Activate IPv6 Privacy extensions

1st Official Post

    Hi there,

    I was trying to activate the privacy extensions on my Libreelec for IPv6, as so far it only generates IPv6 based on the MAC address.

    I did so by setting sysctl in a file in /etc/sysctl.d and reading it via sysctl -p

    net.ipv6.conf.all.use_tempaddr=2
    net.ipv6.conf.default.use_tempaddr=2
    net.ipv6.conf.eth0.use_tempaddr=2

    This somewhat works, as an additional random IP is generated. However two things were not as expected:

    - When rebooting, the eth0 setting gets reset to 0 and only the MAC based IPv6 gets generated. The "all" and "default" are still the same. So something else seems to configure this?

    - The new address generated is a "global secondary dynamic". Shouldn't it be a temporary one?

    Anyone has experience on this and can help how this can be configured correctly in Libreelec?

    PS.: I am using Milhouse builds: LibreELEC (Milhouse): devel-20190327210311-#0327-g5ccaa74 [Build #0327]

    Thanks

    Chris

    OK, so I tested a few things. Apparently the connman configuration overrides the kernel parameters.

    From what I know the config for connman is under /storage/.cache/connman/settings or the devices in that folder. However changes on the connman settings for a device will be overwritten on reboot?

    Other thing I checked was for some configuration option in the GUI. However there is only auto, manual and 6to4 to choose from for IPv6. Strangely the "privacy" option is only found with manual, where it does make little sense, as you set the IP manually.

    So is this now a bug or a feature request to get the privacy option into the "auto" configuration as well?

    • Official Post

    LE is currently built around the assumption of being installed on an IPv4 device behind a NAT gateway in a domestic/home network. As a result you should assume there is only partial support for IPv6 in the OS. In fact i'm surprised there is any, as last time I actually looked it was mostly disabled everywhere. You are welcome to make suggestions on improvements, but AFAIK none of the core team have access to IPv6 networks to validate any suggestions that are made. Things that appear (or not) in the settings GUI could simply be things that didn't exist in connman when the settings add-on was originally written in 2012/2013 so it's worthwhile cross-referencing with connman documentation and the "connmanctl" utility. If you make changes via connmanctl they will be persistent.

    That is good to know. Most services seem to listen on ipv6, so it would be good to know, if they are properly configured. Otherwise it would be worthwhile to deactivate ipv6 overall.

    Regarding connman: I figured that it suffers of the same spelling error as "systemd-networkd" and the configuration has to be spelled "IPv6.privacy=prefered".

    It then changes the configuration for the device and is creating a second ipv6, however not a temporary one.

    A step forward on not using the MAC address anymore, however not the final goal.

    Will see with the connman mailing list what this might be about.

    For improving the ipv6 parts, I can give input and test things. I also looked into the plugin where the settings are done, however I am no real programmer and can't even figure out where and how the addon ends up in kodi (most other plugins are just zipped and I can change (monkey with typewriter :-D) some things).

    So I got contact with Daniel from connman, he will look into the issues I encountered.

    This leaves the gui and settings. I figured that the libreelec-settings is coming from the code in github, however I cannot find it in the packages on the running system.

    I looked for a packages folder as you described, however can only find one in /storage/.kodi/addons. This seems to only contain the .zip files of the addons?

    With a regular addon, I would just copy the code from github, do some changes, zip it and run an update with it. Is this possible with the settings plugin as well?

    • Official Post

    GitHub - LibreELEC/service.libreelec.settings: the LibreELEC settings addon for KODI is the source code. It's possible to clone the add-on and run it under a different ID to the one embedded in the image (same as other Kodi add-ons) but remember that python code is compiled before it runs so you need to develop/learn a workflow of making changes, cleaning the compiled files out, restarting the service, test, etc.

    hmm... that is probably above my level of expertise. Is there a docker available for a build environment?

    Within the github I actually could see the line, that sets the privacy extensions in the manual mode (service.libreelec.settings/connman.py at master · LibreELEC/service.libreelec.settings · GitHub). This should be wrong, as it does not make sense with a manually set ipv6. Think it should be linked to the parent "auto".

    Not sure if this is just changed here and generation for connman will follow or if changes are needed somewhere else. But that is what I would try to change.

    Code
    connmanctl config ethernet_xxxxxxxxxxxx_cable --ipv6 auto preferred

    This is how you can enable the ipv6 privacy mode for a wired interface with LibreELEC 9.2.1 on an RPi2

    This setting will persist across reboots. Editing the connman config files directly doesn't work anymore.

    • Official Post

    Editing connman config files (service files) works if connman is stopped before editing and restarted after. Connman manages the files so if you do not stop > edit > restart connman can (and probably will) overwrite changes made at some point.

    Thanks chewitt, it all makes sense now!

    To those who wish to edit it directly: keep in mind that inside the config file the setting "preferred" is still misspelled as "prefered"

    Cheers!