diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-09-24 19:01:00 +0000 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-09-24 19:01:00 +0000 |
| commit | 53b661d60e50edd1079a2f55e0cb3e44e76553e2 (patch) | |
| tree | 21f5420f71cf4cbaace8943ac4047761dea34414 /src/migration-scripts/ipsec | |
| parent | e0ca5c66796337dd992d6572019ea6f4edb475dc (diff) | |
| download | vyos-1x-53b661d60e50edd1079a2f55e0cb3e44e76553e2.tar.gz vyos-1x-53b661d60e50edd1079a2f55e0cb3e44e76553e2.zip | |
ppp: T9060: do not derive a link-local address from a synthetic MAC
A PPP link has no hardware address. RFC 5072 defines the IPv6 interface
identifier of such a link as the one negotiated via IPV6CP, and that
negotiation is also what guarantees its uniqueness - which is why duplicate
address detection is skipped for the link-local address on PPP links.
VyOS additionally derived an EUI-64 link-local address from a synthetic MAC
address and assigned it to PPPoE and SSTP client interfaces. The peer knows
nothing about that address and its uniqueness was never verified. With two
link-local addresses present, RFC 6724 source address selection falls through
to rule 8 and may pick the synthetic one, so DHCPv6 prefix delegation and
router solicitations leave from an address the BRAS never negotiated. ISPs
validating the source address silently drop them and delegation stalls.
Both interface types now carry only the address negotiated via IPV6CP. A
leftover address on an established session is removed on commit.
Diffstat (limited to 'src/migration-scripts/ipsec')
0 files changed, 0 insertions, 0 deletions