Activate IPv6 Privacy extensions

  • Hi there,

    I was trying to activate the privacy extensions on my Libreelec for IPv6, as so far it only generates IPv6 based on the MAC address.


    I did so by setting sysctl in a file in /etc/sysctl.d and reading it via sysctl -p

    net.ipv6.conf.all.use_tempaddr=2
    net.ipv6.conf.default.use_tempaddr=2
    net.ipv6.conf.eth0.use_tempaddr=2


    This somewhat works, as an additional random IP is generated. However two things were not as expected:


    - When rebooting, the eth0 setting gets reset to 0 and only the MAC based IPv6 gets generated. The "all" and "default" are still the same. So something else seems to configure this?

    - The new address generated is a "global secondary dynamic". Shouldn't it be a temporary one?


    Anyone has experience on this and can help how this can be configured correctly in Libreelec?


    PS.: I am using Milhouse builds: LibreELEC (Milhouse): devel-20190327210311-#0327-g5ccaa74 [Build #0327]


    Thanks

    Chris

  • OK, so I tested a few things. Apparently the connman configuration overrides the kernel parameters.

    From what I know the config for connman is under /storage/.cache/connman/settings or the devices in that folder. However changes on the connman settings for a device will be overwritten on reboot?


    Other thing I checked was for some configuration option in the GUI. However there is only auto, manual and 6to4 to choose from for IPv6. Strangely the "privacy" option is only found with manual, where it does make little sense, as you set the IP manually.


    So is this now a bug or a feature request to get the privacy option into the "auto" configuration as well?

  • LE is currently built around the assumption of being installed on an IPv4 device behind a NAT gateway in a domestic/home network. As a result you should assume there is only partial support for IPv6 in the OS. In fact i'm surprised there is any, as last time I actually looked it was mostly disabled everywhere. You are welcome to make suggestions on improvements, but AFAIK none of the core team have access to IPv6 networks to validate any suggestions that are made. Things that appear (or not) in the settings GUI could simply be things that didn't exist in connman when the settings add-on was originally written in 2012/2013 so it's worthwhile cross-referencing with connman documentation and the "connmanctl" utility. If you make changes via connmanctl they will be persistent.

  • That is good to know. Most services seem to listen on ipv6, so it would be good to know, if they are properly configured. Otherwise it would be worthwhile to deactivate ipv6 overall.


    Regarding connman: I figured that it suffers of the same spelling error as "systemd-networkd" and the configuration has to be spelled "IPv6.privacy=prefered".

    It then changes the configuration for the device and is creating a second ipv6, however not a temporary one.

    A step forward on not using the MAC address anymore, however not the final goal.

    Will see with the connman mailing list what this might be about.


    For improving the ipv6 parts, I can give input and test things. I also looked into the plugin where the settings are done, however I am no real programmer and can't even figure out where and how the addon ends up in kodi (most other plugins are just zipped and I can change (monkey with typewriter :-D) some things).

  • packages/mediacentre/LibreELEC-settings grabs sources from github (same as any other addon) and it's embedded in the image for Kodi use

  • So I got contact with Daniel from connman, he will look into the issues I encountered.

    This leaves the gui and settings. I figured that the libreelec-settings is coming from the code in github, however I cannot find it in the packages on the running system.

    I looked for a packages folder as you described, however can only find one in /storage/.kodi/addons. This seems to only contain the .zip files of the addons?


    With a regular addon, I would just copy the code from github, do some changes, zip it and run an update with it. Is this possible with the settings plugin as well?

  • hmm... that is probably above my level of expertise. Is there a docker available for a build environment?


    Within the github I actually could see the line, that sets the privacy extensions in the manual mode (service.libreelec.settings/connman.py at master · LibreELEC/service.libreelec.settings · GitHub). This should be wrong, as it does not make sense with a manually set ipv6. Think it should be linked to the parent "auto".

    Not sure if this is just changed here and generation for connman will follow or if changes are needed somewhere else. But that is what I would try to change.

  • tools/docker in our git repo, but our distro image/buildsystem environment isn't going to help you develop for our OS. I wish I could help more, but I am not a python developer.