How to turn off IPV6 (link local)
While solving the debian bug #253590 against net-tools, I discovered, that it is not possible to turn off the link local ipv6 addresses.
net.ipv6.conf.default.autoconf does work for the received prefixes, but does not avoid the link local configuration. (this is btw a documentation error)
I would not mind the link local address much, if there wont be some applications (like mozilla) trying to actually use that address to reach internet site.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=253590
So my question is, how can one prevent linux kernel with build in ipv6 from adding the link local prefix, and are the prerequisites of an ipv6 enabled application to not prefer link local prefix to ipv4?
Greetings
Bernd
PS:
autoconf - BOOLEAN
Configure link-local addresses using L2 hardware addresses.
Default: TRUE
Signature · 2 lines
eckes privat - http://www.eckes.org/ Project Freefire - http://www.freefire.org/
Hi Bernd,
CCd: debian bug, read down to the explanation of why this is occuring and why this is not a bug.
Quoted 2 lines
While solving the debian bug #253590 against net-tools, I discovered, that it is not possible to turn off the link local ipv6 addresses.
Indeed.
Quoted 3 lines
net.ipv6.conf.default.autoconf does work for the received prefixes, but does not avoid the link local configuration. (this is btw a documentation error)
autoconf defines whether it will auto-configure an address if a router advertises the IPv6 prefix for the network to it.
Quoted 6 lines
I would not mind the link local address much, if there wont be some applications (like mozilla) trying to actually use that address to reach internet site.
The issue is not having the link local address, because there is no default route and hence the connection should fail.
The problem, in the case of thi sbug, is that he has IPv6 configured, but it is not working, 2001: is a real IPv6 address (so he has a tunnel configured with a router to advertise) and the 2002:: is a '6ot4' address, which something on the system has configured, and obviously that is not working either, probably because he has a router preventing the 6to4 packets from passsing, or the default route for the 2001:
address has a higher metric and thats still broken.
Link-local address start with fe80:: and never have a default route so they will not be a problem.
Quoted 3 lines
So my question is, how can one prevent linux kernel with build in ipv6 from adding the link local prefix, and are the prerequisites of an ipv6 enabled application to not prefer link local prefix to ipv4?
You can't, but it is not the issue here, you could however not load the module.
Cheers,
Trent
Sixlabs
Signature · 2 lines
Trent Lloyd <[email protected]> Bur.st Networking Inc.
Re: Bug#253590: How to turn off IPV6 (link local)
Quoted 6 lines · Trent Lloyd
Quoted 3 lines
net.ipv6.conf.default.autoconf does work for the received prefixes, but does not avoid the link local configuration. (this is btw a documentation error)
autoconf defines whether it will auto-configure an address if a router advertises the IPv6 prefix for the network to it.
Yes, but the configure help tells me otherwise. Especially since there are two options (autoconfigure and accpet_ra) I dont think the current behavious is intended:
autoconf - BOOLEAN
Configure link-local addresses using L2 hardware addresses.
Default: TRUE
accept_ra - BOOLEAN
Accept Router Advertisements; autoconfigure using them.
Functional default: enabled if local forwarding is disabled.
disabled if local forwarding is enabled.
So I think autoconf=0 should avoid adding the 3ff8 link local address (as well as lo ::1)
Quoted 2 lines
The issue is not having the link local address, because there is no default route and hence the connection should fail.
No, please check the bug report. The problem with netscape is that it _does_ fail and not fall back to ipv4. But I think for performance reasons, no ipv6 application should actually try to contact destinations which are not in the scope of the configured address (dont connect to sitelocal/global of only linklocal prefix is configured)
Quoted 2 lines
The problem, in the case of thi sbug, is that he has IPv6 configured, but it is not working, 2001: is a real IPv6 address
That was the initial problem, but we have solved that by turning autoconf off. The last email was only with an fe80:: prefix.
Quoted 2 lines
Link-local address start with fe80:: and never have a default route so they will not be a problem.
They are the problem, as you see above because the applications still prefers them over ipv4.
Quoted 2 lines
You can't, but it is not the issue here, you could however not load the module.
Yes, if it is a module. But see my comment above, I dont think the sysctl behaves as documented, and does not behave as expected.
I can prepare a patch for this, if everybody agrees. In addition to that, I would like to know how application and resolver can be fixed to not use incomplete or broken v6 setups (i.e. ignore link local prefix on non local targets without trying to connect).
Greetings
Bernd
Signature · 4 lines
(OO) -- Bernd_Eckenfels@Mörscher_Strasse_8.76185Karlsruhe.de --
( .. ) ecki@{inka.de,linux.de,debian.org} http://www.eckes.org/
o--o 1024D/E383CD7E eckes@IRCNet v:+497211603874 f:+497211606754
(O____O) When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl!Re: Bug#253590: How to turn off IPV6 (link local)
Quoted 2 lines · Bernd Eckenfels
So I think autoconf=0 should avoid adding the 3ff8 link local address (as well as lo ::1)
3ff8 a link local address? I think you're wrong. Link local addresses have the fe80:: prefix. 3ff8::/64 is a global unicast IPv6 address.
Re: Bug#253590: How to turn off IPV6 (link local)
Quoted 2 lines · In article <[email protected]> you wrote:
3ff8 a link local address? I think you're wrong. Link local addresses have the fe80:: prefix. 3ff8::/64 is a global unicast IPv6 address.
