[pve-devel] [PATCH common] Network: add disable_ipv6 and use it

[Wolfgang Bumiller]

Many interfaces used to get an ipv6 link-local address which
was usually unusable and therefore pointless.

In order to ensure consistency this is called in various
places:
* $bridge_add_interface() and $ovs_bridge_add_port() because
  it's generally a good choice for bridge ports.
* tap_create() and veth_create() because the activate the
  interfaces and we want to avoid the link local address to
  exist temporarily between bringing the interface up and
  adding it to a bridge.
* create_firewall_bridge_*() because firewall bridges aren't
  meant to have addresses either.
* activate_bridge_vlan() - if vlan_filtering is disabled we
  create vlan-bridges and neither them nor their physical
  ports should have link local addresses.
---
 src/PVE/Network.pm | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm
index b760c42..7df8e73 100644
--- a/src/PVE/Network.pm
+++ b/src/PVE/Network.pm
@@ -171,9 +171,20 @@ my $cond_create_bridge = sub {
     }
 };
 
+sub disable_ipv6 {
+    my ($iface) = @_;
+    return if !-d '/proc/sys/net/ipv6'; # ipv6 might be completely disabled
+    my $file = "/proc/sys/net/ipv6/conf/$iface/disable_ipv6";
+    open(my $fh, '>', $file) or die "failed to open $file for writing: $!\n";
+    print {$fh} "1\n" or die "failed to disable link-local ipv6 for $iface\n";
+    close($fh);
+}
+
 my $bridge_add_interface = sub {
     my ($bridge, $iface, $tag, $trunks) = @_;
 
+    # drop link local address (it can't be used when on a bridge anyway)
+    disable_ipv6($iface);
     system("/sbin/brctl addif $bridge $iface") == 0 ||
 	die "can't add interface 'iface' to bridge '$bridge'\n";
 
@@ -215,6 +226,7 @@ my $ovs_bridge_add_port = sub {
     $cmd .= " -- set Interface $iface type=internal" if $internal;
     system($cmd) == 0 ||
 	die "can't add ovs port '$iface'\n";
+    disable_ipv6($iface);
 };
 
 my $activate_interface = sub {
@@ -232,6 +244,7 @@ sub tap_create {
     my $bridgemtu = &$read_bridge_mtu($bridge);
 
     eval { 
+	disable_ipv6($iface);
 	PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu");
     };
     die "interface activation failed\n" if $@;
@@ -252,6 +265,8 @@ sub veth_create {
     }
 
     # up vethpair
+    disable_ipv6($veth);
+    disable_ipv6($vethpeer);
     &$activate_interface($veth);
     &$activate_interface($vethpeer);
 }
@@ -272,6 +287,7 @@ my $create_firewall_bridge_linux = sub {
     my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
 
     &$cond_create_bridge($fwbr);
+    disable_ipv6($fwbr);
     &$activate_interface($fwbr);
 
     copy_bridge_config($bridge, $fwbr);
@@ -292,6 +308,7 @@ my $create_firewall_bridge_ovs = sub {
     my $bridgemtu = &$read_bridge_mtu($bridge);
 
     &$cond_create_bridge($fwbr);
+    disable_ipv6($fwbr);
     &$activate_interface($fwbr);
 
     &$bridge_add_interface($fwbr, $iface);
@@ -414,6 +431,9 @@ sub activate_bridge_vlan_slave {
 	    die "can't add vlan tag $tag to interface $iface\n";
     }
 
+    # remove ipv6 link-local address before activation
+    disable_ipv6("${iface}.${tag}");
+
     # be sure to have the $ifacevlan up
     &$activate_interface($ifacevlan);
 
@@ -468,6 +488,8 @@ sub activate_bridge_vlan {
 
 	#fixme: set other bridge flags
 
+	# remove ipv6 link-local address before activation
+	disable_ipv6($bridgevlan);
 	# be sure to have the bridge up
 	system("/sbin/ip link set $bridgevlan up") == 0 ||
 	    die "can't up bridge $bridgevlan\n";
-- 
2.1.4