Messages in this thread | | | From | Rocco Yue <> | Subject | Re: [PATCH] net: ipv6: don't generate link-local address in any addr_gen_mode | Date | Tue, 6 Jul 2021 20:37:02 +0800 |
| |
On Mon, 2021-07-05 at 10:35 -0600, David Ahern wrote: > On 7/1/21 2:51 AM, Rocco Yue wrote: >> On Wed, 2021-06-30 at 22:41 -0600, David Ahern wrote: >> >> For mobile operators that don't need to support RFC7217, setting >> addr_gen_mode == 1 is sufficient; >> >> But for some other mobile operators that need to support RFC7217, such as AT&T, >> the mobile device's addr_gen_mode will be switched to the >> IN6_ADDR_GEN_MODE_STABLE_PRIVACY, instead of using IN6_ADDR_GEN_MODE_NONE. >> The purpose is: in the IN6_ADDR_GEN_MODE_STABLE_PRIVACY mode, kernel can >> gererate a stable privacy global ipv6 address after receiveing RA, and >> network processes can use this global address to communicate with the >> outside network. >> >> Of course, mobile operators that need to support RFC7217 should also meet >> the requirement of 3GPP TS 29.061, that is, MT should use IID assigned by >> the GGSN to build its ipv6 link-local address and use this address to send RS. >> We don't want the kernel to automatically generate an ipv6 link-local address >> when addr_gen_mode == 2. Otherwise, using the stable privacy ipv6 link-local >> address automatically generated by the kernel to send RS message, GGSN will >> not be able to respond to the RS and reply a RA message. >> >> Therefore, after this patch, kernel will not generate ipv6 link-local address >> for the corresponding device when addr_gen_mode == 1 or addr_gen_mode == 2. >> > > I think another addr_gen_mode is better than a separate sysctl. It looks > like IN6_ADDR_GEN_MODE_STABLE_PRIVACY and IN6_ADDR_GEN_MODE_RANDOM are > the ones used for RAs, so add something like: > > IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA, > IN6_ADDR_GEN_MODE_RANDOM_NO_LLA, > > to in6_addr_gen_mode. >
Hi David,
Thanks for your reply.
According to your suggestion, I checked the ipv6 code again. In my opinion, adding another addr_gen_mode may not be suitable.
(1) In the user space, the process enable the ipv6 stable privacy mode by setting the "/proc/sys/net/ipv6/conf/<iface>/stable_secret".
In the kernel, the addr_gen_mode of a networking device is switched to IN6_ADDR_GEN_MODE_STABLE_PRIVACY by judging the bool value of "cnf.stable_secret.initialized".
So, although adding an additional IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA, user space process has some trouble to let kernel switch the iface's addr_gen_mode to the IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA.
This is not as flexible as adding a separate sysctl.
(2) After adding "proc/sys/net/ipv6/<iface>/disable_gen_linklocal_addr", so that kernel can keep the original code logic of the stable_secret proc file, and expand when the subsequent kernel adds a new add_gen_mode more flexibility and applicability.
And we only need to care about the networking device that do not generate an ipv6 link-local address, and not the addr_gen_mode that this device is using.
Maybe adding a separate sysctl is a better choice. Looking forward to your professional reply again.
Thanks, Rocco
| |