SteamOS icon indicating copy to clipboard operation
SteamOS copied to clipboard

Security - IPv6 - Enable Privacy Extensions for SLAAC

Open pwatk opened this issue 1 year ago • 3 comments

SteamOS on the Steam Deck has privacy extensions disabled. This is a serious privacy and security risk that needs to be rectified.

pwatk avatar Dec 24 '24 15:12 pwatk

This has been improved in 3.7 (in Preview right now), or Main since a few weeks ago.

manuelafm avatar Mar 21 '25 15:03 manuelafm

Now released as Stable. If you have a chance, please test and see if it's what you expected, thanks.

manuelafm avatar May 27 '25 11:05 manuelafm

Instead of fixing the problem someone has decided disable IPv6 for the wlan0 interface.

sysctl -a | grep disable_ipv6
...
net.ipv6.conf.wlan0.disable_ipv6 = 1

The actual fix is to enable privacy extensions for the wlan0 interface which can be done just as easily: net.ipv6.conf.wlan0.use_tempaddr = 2

pwatk avatar Jun 03 '25 16:06 pwatk

Hello @pwatk, checking locally, @manuelafm's claim holds up as the distro default. If you're still seeing those tunables on your system, it's likely a local config from previous tinkering is being retained.

Closing as fixed.

kisak-valve avatar Jul 05 '25 02:07 kisak-valve

Your assumption that I have been "tinkering" is incorrect. Just because I know how to fix this myself doesn't mean I have!

From my perspective, I had working IPv6 (without privacy extensions) before the update and it was explicitly disabled after the update.

I appreciate that this may not have been expected behaviour and if that is the case then I accept that I too was making an assumption.

pwatk avatar Jul 05 '25 07:07 pwatk

For clarity, my local test was with a Steam Deck LCD running SteamOS 3.7.13. This unit has not had any network changes under the hood and reading through sysctl -a, the output contained:

net.ipv6.conf.wlan0.disable_ipv6 = 0
[...]
net.ipv6.conf.wlan0.use_tempaddr = 2

If there's some other factor besides a preexisting config involved in disabling use_tempaddr, then we'll need steps to reproduce the issue or a plausible hypothetical to ponder this further.

kisak-valve avatar Jul 05 '25 12:07 kisak-valve

Thank you for providing more detail regarding this @kisak-valve .

I can only assume the continued lack of IPv6 support on my Steam Deck is indeed an isolated issue.

Thanks to both @manuelafm and yourself for taking the time to work on this.

pwatk avatar Jul 05 '25 15:07 pwatk