ipv6: T4346: delete (migrate) CLI command to disable IPv6 address family

11 files changed, 181 insertions, 135 deletions

diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i
index fb4629bf1..19591256d 100644
--- a/interface-definitions/include/version/system-version.xml.i
+++ b/interface-definitions/include/version/system-version.xml.i
@@ -1,3 +1,3 @@
 <!-- include start from include/version/system-version.xml.i -->
-<syntaxVersion component='system' version='22'></syntaxVersion>
+<syntaxVersion component='system' version='23'></syntaxVersion>
 <!-- include end -->
diff --git a/interface-definitions/system-ipv6.xml.in b/interface-definitions/system-ipv6.xml.in
index af4dcdb0f..63260d00c 100644
--- a/interface-definitions/system-ipv6.xml.in
+++ b/interface-definitions/system-ipv6.xml.in
@@ -15,12 +15,6 @@
               <valueless/>
             </properties>
           </leafNode>
-          <leafNode name="disable">
-            <properties>
-              <help>Disable assignment of IPv6 addresses on all interfaces</help>
-              <valueless/>
-            </properties>
-          </leafNode>
           <node name="multipath">
             <properties>
               <help>IPv6 multipath settings</help>
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index 5b2760386..6b0f08fd4 100755
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -38,7 +38,6 @@ from vyos.util import read_file
 from vyos.util import get_interface_config
 from vyos.util import get_interface_namespace
 from vyos.util import is_systemd_service_active
-from vyos.util import is_ipv6_enabled
 from vyos.template import is_ipv4
 from vyos.template import is_ipv6
 from vyos.validate import is_intf_addr_assigned
@@ -1080,12 +1079,6 @@ class Interface(Control):
         if addr in self._addr:
             return False
 
-        addr_is_v4 = is_ipv4(addr)
-
-        # Failsave - do not add IPv6 address if IPv6 is disabled
-        if is_ipv6(addr) and not is_ipv6_enabled():
-            return False
-
         # add to interface
         if addr == 'dhcp':
             self.set_dhcp(True)
@@ -1517,50 +1510,48 @@ class Interface(Control):
         if 'mtu' in config:
             self.set_mtu(config.get('mtu'))
 
-        # Only change IPv6 parameters if IPv6 was not explicitly disabled
-        if is_ipv6_enabled():
-            # Configure MSS value for IPv6 TCP connections
-            tmp = dict_search('ipv6.adjust_mss', config)
-            value = tmp if (tmp != None) else '0'
-            self.set_tcp_ipv6_mss(value)
-
-            # IPv6 forwarding
-            tmp = dict_search('ipv6.disable_forwarding', config)
-            value = '0' if (tmp != None) else '1'
-            self.set_ipv6_forwarding(value)
-
-            # IPv6 router advertisements
-            tmp = dict_search('ipv6.address.autoconf', config)
-            value = '2' if (tmp != None) else '1'
-            if 'dhcpv6' in new_addr:
-                value = '2'
-            self.set_ipv6_accept_ra(value)
-
-            # IPv6 address autoconfiguration
-            tmp = dict_search('ipv6.address.autoconf', config)
-            value = '1' if (tmp != None) else '0'
-            self.set_ipv6_autoconf(value)
-
-            # IPv6 Duplicate Address Detection (DAD) tries
-            tmp = dict_search('ipv6.dup_addr_detect_transmits', config)
-            value = tmp if (tmp != None) else '1'
-            self.set_ipv6_dad_messages(value)
-
-            # Delete old IPv6 EUI64 addresses before changing MAC
-            for addr in (dict_search('ipv6.address.eui64_old', config) or []):
-                self.del_ipv6_eui64_address(addr)
-
-            # Manage IPv6 link-local addresses
-            if dict_search('ipv6.address.no_default_link_local', config) != None:
-                self.del_ipv6_eui64_address('fe80::/64')
-            else:
-                self.add_ipv6_eui64_address('fe80::/64')
+        # Configure MSS value for IPv6 TCP connections
+        tmp = dict_search('ipv6.adjust_mss', config)
+        value = tmp if (tmp != None) else '0'
+        self.set_tcp_ipv6_mss(value)
+
+        # IPv6 forwarding
+        tmp = dict_search('ipv6.disable_forwarding', config)
+        value = '0' if (tmp != None) else '1'
+        self.set_ipv6_forwarding(value)
+
+        # IPv6 router advertisements
+        tmp = dict_search('ipv6.address.autoconf', config)
+        value = '2' if (tmp != None) else '1'
+        if 'dhcpv6' in new_addr:
+            value = '2'
+        self.set_ipv6_accept_ra(value)
+
+        # IPv6 address autoconfiguration
+        tmp = dict_search('ipv6.address.autoconf', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_ipv6_autoconf(value)
+
+        # IPv6 Duplicate Address Detection (DAD) tries
+        tmp = dict_search('ipv6.dup_addr_detect_transmits', config)
+        value = tmp if (tmp != None) else '1'
+        self.set_ipv6_dad_messages(value)
+
+        # Delete old IPv6 EUI64 addresses before changing MAC
+        for addr in (dict_search('ipv6.address.eui64_old', config) or []):
+            self.del_ipv6_eui64_address(addr)
+
+        # Manage IPv6 link-local addresses
+        if dict_search('ipv6.address.no_default_link_local', config) != None:
+            self.del_ipv6_eui64_address('fe80::/64')
+        else:
+            self.add_ipv6_eui64_address('fe80::/64')
 
