[pve-devel] [PATCH pve-common] fix #4299: network : disable_ipv6: fix path checking
w.bumiller at proxmox.com
Fri Oct 21 10:16:31 CEST 2022
On Fri, Oct 21, 2022 at 04:55:08AM +0000, DERUMIER, Alexandre wrote:
> This is to avoid to have ipv6 local-link ip address on every generated
> tap interfaces (and fwbr bridges too).
> (and have bad packets send to the network)
To be more precise: it's a security measure.
You don't want the host to get IPv6-link-local addresses on every tap,
veth, fw-link, fw-bridge device we create, as each of those would
potentially allow VMs to send packets addressed to that device, which is
very unexpected :-)
> This, of course, don't disabling ipv6 support inside the vm/ct.
> Le jeudi 20 octobre 2022 à 17:07 +0000, Mark Schouten via pve-devel a
> écrit :
> > Hi,
> > Sorry. But I always get extremely triggered by functions called
> > ‘disable_ipv6()’.
> > Can someone hit me with a cluebat as to why that function even
> > exists?
> > (Since we deploy Proxmox without IPv4, so anywhere where ipv6 is
> > actively disabled, will break stuff for us).
You obviously don't use...
...any software out there that does networking :-D
Well, maybe Ceph Hammer, that one worked, but IPv6-only got increasingly
inbearable afterwards until I gave up.
More information about the pve-devel