util/linuxfw: fix IPv6 availability check for nftables

[irbekrm]

See #11353 for context- this change fixes a firewall NAT availability check that was using the no-longer set ipv6NATAvailable field by removing the field and using a method that, for nftables, just checks that IPv6 is available.

When running firewall in nftables mode,
there is no need for a separate NAT availability check (unlike with iptables, there are no hosts that support nftables, but not IPv6 NAT - see #11353).

I have tested that with this change the IPv6 NAT table gets created as expected:

/ # nft list ruleset table ip filter { chain FORWARD { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump ts-forward }

    chain INPUT {
            type filter hook input priority filter; policy accept;
            counter packets 114 bytes 26380 jump ts-input
    }

    chain ts-forward {
            iifname "tailscale0*" counter packets 0 bytes 0 meta mark set meta mark & 0xffff04ff | 0x00000400
            meta mark & 0x0000ff00 == 0x00000400 counter packets 0 bytes 0 accept
            oifname "tailscale0*" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
            oifname "tailscale0*" counter packets 0 bytes 0 accept
    }

    chain ts-input {
            iifname "lo*" ip saddr 100.110.115.23 counter packets 0 bytes 0 accept
            iifname != "tailscale0*" ip saddr 100.115.92.0/23 counter packets 0 bytes 0 return
            iifname != "tailscale0*" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
            iifname "tailscale0*" counter packets 0 bytes 0 accept
            udp dport 35215 counter packets 79 bytes 8632 accept
    }

}
table ip nat {
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
counter packets 46 bytes 6233 jump ts-postrouting
}

    chain ts-postrouting {
            meta mark & 0x0000ff00 == 0x00000400 counter packets 0 bytes 0 masquerade
    }

}
table ip6 filter {
chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 28 bytes 23435 jump ts-forward
}

    chain INPUT {
            type filter hook input priority filter; policy accept;
            counter packets 224 bytes 2783585 jump ts-input
    }

    chain ts-forward {
            iifname "tailscale0*" counter packets 16 bytes 1318 meta mark set meta mark & 0xffff04ff | 0x00000400
            meta mark & 0x0000ff00 == 0x00000400 counter packets 16 bytes 1318 accept
            oifname "tailscale0*" counter packets 12 bytes 22117 accept
    }

    chain ts-input {
            iifname "lo*" ip6 saddr fd7a:115c:a1e0::df01:7317 counter packets 0 bytes 0 accept
            iifname "tailscale0*" counter packets 0 bytes 0 accept
            udp dport 57553 counter packets 52 bytes 5406 accept
    }

}
table ip6 nat {
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
counter packets 28 bytes 2540 jump ts-postrouting
}

    chain ts-postrouting {
            meta mark & 0x0000ff00 == 0x00000400 counter packets 2 bytes 160 masquerade
    }

}


Also updated tests to test the amount of chains/tables created depending on whether the IPv6 check errors out or not- that would have caught this bug.

Updates #12008

[irbekrm]

For consistency, does not change anything functionally

[bradfitz]

I'd prefer this signature remain unchanged and instead add a new unexported package-level func that, if non-nil, is used inside the body, like:

var checkIPv6ForTest func(logger.Logf) error // non-nil in some tests

func CheckIPv6(logf logger.Logf) error {
    if f := checkIPv6ForTest; f != nil {
        return f(logf)
    }
    ....

Then use tstest.Replace to set it.

[irbekrm]

Oh that's really nice

[maisem]

LGTM after addressing brads comment about using tstest.Replace in tests with a package private var.