External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-12 15:52:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable IPv6 on virtual networks

Browse Source 
If the bridge device is configured to have IPv6 address and
accept router advertisments, then a malicious guest can send
out bogus advertisments and hijack/DOS host IPv6 connectivity

* src/network_driver.c: Set accept_ra=0, disable_ipv6=1, autoconf=0
  for IPv6 sysctl on virual network bridge devices
This commit is contained in:
Daniel P. Berrange 2009-07-30 16:34:56 +01:00
parent a49cf8a57d
commit 651153216b
1 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
src/network_driver.c
View File

@ -788,6 +788,55 @@ networkEnableIpForwarding(void)
return virFileWriteStr("/proc/sys/net/ipv4/ip_forward", "1\n"); return virFileWriteStr("/proc/sys/net/ipv4/ip_forward", "1\n");
} }
#define SYSCTL_PATH "/proc/sys"
static int networkDisableIPV6(virConnectPtr conn,
virNetworkObjPtr network)
{
char *field = NULL;
int ret = -1;
if (virAsprintf(&field, SYSCTL_PATH "/net/ipv6/conf/%s/disable_ipv6", network->def->bridge) < 0) {
virReportOOMError(conn);
goto cleanup;
}
if (virFileWriteStr(field, "1") < 0) {
virReportSystemError(conn, errno,
_("cannot enable %s"), field);
goto cleanup;
}
VIR_FREE(field);
if (virAsprintf(&field, SYSCTL_PATH "/net/ipv6/conf/%s/accept_ra", network->def->bridge) < 0) {
virReportOOMError(conn);
goto cleanup;
}
if (virFileWriteStr(field, "0") < 0) {
virReportSystemError(conn, errno,
_("cannot disable %s"), field);
goto cleanup;
}
VIR_FREE(field);
if (virAsprintf(&field, SYSCTL_PATH "/net/ipv6/conf/%s/autoconf", network->def->bridge) < 0) {
virReportOOMError(conn);
goto cleanup;
}
if (virFileWriteStr(field, "1") < 0) {
virReportSystemError(conn, errno,
_("cannot enable %s"), field);
goto cleanup;
}
ret = 0;
cleanup:
VIR_FREE(field);
return ret;
}
static int networkStartNetworkDaemon(virConnectPtr conn, static int networkStartNetworkDaemon(virConnectPtr conn,
struct network_driver *driver, struct network_driver *driver,
virNetworkObjPtr network) { virNetworkObjPtr network) {
@ -806,6 +855,9 @@ static int networkStartNetworkDaemon(virConnectPtr conn,
return -1; return -1;
} }
if (networkDisableIPV6(conn, network) < 0)
goto err_delbr;
if (brSetForwardDelay(driver->brctl, network->def->bridge, network->def->delay) < 0) if (brSetForwardDelay(driver->brctl, network->def->bridge, network->def->delay) < 0)
goto err_delbr; goto err_delbr;