Skip to content

Commit

Permalink
interfaces: also set PCP value on IPv4 DHCP traffic
Browse files Browse the repository at this point in the history 
PR: https://forum.opnsense.org/index.php?topic=33376.0
  • Loading branch information
@fichtner
fichtner committed Apr 9, 2023
1 parent 9d950c8 commit d08a425
Showing 1 changed file with 10 additions and 7 deletions.
17 changes: 10 additions & 7 deletions src/etc/inc/filter.lib.inc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -399,13 +399,16 @@ function filter_core_rules_system($fw, $defaults)
'interface' => $intf, 'descr' => 'allow DHCP client on ' . $intfinfo['descr']),
$defaults['pass']
);
$fw->registerFilterRule(
5,
array('protocol' => 'udp', 'direction' => 'out', 'quick' => false, 'from_port' => 68, 'to_port' => 67,
'#ref' => "interfaces.php?if=" . $intf . "#type",
'interface' => $intf, 'descr' => 'allow DHCP client on ' . $intfinfo['descr']),
$defaults['pass']
);
$dhcpv4_opts = [
'protocol' => 'udp','direction' => 'out', 'quick' => false, 'from_port' => 68, 'to_port' => 67,
'#ref' => "interfaces.php?if=" . $intf . "#type",
'interface' => $intf, 'descr' => 'allow DHCP client on ' . $intfinfo['descr'],
];
/* XXX it looks like we need a property for IPv4 VLAN PCP again */
if (isset($intfinfo['dhcp6vlanprio'])) {
$dhcpv4_opts['set-prio'] = $intfinfo['dhcp6vlanprio'];
}
$fw->registerFilterRule(5, $dhcpv4_opts, $defaults['pass']);
break;
default:
if (isset($config['dhcpd'][$intf]['enable'])) {
Expand Down

5 comments on commit d08a425

@fichtner
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Our own fix which pfSense didn’t want may have worked around the bug introduced by it… opnsense/src@5e4e4f8

@fichtner
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For reference the fix for BPF but not unicast socket: opnsense/src@50ecd99

@tduboys
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the recent issue with Orange.fr regarding vlan priority is caused by this part :
https://github.com/opnsense/src/blob/stable/23.1/sbin/dhclient/bpf.c#L376

when renewing the lease, the client sent a unicast packet to the last known dhcp server, so it dont use the bpf socket and dont have the priority set

@fichtner
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, but the firewall rule in this patch should take care of this and if not its scope may be wrong. IPv6 works the same way. We only ever had dhclient patches because they were written years before and worked reliably until upstream changed this perhaps…

@fichtner
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tduboys 3ed4f6d might be needed as well, see forum discussion

Please sign in to comment.