Bug 1265875 - Network bridges with IPV6INIT=no should have disable_ipv6=1 (virtualization use case)
Network bridges with IPV6INIT=no should have disable_ipv6=1 (virtualization u...
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: initscripts (Show other bugs)
7.1
Unspecified Linux
unspecified Severity high
: rc
: ---
Assigned To: initscripts Maintenance Team
qe-baseos-daemons
:
Depends On:
Blocks: 1289485 1295396
  Show dependency treegraph
 
Reported: 2015-09-23 22:55 EDT by Ondřej Svoboda
Modified: 2016-11-25 08:06 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-03-01 10:35:25 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ondřej Svoboda 2015-09-23 22:55:06 EDT
Hi everyone,

Description of problem:

oVirt uses network bridges to connect virtual machines to each other (via tun devices) and, optionally, to the outer world. Users can configure IPv6 networking, but when they don't, we consider it a security problem if VMs could still communicate via IPv6 "without consent" so we explicitly use a sysctl command to disable_ipv6=1 on bridges in case there is no IPv6 configured on them.

Currently though, this setting doesn't persist after reboot. Dan Kenigsberg suggested that we use drop-in files in /etc/sysctl.d/ to disable_ipv6=1 on bridges at startup.

However, we would like to ask maintainers of initscripts package to consider disabling IPv6 on bridges when IPV6INIT=no so that both cases were covered for us, right in the system.

Version-Release number of selected component (if applicable):
initscripts-9.49.24-1.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Create a bridge and connect eth0 to it.

$ cat /etc/sysconfig/network-scripts/ifcfg-ovirtmgmt
# Generated by VDSM version 4.17.2-170.gitdc2c649.el7
DEVICE=ovirtmgmt
TYPE=Bridge
DELAY=0
STP=off
ONBOOT=yes
BOOTPROTO=dhcp
DEFROUTE=no
NM_CONTROLLED=no
IPV6INIT=no
HOTPLUG=no

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Generated by VDSM version 4.17.2-170.gitdc2c649.el7
DEVICE=eth0
HWADDR=00:1a:4a:23:12:43
BRIDGE=ovirtmgmt
ONBOOT=yes
NM_CONTROLLED=no
IPV6INIT=no

# systemctl restart network

2. Disable IPv6 explicitly (oVirt's VDSM does this on virtualization hosts)

# echo 1 > /proc/sys/net/ipv6/conf/ovirtmgmt/disable_ipv6

Ideally, the network service would have done this.

3. Reboot to see networking restored with IPv6 enabled again.

We could have had a conf file in /etc/sysctl.d/ to solve this use case but we would appreciate if the network service did it for us.

Thank you for giving it a try!
Comment 2 Lukáš Nykrýn 2016-03-01 10:35:25 EST
I am closing this as notabug. IPV6INIT=no only says that initscripts will not setup ipv6 there. It does not mean that it will disable ipv6 in kernel.

Note You need to log in before you can comment on or make changes to this bug.