Re: Wrong source MAC for DHCP requests with AddressRandomization=network

["Toke Høiland-Jørgensen" <toke@toke.dk>]

Denis Kenzior <denkenz@gmail.com> writes:

> Hi Toke,
>
> On 11/24/23 05:58, Toke Høiland-Jørgensen wrote:
>> Hi
>> 
>> When setting AddressRandomization=network in main.conf, I am unable to
>> connect to networks because I don't get a DHCP reply after the L2
>> connection.
>> 
>> Looking at a packet dump, it seems the DHCP request uses the wrong
>> source MAC in the request:
>> 
>
> Can you try the following patch on the ell mailing list?  Here's the patchwork 
> link in case you're not subscribed:
> https://patchwork.kernel.org/project/ell/patch/20231124161740.1243946-1-denkenz@gmail.com/

Yup, that resolves the issue so that I can connect. However, this is the
DHCP packets I see when moving between two networks (back and forth):


17:49:59.040639 1e:aa:ca:6d:0d:e0 > 92:0a:9a:27:ca:65, ethertype IPv4 (0x0800), length 342: 10.42.3.52.68 > 10.42.3.33.67: BOOTP/DHCP, Request from 1e:aa:ca:6d:0d:e0, length 300
17:49:59.392682 ba:06:75:75:30:90 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ba:06:75:75:30:90, length 300
17:49:59.396012 e6:49:86:36:22:bf > ba:06:75:75:30:90, ethertype IPv4 (0x0800), length 335: 10.42.3.97.67 > 10.42.3.102.68: BOOTP/DHCP, Reply, length 293
17:49:59.396167 ba:06:75:75:30:90 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ba:06:75:75:30:90, length 300
17:49:59.397811 e6:49:86:36:22:bf > ba:06:75:75:30:90, ethertype IPv4 (0x0800), length 335: 10.42.3.97.67 > 10.42.3.102.68: BOOTP/DHCP, Reply, length 293

17:50:03.306455 ba:06:75:75:30:90 > e6:49:86:36:22:bf, ethertype IPv4 (0x0800), length 342: 10.42.3.102.68 > 10.42.3.97.67: BOOTP/DHCP, Request from ba:06:75:75:30:90, length 300
17:50:03.614293 1e:aa:ca:6d:0d:e0 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 1e:aa:ca:6d:0d:e0, length 300
17:50:03.619009 92:0a:9a:27:ca:65 > 1e:aa:ca:6d:0d:e0, ethertype IPv4 (0x0800), length 359: 10.42.3.33.67 > 10.42.3.52.68: BOOTP/DHCP, Reply, length 317
17:50:03.619085 1e:aa:ca:6d:0d:e0 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 1e:aa:ca:6d:0d:e0, length 300
17:50:03.620141 92:0a:9a:27:ca:65 > 1e:aa:ca:6d:0d:e0, ethertype IPv4 (0x0800), length 359: 10.42.3.33.67 > 10.42.3.52.68: BOOTP/DHCP, Reply, length 317

As you can see, in each case, there's an initial unicast request that
contains the old MAC and IP. Which seems to be a bit counter productive
if this is supposed to be a privacy feature that doesn't leak addresses
across networks? :)

-Toke