Re: [PATCH 2/3] tcp, udp, conf: Don't silently ignore listens on unsupported IP versions

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 4166 bytes --]

On Tue, Jan 13, 2026 at 01:12:06AM +0100, Stefano Brivio wrote:
> On Mon, 12 Jan 2026 14:48:54 +1100
> David Gibson <david@gibson.dropbear.id.au> wrote:
> 
> > On Sun, Jan 11, 2026 at 12:33:28AM +0100, Stefano Brivio wrote:
> > > On Mon,  5 Jan 2026 19:28:49 +1100
> > > David Gibson <david@gibson.dropbear.id.au> wrote:
> > >   
> > > > Currently, it's possible to explicitly ask for forwarding from an IPv4
> > > > address, while disabling IPv4:
> > > >     $ pasta -t 192.0.2.1/12345 -6
> > > > or vice versa:
> > > >     $ pasta -t 2001:db8::1/12345 -4
> > > > 
> > > > Currently, the impossible to implement forwarding option will be silently
> > > > ignored.  That's potentially confusing since in a complex setup, it might
> > > > not be obvious why the requested forward isn't taking effect.
> > > > 
> > > > Specifically, it's ignored at a fairly low level: tcp_listen() and
> > > > udp_listen() ignore it and return 0.  Those run kind of late to give a
> > > > good error message.  Change the low-level functions to return -EACCES
> > > > (chosen because that's what the kernel will return if you request IPv6
> > > > when it's disabled by sysctl).  
> > > 
> > > I couldn't quite find out in which case EACCES is returned by the
> > > kernel. If I set /proc/sys/net/ipv6/conf/all/disable_ipv6 to 1 and then
> > > bind() an IPv6 address, after setting IPV6_FREEBIND, I get 0.  
> > 
> > Huh.  EAFNOSUPPORT seems like it makes more sense, but oddly didn't
> > spot it.  I was looking at:
> > 
> >     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n1098
> >     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n2565
> >     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/route.c#n3664
> 
> Weird, I guess it eventually gets translated to EOPNOTSUPP later
> (perhaps in netlink code), because:

Yeah, I guess it must.

> # strace ip addr add db8::1 dev ens3
> 
> [...]
> 
> recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1768262003, nlmsg_pid=1598}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=64, nlmsg_type=RTM_NEWADDR, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=1768262003, nlmsg_pid=0}, {ifa_family=AF_INET6, ifa_prefixlen=128, ifa_flags=0, ifa_scope=RT_SCOPE_UNIVERSE, ifa_index=if_nametoindex("ens3")}, [[{nla_len=20, nla_type=IFA_LOCAL}, inet_pton(AF_INET6, "db8::1")], [{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "db8::1")]]]}], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84
> write(2, "RTNETLINK answers: Operation not"..., 43RTNETLINK answers: Operation not supported
> 
> it's EOPNOTSUPP in the NLMSG_ERROR message.

Heh, that's a third option.

> > Happy enough to change it to EAFNOSUPPORT if you'd prefer.
> 
> I think it would make a lot more sense, EACCES would confuse pretty
> much anybody (and I can't get the kernel to return that over netlink
> anyway).

Ok, done.

> > > If I disable IPv6 via command line (ipv6.disable=1) I get EAFNOSUPPORT
> > > on bind(), and EOPNOTSUPP on setting addresses and routes. EACCES, I
> > > couldn't quite spot it yet.  
> > 
> > Huh.  Kind of weird it only fails on bind(), not on socket().
> 
> Oops, I was fooled by the error message we print in that case. It
> actually fails on socket():
> 
> socket(AF_INET6, SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = -1 EAFNOSUPPORT (Address family not supported by protocol)
> 
> but we print:
> 
> L4 socket: Address family not supported by protocol
> Failed to bind port 2548 (Address family not supported by protocol) for option '-t 2b8::1/2548'
> 
> which makes sense because that's what we're doing with that port (just
> not with that socket).

Ah, ok, that makes sense.

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]