pfsensible / core

Core modules for managing pfSense firewalls with ansible
GNU General Public License v3.0
199 stars 48 forks source link

pfsense_interface does not support IPv6 Configuration types: DHCP6, 6rd Tunnel, 6t4 Tunnel and Track Interface #123

Open der-gabe opened 5 months ago

der-gabe commented 5 months ago

Describe the bug I have a Netgate SG2100 router and have been trying to use pfsensible.core to configure it.

The router sits behind a cable modem, so the WAN interface gets its IPv4 address via DHCP and the IPv6 address via either DHCP6 or SLAAC (both work).

I was able set up the the WAN interface successfully with IPv6 config. type SLAAC. (Thanks! :slightly_smiling_face: :+1:)

Now I want to configure the LAN interface. Specifically, I want the LAN interface's IPv6 address to track that of the WAN interface, since that might change and there is no NATting and no private subnets in IPv6 (or at least not in the way we're used to from IPv4). So I cannot use IPv6 Configuration Type "static" and set a static IPv6 address and prefix length.

I can do this manually, but not with pfsensbile.core, because pfsense_interface's ipv6_type field only supports the values none, static and slaac, while pfSense additionally supports:

Each of these options comes with additional sub-options, except for "6t4 Tunnel".

Expected behavior

pfsense_interface should probably support all the IPv6 Configuration Types that pfSense offers.

Playbook Please paste a minimal playbook to reproduce the issue:

---
- name: Interfaces
  hosts: "netgate-sg2100.lan"
  tasks:
  - name: LAN interface
    pfsensible.core.pfsense_interface:
      descr: LAN
      enable: true
      ipv4_address: 192.168.1.1
      ipv4_type: static
      ipv6_type: track_interface
      ipv6_interface: WAN
      ipv6_prefix_id: 0
      interface: mvneta1

Output Please paste the ansible output run with -vv:

ansible-playbook [core 2.16.4]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/gabe/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.11/site-packages/ansible
  ansible collection location = /home/gabe/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible-playbook
  python version = 3.11.8 (main, Feb 08 2024, 08:03:16) [GCC] (/usr/bin/python3.11)
  jinja version = 3.1.3
  libyaml = True
Using /etc/ansible/ansible.cfg as config file
Skipping callback 'default', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.

PLAYBOOK: playbook.yml *************************************************************************************************************
4 plays in playbook.yml
[...]
TASK [LAN interface] ***************************************************************************************************************
task path: /home/gabe/git/iupiter/kenough/playbook.yml:25
fatal: [netgate-sg2100.lan]: FAILED! => {"changed": false, "msg": "value of ipv6_type must be one of: none, static, slaac, got: track_interface"}

Environment

Additional context Personally, I only need "Track Interface" ~but I think DHCP6 is common enough~ EDIT: and DHCP6 (my setup has changed). And I think that pfsense_interface should probably support ~it~ both to be anywhere near feature complete.

I speak Python and I'd be willing to help out with implementation, but I don't know the codebase of pfsensible.core and I've never implemented anything for Ansible, so it might take me forever...

I'm definitely available for testing and review, though!

der-gabe commented 5 months ago

Come to think of it, I should probably have opened this as a feature request...

I can't seem to change this now, but feel free to relabel.