netdev - ip-token: unable to remove a token & multi-token handling & concurrent use w/ EUI64/privacy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 19 Mar 2016 18:53:24 +0000
From:	"Robin H. Johnson" <robbat2@...too.org>
To:	netdev@...r.kernel.org, daniel@...earbox.net
Subject: ip-token: unable to remove a token & multi-token handling &
 concurrent use w/ EUI64/privacy

Hi,

Playing around with IPv6 tokens, I ran into a problem:
Once you have a token set on an interface, it's impossible to remove it!

# ip token set :: dev eth0
RTNETLINK answers: Invalid argument

This is a side-effect of rejecting ipv6_addr_any in inet6_set_iftoken.

While this gets fixed, I have two related feature requests for this:
- Please make it possible to configure multiple tokens on an interface:
  Use case: Deploying local services on well-known addresses inside a
  network without explicit prefix configuration.
- Adding a token causes other address generation methods to be disabled,
  this is problematic if you wish to prefer privacy addresses for
  outbound connections.

Design suggestion:
Convert from using a single token to using a list of tokens, with an
explicit default IPv6-any-addr (::) in the list, to represent that
other address generation should ALSO take place (EUI64/privacy).
Deletion of the any-addr from the list should disable EUI64/privacy
addresses.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead, Foundation Trustee
E-Mail     : robbat2@...too.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85