Support for ATT ipv6 and multiple PDs (#462)

* Support for ATT ipv6 and multiple PDs

* Add example output for successful PD

att-ipv6/10-att-ipv6.sh

@@ -0,0 +1,77 @@
+#! /bin/sh
+set -eo pipefail
+
+wan_iface="eth8"            # "eth9" for UDM Pro WAN2
+vlans="br0"                 # "br0 br100 br101..."
+domain="example.invalid"    # DNS domain
+dns6="[2001:4860:4860::8888],[2001:4860:4860::8844]" # Google
+
+CONTAINER=att-ipv6
+confdir=/mnt/data/att-ipv6
+
+# main
+mkdir -p "${confdir}/dhcpcd"
+
+test -f "${confdir}/dhcpcd.conf" || {
+  : > "${confdir}/dhcpcd.conf.tmp"
+  cat >> "${confdir}/dhcpcd.conf.tmp" <<EOF
+allowinterfaces ${wan_iface}
+ipv6only
+nooption domain_name_servers
+nooption domain_name
+duid
+persistent
+option rapid_commit
+option interface_mtu
+require dhcp_server_identifier
+slaac private
+noipv6rs
+
+interface ${wan_iface}
+  ipv6rs
+  ia_na 0
+EOF
+
+  ix=0
+  for vv in $vlans; do
+    echo "  ia_pd ${ix} ${vv}/0"
+    ix=$((ix+1))
+  done >> "${confdir}/dhcpcd.conf.tmp"
+  mv "${confdir}/dhcpcd.conf.tmp" "${confdir}/dhcpcd.conf"
+}
+
+test -f "${confdir}/att-ipv6-dnsmasq.conf" || {
+  : > "${confdir}/att-ipv6-dnsmasq.conf.tmp"
+  cat >> "${confdir}/att-ipv6-dnsmasq.conf.tmp" <<EOF
+#
+# via att-ipv6
+#
+enable-ra
+no-dhcp-interface=lo
+no-ping
+EOF
+
+  for vv in $vlans; do
+    cat <<EOF
+
+interface=${vv}
+dhcp-range=set:att-ipv6-${vv},::2,::7d1,constructor:${vv},slaac,ra-names,64,86400
+dhcp-option=tag:att-ipv6-${vv},option6:dns-server,${dns6}
+domain=${domain}|${vv}
+ra-param=${vv},high,0
+EOF
+  done >> "${confdir}/att-ipv6-dnsmasq.conf.tmp"
+mv "${confdir}/att-ipv6-dnsmasq.conf.tmp" "${confdir}/att-ipv6-dnsmasq.conf"
+}
+
+
+if podman container exists "$CONTAINER"; then
+  podman start "$CONTAINER"
+else
+  podman run -d --restart=always --name "$CONTAINER" -v "${confdir}/dhcpcd.conf:/etc/dhcpcd.conf" -v "${confdir}/dhcpcd:/var/lib/dhcpcd" --net=host --privileged ghcr.io/michaelw/dhcpcd
+fi
+
+
+# Fix DHCP, assumes DHCPv6 is turned off in UI
+cp "${confdir}/att-ipv6-dnsmasq.conf" /run/dnsmasq.conf.d/
+start-stop-daemon -K -q -x /usr/sbin/dnsmasq

