F45 Change Proposal: IPv6-Mostly_Support_In_NetworkManager [SelfContained]

Wiki: https://fedoraproject.org/wiki/Changes/IPv6-Mostly_Support_In_NetworkManager

Discussion Thread: https://discussion.fedoraproject.org/t/182443

**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

== Summary ==

Enable by default support for IPv6-mostly networks in NetworkManager.

== Owner ==

* Name: [[User:bengal| Beniamino Galvani]], [[User:Sfaye| Stanislas Faye]]
* Email: <bgalvani@redhat.com>, <sfaye@redhat.com>

== Detailed Description ==

Dual-stack networks, where IPv4 and IPv6 run in parallel, are currently the most common transition mechanism to IPv6. However, they don't solve the problem of the IPv4 address exhaustion; furthermore, the availability of IPv4 on every host masks problems with IPv6 and provides very little incentive to fully move to IPv6.

A new architecture is emerging as an alternative to dual stack: IPv6-mostly. RFC 8925 describes an IPv6-mostly network as:
*A network that provides NAT64 (possibly with DNS64) service as well as IPv4 connectivity and allows the coexistence of IPv6-only, dual-stack, and IPv4-only hosts on the same segment. Such a deployment scenario allows operators to incrementally turn off IPv4 on end hosts, while still providing IPv4 to devices that require IPv4 to operate. But IPv6-only-capable devices need not be assigned IPv4 addresses.*
The key components of a IPv6-mostly network are:
* **DHCPv4 option 108 (IPv6-only preferred - RFC 8925)**. An IPv6-mostly network advertises this option. If the client supports and receives this option, it will go IPv6-only, disabling IPv4 configuration. This option serves as the signal for supporting clients to transition to IPv6-only mode.
* **464XLAT (RFC 6877)**. This architecture provides IPv4 connectivity to hosts in a IPv6-only network. It works by implementing a double translation: on the client a CLAT (Customer-side translator) converts IPv4 packets to IPv6; on the network side a PLAT (Provider-side translator) uses NAT64 to convert those packets back to IPv4 before they are delivered to the v4 Internet.
* **PREF64 option (RFC8781)**. The network includes this option in Router Advertisement messages to communicate the prefix used by the NAT64 gateway available in the network.
With this change, NetworkManager will enable automatically the

handling of option 108, CLAT and PREF64. As a result, when operating

in a IPv6-mostly network, it will behave as a IPv6-only host without

getting a DHCPv4 lease. Applications that need to reach the v4 Internet will still continue to work because of DNS64 and/or NAT64.

On networks not advertising option 108 NetworkManager will continue to configure native IPv4 addressing.

== Feedback ==

N/A

== Benefit to Fedora ==

By enabling option 108 and CLAT, Fedora's networking stack will be

compliant with modern Internet standards. This puts Fedora on par with

other major operating systems that already support and enable these

technologies such as Android, macOS and (recently) Windows.

Option 108 allows network administrators to conserve scarce IPv4

address pools, without the need of creating separate segments for IPv4

and IPv6 clients.

CLAT ensures that applications relying on AF_INET sockets or hardcoded

IPv4 literals continue to function transparently even when the host

only has IPv6 connectivity.

== Scope ==

* Proposal owners: Set the default value for option `ipv4.clat` to `auto`, either at build time or via a configuration snippet in /usr. This enables the automatism that starts CLAT based on PREF64, and also enables the handling of option 108.
* Other developers:  N/A
* Release engineering: N/A
* Policies and guidelines: N/A
* Trademark approval: N/A (not needed for this Change)

== Upgrade/compatibility impact ==

There is no manual configuration or data migration needed. The change will be transparent to users.

== Early Testing (Optional) ==

N/A

== How To Test ==

This change can only be tested on an IPv6-mostly network with DHCPv4 option 108, NAT64 and PREF64. Such a network can be set up using equipment that supports those technologies, but also by configuring a Linux router with radvd, dhcpd, and a NAT64 implementation such as jool or tayga.

This feature is tested as part of the [https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/blob/main/features/scenarios/clat.feature NetworkManager-ci] project using network namespaces with radvd, dhcpd and tayga.

== User Experience ==

When connected to a IPv6-mostly network (with option 108, NAT64 and PREF64), the host will get a public IPv6 and a private CLAT IPv4 address in the 192.0.0.0-192.0.0.7 range.

Native IPv6 connectivity will be used for most of the traffic. If there are applications connecting by name to an IPv4-only server, the DNS64 server will return a synthetic AAAA entry that directs the communication to the NAT64 gateway. The CLAT instance started by NetworkManager will be used to convert the remaining IPv4 traffic to IPv6, for example traffic generated by applications using IPv4 literals.

All of this will be transparent to the user.

== Dependencies ==

None

== Contingency Plan ==

* Contingency mechanism: Revert the configuration and disable CLAT and option 108
* Contingency deadline: Beta freeze
* Blocks release? No

== Documentation ==

The configuration options involved are described in the upstream documentation:
* ipv4.clat: https://networkmanager.pages.freedesktop.org/NetworkManager/NetworkManager/nm-settings-nmcli.html#nm-settings-nmcli.property.ipv4.clat
* ipv4.dhcp-ipv6-only-preferred: https://networkmanager.pages.freedesktop.org/NetworkManager/NetworkManager/nm-settings-nmcli.html#nm-settings-nmcli.property.ipv4.dhcp-ipv6-only-preferred

== Release Notes ==

This change should be mentioned in the Releases Notes.