0

I am trying to get stable-privacy address geneted on my box for the router advertisement prefix.

If I just set the kernel parameters like below I do get a good stable privacy address.

sysctl net.ipv6.conf.eth0.stable_secret="aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111"
sysctl net.ipv6.conf.eth0.use_tempaddr=0
sysctl net.ipv6.conf.eth0.addr_gen_mode=2 

17: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 10:82:86:05:dc:36 brd ff:ff:ff:ff:ff:ff
    inet6 fd01:abcd:efab:cdef:170e:bc6c:b50b:383f/64 scope global dynamic mngtmpaddr stable-privacy
       valid_lft 86397sec preferred_lft 14397sec
    inet6 fe80::11f:e820:cf87:4238/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

However, I plan to use systemd-networkd so that I can obtain DNS through RA too.

Now for systemd-networkd no matter whatever I try I cant seem to get the global stable-privacy address as was generated by the kernel. While the address with below config is not eui64, it is not shown as stable-privacy by kernel and is not affected at all by what stable secret I specify.

[Match]
Name=eth0
                                                                                                                                                                                                                                                                                                            
[Network]
IPv6AcceptRA=true
IPv6LinkLocalAddressGenerationMode=stable-privacy
IPv6StableSecretAddress=aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111
IPv6PrivacyExtensions=kernel
IPv6Token=prefixstable

[IPv6AcceptRA]
UseDNS=true

Is there a way to generate and control the stable privacy address as generated by systemd-networkd?

Or is there any service I could use which will let me has the stable-privacy address from the kernel but let me do DNS through RA.

Thanks Dip

1
  • updated with complete contents from the .network file.
    – dip
    Nov 9 '21 at 23:06
0

The IPv6PrivacyExtensions= setting is about RFC 4941 stateless temporary addresses, not the RFC 7217 stable privacy addresses.

As you specify IPv6PrivacyExtensions=kernel, you might be getting a RFC 4941-style address. It will change over time, which does not seem to be what you want.

The documentation for IPv6AcceptRA= indicates systemd must use its own implementation of the IPv6 RA protocol instead of the in-kernel one in order to get access to the DNS information in the RAs. Perhaps setting IPv6PrivacyExtensions=kernel somehow conflicts with this too?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.