{"action":"closed","issue":{"url":"https://api.github.com/repos/arno-iptables-firewall/aif/issues/34","repository_url":"https://api.github.com/repos/arno-iptables-firewall/aif","labels_url":"https://api.github.com/repos/arno-iptables-firewall/aif/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/arno-iptables-firewall/aif/issues/34/comments","events_url":"https://api.github.com/repos/arno-iptables-firewall/aif/issues/34/events","html_url":"https://github.com/arno-iptables-firewall/aif/issues/34","id":227161904,"number":34,"title":"Add EXT_IF_DHCPV6_IPV6 variable","user":{"login":"abelbeck","id":3116543,"avatar_url":"https://avatars2.githubusercontent.com/u/3116543?v=3","gravatar_id":"","url":"https://api.github.com/users/abelbeck","html_url":"https://github.com/abelbeck","followers_url":"https://api.github.com/users/abelbeck/followers","following_url":"https://api.github.com/users/abelbeck/following{/other_user}","gists_url":"https://api.github.com/users/abelbeck/gists{/gist_id}","starred_url":"https://api.github.com/users/abelbeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abelbeck/subscriptions","organizations_url":"https://api.github.com/users/abelbeck/orgs","repos_url":"https://api.github.com/users/abelbeck/repos","events_url":"https://api.github.com/users/abelbeck/events{/privacy}","received_events_url":"https://api.github.com/users/abelbeck/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"abelbeck","id":3116543,"avatar_url":"https://avatars2.githubusercontent.com/u/3116543?v=3","gravatar_id":"","url":"https://api.github.com/users/abelbeck","html_url":"https://github.com/abelbeck","followers_url":"https://api.github.com/users/abelbeck/followers","following_url":"https://api.github.com/users/abelbeck/following{/other_user}","gists_url":"https://api.github.com/users/abelbeck/gists{/gist_id}","starred_url":"https://api.github.com/users/abelbeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abelbeck/subscriptions","organizations_url":"https://api.github.com/users/abelbeck/orgs","repos_url":"https://api.github.com/users/abelbeck/repos","events_url":"https://api.github.com/users/abelbeck/events{/privacy}","received_events_url":"https://api.github.com/users/abelbeck/received_events","type":"User","site_admin":false},"assignees":[{"login":"abelbeck","id":3116543,"avatar_url":"https://avatars2.githubusercontent.com/u/3116543?v=3","gravatar_id":"","url":"https://api.github.com/users/abelbeck","html_url":"https://github.com/abelbeck","followers_url":"https://api.github.com/users/abelbeck/followers","following_url":"https://api.github.com/users/abelbeck/following{/other_user}","gists_url":"https://api.github.com/users/abelbeck/gists{/gist_id}","starred_url":"https://api.github.com/users/abelbeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abelbeck/subscriptions","organizations_url":"https://api.github.com/users/abelbeck/orgs","repos_url":"https://api.github.com/users/abelbeck/repos","events_url":"https://api.github.com/users/abelbeck/events{/privacy}","received_events_url":"https://api.github.com/users/abelbeck/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2017-05-08T20:18:37Z","updated_at":"2017-05-09T13:21:21Z","closed_at":"2017-05-09T13:21:21Z","body":"My business internet connection finally got native IPv6 using DHCPv6-PD and ran across an AIF configuration issue.\r\n\r\nIn my case, IPv4 is statically assigned, so ```EXT_IF_DHCP_IP=0``` .\r\n\r\nBut, in order to receive the return \"dhcp6 advertise\" in response to my \"dhcp6 solicit\", AIF needs to allow ```-p udp --sport 547 --dport 546```.\r\n\r\nCurrently the code is:\r\n```\r\n  # Here we add support for DHCP assigned IP\r\n  ##########################################\r\n  if [ \"$EXT_IF_DHCP_IP\" = \"1\" ]; then\r\n    echo \" Enabling support for DHCP-assigned-IP (DHCP client)\"\r\n    # Allow this host to be an DHCP client:\r\n    ip4tables -A EXT_INPUT_CHAIN -p udp --sport 67 --dport 68 -j ACCEPT\r\n    if [ \"$IPV6_SUPPORT\" = \"1\" ]; then\r\n      # Allow this host to be an DHCPv6 client:\r\n      ip6tables -A EXT_INPUT_CHAIN -p udp --sport 547 --dport 546 -j ACCEPT\r\n    fi\r\n  fi\r\n```\r\nIt is not ideal to set ```EXT_IF_DHCP_IP=1``` in this case.\r\n\r\nI propose we add a ```EXT_IF_DHCPV6_IPV6``` variable, as such:\r\n```\r\n  # Here we add support for DHCP assigned IP\r\n  ##########################################\r\n  if [ \"$EXT_IF_DHCP_IP\" = \"1\" ]; then\r\n    echo \" Enabling support for DHCP-assigned-IP (DHCP client)\"\r\n    # Allow this host to be an DHCP client:\r\n    ip4tables -A EXT_INPUT_CHAIN -p udp --sport 67 --dport 68 -j ACCEPT\r\n    if [ \"$IPV6_SUPPORT\" = \"1\" ]; then\r\n      # Allow this host to be an DHCPv6 client:\r\n      ip6tables -A EXT_INPUT_CHAIN -p udp --sport 547 --dport 546 -j ACCEPT\r\n    fi\r\n+  elif [ \"$EXT_IF_DHCPV6_IPV6\" = \"1\" ]; then\r\n+    if [ \"$IPV6_SUPPORT\" = \"1\" ]; then\r\n+      # Allow this host to be an DHCPv6 client via Link-Local:\r\n+      ip6tables -A EXT_INPUT_CHAIN -s fe80::/10 -p udp --sport 547 --dport 546 -j ACCEPT\r\n+    fi\r\n  fi\r\n```\r\n\r\nWhile it would be a change, do we want to also limit ```EXT_IF_DHCP_IP=1``` DHCPv6 client to Link-Local only as well ?  If so we could combine them in one test.\r\n\r\nThoughts @arnova ?"}}
{"actor":{"display_login":"abelbeck"}}