okay. so the config's cleaned up, and we now create a sparse example config file.

utils/he_ipv6/config.py

@@ -1,53 +1,71 @@
 import collections
 import copy
-import ipaddress
 import os
 import re
 ##
-import netaddr
 import requests
 import requests.auth
 from lxml import etree
-from pyroute2 import IPRoute
 ##
 from . import tunnel
 
 
 def create_default_cfg():
     # Create a stripped sample config.
-    nsmap = {None: 'https://tunnelbroker.net/',
+    ws_re = re.compile(r'^\s*$')
-             'xsi': 'http://www.w3.org/2001/XMLSchema-instance'}
+    cur_dir = os.path.dirname(os.path.abspath(os.path.expanduser(__file__)))
-    attr_qname = etree.QName('http://www.w3.org/2001/XMLSchema-instance', 'schemaLocation')
+    xtbxml = os.path.join(cur_dir, 'example.tunnelbroker.xml')
-    schema_url = 'http://schema.xml.r00t2.io/projects/he_ipv6.xsd'
+    with open(xtbxml, 'rb') as fh:
-    schema_loc = '{0} {1}'.format(nsmap[None], schema_url)
+        xml = etree.fromstring(fh.read())
-    xml = etree.Element('heIPv6',
+    # Create a stripped sample config.
-                        {attr_qname: schema_loc},
+    # First we strip comments (and fix the ensuing whitespace).
-                        nsmap = nsmap)
+    # etree has a .canonicalize(), but it chokes on a default namespace.
-    xml.append(etree.Comment(('See example.tunnelbroker.xml for an extensively commented sample config.')))
+    # https://bugs.launchpad.net/lxml/+bug/1869455
-    creds = etree.SubElement(xml, 'creds')
+    # So everything we do is kind of a hack.
-    creds.append(etree.Comment(('Your tunnelbroker.net *login*. You can specify multiple credentials via multiple '
+    # for c in xml.xpath("//comment()"):
-                                '"cred" items. The "id" attribute is up to you but it must be unique.')))
+    #    parent = c.getparent()
-    cred = etree.SubElement(creds, 'cred')
+    #    parent.remove(c)
-    cred.attrib['id'] = ''
+    xmlstr = etree.tostring(xml, with_comments = False, method = 'c14n', pretty_print = True).decode('utf-8')
-    user = etree.SubElement(cred, 'user')
+    newstr = []
-    user.text = ''
+    for line in xmlstr.splitlines():
-    password = etree.SubElement(cred, 'password')
+        r = ws_re.search(line)
-    password.text = ''
+        if not r:
-    tunnels = etree.SubElement(xml, 'tunnels')
+            newstr.append(line.strip())
-    tunnels.append(etree.Comment(('You can have define multiple tunnels via multiple "tunnel" items. You should most '
+    xml = etree.fromstring(''.join(newstr).encode('utf-8'))
-                                  'likely only run one at a time.')))
+    # Remove text and attr text.
-    tunnel = etree.SubElement(tunnels, 'tunnel')
+    xpathq = "descendant-or-self::*[namespace-uri()!='']"
-    tunnel.append(etree.Comment(('The "id" attribute should match the id number of a tunnel on your tunnelbroker.net '
+    for e in xml.xpath(xpathq):
-                                 'account. The "creds" attribute references a cred item id attribute.')))
+        if e.tag == '{{{0}}}heIPv6'.format(xml.nsmap[None]):
-    tunnel.attrib['id'] = ''
+            continue
-    tunnel.attrib['creds'] = ''
+        if e.text is not None and e.text.strip() != '':
-    ukey = etree.SubElement(tunnel, '')
+            e.text = ''
-    return (etree.tostring(xml,
+        for k, v in e.attrib.items():
-                           encoding = 'UTF-8',
+            if v is not None:
-                           xml_declaration = True,
+                e.attrib[k] = ''
-                           pretty_print = True,
+    # Remove multiple children of same type to simplify.
-                           with_tail = True,
+    for e in xml.xpath(xpathq):
-                           with_comments = True))
+        if e.tag == '{{{0}}}heIPv6'.format(xml.nsmap[None]):
+            continue
+        parent = e.getparent()
+        try:
+            for idx, child in enumerate(parent.findall(e.tag)):
+                if idx == 0:
+                    continue
+                parent.remove(child)
+        except AttributeError:
+            pass
+    # And add a comment pointing them to the fully commented config.
+    xml.insert(0, etree.Comment(('\n  Please reference the fully commented example.tunnelbroker.xml found either '
+                                 'at:\n  '
+                                 '  * {0}\n    * https://git.square-r00t.net/RouterBox/tree/utils/he_ipv6/'
+                                 'example.tunnelbroker.xml\n  and then configure this according to those '
+                                 'instructions.\n  ').format(xtbxml)))
+    return(etree.tostring(xml,
+                          pretty_print = True,
+                          with_comments = True,
+                          with_tail = True,
+                          encoding = 'UTF-8',
+                          xml_declaration = True))
 
