network: make prefixstable mode of IPv6Token= can be applied any received prefixes by yuwata · Pull Request #16618 · systemd/systemd

yuwata · 2020-07-30T03:42:01Z

Closes #4625.

…-mode This is being implemented for any prefix in systemd PR#16618: systemd/systemd#16618

SoapGentoo · 2020-08-29T22:18:20Z

@yuwata any chance of getting this merged?

src/network/networkd-ndisc.c

This allows to statically configure the IPv6 host ID (low 64 bits) when auto-generated IPv6 addressing is used (i.e. DHCPv6 stateless, SLAAC). It introduces one new YAML key in the schema: ipv6-address-token-id. Fixes LP: #1737976 Commits: * Implement ipv6-address-token-id key (LP: #1737976) * Add integration tests for ipv6-address-token-id * networkd: update comment about stable-privacy ipv6-address-generation-mode This is being implemented for any prefix in systemd PR#16618: systemd/systemd#16618 * rename ipv6-address-token from ipv6-address-token-id * avoid unrelated whitespace changes Co-authored-by: Łukasz Zemczak <[email protected]>

src/network/networkd-ndisc.c

keszybz

Looks nice, some minor comments.

keszybz · 2020-09-07T16:55:07Z

man/systemd.network.xml

+            with a colon (<literal>:</literal>). If an IPv6 address is specified, then an interface
+            identifier is generated only when a prefix received in an RA message matches the supplied
+            address.</para>
+            <para>If no address generation mode is specified (which is the default), or a receivd


man/systemd.network.xml

keszybz · 2020-09-07T16:56:22Z

man/systemd.network.xml

+            mode, then the EUI-64 algorithm will be used to form an interface identifier for that
+            prefix. This mode is also SLAAC, but with a potentially stable interface identifier which
+            does not directly map to the interface's hardware address.</para>
+            <para>Note that the <literal>prefixstable</literal> algorithm uses both the interface's


"interface's name" → "interface name"

keszybz · 2020-09-07T16:57:29Z

man/systemd.network.xml

+            prefix. This mode is also SLAAC, but with a potentially stable interface identifier which
+            does not directly map to the interface's hardware address.</para>
+            <para>Note that the <literal>prefixstable</literal> algorithm uses both the interface's
+            name and MAC address in the hash used to compute the interface identifier, so if either of


in the hash → as input to the hash

src/network/networkd-ndisc.c

keszybz · 2020-09-07T17:02:05Z

src/network/networkd-ndisc.c

-        else {
+                if (*p == ':')
+                        p++;
+                else


Hmm, so if I specify "IPv6Token=prefixstableasdfasdfasdf" then it will be interpreted as "prefixstable". I think this needs to check that !*p here.

This does not a separate. It can be added there itself. Hence it is reductant

…eceived prefixes Closes systemd#4625.

yuwata · 2020-09-08T05:35:10Z

@keszybz Thank you for the review. Updated. Now all your comments are addressed. Setting the green label.

keszybz · 2020-09-08T05:51:54Z

LGTM.

disich · 2021-11-09T22:50:33Z

Trying to use sytemd-249 and setting IPv6Token=prefixstable.
However, this address is not the same as what I get by directly setting addr_gen_mode=2 and the specifying stable_secret with sysctl. Additionally 'ip addr show' does not report this address as stable-privacy. Is there a way for me to specify stable_secret while using systemd-networkd? Is there a retain the stable-privacy address as generated by the kernel.

yuwata · 2021-11-09T23:50:09Z

@disich I guess IPv6LinkLocalAddressGenerationMode=stable-privacy and IPv6StableSecretAddress= suffices what you want.

disich · 2021-11-10T00:02:31Z

@yuwata
I am using these already but it only produces a stable-privacy link local address (fe80::) for me. The link local address using systemd-networkd is identical to what kernel generates by directly setting the parameters with sysctl.
However, for global address based on RA:
Looking into the systemd-249 code (my first attempt to understand this code), it appears /etc/machine-id is used.
Ref: networkd-ndisc.c in make_stableprivate_address.
r = sd_id128_get_machine_app_specific(NDISC_APP_ID, &secret_key);).
eventually sd_id128_get_machine reads /etc/machine-id.
Is this reading correct? Can we have an option that will generate global stable-privacy address as the kernel would.

yuwata · 2021-11-10T00:16:22Z

@disich Right. The IPv6Token=prefixstable does NOT mean the generated address is the same as the one by kernel.
The RFC allows to use arbitrary hash func to generate the address.

disich · 2021-11-10T00:45:52Z

@yuwata : Thanks, Agree thats its not about RFC compliance. Its about how stable my machine-id will be if we migrate to another linux distribution. We wanted to have the stable-privacy address to be constant even if we change distribution. So I was planning to hash the serial number of our embedded device (or something similar) and specify it as a stable-secret. A new ehancement in systemd-networkd which lets me specify stable secret for global ipv6 address would be awesome enhancement.
In parallel, I will check how we can keep our machine-id constant even if we migrate distributions.

