mirror of
https://github.com/trailofbits/algo.git
synced 2025-10-05 18:15:31 +02:00
146e2dcf24
* fix: Fix IPv6 address selection on BSD systems (#1843) BSD systems return IPv6 addresses in the order they were added to the interface, not sorted by scope like Linux. This causes ansible_default_ipv6 to contain link-local addresses (fe80::) with interface suffixes (%em0) instead of global addresses, breaking certificate generation. This fix: - Adds a new task file to properly select global IPv6 addresses on BSD - Filters out link-local addresses and interface suffixes - Falls back to ansible_all_ipv6_addresses when needed - Ensures certificates are generated with valid global IPv6 addresses The workaround is implemented in Algo rather than waiting for the upstream Ansible issue (#16977) to be fixed, which has been open since 2016. Fixes #1843 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * chore: Remove duplicate condition in BSD IPv6 facts Removed redundant 'global_ipv6_address is not defined' condition that was checked twice in the same when clause. * improve: simplify regex for IPv6 interface suffix removal Change regex from '(.*)%.*' to '%.*' for better readability and performance when stripping interface suffixes from IPv6 addresses. The simplified regex is equivalent but more concise and easier to understand. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: resolve yamllint trailing spaces in BSD IPv6 test Remove trailing spaces from test_bsd_ipv6.yml to ensure CI passes 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: resolve yamllint issues across repository - Remove trailing spaces from server.yml, WireGuard test files, and keys.yml - Add missing newlines at end of test files - Ensure all YAML files pass yamllint validation for CI 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
56 lines
2.3 KiB
YAML
56 lines
2.3 KiB
YAML
---
|
|
# BSD systems return IPv6 addresses in the order they were added to the interface,
|
|
# not sorted by scope like Linux does. This means ansible_default_ipv6 often contains
|
|
# a link-local address (fe80::) instead of a global address, which breaks certificate
|
|
# generation due to the %interface suffix.
|
|
#
|
|
# This task file creates a fact with the first global IPv6 address found.
|
|
|
|
- name: Initialize all_ipv6_addresses as empty list
|
|
set_fact:
|
|
all_ipv6_addresses: []
|
|
|
|
- name: Get all IPv6 addresses for the default interface
|
|
set_fact:
|
|
all_ipv6_addresses: "{{ ansible_facts[ansible_default_ipv6.interface]['ipv6'] | default([]) }}"
|
|
when:
|
|
- ansible_default_ipv6 is defined
|
|
- ansible_default_ipv6.interface is defined
|
|
- ansible_facts[ansible_default_ipv6.interface] is defined
|
|
|
|
- name: Find first global IPv6 address from interface-specific addresses
|
|
set_fact:
|
|
global_ipv6_address: "{{ item.address }}"
|
|
global_ipv6_prefix: "{{ item.prefix }}"
|
|
loop: "{{ all_ipv6_addresses }}"
|
|
when:
|
|
- all_ipv6_addresses | length > 0
|
|
- item.address is defined
|
|
- not item.address.startswith('fe80:') # Filter out link-local addresses
|
|
- "'%' not in item.address" # Ensure no interface suffix
|
|
- global_ipv6_address is not defined # Only set once
|
|
loop_control:
|
|
label: "{{ item.address | default('no address') }}"
|
|
|
|
- name: Find first global IPv6 address from ansible_all_ipv6_addresses
|
|
set_fact:
|
|
global_ipv6_address: "{{ item | regex_replace('%.*', '') }}"
|
|
global_ipv6_prefix: "128" # Assume /128 for addresses from this list
|
|
loop: "{{ ansible_all_ipv6_addresses | default([]) }}"
|
|
when:
|
|
- global_ipv6_address is not defined
|
|
- ansible_all_ipv6_addresses is defined
|
|
- not item.startswith('fe80:')
|
|
|
|
- name: Override ansible_default_ipv6 with global address on BSD
|
|
set_fact:
|
|
ansible_default_ipv6: "{{ ansible_default_ipv6 | combine({'address': global_ipv6_address, 'prefix': global_ipv6_prefix}) }}"
|
|
when:
|
|
- global_ipv6_address is defined
|
|
- ansible_default_ipv6 is defined
|
|
- ansible_default_ipv6.address.startswith('fe80:') or '%' in ansible_default_ipv6.address
|
|
|
|
- name: Debug IPv6 address selection
|
|
debug:
|
|
msg: "Selected IPv6 address: {{ ansible_default_ipv6.address | default('none') }}"
|
|
when: algo_debug | default(false) | bool
|