Yes indeed, this was an cut+paste error, the other places in the text correctly refer to fe80::/64.
I moved the discussion to linux-net@vger.
Gruss
Bernd
Signature · 2 lines
eckes privat - http://www.eckes.org/ Project Freefire - http://www.freefire.org/
Re: Bug#253590: How to turn off IPV6 (link local)
In reply to Bernd EckenfelsHi All,
Quoted 6 lines
Quoted 2 lines
autoconf defines whether it will auto-configure an address if a router advertises the IPv6 prefix for the network to it.
Yes, but the configure help tells me otherwise. Especially since there are two options (autoconfigure and
accpet_ra) I dont think the current behavious is intended:
Ahh, i see, however you would have to set autoconf to off then *remove* the link-local addresses, because they are setup before that variable is changed? [or is there an option for this in the kernel? afaik its just in proc (sysctl)]
That said, the link-local addresses are *NOT* the issue here, and having them will not cause said problems, the problem here is the user has 4 real world IPv6 addresses configured by a router on his network + user configuration (the 6to4 address).
Quoted 9 lines
autoconf - BOOLEAN
Configure link-local addresses using L2 hardware addresses.Default: TRUE
accept_ra- BOOLEAN
Accept Router Advertisements; autoconfigure using them.
Quoted 6 lines
Functional default: enabled if local forwarding is disabled.
disabled if local forwarding is enabled.So I think autoconf=0 should avoid adding the 3ff8 link local address (as well as lo ::1)
loopback will always be configured (like in ipv4)
3ff8 isnt link local, fe80 is.
Quoted 9 lines
Quoted 3 lines
The issue is not having the link local address, because there is no default route and hence the connection should fail.
No, please check the bug report. The problem with netscape is that it _does_ fail and not fall back to ipv4. But I think for performance reasons, no ipv6 application should actually try to contact destinations which are not in the scope of the configured address (dont connect to sitelocal/global of only linklocal prefix is configured)
They won't, it acts on routing, and netscape is also broken in not falling back.
Quoted 5 lines
Quoted 2 lines
The problem, in the case of thi sbug, is that he has IPv6 configured, but it is not working, 2001: is a real IPv6 address
That was the initial problem, but we have solved that by turning autoconf off. The last email was only with an fe80:: prefix.
Ah right, I didn't see that.
Quoted 6 lines
Quoted 3 lines
Link-local address start with fe80:: and never have a default route so they will not be a problem.
They are the problem, as you see above because the applications still prefers them over ipv4.
It will attempt to connect, yes, but it will do this whether you have any addresses or not because binding a socket to AF_INET6 suceeds, in this case netscape is just horrendously broken in not falling back and a bug should be filed with that program.
Quoted 10 lines
Quoted 2 lines
You can't, but it is not the issue here, you could however not load the module.
Yes, if it is a module. But see my comment above, I dont think the sysctl behaves as documented, and does not behave as expected.
I can prepare a patch for this, if everybody agrees. In addition to that, I would like to know how application and resolver can be fixed to not use incomplete or broken v6 setups (i.e. ignore link local prefix on non local targets without trying to connect).
Check out http://www.sixlabs.org/talks/, in my IPv6 programming talk I have code showing how to use getaddrinfo() and try each address until one suceeds.
Basically, when the application resolves and gets any number of IPv6 and IPv4 addresses, it should try each in order until one works.
Sorry I mis-understood a little missing an email where you turned off the global addresses.
If you need any more help, feel free to contact me privately (with coding problems, etc), however I am limited in time and net access at the moment so my replies may be a little delayed.
Happy hacking,
Trent
Sixlabs
--
Trent Lloyd <[email protected]>
Bur.st Networking Inc.
Quoted 4 lines · Trent Lloyd
Ahh, i see, however you would have to set autoconf to off then *remove* the link-local addresses, because they are setup before that variable is changed? [or is there an option for this in the kernel? afaik its just in proc (sysctl)]
you can set net.ipv6.conf.defaul.autoconf=0 and then up the interface. This will prevent it from getting any announced prefixes, but it wont prevent it from getting linklocal prefix.
So my idea is, that autoconf=0 will prevent it from getting linklocal and advertised adddresses and accept_ra=0 will prevent it from getting announced prefixes.
Quoted 4 lines
That said, the link-local addresses are *NOT* the issue here, and having them will not cause said problems, the problem here is the user has 4 real world IPv6 addresses configured by a router on his network + user configuration (the 6to4 address).
Well, the user does not have them now anymore and Mozilla uses the link-local. However I agree with you, that it might not help to remove (prevent autoconfgration) because mozilla still might suceed in AF_INET6 binding and try the connect w/o failback.
Quoted 3 lines
Check out http://www.sixlabs.org/talks/, in my IPv6 programming talk I have code showing how to use
getaddrinfo()and try each address until one suceeds.
There is btw an additional issue with sending AAAA requests on a host which is not fully configured for ipv6. In fact I think we should disable to compile ipv6 into the kernel, its so painfull to turn the AF off.
Greetings
Bernd
Signature · 4 lines
(OO) -- Bernd_Eckenfels@Mörscher_Strasse_8.76185Karlsruhe.de --
( .. ) ecki@{inka.de,linux.de,debian.org} http://www.eckes.org/
o--o 1024D/E383CD7E eckes@IRCNet v:+497211603874 f:+497211606754
(O____O) When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl!