Re: bad interaction between privacy extensions, prefix lifetimes and protocols that maintain long-term connections.

[Bjørn Mork <bjorn@mork.no>]

peter green <plugwash@p10link.net> writes:

> Disabling privacy extensions solved the issue but obviously reveals
> the MAC address of my new machine to the world which is undesirable.

I have no solution to the problem with privacy extensions, but just
wanted to let you know there is a third alternative for IPv6
autoconfigured addresses: stable-privacy

This will give you addresses which are just as stable as the eui64
addresses, but derived from a configurable secret instead of the
mac. The kernel part is documented in under 'stable_secret' in
https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

If you use NetworkManager, then this is very easy to set up: Just set
'addr-gen-mode' to 'stable-privacy'.  See the docs in nm-settings(5).

Or if you use ifupdown and prefer to control it yourself, you can
e.g. save the secret (in IPv6 address format) in some file and write it
to /proc/sys/net/ipv6/conf/default/stable_secret on boot.  This will set
a common secret for all interfaces.  Note that the generated interface
ids still will be different, since the prefix is used as part of the
input to the generator.



Bjørn