Re: [PATCH] net: ipv6: don't generate link-local address in any addr_gen_mode

On Mon, 2021-07-05 at 10:35 -0600, David Ahern wrote:

On 7/1/21 2:51 AM, Rocco Yue wrote:

quoted

On Wed, 2021-06-30 at 22:41 -0600, David Ahern wrote:

For mobile operators that don't need to support RFC7217, setting
addr_gen_mode == 1 is sufficient;

But for some other mobile operators that need to support RFC7217, such as AT&T,
the mobile device's addr_gen_mode will be switched to the
IN6_ADDR_GEN_MODE_STABLE_PRIVACY, instead of using IN6_ADDR_GEN_MODE_NONE.
The purpose is: in the IN6_ADDR_GEN_MODE_STABLE_PRIVACY mode, kernel can
gererate a stable privacy global ipv6 address after receiveing RA, and
network processes can use this global address to communicate with the
outside network.

Of course, mobile operators that need to support RFC7217 should also meet
the requirement of 3GPP TS 29.061, that is, MT should use IID assigned by
the GGSN to build its ipv6 link-local address and use this address to send RS.
We don't want the kernel to automatically generate an ipv6 link-local address
when addr_gen_mode == 2. Otherwise, using the stable privacy ipv6 link-local
address automatically generated by the kernel to send RS message, GGSN will
not be able to respond to the RS and reply a RA message.

Therefore, after this patch, kernel will not generate ipv6 link-local address
for the corresponding device when addr_gen_mode == 1 or addr_gen_mode == 2.

I think another addr_gen_mode is better than a separate sysctl. It looks
like IN6_ADDR_GEN_MODE_STABLE_PRIVACY and IN6_ADDR_GEN_MODE_RANDOM are
the ones used for RAs, so add something like:

IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA,
IN6_ADDR_GEN_MODE_RANDOM_NO_LLA,

to in6_addr_gen_mode.

Hi David,

Thanks for your reply.

According to your suggestion, I checked the ipv6 code again. In my
opinion, adding another addr_gen_mode may not be suitable.

(1)
In the user space, the process enable the ipv6 stable privacy mode by
setting the "/proc/sys/net/ipv6/conf/<iface>/stable_secret".

In the kernel, the addr_gen_mode of a networking device is switched to
IN6_ADDR_GEN_MODE_STABLE_PRIVACY by judging the bool value of
"cnf.stable_secret.initialized".

So, although adding an additional IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA,
user space process has some trouble to let kernel switch the iface's
addr_gen_mode to the IN6_ADDR_GEN_MODE_STABLE_PRIVACY_NO_LLA.

This is not as flexible as adding a separate sysctl.

(2)
After adding "proc/sys/net/ipv6/<iface>/disable_gen_linklocal_addr",
so that kernel can keep the original code logic of the stable_secret
proc file, and expand when the subsequent kernel adds a new add_gen_mode
more flexibility and applicability.

And we only need to care about the networking device that do not
generate an ipv6 link-local address, and not the addr_gen_mode that
this device is using.

Maybe adding a separate sysctl is a better choice.
Looking forward to your professional reply again.

Thanks,
Rocco
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel