Package: bridge-utils Version: 1.7.1-1 Severity: normal
Issue ===== Using "ip token", a command to specify a fixed Interface ID for IPv6 addressing, fails with bridges in Debian Bookworm, as the token needs to be set in between interface creation and taking the interface up. /lib/bridge-utils/ifupdown.sh currently does not allow to hook into that stage. Using the following interface config: auto br0 iface br0 inet dhcp bridge_ports enp1s0 bridge_hw 12:34:56:78:90:12 iface br0 inet6 manual pre-up ip token set ::192.168.1.35 dev br0 causes the system to end up with the usual EUI-64 based global IPv6 addresses in addition to the token-based addresses. The kernel then keeps the EUI-64 based addresses in addition to the wanted token-based addresses until they expire, at which point only the tokized interface identifiers keep being used. Workaround ========== As a "hack", the following workaround configuration can be used: auto br0 iface br0 inet dhcp pre-up brctl addbr br0 pre-up ip link set dev br0 address 12:34:56:78:90:12 pre-up ip token set ::192.168.1.35 dev br0 bridge_ports enp1s0 bridge_hw 00:1e:06:45:2e:fa iface br0 inet6 manual This causes the "ip token" command to apply between interface creation and taking the interface up, which works as expected (i.e. the system only has global addresses based on the token). Of course, any required feature dealt with in /lib/bridge-utils/ifupdown.sh in between interface creation and taking the interface up needs to be replicated manually via pre-up. Proposed fix ============ Adding the lines: if [ "$IF_BRIDGE_TOKEN" ] then ip token set $IF_BRIDGE_TOKEN dev $IFACE fi right before: # We activate the bridge ip link set dev $IFACE up in /lib/bridge-utils/ifupdown.sh and using the interface config: auto br0 iface br0 inet dhcp bridge_ports enp1s0 bridge_hw 12:34:56:78:90:12 bridge_token ::192.168.1.35 fixes the problem. However, this necessarily introduces a dependency on iproute2 (i.e. it should probably be a "recommends", existence of "/sbin/ip" might be necessary to check, documentation needs to be adapted).