att-ipv6/README.md

@@ -0,0 +1,129 @@
+# AT&T IPv6
+
+On ATT IPv6, the RG (residential gateway) receives a /60 prefix itself, but only hands out one /64 to routers in IP Passthrough mode, regardless how big of a prefix was requested.  The RG keeps the lower 8 /64s for its own purposes (`2600:1700:X:yyy0::/63`), and Unifi normally only receives `2600:1700:X:yyyf::/64`.
+
+This script enables UDM to receive up to 8 PDs on ATT IPv6 (tested with RG BGW320-500), usually starting at `2600:1700:X:yyyf::/64` down to `2600:1700:X:yyy8::/64`.
+Note that these may not always be assigned contiguous or in order.
+
+The price to pay is that almost none of the IPv6 support native to UDM remains enabled, hence options like DHCPv6 cannot be changed in the UI anymore.
+Firewall and routing rules remain functional, however.
+
+## Requirements
+
+1. You have successfully setup the on boot script described [here](https://github.com/unifi-utilities/unifios-utilities/tree/main/on-boot-script)
+2. You must set up the ATT RG in ["IP Passthrough" mode](https://patrickdomingues.com/2022/09/03/udm-pro-vpn-on-att-fiber-bgw320/)
+3. You must turn off IPv6 on the ATT WAN connection, AND on each network/VLAN (IPv6 Interface Type: None)
+4. You must add Firewall rules equivalent to (this can be done in the UI, select `Internet v6 Local` chain)
+    ```
+    -A UBIOS_WAN_LOCAL_USER -p udp -m udp --sport 547 --dport 546 -j RETURN   # select IPv6 Protocol "UDP" and create port groups for source port 547 and dest port 546
+    -A UBIOS_WAN_LOCAL_USER -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j RETURN # select IPv6 Protocol "ICMPv6" and IPv6ICMP  Type Name "Router Advertisement"
+    ```
+5. You may want to add a "Traffic Management" route on your ATT WAN device to access 192.168.1.254/32, so that you can access the RG after it is in passthrough mode.
+
+## Customization
+
+Near the top of `10-att-ipv6.sh`:
+
+    ```sh
+    wan_iface="eth8"            # use "eth9" for UDM Pro WAN2
+    vlans="br0"                 # "br0 br100 br101..."
+    domain="example.invalid"    # DNS domain
+    dns6="[2001:4860:4860::8888],[2001:4860:4860::8844]" # Google
+    ```
+
+This generates configuration files in directory `/mnt/data/att-ipv6`, if they don't exist.
+The files can be edited, or regenerated by deleting them and re-running the script.
+
+## Installation
+
+    ```sh
+    cd /mnt/data/on_boot.d
+    curl -LO https://raw.githubusercontent.com/unifi-utilities/unifios-utilities/HEAD/att-ipv6/10-att-ipv6.sh
+    chmod +x 10-att-ipv6.sh
+    ./10-att-ipv6.sh
+    ```
+
+The dhcpcd container being used is built [here](https://github.com/michaelw/dhcpcd-container/pkgs/container/dhcpcd)
+
+## Validation
+
+Running the script starts dhcpcd within the `att-ipv6` container on `eth8` (WAN1) and only for the default network (`br0`).  This can be customized, see above.
+
+To check that everything is working as expected, and the ATT RG delegates multiple prefixes:
+
+On UDM:
+```sh
+$ ip -6 r               # should see a default route on the WAN interface, and a 2600:1700:X:Y::/64 prefix on each configured VLAN bridge interface
+2600:1700:X:yyy0::/64 dev eth9 proto ra metric 203 mtu 1500 pref medium
+2600:1700:X:yyyb::/64 dev br104 proto dhcp metric 235 pref medium
+2600:1700:X:yyyc::/64 dev br103 proto dhcp metric 234 pref medium
+2600:1700:X:yyyd::/64 dev br102 proto dhcp metric 233 pref medium
+2600:1700:X:yyye::/64 dev br101 proto dhcp metric 232 pref medium
+2600:1700:X:yyyf::/64 dev br0 proto dhcp metric 212 pref medium
+[...]
+```
+
+```sh
+$ podman logs att-ipv6  # should see dhcpcd successfully acquiring prefixes
+[...]
+eth9: writing lease `/var/lib/dhcpcd/eth9.lease6'
+eth9: delegated prefix 2600:1700:X:yyyf::/64
+eth9: delegated prefix 2600:1700:X:yyye::/64
+eth9: delegated prefix 2600:1700:X:yyyd::/64
+eth9: delegated prefix 2600:1700:X:yyyc::/64
+eth9: delegated prefix 2600:1700:X:yyyb::/64
+br0: adding address 2600:1700:X:yyyf::1/64
+br0: pltime 3600 seconds, vltime 3600 seconds
+br0: executing `/lib/dhcpcd/dhcpcd-run-hooks' DELEGATED6
+br101: adding address 2600:1700:X:yyye::1/64
+br101: pltime 3600 seconds, vltime 3600 seconds
+br101: executing `/lib/dhcpcd/dhcpcd-run-hooks' DELEGATED6
+br102: adding address 2600:1700:X:yyyd::1/64
+br102: pltime 3600 seconds, vltime 3600 seconds
+br102: executing `/lib/dhcpcd/dhcpcd-run-hooks' DELEGATED6
+br103: adding address 2600:1700:X:yyyc::1/64
+br103: pltime 3600 seconds, vltime 3600 seconds
+br103: executing `/lib/dhcpcd/dhcpcd-run-hooks' DELEGATED6
+br104: adding address 2600:1700:X:yyyb::1/64
+br104: pltime 3600 seconds, vltime 3600 seconds
+br104: executing `/lib/dhcpcd/dhcpcd-run-hooks' DELEGATED6
+br0: adding route to 2600:1700:X:yyyf::/64
+br101: adding route to 2600:1700:X:yyye::/64
+br102: adding route to 2600:1700:X:yyyd::/64
+br103: adding route to 2600:1700:X:yyyc::/64
+br104: adding route to 2600:1700:X:yyyb::/64
+lo: deleting reject route to 2600:1700:X:yyyf::/64
+lo: deleting reject route to 2600:1700:X:yyye::/64
+lo: deleting reject route to 2600:1700:X:yyyd::/64
+lo: deleting reject route to 2600:1700:X:yyyc::/64
+lo: deleting reject route to 2600:1700:X:yyyb::/64
+[...]
+```
+
+```sh
+$ ps auxw|grep dnsmasq  # should see dnsmasq running
+```
+
+On BGW320-500, check https://192.168.1.254/cgi-bin/lanstatistics.ha for multiple PDs in `IPv6 Delegated Prefix Subnet (including length)`.
+
+
+On clients:
+```
+ip -6 addr show # should see SLAAC and/or DHCPv6 addresses received (if not, check dnsmasq configuration in `/run/dnsmasq.conf.d`)
+```
+
+### Useful commands
+
+```sh
+# View dhcpcd logs to verify the container is running without error (ipv6 logs from dhcpcd are normal).
+podman logs att-ipv6
+
+# Restart dhcpcd (e.g., after configuration change)
+podman exec -it dhcpcd -x
+
+# Stop the container
+podman stop att-ipv6
+
+# Remove the container
+podman rm att-ipv6
+```