Skip to content
This repository has been archived by the owner on Feb 7, 2022. It is now read-only.

Request: Select non-temporary (non-private) global ipv6 if available #58

Open
robobenklein opened this issue Jul 11, 2020 · 1 comment

Comments

@robobenklein
Copy link

I see the latest commit does address the issue of local addresses being assigned as permanent addresses on the interface, but I wouldn't consider all other addresses to be "permanent" or even suitable for inclusion in a DNS AAAA record.

Here's an example:

$ ip -6 addr show scope global
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2601:844:4000:750:XXXX:XXXX:XXXX:9431/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86383sec preferred_lft 14383sec
3: eno2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2601:844:4000:750:ffff:74:8:10/128 scope global dynamic noprefixroute 
       valid_lft 4470sec preferred_lft 1770sec
    inet6 2601:844:4000:750:XXXX:XXXX:XXXX:9432/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86383sec preferred_lft 14383sec

Each interface has a private, temporary address: marked by mngtmpaddr which means:

(IPv6 only) make the kernel manage temporary addresses created from this one as
template on behalf of Privacy Extensions (RFC3041). For this to become active, the
use_tempaddr sysctl setting has to be set to a value greater than zero. The given
address needs to have a prefix length of 64. This flag allows to use privacy
extensions in a manually configured network, just like if stateless auto-
configuration was active.

And I think that if an address is intended to be 'private' and 'temporary' we should instead prefer a non-private address, even if it might still be labeled as 'temporary' by the lifetime valid/preferred timers or 'dynamic'. ('dynamic' addresses can still be assigned to something unchanging by the router, like it is in my case, which also has SLAAC)

@robobenklein
Copy link
Author

robobenklein commented Jul 11, 2020

Simplest implementation seems to be to run ip -6 addr show scope global -mngtmpaddr -temporary first, and if it has no matches, then continue with the existing implementation.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant