#1148882 ferm: ferm-early needs support for DHCPv6

Package:
ferm
Source:
ferm
Submitter:
David Härdeman
Date:
2026-10-07 11:15:01 UTC
Severity:
normal
Tags:
#1148882#5
Date:
2026-09-24 15:54:12 UTC
From:
To:
Dear Maintainer,

ferm-early.service runs before network-pre.target and ferm.service runs
after network-online.target.

network-online.target might (systemd/Network-Manager) rely on DHCPv6,
but there's no support for DHCPv6 in ferm-early.service, meaning that
network-online.target will hang waiting for a DHCPv6 reply which is
filtered.

DHCPv4 works because DHCPv4 clients will typically use a raw socket and
later unicast (which will be handled by conntracking), but DHCPv6 sends
multicast messages and receives a reply via a link-local address, so
that's not something conntrack can handle.

As a workaround, I've added this as /etc/ferm/ferm-early.d/dhcpv6.conf:

domain ip6 table filter chain INPUT {
         proto udp saddr fe80::/10 sport 547 dport 546 ACCEPT;
         proto ipv6-icmp ACCEPT;
}

Which works for me (the icmp part isn't strictly necessary, more for
feature-parity with IPv4), but it would be nice if this was supported
correctly out of the box.
#1148882#10
Date:
2026-09-24 17:30:56 UTC
From:
To:
Hi David,

thanks for spotting this. As an IPv6 user, I should have seen and
noticed that myself.

I have drafted a fix in zg/icmpv6,
https://salsa.debian.org/debian/ferm/-/tree/zg/icmpv6?ref_type=heads,
but didnt get around yet to fixing it. Would you want to try?

Greetings
Marc
#1148882#15
Date:
2026-09-25 07:27:58 UTC
From:
To:
Hi Marc,

I did a quick and dirty test by downloading only debian/ferm-early.conf
from that branch and putting it in /etc/ferm/ferm-early.conf (also
removed my local modifications) followed by a reboot. It seems to work
as expected (DHCPv6 lease obtained quickly, boot wasn't delayed).

Cheers,
David
#1148882#20
Date:
2026-09-25 11:33:46 UTC
From:
To:
Hi David,

Are you already running a reasonably late ferm version that allows you
to run with debugging enabled? I would be interested in exactly how the
early ruleset looks on your system with the patch.

Greetings
Marc
#1148882#25
Date:
2026-10-07 11:13:48 UTC
From:
To:
Yeah, I'm running Debian Unstable (ferm 2.7-9) on the system where I did
the testing, and I already added some custom systemd .service files to
tcpdump the traffic to diagnose the initial issue, so further debugging
output should be easy to provide. Which steps do you want me to
take/which debugging info do you want?

Cheers,
David