-            # Add IPv6 EUI-based addresses
-            tmp = dict_search('ipv6.address.eui64', config)
-            if tmp:
-                for addr in tmp:
-                    self.add_ipv6_eui64_address(addr)
+        # Add IPv6 EUI-based addresses
+        tmp = dict_search('ipv6.address.eui64', config)
+        if tmp:
+            for addr in tmp:
+                self.add_ipv6_eui64_address(addr)
 
         # re-add ourselves to any bridge we might have fallen out of
         if 'is_bridge_member' in config:
diff --git a/python/vyos/ifconfig/loopback.py b/python/vyos/ifconfig/loopback.py
index 30c890fdf..b3babfadc 100644
--- a/python/vyos/ifconfig/loopback.py
+++ b/python/vyos/ifconfig/loopback.py
@@ -14,7 +14,6 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from vyos.ifconfig.interface import Interface
-from vyos.util import is_ipv6_enabled
 
 @Interface.register
 class LoopbackIf(Interface):
@@ -58,15 +57,14 @@ class LoopbackIf(Interface):
         interface setup code and provide a single point of entry when workin
         on any interface. """
 
-        addr = config.get('address', [])
-
+        address = config.get('address', [])
         # We must ensure that the loopback addresses are never deleted from the system
-        addr.append('127.0.0.1/8')
-        if is_ipv6_enabled():
-            addr.append('::1/128')
+        for tmp in self._persistent_addresses:
+            if tmp not in address:
+                address.append(tmp)
 
         # Update IP address entry in our dictionary
-        config.update({'address' : addr})
+        config.update({'address' : address})
 
