getting ipv6 stable-privacy address with systemd-networkd

Question

I am trying to get stable-privacy address geneted on my box for the router advertisement prefix.

If I just set the kernel parameters like below I do get a good stable privacy address.

sysctl net.ipv6.conf.eth0.stable_secret="aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111"
sysctl net.ipv6.conf.eth0.use_tempaddr=0
sysctl net.ipv6.conf.eth0.addr_gen_mode=2 

17: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 10:82:86:05:dc:36 brd ff:ff:ff:ff:ff:ff
    inet6 fd01:abcd:efab:cdef:170e:bc6c:b50b:383f/64 scope global dynamic mngtmpaddr stable-privacy
       valid_lft 86397sec preferred_lft 14397sec
    inet6 fe80::11f:e820:cf87:4238/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

However, I plan to use systemd-networkd so that I can obtain DNS through RA too.

Now for systemd-networkd no matter whatever I try I cant seem to get the global stable-privacy address as was generated by the kernel. While the address with below config is not eui64, it is not shown as stable-privacy by kernel and is not affected at all by what stable secret I specify.

[Match]
Name=eth0
                                                                                                                                                                                                                                                                                                            
[Network]
IPv6AcceptRA=true
IPv6LinkLocalAddressGenerationMode=stable-privacy
IPv6StableSecretAddress=aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111
IPv6PrivacyExtensions=kernel
IPv6Token=prefixstable

[IPv6AcceptRA]
UseDNS=true

Is there a way to generate and control the stable privacy address as generated by systemd-networkd?

Or is there any service I could use which will let me has the stable-privacy address from the kernel but let me do DNS through RA.

Thanks Dip

Answer 1

The IPv6PrivacyExtensions= setting is about RFC 4941 stateless temporary addresses, not the RFC 7217 stable privacy addresses.

As you specify IPv6PrivacyExtensions=kernel, you might be getting a RFC 4941-style address. It will change over time, which does not seem to be what you want.

The documentation for IPv6AcceptRA= indicates systemd must use its own implementation of the IPv6 RA protocol instead of the in-kernel one in order to get access to the DNS information in the RAs. Perhaps setting IPv6PrivacyExtensions=kernel somehow conflicts with this too?