yuwata · 2021-11-10T00:55:41Z

@disich Yeah. As you can see, the address is generated with

machine-ID
interface name
prefix
(and internal counter)

So, keeping the same machine-ID and interface name should be basically enough when changing distribution.

disich · 2021-11-12T18:23:36Z

@yuwata Appreciate you looking into. I think this is good for most but not for systems which deploy redundancy.
Our device is in a chassis with cards having 1:1 redundancy. Till now we only support eui64 so they get the same RA derived IP (they share same MAC but only Active brings up its network interface). However, they do not share the same machine-id. So this will cause them to get a different stable-privacy address.
Do you think the community may be willing to take up an enhancement to add a config file parameter where we can specify the stable_secret (instead of machine-id). Or provide an option where we can use this functionality from the kernel. Currently this is already allowed but only for link local address (using IPv6LinkLocalAddressGenerationMode).

yuwata · 2021-11-13T03:11:38Z

@disich Let's discuss at #21345.

The relevant systemd pull request has long been merged, so add support for IPv6Token=prefixstable in the networkd generator. systemd/systemd#16618

yuwata added the network label Jul 30, 2020

This was referenced Jul 30, 2020

Request support Semantically Opaque Interface Identifiers with IPv6 (SLAAC) RFC 7217 #4625

Closed

[networkd] keeps old interface id when global prefix changes #10499

Open

slyon added a commit to canonical/netplan that referenced this pull request Aug 28, 2020

networkd: update comment about stable-privacy ipv6-address-generation…

9a50273

…-mode This is being implemented for any prefix in systemd PR#16618: systemd/systemd#16618

ssahani reviewed Aug 31, 2020

View reviewed changes

src/network/networkd-ndisc.c Show resolved Hide resolved

yuwata added do-not-merge 💣 and removed do-not-merge 💣 labels Sep 4, 2020

yuwata force-pushed the network-ipv6token-prefixstable branch from 8eb101d to 4430c0d Compare September 4, 2020 00:23

yuwata added the new-feature label Sep 4, 2020

ssahani reviewed Sep 7, 2020

View reviewed changes

src/network/networkd-ndisc.c Outdated Show resolved Hide resolved

yuwata force-pushed the network-ipv6token-prefixstable branch from 4430c0d to 30040c8 Compare September 7, 2020 16:56

keszybz requested changes Sep 7, 2020

View reviewed changes

keszybz added the good-to-merge/with-minor-suggestions label Sep 7, 2020

yuwata added 2 commits September 8, 2020 14:32

network: make prefixstable mode of IPv6Token= can be applied to any r…

b27caa3

…eceived prefixes Closes systemd#4625.

test-network: add test for IPv6Token=prefixstable

68248f4

yuwata force-pushed the network-ipv6token-prefixstable branch from 30040c8 to 68248f4 Compare September 8, 2020 05:34

yuwata added good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed and removed good-to-merge/with-minor-suggestions labels Sep 8, 2020

keszybz removed the good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed label Sep 8, 2020

keszybz merged commit a9aa8de into systemd:master Sep 8, 2020

yuwata deleted the network-ipv6token-prefixstable branch September 8, 2020 11:38

yuwata mentioned this pull request Nov 13, 2021

network: extend Token=prefixstable to not use machine-ID #21345

Closed

tatokis mentioned this pull request Jun 16, 2024

networkd: Implement ipv6-address-generation: stable-privacy canonical/netplan#480

Merged

5 tasks

Uh oh!

Conversation

yuwata commented Jul 30, 2020

Uh oh!

SoapGentoo commented Aug 29, 2020

Uh oh!

Uh oh!

Uh oh!

keszybz left a comment

Choose a reason for hiding this comment

Uh oh!

keszybz Sep 7, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

keszybz Sep 7, 2020

Choose a reason for hiding this comment

Uh oh!

keszybz Sep 7, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

keszybz Sep 7, 2020

Choose a reason for hiding this comment

Uh oh!

ssahani Sep 7, 2020

Choose a reason for hiding this comment

Uh oh!

yuwata commented Sep 8, 2020

Uh oh!

keszybz commented Sep 8, 2020

Uh oh!

disich commented Nov 9, 2021

Uh oh!

yuwata commented Nov 9, 2021

Uh oh!

disich commented Nov 10, 2021

Uh oh!

yuwata commented Nov 10, 2021

Uh oh!

disich commented Nov 10, 2021

Uh oh!

yuwata commented Nov 10, 2021

Uh oh!

disich commented Nov 12, 2021

Uh oh!

yuwata commented Nov 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

yuwata commented Nov 13, 2021 •

edited

Loading