Adapt the default config to bind on IPv6.

[14mRh4X0r]

Most deployments are on Linux, so this would actually bind on both IPv4 and IPv6. Resolves #1886.

This change would additionally prevent timeouts for domain names with both A and AAAA records, and allows IPv6-only homeservers to connect to servers with an AAAA record.

[matrixbot]

Can one of the admins verify this patch?

[matrixbot]

Can one of the admins verify this patch?

[matrixbot]

Can one of the admins verify this patch?

[silkeh]

Side note: on BSD-variants (including macOS) this may bind on IPv6 only, depending on the net.inet6.ip6.v6only sysctl setting. By default this is false on macOS, and true on FreeBSD/OpenBSD. The latter need to uncomment the 0.0.0.0 line as indicated.

[ara4n]

yup, the v6only thing is why we haven't dones this before. that said, i'm unsure why we can't just bind on 0.0.0.0 as well as :: (ie do two binds...)

[ara4n]

i suspect the right fix for this is to listen twice, but fix the bind code so that a failing bind isn't considered a terminal error

[14mRh4X0r]

I think it's safe to say that almost all Synapse installations are on Linux (where V6ONLY is disabled by default, so :: binds on 0.0.0.0 as well), and for other operating systems there are clear instructions on how to make it work. To me this seems like a more sensible default than only listening on IPv4.

I have looked into forcing V6ONLY to false, but as far as I can tell that requires meddling with Twisted internals.

[14mRh4X0r]

By the way, according to RFC 3493, IPV6_V6ONLY should default to false.

[ara4n]

A very common pattern (eg the one that half the matrix core team use) is to get up and running locally on OSX before then shifting to run on linux in production...

[silkeh]

@ara4n: This works the same on macOS as on Linux. The main exception in functionality is Windows, which does require a separate bind, but the 0.0.0.0 bind can easily be uncommented in the configuration.

[14mRh4X0r]

I see I overlooked some IPv4 addresses, so changed them to IPv6 as well.

[ghost]

I got an error with archlinux after commenting in both 0.0.0.0 and :: that the port is already used. So I am not sure if this would be a safe alternative.

[silkeh]

@saram-kon: on Linux :: listens on both IPv4 and IPv6, so you only need ::.

[ghost]

I know 😄 I just wanted to point out that enabling both as the default, as suggested by @ara4n

i'm unsure why we can't just bind on 0.0.0.0 as well as :: (ie do two binds...)

might not work on all platforms

[ArchangeGabriel]

Apparently binding to ::1 does not bind to 127.0.0.1. I’ve tried above (I use nginx as a reverse proxy), and bind_addresses: ['::1'] did not bind 127.0.0.1, but ['::1', '127.0.0.1'] worked.

[14mRh4X0r]

You're correct. I'll fix that.

[uhoreg]

@kyrias, can you comment on this PR? I seem to remember you looking into something like this when you first did the IPv6 support.

[kyrias]

So yeah, twisted currently has no support for setting IPV6_V6ONLY which is why I left the default config with just IPv4 listeners enabled with just the note about IPv6 support. Seems I even found a twisted PR and commented on it back in December, but nothing has really changed since then.

I do think it make sense to default to ::, since Linux and MacOS apparently follows the default set forth in the RFC, and then BSD or Windows users could just change it themselves. This would give us IPv6 support by default and we're following standards so the default config not working on non-conforming operating systems is okay, I think. I mostly just left it as it is now because it would have made sense to discuss separately from the general IPv6 support PR, but then I forgot to actually open an issue about it!

On the other hand, it might also make sense to have the generated config be conditional on the platform, so on Windows and the BSDs where it's enabled by default we could generate a config file with listeners for both IPv4 and IPv6 enabled.

[kyrias]

X shower thoughts later, I rather dislike the idea of automatically changing the default config based on platform for various reasons. I think what I'd prefer instead would be to have :: be the default, and then have a command line option to select between 0.0.0.0, ::, and both when generating the config. And then if you're generate a config on a platform where IPV6_V6ONLY is enabled by default without passing said command line option we would print a warning about it, preferably with a link that explains what's up more in-depth.

[ara4n]

having just discussed this briefly with @kyrias again in #matrix-dev:matrix.org, I'm still unclear why my suggestion of:

i suspect the right fix for this is to listen twice, but fix the bind code so that a failing bind isn't considered a terminal error

doesn't work. It just feels clumsy to have to tell people to comment/uncomment chunks of config depending on platform (or special-casing '::' based on platform). Can we not just try to bind to all the given addresses, but not consider bind failures fatal?

[ArchangeGabriel]

That seems like a good idea, and is what MPD does for instance: the default setting for bind_address is any, i.e. 0.0.0.0+::, but on my system this gives exception: bind to '0.0.0.0:6600' failed (continuing anyway, because binding to '[::]:6600' succeeded): Failed to bind socket: Address already in use, which is expected since :: implies 0.0.0.0. But note the continuing anyway. ;) (And indeed setting it to :: instead also binds 0.0.0.0:6660 and remove this warning)

[richvdh]

superceded by #2435