 
 class Credential(object):
@@ -189,7 +207,10 @@ class Config(BaseConfig):
     def __init__(self, xml_path, *args, **kwargs):
         self.xml_path = os.path.abspath(os.path.expanduser(xml_path))
         if not os.path.isfile(self.xml_path):
-            raise ValueError('xml_path does not exist')
+            with open(self.xml_path, 'wb') as fh:
+                fh.write(create_default_cfg())
+            raise ValueError('xml_path does not exist; '
+                             'a sample configuration has been generated (be sure to configure it)')
         else:
             with open(xml_path, 'rb') as fh:
                 raw_xml = fh.read()

utils/he_ipv6/example.tunnelbroker.xml

@@ -8,7 +8,8 @@
     https://www.tunnelbroker.net/tunnel_detail.php?tid=584532
   I highly recommend their (free) certification as well if you're brand-new to IPv6:
     https://ipv6.he.net/certification/
-  **It is VERY highly encouraged to only use one tunnel at a time on a machine.**
+  **It is VERY highly encouraged to only use one tunnel at a time on a machine. Completely unpredictable results will
+    incur if this is not heeded.**
   -->
   <creds>
     <!--
@@ -39,10 +40,14 @@
       -->
       <updateKey>xXxXxXxXxXxXxXXX</updateKey>
       <!--
-      Where to assign your allocations. The default allocation prefix is a /64 (prefix="64"), since that's what SLAAC
+      Where to assign your allocations. The default allocation prefix is a /64 (prefix="64"), since that's what
-      recommends.
+      SLAAC (RFC 2462) recommends.
-      It has one optional attribute, "raProvider", which can be "dnsmasq" or "radvd". Further system configuration may
+      It has one optional attribute, "raProvider", which can be "dnsmasq" or "radvd". Its configuration file will be
-      be required. If not specified, the default is to not send router advertisements.
+      regenerated and the service restarted after the addresses are allocated to interfaces. Further system
+      configuration may be required. If not specified, the default is to not send router advertisements (RFC 4861). See
+      the "ra" child element under <assign> for further details.
+      If you are using dnsmasq, you will want to edit dnsmasq.conf to *include* the generated file, most likely, as it
+      only generates configuration for IPv6 options.
       -->
       <assignments raProvider="dnsmasq">
         <!--
@@ -60,24 +65,52 @@
         -->
         <assign prefix="64" alloc="64" iface="eth0">
           <!--
-          Each assignment can have an "ra" child. The default is to not implement RA for this interface if not
+          Each assignment CAN have an "ra" child. The default is to not implement RA for this interface if an ra element
-          present.
+          is not present.
+          It takes one optional attribute, which is only used for raProvider="dnsmasq", "tag", which is the tag name for
+          the interface (this should be set in an earlier included conf/the main dnsmasq.conf).
           -->
-          <ra>
+          <ra tag="main">
-            <dns>true</dns>
+            <!--
-            <dhcpv6>true</dhcpv6>
+            Specify RDNSS (RFC 8106). If specified, this allocation's "router IP" (<PREFIX>::1) will be passed as a
+            resolver via RDNSS.
+            It takes one (optional) attribute, "domains", which is a space-separated list of search domains, referred
+            to in IPv6 as DNSSL (RFC 6106).
+            Note that Windows does not support DNSSL, and as such you must use dhcpv6's "domains" attribute if you wish
+            to do that.
+            If "domains" is specified but the element is false, the configuration will only advertise DNSSL and not
+            RDNSS.
+            -->
+            <dns domains="foo.com bar.com">true</dns>
+            <!--
+            Enable DHCPv6 for this assignment. Only used for dnsmasq, has no effect for radvd. As mentioned above, you
+            can also specify the "domains" attribute here as well, which will pass them via a regular DHCPv6 option.
+            If "domains" is specified but the element is false, only the domains will be passed.
+            Again, this only pertains to dnsmasq since radvd offers no DHCPv6 capabilities whatsoever.
+            -->
+            <dhcpv6 domains="foo.com bar.com">true</dhcpv6>
           </ra>
         </assign>
+        <!-- Disable RA for this set (no "ra" chiled specified). -->
         <assign prefix="64" alloc="48" iface="eth0"/>
         <assign prefix="64" alloc="48" iface="eth1">
-
+          <ra tag="vmlan">
+            <!-- This will use strictly SLAAC (if using dnsmasq, obviously - radvd only does SLAAC). -->
+            <dhcpv6>false</dhcpv6>
+            <!-- And let clients choose their own resolver. -->
+            <dns>false</dns>
+          </ra>
+        </assign>
+        <assign prefix="64" alloc="48" iface="eth2">
+          <ra tag="wlan">
+            <!-- Only pass RDNSS resolvers. -->
+            <dns>true</dns>
+            <dhcpv6>false</dhcpv6>
+          </ra>
         </assign>
-        <assign prefix="64" alloc="48" iface="eth2"/>
       </assignments>
     </tunnel>
-    <!--
+    <!-- And you can, of course, specify multiple tunnels. -->
-    And you can, of course, specify multiple tunnels.
-    -->
     <tunnel id="54321" creds="anotheruser">
       <updateKey>0000000000000000</updateKey>
       <assignments>

