gnrc_ipv6_nib/SLAAC: rfc7217 stable privacy addresses

sys/include/net/gnrc/ipv6/nib/conf.h

@@ -186,6 +186,13 @@ extern "C" {
 #define CONFIG_GNRC_IPV6_NIB_SLAAC                    1
 #endif
 
+/**
+ * @brief Use stable privacy addresses (rfc7217)
+ */
+#ifndef CONFIG_GNRC_IPV6_STABLE_PRIVACY
+#define CONFIG_GNRC_IPV6_STABLE_PRIVACY 0
+#endif
+
 /**
  * @brief    handle Redirect Messages
  */

sys/include/net/gnrc/netif/internal.h

@@ -130,6 +130,28 @@ void gnrc_netif_ipv6_addr_remove_internal(gnrc_netif_t *netif,
 int gnrc_netif_ipv6_addr_idx(gnrc_netif_t *netif,
                              const ipv6_addr_t *addr);
 
+/**
+ * @brief   Returns the index of the first pfx
+ *          in gnrc_netif_t::ipv6_addrs of @p netif
+ *          where the first @p pfx_len bits match with @p pfx
+ *
+ * @pre `(netif != NULL) && (pfx != NULL)`
+ *
+ * Can be used to check if an address is assigned to an interface.
+ *
+ * @param[in] netif the network interface
+ * @param[in] pfx  the address to check
+ * @param[in] pfx_len the amount of bits to compare
+ *
+ * @note    Only available with @ref net_gnrc_ipv6 "gnrc_ipv6".
+ *
+ * @return  index of the first matching address
+ *          in gnrc_netif_t::ipv6_addrs of @p netif
+ * @return  -1, if no matching address found for @p netif
+ */
+int gnrc_netif_ipv6_addr_pfx_idx(gnrc_netif_t *netif,
+                                 const ipv6_addr_t *pfx, uint8_t pfx_len);
+
 /**
  * @brief   Gets state from address flags
  *
@@ -160,6 +182,25 @@ static inline uint8_t gnrc_netif_ipv6_addr_dad_trans(const gnrc_netif_t *netif,
     return netif->ipv6.addrs_flags[idx] & GNRC_NETIF_IPV6_ADDRS_FLAGS_STATE_TENTATIVE;
 }
 
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY) || defined(DOXYGEN)
+/**
+ * @brief   Gets number of address generation retries already performed for an address
+ *
+ * @param[in] netif the network interface
+ * @param[in] idx   index of the address (and its flags)
+ *
+ * @return  the number of address generation retries already
+ *          performed
+ */
+static inline uint8_t gnrc_netif_ipv6_addr_gen_retries(const gnrc_netif_t *netif,
+                                                     int idx)
+{
+    return (netif->ipv6.addrs_flags[idx]
+    & GNRC_NETIF_IPV6_ADDRS_FLAGS_IDGEN_RETRIES)
+    >> GNRC_NETIF_IPV6_ADDRS_FLAGS_IDGEN_RETRIES_POS;
+}
+#endif
+
 /**
  * @brief   Returns the index of an address in gnrc_netif_t::ipv6_addrs of @p
  *          netif that matches @p addr best

sys/include/net/gnrc/netif/ipv6.h

@@ -68,6 +68,19 @@ extern "C" {
  * @brief   Address is an anycast address
  */
 #define GNRC_NETIF_IPV6_ADDRS_FLAGS_ANYCAST                (0x20U)
+
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY) || defined(DOXYGEN)
+/**
+ * @brief Number of address generation retries
+ * For addresses generated as per RFC7217, this stores the DAD_Counter value
+ * and the upper limit is defined by @ref STABLE_PRIVACY_IDGEN_RETRIES
+ */
+#define GNRC_NETIF_IPV6_ADDRS_FLAGS_IDGEN_RETRIES          (0xC0U)
+/**
+ * @brief Shift position of address generation retries
+ */
+#define GNRC_NETIF_IPV6_ADDRS_FLAGS_IDGEN_RETRIES_POS      (6)
+#endif
 /** @} */
 
 /**

sys/include/net/netopt.h

@@ -25,8 +25,11 @@
 #ifndef NET_NETOPT_H
 #define NET_NETOPT_H
 
+#include <kernel_defines.h>
 #include <stdint.h>
 #include <stdbool.h>
+#include <net/ipv6/addr.h>
+#include "eui64.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -911,6 +914,38 @@
     /* add other states if needed */
 } netopt_state_t;
 
