On 05.12.2015 20:02, Bjørn Mork wrote:

Hannes Frederic Sowa [off-list ref] writes:

quoted

On Thu, Dec 3, 2015, at 20:29, Bjørn Mork wrote:

quoted

After looking more at addrconf, I started wondering if we couldn't abuse
ipv6_generate_stable_address() for this purpose?  We could add a new
addr_gen_mode which would trigger automatic generation of a secret if
stable_secret is uninitialized.  This would be good enough to ensure
stability until the interface is destroyed.  And it would still allow
the adminstrator to select IN6_ADDR_GEN_MODE_STABLE_PRIVACY by entering
a new secret.

I am fine with your proposal but I would really like to see it only
happen on the per-interface stable_secret instance.

Do you think something like the patch below will be OK?

I wouldn't call it IN6_ADDR_GEN_MODE_AUTO, this doesn't say anything.
But the idea is already good.

Or would it be better to drop the additional mode and just generate a
random secret if the mode is IN6_ADDR_GEN_MODE_STABLE_PRIVACY and the
secrets are missing?  Or would that be changing the userspace ABI?  This
is not clear to me...

I would not like to do that somehow. The problem is that the stable
secrets get written by user space probably during boot-up, but we don't
know when. That's why I would also not set the ->initialized flag, so
user can overwrite it to the final secret later on. We block it otherwise.

My proposal would be to use the stable privacy generator in case the
device does not have a device address for EUI-48 generation with a
secret which we simply generate on the stack. Let's factor out the part
of the generator which depends on the inet6_dev and cnf bits for that.

What do you think?

Bye,
Hannes