         # call base class
         super().update(config)
diff --git a/python/vyos/util.py b/python/vyos/util.py
index 0bf6b699e..de55e108b 100644
--- a/python/vyos/util.py
+++ b/python/vyos/util.py
@@ -1024,7 +1024,3 @@ def sysctl_write(name, value):
         call(f'sysctl -wq {name}={value}')
         return True
     return False
-
-def is_ipv6_enabled() -> bool:
-    """ Check if IPv6 support on the system is enabled or not """
-    return (sysctl_read('net.ipv6.conf.all.disable_ipv6') == '0')
diff --git a/smoketest/configs/ipv6-disable b/smoketest/configs/ipv6-disable
new file mode 100644
index 000000000..da41e9020
--- /dev/null
+++ b/smoketest/configs/ipv6-disable
@@ -0,0 +1,83 @@
+interfaces {
+    ethernet eth0 {
+        duplex auto
+        smp-affinity auto
+        speed auto
+        vif 201 {
+            address 172.18.201.10/24
+        }
+        vif 202 {
+            address 172.18.202.10/24
+        }
+        vif 203 {
+            address 172.18.203.10/24
+        }
+        vif 204 {
+            address 172.18.204.10/24
+        }
+    }
+}
+protocols {
+    static {
+        route 0.0.0.0/0 {
+            next-hop 172.18.201.254 {
+                distance 10
+            }
+            next-hop 172.18.202.254 {
+                distance 20
+            }
+            next-hop 172.18.203.254 {
+                distance 30
+            }
+            next-hop 172.18.204.254 {
+                distance 40
+            }
+        }
+    }
+}
+system {
+    config-management {
+        commit-revisions 200
+    }
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    domain-name vyos.net
+    host-name vyos
+    ipv6 {
+        disable
+    }
+    login {
+        user vyos {
+            authentication {
+                encrypted-password $6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/
+                plaintext-password ""
+            }
+            level admin
+        }
+    }
+    name-server 172.16.254.20
+    name-server 172.16.254.30
+    ntp {
+        server 172.16.254.20 {
+        }
+        server 172.16.254.30 {
+        }
+    }
+    syslog {
+        global {
+            facility all {
+                level info
+            }
+            facility protocols {
+                level debug
+            }
+        }
+    }
+}
+
+/* Warning: Do not remove the following line. */
+/* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@9:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */
+/* Release version: 1.2.6 */
diff --git a/smoketest/scripts/cli/test_system_ipv6.py b/smoketest/scripts/cli/test_system_ipv6.py
index 837d1dc12..c8aea9100 100755
--- a/smoketest/scripts/cli/test_system_ipv6.py
+++ b/smoketest/scripts/cli/test_system_ipv6.py
@@ -20,7 +20,6 @@ from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.template import is_ipv4
 from vyos.util import read_file
-from vyos.util import is_ipv6_enabled
 from vyos.util import get_interface_config
 from vyos.validate import is_intf_addr_assigned
 
@@ -46,41 +45,6 @@ class TestSystemIPv6(VyOSUnitTestSHIM.TestCase):
 
         self.assertEqual(read_file(file_forwarding), '0')
 
-    def test_system_ipv6_disable(self):
-        # Verify previous "enable" state
-        self.assertEqual(read_file(file_disable), '0')
-        self.assertTrue(is_ipv6_enabled())
-
-        loopbacks = ['127.0.0.1', '::1']
-        for addr in loopbacks:
-            self.assertTrue(is_intf_addr_assigned('lo', addr))
-
-        # Do not assign any IPv6 address on interfaces, this requires a reboot
-        # which can not be tested, but we can read the config file :)
-        self.cli_set(base_path + ['disable'])
-        self.cli_commit()
-
-        # Verify configuration file
-        self.assertEqual(read_file(file_disable), '1')
-        self.assertFalse(is_ipv6_enabled())
-
-        for addr in loopbacks:
-            if is_ipv4(addr):
-                self.assertTrue(is_intf_addr_assigned('lo', addr))
-            else:
-                self.assertFalse(is_intf_addr_assigned('lo', addr))
-
-        # T4330: Verify MTU can be changed with IPv6 disabled
-        mtu = '1600'
-        eth_if = 'eth0'
-        self.cli_set(['interfaces', 'ethernet', eth_if, 'mtu', mtu])
-        self.cli_commit()
-
-        tmp = get_interface_config(eth_if)
-        self.assertEqual(tmp['mtu'], int(mtu))
-
-        self.cli_delete(['interfaces', 'ethernet', eth_if, 'mtu'])
-
     def test_system_ipv6_strict_dad(self):
         # This defaults to 1
         self.assertEqual(read_file(file_dad), '1')
diff --git a/src/conf_mode/system-ipv6.py b/src/conf_mode/system-ipv6.py
index e6bcc12ad..26aacf46b 100755
--- a/src/conf_mode/system-ipv6.py
+++ b/src/conf_mode/system-ipv6.py
@@ -17,11 +17,8 @@
 import os
 
 from sys import exit
-from vyos.base import DeprecationWarning
 from vyos.config import Config
 from vyos.configdict import dict_merge
-from vyos.configdict import leaf_node_changed
-from vyos.util import call
 from vyos.util import dict_search
 from vyos.util import sysctl_write
 from vyos.util import write_file
@@ -39,9 +36,6 @@ def get_config(config=None):
 
     opt = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
 
-    tmp = leaf_node_changed(conf, base + ['disable'])
-    if tmp: opt['reboot_required'] = {}
-
     # We have gathered the dict representation of the CLI, but there are default
     # options which we need to update into the dictionary retrived.
     default_values = defaults(base)
@@ -50,24 +44,12 @@ def get_config(config=None):
     return opt
 
 def verify(opt):
-    if 'disable' in opt:
-        DeprecationWarning('VyOS 1.4 (sagitta) will remove the CLI command to '\
-                           'disable IPv6 address family in the Linux Kernel!')
     pass
 
 def generate(opt):
     pass
 
 def apply(opt):
-    # disable IPv6 globally
-    tmp = dict_search('disable', opt)
-    value = '1' if (tmp != None) else '0'
-    sysctl_write('net.ipv6.conf.all.disable_ipv6', value)
-
-    if 'reboot_required' in opt:
-        print('Changing IPv6 disable parameter will only take affect\n' \
-              'when the system is rebooted.')
-
     # configure multipath
     tmp = dict_search('multipath.layer4_hashing', opt)
     value = '1' if (tmp != None) else '0'
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index c3e2d8efd..f79c8a21e 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -30,7 +30,6 @@ from vyos.util import get_interface_config
 from vyos.util import popen
 from vyos.util import run
 from vyos.util import sysctl_write
-from vyos.util import is_ipv6_enabled
 from vyos import ConfigError
 from vyos import frr
 from vyos import airbag
@@ -219,8 +218,7 @@ def apply(vrf):
             # We also should add proper loopback IP addresses to the newly added
             # VRF for services bound to the loopback address (SNMP, NTP)
             vrf_if.add_addr('127.0.0.1/8')
-            if is_ipv6_enabled():
-                vrf_if.add_addr('::1/128')
+            vrf_if.add_addr('::1/128')
             # add VRF description if available
             vrf_if.set_alias(config.get('description', ''))
 
diff --git a/src/migration-scripts/system/22-to-23 b/src/migration-scripts/system/22-to-23
new file mode 100755
index 000000000..7f832e48a
--- /dev/null
+++ b/src/migration-scripts/system/22-to-23
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit, argv
+from vyos.configtree import ConfigTree
+
+if (len(argv) < 1):
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+base = ['system', 'ipv6']
+config = ConfigTree(config_file)
+
+if not config.exists(base):
+    # Nothing to do
+    exit(0)
+
+# T4346: drop support to disbale IPv6 address family within the OS Kernel
+if config.exists(base + ['disable']):
+    config.delete(base + ['disable'])
+    # IPv6 address family disable was the only CLI option set - we can cleanup
+    # the entire tree
+    if len(config.list_nodes(base)) == 0:
+        config.delete(base)
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print(f'Failed to save the modified config: {e}')
+    exit(1)
diff --git a/src/tests/test_util.py b/src/tests/test_util.py
index 91890262c..8ac9a500a 100644
--- a/src/tests/test_util.py
+++ b/src/tests/test_util.py
@@ -26,13 +26,3 @@ class TestVyOSUtil(TestCase):
 
     def test_sysctl_read(self):
         self.assertEqual(sysctl_read('net.ipv4.conf.lo.forwarding'), '1')
-
-    def test_ipv6_enabled(self):
-        tmp = sysctl_read('net.ipv6.conf.all.disable_ipv6')
-        # We need to test for both variants as this depends on how the
-        # Docker container is started (with or without IPv6 support) - so we
-        # will simply check both cases to not make the users life miserable.
-        if tmp == '0':
-            self.assertTrue(is_ipv6_enabled())
-        else:
-            self.assertFalse(is_ipv6_enabled())