On Tue, Jan 13, 2026 at 01:12:06AM +0100, Stefano Brivio wrote: > On Mon, 12 Jan 2026 14:48:54 +1100 > David Gibson wrote: > > > On Sun, Jan 11, 2026 at 12:33:28AM +0100, Stefano Brivio wrote: > > > On Mon, 5 Jan 2026 19:28:49 +1100 > > > David Gibson wrote: > > > > > > > Currently, it's possible to explicitly ask for forwarding from an IPv4 > > > > address, while disabling IPv4: > > > > $ pasta -t 192.0.2.1/12345 -6 > > > > or vice versa: > > > > $ pasta -t 2001:db8::1/12345 -4 > > > > > > > > Currently, the impossible to implement forwarding option will be silently > > > > ignored. That's potentially confusing since in a complex setup, it might > > > > not be obvious why the requested forward isn't taking effect. > > > > > > > > Specifically, it's ignored at a fairly low level: tcp_listen() and > > > > udp_listen() ignore it and return 0. Those run kind of late to give a > > > > good error message. Change the low-level functions to return -EACCES > > > > (chosen because that's what the kernel will return if you request IPv6 > > > > when it's disabled by sysctl). > > > > > > I couldn't quite find out in which case EACCES is returned by the > > > kernel. If I set /proc/sys/net/ipv6/conf/all/disable_ipv6 to 1 and then > > > bind() an IPv6 address, after setting IPV6_FREEBIND, I get 0. > > > > Huh. EAFNOSUPPORT seems like it makes more sense, but oddly didn't > > spot it. I was looking at: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n1098 > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n2565 > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/route.c#n3664 > > Weird, I guess it eventually gets translated to EOPNOTSUPP later > (perhaps in netlink code), because: Yeah, I guess it must. > # strace ip addr add db8::1 dev ens3 > > [...] > > recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1768262003, nlmsg_pid=1598}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=64, nlmsg_type=RTM_NEWADDR, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=1768262003, nlmsg_pid=0}, {ifa_family=AF_INET6, ifa_prefixlen=128, ifa_flags=0, ifa_scope=RT_SCOPE_UNIVERSE, ifa_index=if_nametoindex("ens3")}, [[{nla_len=20, nla_type=IFA_LOCAL}, inet_pton(AF_INET6, "db8::1")], [{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "db8::1")]]]}], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84 > write(2, "RTNETLINK answers: Operation not"..., 43RTNETLINK answers: Operation not supported > > it's EOPNOTSUPP in the NLMSG_ERROR message. Heh, that's a third option. > > Happy enough to change it to EAFNOSUPPORT if you'd prefer. > > I think it would make a lot more sense, EACCES would confuse pretty > much anybody (and I can't get the kernel to return that over netlink > anyway). Ok, done. > > > If I disable IPv6 via command line (ipv6.disable=1) I get EAFNOSUPPORT > > > on bind(), and EOPNOTSUPP on setting addresses and routes. EACCES, I > > > couldn't quite spot it yet. > > > > Huh. Kind of weird it only fails on bind(), not on socket(). > > Oops, I was fooled by the error message we print in that case. It > actually fails on socket(): > > socket(AF_INET6, SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = -1 EAFNOSUPPORT (Address family not supported by protocol) > > but we print: > > L4 socket: Address family not supported by protocol > Failed to bind port 2548 (Address family not supported by protocol) for option '-t 2b8::1/2548' > > which makes sense because that's what we're doing with that port (just > not with that socket). Ah, ok, that makes sense. -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson