1

I am trying to setup an IPv6 stable-privacy adress on a box with systemd-networkd.

The box is an rpi runnning archlinux-arm but this is the same than for archlinux

So following the wiki @archlinux.org, I have set up a stable_secret and use addr_gen_mode=2 for the kernel configuration, and then tells systemd-networkd to use the kernel configuration (is there another way ?)

# cat /etc/sysctl.d/40-ipv6.conf 
net.ipv6.conf.eth0.use_tempaddr=2
net.ipv6.conf.eth0.stable_secret=dead:beaf:dead:beaf:dead:beaf:dead:beaf
net.ipv6.conf.eth0.addr_gen_mode=2

# cat /etc/systemd/network/eth0.network 
[Match]
Name=eth0

[Network]
DHCP=ipv4
IPv6PrivacyExtensions=kernel

But this does not work. stable-privacy is not even enabled.

So I added an [Address] section to eth0.network

[Address]
ManageTemporaryAddress=false

At last, stable-privacy is enabled because the local link ("scope link") is labelled stable-privacy for eth0

$ ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether b8:27:eb:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.44.106/24 brd 192.168.44.255 scope global dynamic eth0
       valid_lft 42796sec preferred_lft 42796sec
    inet6 xxxx:xxx:xxx:xxxx:80c1:77d4:f72b:b132/64 scope global temporary dynamic 
       valid_lft 85998sec preferred_lft 85829sec
    inet6 xxxx:xxx:xxx:xxxx:baxx:xxff:fxxx:xxxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 85998sec preferred_lft 85998sec
    inet6 fe80::24e2:14e:ad9e:df8/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

However, I expect the temporary dynamic address I got not to change at each reboot. This is not the case.

Am I wrong, or something is misconfigured ?

2

As systemd-networkd was able to be configured to use Privacy Extensions to generate temporary global addresses (by telling it to use the kernel config in fact), I assumed it would be the same for SOII aka RFC 7217.

But no. systemd-networkd can't do it: https://github.com/systemd/systemd/issues/4625

| improve this answer | |
1

I was just trying to use systemd-networkd and your post was very helpful, thanks. Using arch linux x64 need to put the default device kernel name eg:

# cat /etc/systemd/network/25-wireless.network 
[Match]
Name=wlp3s0u1  

[Network]
DHCP=yes
IPv6PrivacyExtensions=kernel

Because the udev name that i set (eth0, wlan0) does not work with wpa_supplicant. Maybe the stable privacy relies at local link and private extension at temp dynamic link? Here i choose to run ipv6 with temporary dynamic address and need to change the 40-ipv6.conf too (now with stable privacy):

# cat /etc/sysctl.d/40-ipv6.conf
# Enable IPv6 Privacy Extensions
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
net.ipv6.conf.wlp3s0u1.use_tempaddr=2
net.ipv6.conf.enp5s0.use_tempaddr=2  

# Enable IPv6 stable privacy mode
net.ipv6.conf.wlp3s0u1.stable_secret=66e5:0a06:9d23:15f7:xxxx:xxxx:xxxx:xxxx
net.ipv6.conf.wlp3s0u1.addr_gen_mode=2

Well did some reboots and now i got privacy extension. And stable privacy with the same local address, but not at temporary dynamic. Maybe that's the way it works. Thank you again.

# ip addr show dev wlp3s0u1
3: wlp3s0u1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 90:f6:52:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.0.255 scope global dynamic wlp3s0u1
       valid_lft 15550560sec preferred_lft 15550560sec
    inet6 2804:d51:ef9:5d00:xxxx:xxxx:xxxx:xxxx/64 scope global temporary dynamic 
       valid_lft 86381sec preferred_lft 84583sec
    inet6 2804:d51:ef9:5d00:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86381sec preferred_lft 86381sec
    inet6 fe80::7902:xxxx:xxxx:xxxx/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.