netdev - [RFC PATCH] ipv6: Use dev_addr in stable-privacy address generation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Mar 2020 10:42:52 +0100
From:   "Bram Bonné" <brambonne@...gle.com>
To:     "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Hannes Frederic Sowa <hannes@...essinduktion.org>
Cc:     netdev@...r.kernel.org,
        "Bram Bonné" <brambonne@...gle.com>,
        Lorenzo Colitti <lorenzo@...gle.com>,
        Jeffrey Vanderstoep <jeffv@...gle.com>
Subject: [RFC PATCH] ipv6: Use dev_addr in stable-privacy address generation

This patch extends the IN6_ADDR_GEN_MODE_STABLE_PRIVACY address
generation mode to use the software-defined MAC address (dev_addr)
rather than the permanent, hardware-defined MAC address (perm_addr) of
the interface when generating IPv6 link-local addresses.

This ensures that the IPv6 link-local address changes in line with the
MAC address when per-network MAC address randomization is used,
providing the expected privacy guarantees.

When no MAC address randomization is used, dev_addr corresponds to
perm_addr, and IN6_ADDR_GEN_MODE_STABLE_PRIVACY behaves as before.

When MAC address randomization is used, this makes the MAC address
fulfill the role of both the Net_Iface and the (optional) Network_ID
parameters in RFC7217.

Cc: Lorenzo Colitti <lorenzo@...gle.com>
Cc: Jeffrey Vanderstoep <jeffv@...gle.com>
Signed-off-by: Bram Bonné <brambonne@...gle.com>
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5b9de773ce73..cd69a4331246 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3252,7 +3252,7 @@ static int ipv6_generate_stable_address(struct in6_addr *address,
 	sha_init(digest);
 	memset(&data, 0, sizeof(data));
 	memset(workspace, 0, sizeof(workspace));
-	memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
+	memcpy(data.hwaddr, idev->dev->dev_addr, idev->dev->addr_len);
 	data.prefix[0] = address->s6_addr32[0];
 	data.prefix[1] = address->s6_addr32[1];
 	data.secret = secret;
-- 
2.25.1.696.g5e7596f4ac-goog