Fedora Account System
Red Hat Associate
Red Hat Customer
When checking IPs in my machine on a fresh install, IPv6 privacy extensions are off, and only one global address, which is stable, is seen. Reproducible: Always Steps to Reproduce: Pre-requisites: * have a working IPv6 network, having it connected to the internet *might* not be needed, but it should use SLAAC, and also 1. Install Fedora Workstation 40 (might also happen on a live environment) 2. Check IPs, through ifconfig or the GUI for networking Actual Results: 3. There is only one global IPv6 address. Expected Results: 3. There *should* be two addresses, the regular global stable one, and the preferred, temporary address from Privacy Extensions. Workarounds It is possible to enable them back using the terminal. Run nmcli connection and check what the UUID for the relevant interface is, and copy it. Run nmcli connection modify <uuid> ipv6.ip6-privacy 2, replacing <uuid> with the relevant UUID. Disable your connection and enable it again, and it should be solved. You may need to run these with sudo? Unsure. --- One thing I’d like to add, is that from the distros I’ve used, Linux Mint, did not have this issue, but Linux Mint Debian Edition did, so I suppose Ubuntu fixed this. On LMDE, it was easy to fix without the terminal by going into network settings and then connections, and there all that can be done through a GUI. The weird thing is that the option marked as ‘Default’ there, seems to just not use them. I’m unsure if this could potentially have been being caused by my network. I think my network has DHCPv6 for DNS only (for an address that doesn’t have port 53 open… but anyway) but uses regular SLAAC for addressing. Maybe Linux thinks I’m using DHCPv6 because of that and doesn’t deal with this properly…? The only reason I even think I might have DHCPv6 is because AOSP doesn’t get these bad DNS addresses (it’s the router’s local link address) while other OSes do. I believe this is a bug really, unless it’s something really weird with my setup, but it’s weird it wasn’t an issue in Linux Mint regular, using Ubuntu. For servers, keeping IPv6 privacy extensions off might make sense, as they’d probably want to use a stable IPv6 address there anyway, but not for workstations, regular desktop use.
Hi. Please provide the output of these 3 commands (remove sensitive data from them): nmcli --version sysctl net.ipv6.conf.default.use_tempaddr NetworkManager --print-config Also, why do you think that using IPv6 privacy is the default? Normally it is not, unless you have done something to make it the default.
Hey, hello! Here: ``` lucas@fedora:~$ nmcli --version ferramenta nmcli, versão 1.46.0-2.fc40 lucas@fedora:~$ sysctl net.ipv6.conf.default.use_tempaddr net.ipv6.conf.default.use_tempaddr = 0 lucas@fedora:~$ NetworkManager --print-config # NetworkManager configuration: /etc/NetworkManager/NetworkManager.conf (lib: 20-connectivity-fedora.conf, 22-wifi-mac-addr.conf) (run: 15-carrier-timeout.conf) [main] # plugins= # rc-manager=auto # migrate-ifcfg-rh=true # auth-polkit=true # dhcp=internal # iwd-config-path= configure-and-quit=no [connectivity] enabled=true uri=http://fedoraproject.org/static/hotspot.txt response=OK interval=300 [logging] # backend=journal # audit=false [device] # wifi.backend=wpa_supplicant [connection.22-wifi-mac-addr] match-device=type:wifi wifi.cloned-mac-address=stable-ssid # no-auto-default file "/var/lib/NetworkManager/no-auto-default.state" ``` It usually is the default in every other OS, at least for users, examples are macOS, Windows, AOSP (Android), iOS, all have IPv6 Privacy Extensions enabled by default. This might not make sense to apply to something like Fedora Server, but for things like Fedora Workstation, that are focused towards the user that won't want, or will, be messing around with the terminal (which may not even be aware of this), privacy should be the default. This only might cause issues in the context of a server, not of a PC user, it is overall beneficial to the user. If one has a stable IPv6 prefix, they will have the same IPv6 address always, which will be used for everything, which isn't great. Even with dynamic prefixes, people don't restart their router all the time, so it would still stay problematic as addresses are used for very long periods of time, and can be easily linked together. IPv6 Privacy Extensions aren't perfect but they're essential. I'm unsure if I'm reporting this as the right component to be fair. I put it as NetworkManager because that's as far as I know when it comes to this. I'm new to Linux overall and found this kind of problematic. Maybe this should be sent somewhere else? I'm lost. Also sorry about formatting here, I'm not used to this platform.
Ok, there is no bug anywhere. With your current configuration, it's just that IP6 privacy is not enabled because it's not the default in Fedora. If you want to enable it by default for all the connections, you can do one of these things: 1. Enable as NetworkManager config (will affect to NetworkManager managed devices only).Create a file in /etc/NetworkManager/conf.d/10-ip6-privacy.conf, with the content: [connection.ip6-privacy] ipv6.ip6-privacy=2 2. Enable it globally via sysctl (NetworkManager will pick this value). Create a file in /etc/sysctl.d/10-ip6-privacy.conf, with the content: net.ipv6.conf.default.use_tempaddr = 2 Then restart NetworkManager, or reboot for the second method. So that's the solution for you. If you think that this should be the default in Fedora, that's a change in system policies and probably needs to be requested and approved. We cannot just change the default in NetworkManager without approval because it can affect to the existing network connectivity of existing users. If you or someone else wants to request the change, I think this is the explanation about how to do it (it requires to defend the reasons of why it is a good idea, how to avoid breaking existing users, etc.): https://docs.fedoraproject.org/en-US/program_management/changes_policy/ I'm closing this bug as there is nothing to fix. If the change is requested as a system policy, a dedicated ticket will be needed, I guess.