utils/he_ipv6/ref

@@ -1,4 +1,4 @@
-## General Info/Networking Configuration
+## General Info/Networking Configuration ##
 # https://wiki.archlinux.org/index.php/IPv6_tunnel_broker_setup
 # https://gist.github.com/pklaus/960672
 # https://genneko.github.io/playing-with-bsd/networking/freebsd-tunnelv6-he
@@ -8,8 +8,27 @@
 # https://shorewall.org/6to4.htm#idm143
 # https://shorewall.org/6to4.htm#SixInFour
 # https://wiki.ubuntu.com/IPv6#Configure_your_Ubuntu_box_as_a_IPv6_router
+# http://koo.fi/blog/2013/03/20/linux-ipv6-router-radvd-dhcpv6/
 
-## Tunnelbroker API
+## Tunnelbroker API ##
 # https://forums.he.net/index.php?topic=3153.0 ("The following scripts conform to the Dyn DNS Update API (as documented at http://dyn.com/support/developers/api/).")
 # https://help.dyn.com/remote-access-api/return-codes/
-#
+
+## DNSMASQ ##
+# https://hveem.no/using-dnsmasq-for-dhcpv6
+
+## RFCs ##
+# DNSSL #
+# https://tools.ietf.org/html/rfc6106
+# https://tools.ietf.org/html/rfc8106
+# RDNSS #
+# https://tools.ietf.org/html/rfc5006 (see also 6106, 8106)
+# SLAAC
+# https://tools.ietf.org/html/rfc2462
+# https://tools.ietf.org/html/rfc4862
+# https://tools.ietf.org/html/rfc8064
+# Router Advertisements
+# https://tools.ietf.org/html/rfc4861
+# https://tools.ietf.org/html/rfc5175
+# https://tools.ietf.org/html/rfc6104
+# https://tools.ietf.org/html/rfc7772