New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ipv6 privacy extensions #62835
Ipv6 privacy extensions #62835
Conversation
d15d5d9
to
ab225fc
Compare
@GrahamcOfBorg test ipv6 |
IPv6 Privacy Extensions are now enabled by default for undeclared | ||
interfaces. The previous behaviour was quite misleading — even though | ||
the default value for | ||
<option>networking.interfaces.*.preferTempAddress</option> was |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
<option>networking.interfaces.*.preferTempAddress</option> was | |
<option>networking.interfaces.<name?>.preferTempAddress</option> was |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's not valid XML AFAIK. I'd prefer leaving it as * to improve readability of the source.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was trying to make it appear the same as in the option search https://nixos.org/nixos/options.html#networking.interfaces.+prefertempaddress
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This works fine but settings preferTempAddress = false
seems to not work anymore with this change.
I figured out how to make both works by adding a second udev rule: commit 875381d10007782197fcf8450ec7af7200bda126 (HEAD -> ipv6-fix)
Author: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed Jul 3 15:18:14 2019 +0200
nixos/network-interfaces: make `preferTempAddr=false` work again
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index e14cafa9b12..1a13e386947 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1089,12 +1089,22 @@ in
services.udev.packages = [
(pkgs.writeTextFile rec {
- name = "99-ipv6-privacy-extensions.rules";
- destination = "/etc/udev/rules.d/99-${name}";
+ name = "ipv6-privacy-extensions.rules";
+ destination = "/etc/udev/rules.d/98-${name}";
text = ''
+ # enable and prefer IPv6 privacy addresses by default
ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.%k.use_tempaddr=2"
'';
- }) ] ++ lib.optional (cfg.wlanInterfaces != {})
+ })
+ (pkgs.writeTextFile rec {
+ name = "ipv6-privacy-extensions.rules";
+ destination = "/etc/udev/rules.d/99-${name}";
+ text = concatMapStrings (i: ''
+ # enable IPv6 privacy addresses but prefer EUI-64 addresses for ${i.name}
+ ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${i.name}.use_tempaddr=1"
+ '') (filter (i: !i.preferTempAddress) interfaces);
+ })
+ ] ++ lib.optional (cfg.wlanInterfaces != {})
(pkgs.writeTextFile {
name = "99-zzz-40-wlanInterfaces.rules";
destination = "/etc/udev/rules.d/99-zzz-40-wlanInterfaces.rules";
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index ed9f287d558..949d946bdc4 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -510,7 +510,7 @@ let
'';
};
};
- nodes.client = { pkgs, ... }: with pkgs.lib; {
+ nodes.clientWithPrivacy = { pkgs, ... }: with pkgs.lib; {
virtualisation.vlans = [ 1 ];
networking = {
useNetworkd = networkd;
@@ -522,21 +522,39 @@ let
};
};
};
+ nodes.client = { pkgs, ... }: with pkgs.lib; {
+ virtualisation.vlans = [ 1 ];
+ networking = {
+ useNetworkd = networkd;
+ useDHCP = true;
+ interfaces.eth1 = {
+ preferTempAddress = false;
+ ipv4.addresses = mkOverride 0 [ ];
+ ipv6.addresses = mkOverride 0 [ ];
+ };
+ };
+ };
testScript = { ... }:
''
startAll;
$client->waitForUnit("network.target");
+ $clientWithPrivacy->waitForUnit("network.target");
$router->waitForUnit("network-online.target");
# Wait until we have an ip address
+ $clientWithPrivacy->waitUntilSucceeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'");
$client->waitUntilSucceeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'");
# Test vlan 1
+ $clientWithPrivacy->waitUntilSucceeds("ping -c 1 fd00:1234:5678:1::1");
$client->waitUntilSucceeds("ping -c 1 fd00:1234:5678:1::1");
# Test address used is temporary
- $client->waitUntilSucceeds("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
+ $clientWithPrivacy->waitUntilSucceeds("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
+
+ # Test address used is EUI-64
+ $client->waitUntilSucceeds("ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
'';
};
routes = { This patch also updates the test to check both cases. |
Oh, good catch! Thanks. |
Soo, can we merge this? |
Motivation for this change
#56306
Things done
sandbox
innix.conf
on non-NixOS)nix-shell -p nix-review --run "nix-review wip"
./result/bin/
)nix path-info -S
before and after)