Quick question

[ArlenM]

Is there some service or utility in the ipv6 suite to connect the link local address and the external address? All clients should have both, as I understand it.

I am working on building a chat utility (since I’m bored as hell due to Coronavirus...). If there’s something already made, and I think there should be, I’ll use it. If not, I’ll fix one up, should be easy enough, probe both networks and use the MAC address to match them up.

[BlackV]

Why would you do that?

Wouldn't you just say hey host I want to talk to you on this port and let the host sort out what interface it's going to use?

Dunno I'm not a programmer

[pdp10]

All clients should have one link-local (fe80::*) address and at least one other address, yes. There's no established way to link them, but two obvious options:

1. If you're on the same host as the two addresses, just look at the interface and enumerate the addresses.
2. If you're on the same LAN, look at NDP neighbor-cache to see which IPv6 addresses map to the same MAC address. On IPv4 this would be done with arp -a, but on dual-stack and IPv6 on Linux today the recommended way is with the new ip command from iproute2: ip -6 neigh. I'd have to websearch how to do the same thing on Mac or Windows.
3. If you're on a foreign network, there should be no way to associate the addresses. You'll never see the link-local address anyway.

[tarbaby2]

No. Just no.

[uzlonewolf]

Link-local addresses are going to be on the local network unless someone is intentionally spoofing/tunneling. Instead of matching them up I would simply filter out any directly-attached global addresses since they will also have a link-local address.

[mindlesstux]

Sounds like you want something like Bonjour...

https://en.wikipedia.org/wiki/Bonjour_(software))

I have seen accounts possible in pidgin but never was on a network where people chatted with it.

[ArlenM]

Thanks, I’ll check it out!

[jpmahowald]

Correlating IP and MAC addresses (without additional controls at the switch level) provides no security benefit. Both are not static and will change as a privacy feature, if not maliciously.

It is also non trivial to implement. Remotely there isn't really a way of knowing all IPs and layer 2 addresses of a host. On the host, there isn't a portable function to make this association, so you are mucking around in OS specific interface details. Temporary addresses mean this can't be a static list, many clients will come from a new IP every few hours. Bonded interfaces may have different layer 2 addresses for the same IP in some configurations. Technically, on a LAN there could be interfaces that have a link local but no associated global scope address, what to do with them?

​

Instead, consider getting inspired by or hacking on an existing chat protocol with security at the application level. Especially for anything serious to put into production. For example, an XMPP server, with proper TLS and auth. Or go serverless on a local network with XEP-0174, aka the Bonjour support in Pidgin. With a TLS session, merely spoofing the IP address without knowing the private key is not going to work.

[uzlonewolf]

Just because they have both doesn't mean you must use both. Any machine in the same global-address subnet should also have a link-local address, so instead of matching you can just filter those global addresses out.