+/**
+ * @brief   Option parameter to be used with @ref NETOPT_IPV6_IID
+ */
+enum {
+    NETOPT_IPV6_IID_HWADDR = 0,
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY) || defined(DOXYGEN)
+    NETOPT_IPV6_IID_RFC7217,
+#endif
+};
+
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY) || defined(DOXYGEN)
+/**
+ * @brief       Data for @ref NETOPT_IPV6_IID when using RFC7217,
+ *              passed on to ipv6_get_rfc7217_iid,
+ *              from which the descriptions are also copied
+ */
+typedef struct {
+    /**
+     * @param[out] where to store the generated interface identifier
+     */
+    eui64_t *iid;
+    /**
+     * @param[in] pfx The prefix for which the IID is to be generated.
+     */
+    const ipv6_addr_t *pfx;
+    /**
+     * @param[in,out] dad_ctr ("DAD_Counter" in rfc7217)
+     */
+    uint8_t *dad_ctr;
+} netopt_ipv6_rfc7217_iid_data;
+#endif
+
 /**
  * @brief   Option parameter to be used with @ref NETOPT_RF_TESTMODE
  */
@@ -1030,7 +1065,7 @@
 /**
  * @brief   Basic callback type on network disconnection @ref NETOPT_CONNECT
  */
 typedef void (*netopt_on_disconnect_result_t) (void *netif, const struct netopt_disconnect_result *res);
 
 /**
  * @brief   Basic network connect request

sys/net/gnrc/Makefile.dep

@@ -431,6 +431,21 @@ ifneq (,$(filter gnrc_ipv6_nib,$(USEMODULE)))
   USEMODULE += random
 endif
 
+#This checks if the option is being set via Kconfig or CFLAGS
+ifneq (,$(or $(CONFIG_GNRC_IPV6_STABLE_PRIVACY),$(filter -DCONFIG_GNRC_IPV6_STABLE_PRIVACY=1,$(CFLAGS))))
+  # Set another macro that is needed for this option.
+
+  ##prepare value
+  stable_privacy_secret_key != python3 -c "import secrets; print(','.join([f'0x{byte:02x}' for byte in secrets.token_bytes(16)]))"
+
+  ##set macro
+  CFLAGS += -DSTABLE_PRIVACY_SECRET_KEY=$(stable_privacy_secret_key)
+
+  # dependencies
+  USEMODULE += hashes ##include "hashes/sha256.h"
+  USEMODULE += ztimer_msec
+endif
+
 ifneq (,$(filter gnrc_udp,$(USEMODULE)))
   DEFAULT_MODULE += auto_init_gnrc_udp
   USEMODULE += gnrc_nettype_udp

sys/net/gnrc/netif/gnrc_netif.c

@@ -49,6 +49,7 @@
 
 #define ENABLE_DEBUG 0
 #include "debug.h"
+#include "../network_layer/ipv6/nib/_nib-slaac.h"
 
 static void _update_l2addr_from_dev(gnrc_netif_t *netif);
 static void _check_netdev_capabilities(netdev_t *dev);
@@ -269,8 +270,23 @@
             }
             break;
         case NETOPT_IPV6_IID:
-            assert(opt->data_len >= sizeof(eui64_t));
-            res = gnrc_netif_ipv6_get_iid(netif, opt->data);
+            switch ((int16_t)opt->context) {
+                case NETOPT_IPV6_IID_HWADDR:
+                    assert(opt->data_len >= sizeof(eui64_t));
+                    res = gnrc_netif_ipv6_get_iid(netif, opt->data);
+                    break;
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY)
+                case NETOPT_IPV6_IID_RFC7217:
+                    assert(opt->data_len == sizeof(netopt_ipv6_rfc7217_iid_data));
+                    netopt_ipv6_rfc7217_iid_data *data =
+                            (netopt_ipv6_rfc7217_iid_data *) opt->data;
+                    res = ipv6_get_rfc7217_iid_idempotent(
+                            data->iid, netif, data->pfx, data->dad_ctr);
+                    break;
+#endif
+                default:
+                    break;
+            }
             break;
         case NETOPT_MAX_PDU_SIZE:
             if (opt->context == GNRC_NETTYPE_IPV6) {
@@ -502,6 +518,9 @@
 
 #if IS_USED(MODULE_GNRC_NETIF_IPV6)
 static int _addr_idx(const gnrc_netif_t *netif, const ipv6_addr_t *addr);
+static int _addr_pfx_idx(const gnrc_netif_t *netif,
+                                const ipv6_addr_t *pfx,
+                                uint8_t pfx_len);
 static int _group_idx(const gnrc_netif_t *netif, const ipv6_addr_t *addr);
 
 static char addr_str[IPV6_ADDR_MAX_STR_LEN];
@@ -730,6 +749,23 @@
     return idx;
 }
 
