sackOK,TS val 1820218386 ecr 0,nop,wscale 7], length 0

---

[coveralls]

coverage: 52.709% (-0.007%) from 52.716%
when pulling 06caadf on kyrtapz:ipv6_forwarding
into 701b8e0 on ovn-org:master.

[flavio-fernandes]

short of silly nits, this LGTM

[kyrtapz]

short of silly nits, this LGTM

Thanks for the review! :)

[karampok]

I see that there is a default DROP rule at the end of the FORWARD chain, which in essence is replacing the default Policy of the chain. I would like just to propose if instead of a rule we change the policy iptables -P FORWARD DROP?

The reason is that it would make easier for third components to add their specific iptables rule (just append instead of taking care to before the DROP rule).

This is only implementation detail, the behavior (either DROP policy or last DROP rule) is of course the same.

[kyrtapz]

I see that there is a default DROP rule at the end of the FORWARD chain, which in essence is replacing the default Policy of the chain. I would like just to propose if instead of a rule we change the policy iptables -P FORWARD DROP?

The reason is that it would make easier for third components to add their specific iptables rule (just append instead of taking care to before the DROP rule).

This is only implementation detail, the behavior (either DROP policy or last DROP rule) is of course the same.

Thanks for the suggestion, I think it makes sense to go with the DROP policy and I have updated the PR.

[karampok]

thanks @kyrtapz for the PR.
AFAICT this change is good enough to block all unwanted traffic and makes openshift/cluster-network-operator#2409 not required.