[pve-devel] [PATCH pve-common] fix #4299: network : disable_ipv6: fix path checking

[Wolfgang Bumiller]

On Fri, Oct 21, 2022 at 04:55:08AM +0000, DERUMIER, Alexandre wrote:
> Hi,
> 
> This is to avoid to have ipv6 local-link ip address on every generated
> tap interfaces (and fwbr bridges too).
> (and have bad packets send to the network)

To be more precise: it's a security measure.

You don't want the host to get IPv6-link-local addresses on every tap,
veth, fw-link, fw-bridge device we create, as each of those would
potentially allow VMs to send packets addressed to that device, which is
very unexpected :-)

> 
> 
> This, of course, don't disabling ipv6 support inside the vm/ct.
> 
> 
> 
> Le jeudi 20 octobre 2022 à 17:07 +0000, Mark Schouten via pve-devel a
> écrit :
> > Hi,
> > 
> > Sorry. But I always get extremely triggered by functions called 
> > ‘disable_ipv6()’.
> > 
> > Can someone hit me with a cluebat as to why that function even
> > exists? 
> > (Since we deploy Proxmox without IPv4, so anywhere where ipv6 is 
> > actively disabled, will break stuff for us).

You obviously don't use...
...umm
...any software out there that does networking :-D

Well, maybe Ceph Hammer, that one worked, but IPv6-only got increasingly
inbearable afterwards until I gave up.