vyos-1x.git/data/templates/dhcp-client/ipv6.j2, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2025-10-09T15:12:10+00:00pppoe: T7485: add DHCPv6 options to disable DNS2025-10-09T15:12:10+00:00Nicolas Vandammen.vandamme@firis-system.lu2025-10-09T15:12:10+00:00urn:sha1:0c5809588980a198a02ebfb70a459d519af0001e
Co-Authored-By: Christian Breunig <christian@breunig.cc>
T7682: incorrect sla-len in DHCPv6 client prefix delegation (DHCPv6-PD)2025-09-13T06:55:31+00:00Christian Breunigchristian@breunig.cc2025-09-13T06:55:31+00:00urn:sha1:44fd159ce2d344cdf7b08487801e077ebf59869c
The current template has an overly optimistic logic for sla-len calculation,
relying on an assumption that a server always provides a prefix with the exact
length requested by the client. This is incorrect. According to RFC8415 and
RFC7084, the prefix length in a request is only a hint for the server, which
may decide to provide a different prefix size.
The big issue here is that wide-dhcpv6-client uses the sla-len value from the
configuration regardless of the received prefix size. This seems to be the
known issue.
The good news is that we have already inherited a patch from Debian to mitigate
the issue [1]. It accomplishes exactly what we are doing in the configuration
template, but with the advantage of using the actual prefix length from the
received prefix, rather than the one configured in the configuration file.
If we simply remove sla-len from the template, everything appears to function
normally.
Before - server sending /56
set interfaces ethernet eth1 address 'dhcpv6'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 address '1'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 sla-id '0'
set interfaces ethernet eth1 dhcpv6-options pd 1 length '60'
Resulted in:
vyos@vyos# run show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ------------------- ----------------- ------- ----- ----- -------------
eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u
eth2 fc00:0:2:ff00::1/60 0c:67:94:67:00:02 default 1500 u/u
Whereas IPv6 PD should always use a /64 prefix on the interface we assign a
dynamic DHCPv6 prefix to.
After the fix:
vyos@vyos:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ------------------- ----------------- ------- ----- ----- -------------
eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u
eth2 fc00:0:2:ff00::1/64 0c:67:94:67:00:02 default 1500 u/u
If a DHCPv6 server (e.g. VyOS itself) even provides multiple PD prefixes, the
right one is choosen. Assume the following server configuration:
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 address-range start fc00:0:0:1::100 stop 'fc00:0:0:1::200'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 lease-time default '120'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: prefix-length '56'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: stop 'fc00:0:2:ff00::'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: prefix-length '60'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: stop 'fc00:0:3:ff00::'
If a /56 is requested ("dhcpv6-options pd 1 length 56") - we will get a per
interface /64 from the original /56 prefix-delegation from the DHCPv6 server.
If the user suddently requests a /60 ("dhcpv6-options pd 1 length 60") the
delegated prefix will be from the above fc00:0:3:: pool.
1: https://salsa.debian.org/debian/wide-dhcpv6/-/blob/debian/20080615-23/debian/patches/0021-Make-sla-len-config-optional.patch
dhcpv6-client: T2590: fix vyos-hostsd update for nameserver and search domains2024-04-01T12:04:50+00:00Christian Breunigchristian@breunig.cc2024-04-01T12:04:50+00:00urn:sha1:ece425f0191762638b7c967097accd8739e9103d
After migrating from ISC DHCLIENT for IPv6 to wide-dhcp-client the logic which
was present to update /etc/resolv.conf with the DHCP specified nameservers and
also the search domain list was no longer present.
This commit adds a per interface rendered script to inform vyos-hostsd about
the received IPv6 nameservers and search domains.
dhcpv6-pd: T2821: bugfix Jinja2 template - missing conditional if2022-09-21T17:34:23+00:00Christian Poessingerchristian@poessinger.com2022-09-21T17:30:22+00:00urn:sha1:b004cad76803af1615df8435c9b4881905a5ae64
Specifying "dhcpv6-options pd 0" for any interface without an interface where
we delegate an address to resulted in a commit error:
{% for interface, interface_config in pd_config.interface.items() if pd_config.interface is vyos_defined %}
jinja2.exceptions.UndefinedError: 'dict object' has no attribute 'interface'
dhcp(v6)-client: T4353: fix Jinja2 linting errors2022-04-16T10:14:56+00:00Christian Poessingerchristian@poessinger.com2022-04-16T10:14:56+00:00urn:sha1:039e323d7e46f7d8244c42794f713a0bfecbe2d3