IPv6 privacy extensions disabled and EUI-64 used, exposing the WLAN MAC address to remote hosts

Bug Reports
1

REPRODUCIBILITY: 100%
OS VERSION: 5.2.0.17
HARDWARE: Jolla Phone (2026), jp2601
UI LANGUAGE: English
REGRESSION: No, longstanding behaviour

DESCRIPTION:

IPv6 privacy extensions (RFC 4941) are disabled on every WLAN connection, and
SLAAC addresses are generated with EUI-64. The resulting global address embeds
the interface MAC address, so the device’s permanent hardware address is sent
to every remote host contacted over IPv6.

The kernel is configured for privacy addressing:

/proc/sys/net/ipv6/conf/all/use_tempaddr     = 2
/proc/sys/net/ipv6/conf/default/use_tempaddr = 2

but ConnMan overrides this per interface, writing IPv6.privacy=disabled into
every saved service, resulting in:

/proc/sys/net/ipv6/conf/wlan0/use_tempaddr   = 0

Address generation also uses EUI-64 rather than stable-privacy:

/proc/sys/net/ipv6/conf/wlan0/addr_gen_mode  = 0

The SLAAC address is flagged mngtmpaddr, i.e. the kernel is ready to derive
temporary addresses from it, but none are generated because use_tempaddr is 0.

(MAC addresses, prefixes and identifiers below are substituted.)

PRECONDITIONS:

A WLAN network providing IPv6 via SLAAC/router advertisements.

STEPS TO REPRODUCE:

  1. Connect to a WLAN network that provides IPv6.
  2. Run: ip -6 addr show wlan0
  3. Compare the host portion of the global address with the interface MAC
    address from: ip link show wlan0

EXPECTED RESULT:

A temporary (privacy) address is generated and preferred for outgoing
connections, as the global use_tempaddr=2 setting indicates was intended.
The stable address, if present, should not be derived from the MAC address.

ACTUAL RESULT:

Only a EUI-64 address is present. The MAC address appears in the host portion
with the universal/local bit flipped and ff:fe inserted in the middle. With a
MAC of aa:bb:cc:11:22:33 the address ends in a8bb:ccff:fe11:2233, making the
hardware address visible to every remote server.

Per-service configuration under
.local/share/system/privileged/connman/wifi_*/settings contains
IPv6.privacy=disabled on all saved networks.

MODIFICATIONS:

Patchmanager and OpenRepos packages installed; none affecting networking.

ADDITIONAL INFORMATION:

Observed after a clean reboot:

$ ip -6 addr show wlan0
34: wlan0: <BROADCAST,MULTICAST,DYNAMIC,UP,LOWER_UP> mtu 1500 state UP
    inet6 2001:db8:1:2::198/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2001:db8:1:2:a8bb:ccff:fe11:2233/64 scope global dynamic mngtmpaddr proto kernel_ra
       valid_lft 3597sec preferred_lft 3597sec
    inet6 fe80::a8bb:ccff:fe11:2233/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever

$ ip link show wlan0
34: wlan0: <BROADCAST,MULTICAST,DYNAMIC,UP,LOWER_UP> mtu 1500 qdisc mq state UP
    link/ether aa:bb:cc:11:22:33 brd ff:ff:ff:ff:ff:ff permaddr aa:bb:cc:11:22:33

The DHCPv6 DUID stored in the same service files is DUID-LLT and also embeds
the MAC address (e.g. 0001000131fa04aaaabbcc112233), so it would remain a
stable identifier even if address generation were fixed.

1 Like