SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28191 from yuwata/network-ipv6-privacy-extensions

Browse Source 
network: introduce global setting for IPv6 privacy extensions
This commit is contained in:
Luca Boccassi
2023-06-29 22:16:10 +01:00
committed by GitHub
parent f56f9c6b3e 856a247e19
commit 3a6a93220a
13 changed files with 56 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/networkd.conf.xml
+10
View File
@@ -94,6 +94,16 @@
specified earlier are cleared. Defaults to unset.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>IPv6PrivacyExtensions=</varname></term>
<listitem>
<para>Specifies the default value for per-network <varname>IPv6PrivacyExtensions=</varname>.
Takes a boolean or the special values <literal>prefer-public</literal> and
<literal>kernel</literal>. See for details in
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
Defaults to <literal>no</literal>.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
man/systemd.network.xml
+4 -2
View File
@@ -724,8 +724,10 @@ Table=1234</programlisting></para>
enables the privacy extensions and prefers temporary addresses over public addresses. When
<literal>prefer-public</literal>, enables the privacy extensions, but prefers public
addresses over temporary addresses. When false, the privacy extensions remain disabled. When
<literal>kernel</literal>, the kernel's default setting will be left in place. Defaults to
<literal>no</literal>.</para>
<literal>kernel</literal>, the kernel's default setting will be left in place. When unspecified,
the value specified in the same setting in
<citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
which defaults to <literal>no</literal>, will be used.</para>
</listitem>
</varlistentry>
src/network/networkd-gperf.gperf
+1
View File
@@ -26,6 +26,7 @@ Network.SpeedMeterIntervalSec, config_parse_sec,
Network.ManageForeignRoutingPolicyRules, config_parse_bool, 0, offsetof(Manager, manage_foreign_rules)
Network.ManageForeignRoutes, config_parse_bool, 0, offsetof(Manager, manage_foreign_routes)
Network.RouteTable, config_parse_route_table_names, 0, 0
Network.IPv6PrivacyExtensions, config_parse_ipv6_privacy_extensions, 0, offsetof(Manager, ipv6_privacy_extensions)
DHCPv4.DUIDType, config_parse_duid_type, 0, offsetof(Manager, dhcp_duid)
DHCPv4.DUIDRawData, config_parse_duid_rawdata, 0, offsetof(Manager, dhcp_duid)
DHCPv6.DUIDType, config_parse_duid_type, 0, offsetof(Manager, dhcp6_duid)
src/network/networkd-manager.c
+1
View File
@@ -589,6 +589,7 @@ int manager_new(Manager **ret, bool test_mode) {
*m = (Manager) {
.keep_configuration = _KEEP_CONFIGURATION_INVALID,
.ipv6_privacy_extensions = IPV6_PRIVACY_EXTENSIONS_NO,
.test_mode = test_mode,
.speed_meter_interval_usec = SPEED_METER_DEFAULT_TIME_INTERVAL,
.online_state = _LINK_ONLINE_STATE_INVALID,
src/network/networkd-manager.h
+2
View File
@@ -13,6 +13,7 @@
#include "hashmap.h"
#include "networkd-link.h"
#include "networkd-network.h"
#include "networkd-sysctl.h"
#include "ordered-set.h"
#include "set.h"
#include "time-util.h"
@@ -29,6 +30,7 @@ struct Manager {
int ethtool_fd;
KeepConfiguration keep_configuration;
IPv6PrivacyExtensions ipv6_privacy_extensions;
bool test_mode;
bool enumerating;
src/network/networkd-network.c
+1 -1
View File
@@ -467,7 +467,7 @@ int network_load_one(Manager *manager, OrderedHashmap **networks, const char *fi
.ipv4_accept_local = -1,
.ipv4_route_localnet = -1,
.ipv6_privacy_extensions = IPV6_PRIVACY_EXTENSIONS_NO,
.ipv6_privacy_extensions = _IPV6_PRIVACY_EXTENSIONS_INVALID,
.ipv6_dad_transmits = -1,
.ipv6_hop_limit = -1,
.ipv6_proxy_ndp = -1,
src/network/networkd-sysctl.c
+16 -39
View File
@@ -5,6 +5,7 @@
#include "missing_network.h"
#include "networkd-link.h"
#include "networkd-manager.h"
#include "networkd-network.h"
#include "networkd-sysctl.h"
#include "socket-util.h"
@@ -89,7 +90,10 @@ static int link_set_ipv6_forward(Link *link) {
}
static int link_set_ipv6_privacy_extensions(Link *link) {
IPv6PrivacyExtensions val;
assert(link);
assert(link->manager);
if (!socket_ipv6_is_supported())
return 0;
@@ -100,11 +104,15 @@ static int link_set_ipv6_privacy_extensions(Link *link) {
if (!link->network)
return 0;
// this is the special "kernel" value
if (link->network->ipv6_privacy_extensions == _IPV6_PRIVACY_EXTENSIONS_INVALID)
val = link->network->ipv6_privacy_extensions;
if (val < 0) /* If not specified, then use the global setting. */
val = link->manager->ipv6_privacy_extensions;
/* When "kernel", do not update the setting. */
if (val == IPV6_PRIVACY_EXTENSIONS_KERNEL)
return 0;
return sysctl_write_ip_property_int(AF_INET6, link->ifname, "use_tempaddr", (int) link->network->ipv6_privacy_extensions);
return sysctl_write_ip_property_int(AF_INET6, link->ifname, "use_tempaddr", (int) val);
}
static int link_set_ipv6_accept_ra(Link *link) {
@@ -307,44 +315,13 @@ int link_set_sysctl(Link *link) {
}
static const char* const ipv6_privacy_extensions_table[_IPV6_PRIVACY_EXTENSIONS_MAX] = {
[IPV6_PRIVACY_EXTENSIONS_NO] = "no",
[IPV6_PRIVACY_EXTENSIONS_NO] = "no",
[IPV6_PRIVACY_EXTENSIONS_PREFER_PUBLIC] = "prefer-public",
[IPV6_PRIVACY_EXTENSIONS_YES] = "yes",
[IPV6_PRIVACY_EXTENSIONS_YES] = "yes",
[IPV6_PRIVACY_EXTENSIONS_KERNEL] = "kernel",
};
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(ipv6_privacy_extensions, IPv6PrivacyExtensions,
IPV6_PRIVACY_EXTENSIONS_YES);
int config_parse_ipv6_privacy_extensions(
const char* unit,
const char *filename,
unsigned line,
const char *section,
unsigned section_line,
const char *lvalue,
int ltype,
const char *rvalue,
void *data,
void *userdata) {
IPv6PrivacyExtensions s, *ipv6_privacy_extensions = ASSERT_PTR(data);
assert(filename);
assert(lvalue);
assert(rvalue);
s = ipv6_privacy_extensions_from_string(rvalue);
if (s < 0) {
if (streq(rvalue, "kernel"))
s = _IPV6_PRIVACY_EXTENSIONS_INVALID;
else {
log_syntax(unit, LOG_WARNING, filename, line, 0,
"Failed to parse IPv6 privacy extensions option, ignoring: %s", rvalue);
return 0;
}
}
*ipv6_privacy_extensions = s;
return 0;
}
DEFINE_CONFIG_PARSE_ENUM(config_parse_ipv6_privacy_extensions, ipv6_privacy_extensions, IPv6PrivacyExtensions,
"Failed to parse IPv6 privacy extensions option");
src/network/networkd-sysctl.h
+2 -1
View File
@@ -11,7 +11,8 @@ typedef enum IPv6PrivacyExtensions {
/* The values map to the kernel's /proc/sys/net/ipv6/conf/xxx/use_tempaddr values */
IPV6_PRIVACY_EXTENSIONS_NO,
IPV6_PRIVACY_EXTENSIONS_PREFER_PUBLIC,
IPV6_PRIVACY_EXTENSIONS_YES, /* aka prefer-temporary */
IPV6_PRIVACY_EXTENSIONS_YES, /* aka prefer-temporary */
IPV6_PRIVACY_EXTENSIONS_KERNEL, /* keep the kernel's default value */
_IPV6_PRIVACY_EXTENSIONS_MAX,
_IPV6_PRIVACY_EXTENSIONS_INVALID = -EINVAL,
} IPv6PrivacyExtensions;
src/network/networkd.conf
+1
View File
@@ -18,6 +18,7 @@
#ManageForeignRoutingPolicyRules=yes
#ManageForeignRoutes=yes
#RouteTable=
#IPv6PrivacyExtensions=no
[DHCPv4]
#DUIDType=vendor
test/test-network/conf/25-global-ipv6-privacy-extensions.conf
+3
View File
@@ -0,0 +1,3 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Network]
IPv6PrivacyExtensions=prefer-public
test/test-network/conf/25-sysctl.network
+3 -4
View File
@@ -3,11 +3,10 @@
Name=dummy98
[Network]
IPForward=true
IPv6PrivacyExtensions=true
IPForward=yes
IPv6DuplicateAddressDetection=3
IPv6HopLimit=5
IPv4ProxyARP=true
IPv6ProxyNDP=true
IPv4ProxyARP=yes
IPv6ProxyNDP=yes
IPv6AcceptRA=no
IPv4AcceptLocal=yes
test/test-network/conf/25-sysctl.network.d/25-ipv6-privacy-extensions.conf
+3
View File
@@ -0,0 +1,3 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Network]
IPv6PrivacyExtensions=yes
test/test-network/systemd-networkd-tests.py
+9 -2
View File
@@ -3121,12 +3121,13 @@ class NetworkdNetworkTests(unittest.TestCase, Utilities):
self.assertRegex(output, 'inet6 .* scope link')
def test_sysctl(self):
copy_network_unit('25-sysctl.network', '12-dummy.netdev')
copy_networkd_conf_dropin('25-global-ipv6-privacy-extensions.conf')
copy_network_unit('25-sysctl.network', '12-dummy.netdev', copy_dropins=False)
start_networkd()
self.wait_online(['dummy98:degraded'])
self.check_ipv6_sysctl_attr('dummy98', 'forwarding', '1')
self.check_ipv6_sysctl_attr('dummy98', 'use_tempaddr', '2')
self.check_ipv6_sysctl_attr('dummy98', 'use_tempaddr', '1')
self.check_ipv6_sysctl_attr('dummy98', 'dad_transmits', '3')
self.check_ipv6_sysctl_attr('dummy98', 'hop_limit', '5')
self.check_ipv6_sysctl_attr('dummy98', 'proxy_ndp', '1')
@@ -3134,6 +3135,12 @@ class NetworkdNetworkTests(unittest.TestCase, Utilities):
self.check_ipv4_sysctl_attr('dummy98', 'proxy_arp', '1')
self.check_ipv4_sysctl_attr('dummy98', 'accept_local', '1')
copy_network_unit('25-sysctl.network.d/25-ipv6-privacy-extensions.conf')
networkctl_reload()
self.wait_online(['dummy98:degraded'])
self.check_ipv6_sysctl_attr('dummy98', 'use_tempaddr', '2')
def test_sysctl_disable_ipv6(self):
copy_network_unit('25-sysctl-disable-ipv6.network', '12-dummy.netdev')