Hi everyone,

Description of problem:

oVirt uses network bridges to connect virtual machines to each other (via tun devices) and, optionally, to the outer world. Users can configure IPv6 networking, but when they don't, we consider it a security problem if VMs could still communicate via IPv6 "without consent" so we explicitly use a sysctl command to disable_ipv6=1 on bridges in case there is no IPv6 configured on them.

Currently though, this setting doesn't persist after reboot. Dan Kenigsberg suggested that we use drop-in files in /etc/sysctl.d/ to disable_ipv6=1 on bridges at startup.

However, we would like to ask maintainers of initscripts package to consider disabling IPv6 on bridges when IPV6INIT=no so that both cases were covered for us, right in the system.

Version-Release number of selected component (if applicable):
initscripts-9.49.24-1.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Create a bridge and connect eth0 to it.

$ cat /etc/sysconfig/network-scripts/ifcfg-ovirtmgmt
# Generated by VDSM version 4.17.2-170.gitdc2c649.el7
DEVICE=ovirtmgmt
TYPE=Bridge
DELAY=0
STP=off
ONBOOT=yes
BOOTPROTO=dhcp
DEFROUTE=no
NM_CONTROLLED=no
IPV6INIT=no
HOTPLUG=no

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Generated by VDSM version 4.17.2-170.gitdc2c649.el7
DEVICE=eth0
HWADDR=00:1a:4a:23:12:43
BRIDGE=ovirtmgmt
ONBOOT=yes
NM_CONTROLLED=no
IPV6INIT=no

# systemctl restart network

2. Disable IPv6 explicitly (oVirt's VDSM does this on virtualization hosts)

# echo 1 > /proc/sys/net/ipv6/conf/ovirtmgmt/disable_ipv6

Ideally, the network service would have done this.

3. Reboot to see networking restored with IPv6 enabled again.

We could have had a conf file in /etc/sysctl.d/ to solve this use case but we would appreciate if the network service did it for us.

Thank you for giving it a try!