diff --git a/src/etc/config.xml.sample b/src/etc/config.xml.sample index dff25b283..f75130262 100644 --- a/src/etc/config.xml.sample +++ b/src/etc/config.xml.sample @@ -227,7 +227,7 @@ 1 1 1 - + 1 hadp hadp hadp diff --git a/src/etc/inc/filter.lib.inc b/src/etc/inc/filter.lib.inc index 01f83651f..3c5923202 100644 --- a/src/etc/inc/filter.lib.inc +++ b/src/etc/inc/filter.lib.inc @@ -209,13 +209,13 @@ function filter_core_rules_system($fw, $defaults) $fw->registerFilterRule( 1, array('interface' => 'lo0', 'ipprotocol' => 'inet6', 'disabled' => isset($config['system']['ipv6allow']), - 'descr' => 'Pass all loopback IPv6', '#ref' => 'system_advanced_firewall.php#ipv6allow'), + 'descr' => 'Pass all loopback IPv6', '#ref' => 'system_advanced_network.php#ipv6allow'), $defaults['pass'] ); $fw->registerFilterRule( 1, array('ipprotocol' => 'inet6','descr' => 'Block all IPv6', 'disabled' => isset($config['system']['ipv6allow']), - '#ref' => 'system_advanced_firewall.php#ipv6allow'), + '#ref' => 'system_advanced_network.php#ipv6allow'), $defaults['block'] ); @@ -351,19 +351,19 @@ function filter_core_rules_system($fw, $defaults) 1, array('protocol' => 'udp', 'from' => 'fe80::/10', 'from_port' => 546, 'to' => 'fe80::/10', 'interface' => $intf, 'to_port' => 546, 'descr' => 'allow dhcpv6 client in ' . $intfinfo['descr'], - '#ref' => 'system_advanced_firewall.php#ipv6allow'), + '#ref' => 'system_advanced_network.php#ipv6allow'), $defaults['pass'] ); $fw->registerFilterRule( 1, array('protocol' => 'udp', 'from_port' => 547,'to_port' => 546, 'direction' => 'in', 'interface' => $intf, 'descr' => 'allow dhcpv6 client in ' . $intfinfo['descr'], - '#ref' => 'system_advanced_firewall.php#ipv6allow'), + '#ref' => 'system_advanced_network.php#ipv6allow'), $defaults['pass'] ); $dhcpv6_opts = array( 'descr' => 'allow dhcpv6 client in ' . $intfinfo['descr'], - '#ref' => 'system_advanced_firewall.php#ipv6allow', + '#ref' => 'system_advanced_network.php#ipv6allow', 'direction' => 'out', 'interface' => $intf, 'protocol' => 'udp', diff --git a/src/etc/inc/interfaces.inc b/src/etc/inc/interfaces.inc index a49599689..bbbdc7485 100644 --- a/src/etc/inc/interfaces.inc +++ b/src/etc/inc/interfaces.inc @@ -2314,15 +2314,12 @@ function interface_configure($verbose = false, $interface = 'wan', $reload = fal * already does that so at this point try to be more consistent. */ $interface_descr = sprintf('%s (%s)', !empty($wancfg['descr']) ? $wancfg['descr'] : strtoupper($interface), $interface); + /* XXX we should maybe set "ifdisabled" but it could be dangerous for assigned tunnel devices */ mwexecf('/sbin/ifconfig %s inet6 -accept_rtadv -no_dad description %s up', [$realif, $interface_descr]); - switch ($wancfg['ipaddrv6'] ?? 'none') { + switch (isset($config['system']['ipv6allow']) ? ($wancfg['ipaddrv6'] ?? 'none') : 'none') { case 'slaac': case 'dhcp6': - /* XXX move these to tunables maybe as they are global anyway */ - set_single_sysctl('net.inet6.ip6.accept_rtadv', '1'); - set_single_sysctl('net.inet6.ip6.rfc6204w3', '1'); - mwexecf('/sbin/ifconfig %s inet6 %saccept_rtadv -ifdisabled up', [$realifv6, isset($wancfg['dhcp6deny_rtadv']) ? '-' : '']); if (!isset($wancfg['dhcp6usev4iface'])) { diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc index 804509626..c3fa13052 100644 --- a/src/etc/inc/system.inc +++ b/src/etc/inc/system.inc @@ -74,8 +74,8 @@ function system_sysctl_defaults() 'hw.ixl.enable_head_writeback' => [ 'default' => '0', 'required' => true ], 'hw.syscons.kbd_reboot' => [ 'default' => '0' ], 'hw.uart.console' => [ 'default' => 'io:0x3f8,br:' . system_console_speed(), 'type' => 't' ], /* XXX support comconsole_port if needed */ - 'kern.ipc.maxsockbuf' => [ 'default' => '4262144' ], 'kern.coredump' => [ 'default' => '0', 'required' => true ], + 'kern.ipc.maxsockbuf' => [ 'default' => '4262144' ], 'kern.randompid' => [ 'default' => '1' ], 'net.enc.in.ipsec_bpf_mask' => [ 'default' => '2', 'required' => true ], /* after processing */ 'net.enc.in.ipsec_filter_mask' => [ 'default' => '2', 'required' => true ], /* after processing */ @@ -103,10 +103,12 @@ function system_sysctl_defaults() 'net.inet.udp.blackhole' => [ 'default' => '1' ], 'net.inet.udp.checksum' => [ 'default' => 1 ], 'net.inet.udp.maxdgram' => [ 'default' => '57344' ], + 