提交 c0788af0 编写于 作者: L Laine Stump

network: always set disable_ipv6, even when it should be 0

libvirt previously only touched an interface's disable_ipv6 setting in
sysfs if it needed to be set to 1, assuming that 0 is the
default. Apparently that isn't always the case though (kernel 3.15.7-1
in Arch Linux reportedly defaults a new interface's disable_ipv6
setting to 1) so this patch explicitly sets it to 0 or 1 as
appropriate.
上级 be3cbecd
...@@ -1824,33 +1824,34 @@ networkSetIPv6Sysctls(virNetworkObjPtr network) ...@@ -1824,33 +1824,34 @@ networkSetIPv6Sysctls(virNetworkObjPtr network)
{ {
char *field = NULL; char *field = NULL;
int ret = -1; int ret = -1;
bool enableIPv6 = !!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0);
if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { /* set disable_ipv6 if there are no ipv6 addresses defined for the
/* Only set disable_ipv6 if there are no ipv6 addresses defined for * network. But also unset it if there *are* ipv6 addresses, as we
* the network. * can't be sure of its default value.
*/ */
if (virAsprintf(&field, SYSCTL_PATH "/net/ipv6/conf/%s/disable_ipv6", if (virAsprintf(&field, SYSCTL_PATH "/net/ipv6/conf/%s/disable_ipv6",
network->def->bridge) < 0) network->def->bridge) < 0)
goto cleanup; goto cleanup;
if (access(field, W_OK) < 0 && errno == ENOENT) { if (access(field, W_OK) < 0 && errno == ENOENT) {
if (!enableIPv6)
VIR_DEBUG("ipv6 appears to already be disabled on %s", VIR_DEBUG("ipv6 appears to already be disabled on %s",
network->def->bridge); network->def->bridge);
ret = 0; ret = 0;
goto cleanup; goto cleanup;
} }
if (virFileWriteStr(field, "1", 0) < 0) { if (virFileWriteStr(field, enableIPv6 ? "0" : "1", 0) < 0) {
virReportSystemError(errno, virReportSystemError(errno,
_("cannot write to %s to disable IPv6 on bridge %s"), _("cannot write to %s to enable/disable IPv6 "
field, network->def->bridge); "on bridge %s"), field, network->def->bridge);
goto cleanup; goto cleanup;
}
VIR_FREE(field);
} }
VIR_FREE(field);
/* The rest of the ipv6 sysctl tunables should always be set, /* The rest of the ipv6 sysctl tunables should always be set the
* whether or not we're using ipv6 on this bridge. * same, whether or not we're using ipv6 on this bridge.
*/ */
/* Prevent guests from hijacking the host network by sending out /* Prevent guests from hijacking the host network by sending out
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册