Change in vdsm[ovirt-3.6]: net: also disable IPv6 on bridges not using it, after unifie...

osvoboda at redhat.com osvoboda at redhat.com
Tue Feb 23 10:46:49 UTC 2016


Hello Dan Kenigsberg, Edward Haas,

I'd like you to do a code review.  Please visit

    https://gerrit.ovirt.org/53882

to review the following change.

Change subject: net: also disable IPv6 on bridges not using it, after unified restoration
......................................................................

net: also disable IPv6 on bridges not using it, after unified restoration

This is a follow-up work to disallow VM-host communication over IPv6
(using e.g. link-local addresses) in the case when networking on the host
was configured without IPv6.

This covers the reboot scenario, in addition to the previously implemented
disablement of IPv6 during network configuration through setupNetworks.

Change-Id: I12be9d8c99ddfeb85d6ba6093535e35b6883e963
Bug-Url: https://bugzilla.redhat.com/1219363
Signed-off-by: Ondřej Svoboda <osvoboda at redhat.com>
Reviewed-on: https://gerrit.ovirt.org/53683
Continuous-Integration: Jenkins CI
Reviewed-by: Edward Haas <edwardh at redhat.com>
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M vdsm/vdsm-restore-net-config
1 file changed, 18 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/82/53882/1

diff --git a/vdsm/vdsm-restore-net-config b/vdsm/vdsm-restore-net-config
index 7ede6f0..1074d11 100755
--- a/vdsm/vdsm-restore-net-config
+++ b/vdsm/vdsm-restore-net-config
@@ -28,12 +28,16 @@
 import time
 import errno
 
+import six
+
 from vdsm.config import config
 from vdsm import ipwrapper
 from vdsm import netinfo
+from vdsm.netinfo import ipv6_supported
 from vdsm.constants import P_VDSM_RUN
 from vdsm.netconfpersistence import RunningConfig, PersistentConfig, \
     KernelConfig, CONF_PERSIST_DIR, BaseConfig
+from vdsm import sysctl
 from vdsm.utils import monotonic_time
 import hostdev
 
@@ -132,6 +136,8 @@
         logging.debug('Calling setupNetworks with networks (%s) '
                       'and bond (%s).', nets, bonds)
         setupNetworks(nets, bonds, connectivityCheck=False, _inRollback=True)
+    if ipv6_supported():
+        _restore_disable_ipv6(nets)
 
 
 def _verify_all_devices_are_up(owned_ifcfg_files):
@@ -341,6 +347,18 @@
                not l.oper_up)
 
 
+def _restore_disable_ipv6(networks):
+    """
+    Disable IPv6 on bridges with no IPv6 configuration, after networks have
+    been restored. This is implemented for unified persistence only.
+    """
+    for net, net_attr in six.iteritems(networks):
+        if net_attr.get('bridged') and not net_attr.get('ipv6addr') and not (
+                net_attr.get('ipv6autoconf')) and not net_attr.get('dhcpv6'):
+            # _wait_for_for_all_devices_up has already run, so assuming up
+            sysctl.disable_ipv6(net)
+
+
 def _owned_ifcfg(link_name):
     return _ifcfg_predicate(link_name, _owned_ifcfg_content)
 


-- 
To view, visit https://gerrit.ovirt.org/53882
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I12be9d8c99ddfeb85d6ba6093535e35b6883e963
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.6
Gerrit-Owner: Ondřej Svoboda <osvoboda at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh at redhat.com>


More information about the vdsm-patches mailing list