lime-proto-wan fails trying to allow link local traffic on WAN. Fix or erase?

[ilario]

Restarting the firewall using /etc/init.d/firewall restart on a LibreMesh with the latest LibreMesh code on top of OpenWrt 24.10, I observed this message:

Section lime_allow_wan_all_link_local (lime_allow_wan_all_link_local) is restricted to IPv4 but referenced source IP is IPv6 only, skipping

That is caused by this section present in /etc/config/firewall:

config rule 'lime_allow_wan_all_link_local'       
        option name 'lime_allow_wan_all_link_local'
        option src 'wan'                    
        option family 'ipv6'                    
        option src_ip 'fe80::/10'                  
        option dest_ip 'fe80::/10'                
        option target 'ACCEPT'                    
        option family ipv4

The option family is specified twice, which is wrong.
Weirdly, in lime-proto-wan, only option family ipv6 is present:

lime-packages/packages/lime-proto-wan/files/usr/lib/lua/lime/proto/wan.lua

Lines 31 to 42 in 5f955d5

	--! Accepting link local traffic also on WAN should not cause hazards.
	--! It is very helpful in cases where the devices have problem to the other
	--! ports, to have at least an addictional way to enter for rescue operation
	local ALLOW_WAN_LL_SECT = "lime_allow_wan_all_link_local"
	uci:set("firewall", ALLOW_WAN_LL_SECT, "rule")
	uci:set("firewall", ALLOW_WAN_LL_SECT, "name", ALLOW_WAN_LL_SECT)
	uci:set("firewall", ALLOW_WAN_LL_SECT, "src", "wan")
	uci:set("firewall", ALLOW_WAN_LL_SECT, "family", "ipv6")
	uci:set("firewall", ALLOW_WAN_LL_SECT, "src_ip", "fe80::/10")
	uci:set("firewall", ALLOW_WAN_LL_SECT, "dest_ip", "fe80::/10")
	uci:set("firewall", ALLOW_WAN_LL_SECT, "target", "ACCEPT")
	uci:save("firewall")

Running again lime-config made disappear that option family ipv4 line, so now I am a bit confused, can anyone confirm this?

Anyway, before trying to fix, I would like to make sure that we still want to have this section. What this section means is that even if the firewall blocks all ports (e.g. blocks SSH connections on port 22 coming from the internet), it does not block any of them if IPv6 is used for the connection. Which means that the internet cannot access your port 22, but that your internet service provider can. Or whatever you have on the other side of the WAN cable, which can be a not-so-trusted network. I think that this is a bit risky AND nobody would expect this, also because it is not documented at all.

Negative aspect of having that section: lowers security without the user expecting it.
Positive aspect of having that section: an additional way to log in when some seriously bad configuration blocks you from using the LAN ports or the WiFi access point or the WiFi mesh.

This has been added by @altergui and approved by @p4u and @G10h4ck in #239. Do we still want this?

[p4u]

Wow, it has been like 10 years ago, I don't know what you talking about :)

[ilario]

Hehehe don't worry, I was tagging just for historical reference :) Sorry for the noise!
The question "Do we still want this?" was for the currently active LibreMesh community :)
For example @a-gave @pony1k @digitigrafo @javierbrk @G10h4ck @luandro @tdruiva @usg-ishimura