+int gnrc_netif_ipv6_addr_pfx_idx(gnrc_netif_t *netif,
+                                 const ipv6_addr_t *pfx, uint8_t pfx_len)
+{
+    int idx;
+
+    assert((netif != NULL) && (pfx != NULL));
+    DEBUG("gnrc_netif: get index of first address matching %s/%u"
+          " from interface %" PRIkernel_pid "\n",
+          ipv6_addr_to_str(addr_str, pfx, sizeof(addr_str)),
+          pfx_len,
+          netif->pid);
+    gnrc_netif_acquire(netif);
+    idx = _addr_pfx_idx(netif, pfx, pfx_len);
+    gnrc_netif_release(netif);
+    return idx;
+}
+
 int gnrc_netif_ipv6_addr_match(gnrc_netif_t *netif,
                                const ipv6_addr_t *addr)
 {
@@ -947,11 +983,35 @@
     return -1;
 }
 
+static int _pfx_idx(const gnrc_netif_t *netif, const ipv6_addr_t *pfx, uint8_t pfx_len, bool mcast)
+{
+    /*same as function @ref _idx above, but with generalized condition*/
+    if (!ipv6_addr_is_unspecified(pfx)) {
+        const ipv6_addr_t *iplist = (mcast) ? netif->ipv6.groups :
+                                    netif->ipv6.addrs;
+        unsigned ipmax = (mcast) ? GNRC_NETIF_IPV6_GROUPS_NUMOF :
+                         CONFIG_GNRC_NETIF_IPV6_ADDRS_NUMOF;
+        for (unsigned i = 0; i < ipmax; i++) {
+            if (ipv6_addr_match_prefix(&iplist[i], pfx) >= pfx_len) {
+                return i;
+            }
+        }
+    }
+    return -1;
+}
+
 static inline int _addr_idx(const gnrc_netif_t *netif, const ipv6_addr_t *addr)
 {
     return _idx(netif, addr, false);
 }
 
+static inline int _addr_pfx_idx(const gnrc_netif_t *netif,
+                                const ipv6_addr_t *pfx,
+                                uint8_t pfx_len)
+{
+    return _pfx_idx(netif, pfx, pfx_len, false);
+}
+
 static inline int _group_idx(const gnrc_netif_t *netif, const ipv6_addr_t *addr)
 {
     return _idx(netif, addr, true);
@@ -1284,8 +1344,22 @@
     assert(netif != NULL);
     DEBUG("gnrc_netif: (re-)configure prefix %s/%d\n",
           ipv6_addr_to_str(addr_str, pfx, sizeof(addr_str)), pfx_len);
-    if (gnrc_netapi_get(netif->pid, NETOPT_IPV6_IID, 0, &iid,
-                        sizeof(eui64_t)) >= 0) {
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY)
+    uint8_t dad_ctr = 0;
+    netopt_ipv6_rfc7217_iid_data data;
+    data.iid = &iid;
+    data.pfx = pfx;
+    data.dad_ctr = &dad_ctr;
+    /* no need to store dad_ctr with address (via flags)
+     * as it can't fail DAD, since already valid */
+#endif
+    if (gnrc_netapi_get(netif->pid, NETOPT_IPV6_IID,
+#if IS_ACTIVE(CONFIG_GNRC_IPV6_STABLE_PRIVACY)
+                        NETOPT_IPV6_IID_RFC7217, &data, sizeof(data)
+#else
+                        NETOPT_IPV6_IID_HWADDR, &iid, sizeof(eui64_t)
+#endif
+                        ) >= 0) {
         ipv6_addr_set_aiid(&addr, iid.uint8);
     }
     else {
@@ -2149,4 +2223,4 @@
         }
     }
 }
 /** @} */

sys/net/gnrc/network_layer/ipv6/nib/Kconfig

@@ -38,6 +38,14 @@ config GNRC_IPV6_NIB_SLAAC
     default n if USEMODULE_GNRC_IPV6_NIB_6LR || USEMODULE_GNRC_IPV6_NIB_6LN
     default y
 
+config GNRC_IPV6_STABLE_PRIVACY
+    bool "Use stable privacy addresses (rfc7217)"
+    depends on GNRC_IPV6_NIB_SLAAC
+    help
+        Generate semantically opaque interface identifiers
+        (i.e. L2ADDR is not embedded)
+        for SLAAC IPv6 addresses
+
 config GNRC_IPV6_NIB_QUEUE_PKT
     bool "Use packet queue with address resolution"
     default n if USEMODULE_GNRC_IPV6_NIB_6LN || GNRC_IPV6_NIB_6LN