'net.inet6.ip6.accept_rtadv' => [ 'default' => isset($config['system']['ipv6allow']) ? '1' : '0', 'required' => true ], 'net.inet6.ip6.forwarding' => [ 'default' => '1', 'required' => true ], 'net.inet6.ip6.intr_queue_maxlen' => [ 'default' => '1000', 'required' => true ], 'net.inet6.ip6.prefer_tempaddr' => [ 'default' => '0' ], 'net.inet6.ip6.redirect' => [ 'default' => '0' ], + 'net.inet6.ip6.rfc6204w3' => [ 'default' => isset($config['system']['ipv6allow']) ? '1' : '0', 'required' => true ], 'net.inet6.ip6.use_tempaddr' => [ 'default' => '0' ], 'net.link.bridge.pfil_bridge' => [ 'default' => '0' ], 'net.link.bridge.pfil_local_phys' => [ 'default' => '0' ], diff --git a/src/etc/rc.newwanip b/src/etc/rc.newwanip index cb6ec5af2..88fc123dd 100755 --- a/src/etc/rc.newwanip +++ b/src/etc/rc.newwanip @@ -82,7 +82,7 @@ interfaces_vips_configure($interface, 4); $greifs = link_interface_to_gre($interface, true, 4); $gififs = link_interface_to_gif($interface, true, 4); -switch ($config['interfaces'][$interface]['ipaddrv6'] ?? 'none') { +switch (isset($config['system']['ipv6allow']) ? ($config['interfaces'][$interface]['ipaddrv6'] ?? 'none') : 'none') { case '6to4': interface_6to4_configure($interface, $config['interfaces'][$interface], true); system_routing_configure(false, $interface); /* XXX interface recreation breaks attached routes */ diff --git a/src/www/system_advanced_firewall.php b/src/www/system_advanced_firewall.php index 05b51a9ae..8f49f01cb 100644 --- a/src/www/system_advanced_firewall.php +++ b/src/www/system_advanced_firewall.php @@ -35,7 +35,6 @@ require_once("system.inc"); if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig = array(); - $pconfig['ipv6allow'] = isset($config['system']['ipv6allow']); $pconfig['disablefilter'] = !empty($config['system']['disablefilter']); $pconfig['optimization'] = isset($config['system']['optimization']) ? $config['system']['optimization'] : "normal"; $pconfig['state-policy'] = isset($config['system']['state-policy']) ; @@ -151,12 +150,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { unset($config['system']['srctrack']); } - if (!empty($pconfig['ipv6allow'])) { - $config['system']['ipv6allow'] = true; - } elseif (isset($config['system']['ipv6allow'])) { - unset($config['system']['ipv6allow']); - } - if (!empty($pconfig['disablefilter'])) { $config['system']['disablefilter'] = "enabled"; } elseif (isset($config['system']['disablefilter'])) { @@ -305,29 +298,6 @@ include("head.inc"); ?>
-
- - - - - - - - - - 1): ?> -
- - -
- onclick="enable_change(false)" /> - - -
-
@@ -363,7 +333,6 @@ include("head.inc"); -
diff --git a/src/www/system_advanced_network.php b/src/www/system_advanced_network.php index fdcef8ced..44e075727 100644 --- a/src/www/system_advanced_network.php +++ b/src/www/system_advanced_network.php @@ -171,6 +171,7 @@ $duid = read_duid(); if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig = []; + $pconfig['ipv6allow'] = isset($config['system']['ipv6allow']); $pconfig['disablechecksumoffloading'] = isset($config['system']['disablechecksumoffloading']); $pconfig['disablesegmentationoffloading'] = isset($config['system']['disablesegmentationoffloading']); $pconfig['disablelargereceiveoffloading'] = isset($config['system']['disablelargereceiveoffloading']); @@ -198,6 +199,12 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { unset($config['system']['sharednet']); } + if (!empty($pconfig['ipv6allow'])) { + $config['system']['ipv6allow'] = true; + } elseif (isset($config['system']['ipv6allow'])) { + unset($config['system']['ipv6allow']); + } + if (!empty($pconfig['disablechecksumoffloading'])) { $config['system']['disablechecksumoffloading'] = true; } elseif (isset($config['system']['disablechecksumoffloading'])) { @@ -248,6 +255,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { interface_dhcpv6_configure('duidonly', null); /* XXX refactor */ system_sysctl_configure(); interfaces_hardware(); + /* XXX interfaces IPv6 mode is forced to disable maybe but we are not reconfiguring here */ + filter_configure(); } } @@ -257,6 +266,12 @@ include("head.inc"); ?> + +
@@ -285,7 +300,7 @@ include("head.inc"); /> - + @@ -295,7 +310,7 @@ include("head.inc"); /> -
+ @@ -305,7 +320,7 @@ include("head.inc"); /> -
+ @@ -333,13 +348,23 @@ include("head.inc"); - /> -
+ /> + + + + + /> + + + +