3

I am trying to setup an IPv6 stable-privacy adress on a box with systemd-networkd.

The box is an rpi runnning archlinux-arm but this is the same than for archlinux

So following the wiki @archlinux.org, I have set up a stable_secret and use addr_gen_mode=2 for the kernel configuration, and then tells systemd-networkd to use the kernel configuration (is there another way ?)

# cat /etc/sysctl.d/40-ipv6.conf 
net.ipv6.conf.eth0.use_tempaddr=2
net.ipv6.conf.eth0.stable_secret=dead:beaf:dead:beaf:dead:beaf:dead:beaf
net.ipv6.conf.eth0.addr_gen_mode=2

# cat /etc/systemd/network/eth0.network 
[Match]
Name=eth0

[Network]
DHCP=ipv4
IPv6PrivacyExtensions=kernel

But this does not work. stable-privacy is not even enabled.

So I added an [Address] section to eth0.network

[Address]
ManageTemporaryAddress=false

At last, stable-privacy is enabled because the local link ("scope link") is labelled stable-privacy for eth0

$ ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether b8:27:eb:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.44.106/24 brd 192.168.44.255 scope global dynamic eth0
       valid_lft 42796sec preferred_lft 42796sec
    inet6 xxxx:xxx:xxx:xxxx:80c1:77d4:f72b:b132/64 scope global temporary dynamic 
       valid_lft 85998sec preferred_lft 85829sec
    inet6 xxxx:xxx:xxx:xxxx:baxx:xxff:fxxx:xxxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 85998sec preferred_lft 85998sec
    inet6 fe80::24e2:14e:ad9e:df8/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

However, I expect the temporary dynamic address I got not to change at each reboot. This is not the case.

Am I wrong, or something is misconfigured ?

2 Answers 2

4

I was just trying to use systemd-networkd and your post was very helpful, thanks. Using arch linux x64 need to put the default device kernel name eg:

# cat /etc/systemd/network/25-wireless.network 
[Match]
Name=wlp3s0u1  

[Network]
DHCP=yes
IPv6PrivacyExtensions=kernel

Because the udev name that i set (eth0, wlan0) does not work with wpa_supplicant. Maybe the stable privacy relies at local link and private extension at temp dynamic link? Here i choose to run ipv6 with temporary dynamic address and need to change the 40-ipv6.conf too (now with stable privacy):

# cat /etc/sysctl.d/40-ipv6.conf
# Enable IPv6 Privacy Extensions
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
net.ipv6.conf.wlp3s0u1.use_tempaddr=2
net.ipv6.conf.enp5s0.use_tempaddr=2  

# Enable IPv6 stable privacy mode
net.ipv6.conf.wlp3s0u1.stable_secret=66e5:0a06:9d23:15f7:xxxx:xxxx:xxxx:xxxx
net.ipv6.conf.wlp3s0u1.addr_gen_mode=2

Well did some reboots and now i got privacy extension. And stable privacy with the same local address, but not at temporary dynamic. Maybe that's the way it works. Thank you again.

# ip addr show dev wlp3s0u1
3: wlp3s0u1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 90:f6:52:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.0.255 scope global dynamic wlp3s0u1
       valid_lft 15550560sec preferred_lft 15550560sec
    inet6 2804:d51:ef9:5d00:xxxx:xxxx:xxxx:xxxx/64 scope global temporary dynamic 
       valid_lft 86381sec preferred_lft 84583sec
    inet6 2804:d51:ef9:5d00:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86381sec preferred_lft 86381sec
    inet6 fe80::7902:xxxx:xxxx:xxxx/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
3

As systemd-networkd was able to be configured to use Privacy Extensions to generate temporary global addresses (by telling it to use the kernel config in fact), I assumed it would be the same for SOII aka RFC 7217.

But no. systemd-networkd can't do it: https://github.com/systemd/systemd/issues/4625

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .