T7682: incorrect sla-len in DHCPv6 client prefix delegation (DHCPv6-PD)

The current template has an overly optimistic logic for sla-len calculation,
relying on an assumption that a server always provides a prefix with the exact
length requested by the client. This is incorrect. According to RFC8415 and
RFC7084, the prefix length in a request is only a hint for the server, which
may decide to provide a different prefix size.

The big issue here is that wide-dhcpv6-client uses the sla-len value from the
configuration regardless of the received prefix size. This seems to be the
known issue.

The good news is that we have already inherited a patch from Debian to mitigate
the issue [1]. It accomplishes exactly what we are doing in the configuration
template, but with the advantage of using the actual prefix length from the
received prefix, rather than the one configured in the configuration file.

If we simply remove sla-len from the template, everything appears to function
normally.

Before - server sending /56

set interfaces ethernet eth1 address 'dhcpv6'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 address '1'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 sla-id '0'
set interfaces ethernet eth1 dhcpv6-options pd 1 length '60'

Resulted in:

vyos@vyos# run show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address           MAC                VRF        MTU  S/L    Description
-----------  -------------------  -----------------  -------  -----  -----  -------------
eth1         fc00:0:0:1::200/128  0c:67:94:67:00:01  default   1500  u/u
eth2         fc00:0:2:ff00::1/60  0c:67:94:67:00:02  default   1500  u/u

Whereas IPv6 PD should always use a /64 prefix on the interface we assign a
dynamic DHCPv6 prefix to.

After the fix:

vyos@vyos:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address           MAC                VRF        MTU  S/L    Description
-----------  -------------------  -----------------  -------  -----  -----  -------------
eth1         fc00:0:0:1::200/128  0c:67:94:67:00:01  default   1500  u/u
eth2         fc00:0:2:ff00::1/64  0c:67:94:67:00:02  default   1500  u/u

If a DHCPv6 server (e.g. VyOS itself) even provides multiple PD prefixes, the
right one is choosen. Assume the following server configuration:

set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 address-range start fc00:0:0:1::100 stop 'fc00:0:0:1::200'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 lease-time default '120'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: prefix-length '56'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: stop 'fc00:0:2:ff00::'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: prefix-length '60'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: stop 'fc00:0:3:ff00::'

If a /56 is requested ("dhcpv6-options pd 1 length 56") - we will get a per
interface /64 from the original /56 prefix-delegation from the DHCPv6 server.
If the user suddently requests a /60 ("dhcpv6-options pd 1 length 60") the
delegated prefix will be from the above fc00:0:3:: pool.

1: https://salsa.debian.org/debian/wide-dhcpv6/-/blob/debian/20080615-23/debian/patches/0021-Make-sla-len-config-optional.patch

0 files changed, 0 insertions, 0 deletions