Re: [Xen-devel] [PATCH 4/5] hotplug/linux: Add IPv6 support to the iptables logic

[Sylvain Munaut <s.munaut@xxxxxxxxxxxxxxxxxxxx>]

Hi,


> So here we deny DHCP whereas for v4 we don't? Why is that? And in other
> cases for v4 we explicitly allow it?

Both for v4 and v6 it allows the VM to make DHCP requests (be a
client) in the case not everything is allowed.


> I see you called this out in the
> commit message, but I must confess I don't know v6 well enough to guess
> why. Is allowing a guest to send DHCP responses more dangerous for v6
> than with v4?

I'm not sure about "more dangerous" in absolute terms, but the fact
many distribs comes with v6 enabled but people don't always take care
to configure it properly by default, I thought it would be a good idea
to be "safe by default".

For v6, the Router Announcement can contain a flag compelling the
client to not only do the classic autoconfig but to also make a DHCPv6
requests to obtains missing parameters (like DNS which isn't part of
RA). A lot of distribs have v6 autoconfig enabled by default, I'm not
sure how many will actually obey this flag though.

Honestly maybe blocking dhcp server response for v4 by default would
make sense, but this could break some existing config and I tried to
stay away from implementing changes that would require people to do
stuff for it to work again.

All the changes here should have no breaking impact if people don't
change their config. They could however allow more stuff than before.
If they had before a working ip6tables setup that was set to FORWARD
policy DROP, and no 'ip' sets in the VIF config, their VMs wouldn't be
able to exchange ipv6 before and they will be able to afterwards.


>> ip6tables:
>>  ACCEPT  all    ::216:3eff:fed0:da2d/::ffff:ffff:ffff:ffff  ::/0
>> PHYSDEV mat
>
> 216:3eff:fed0:da2d here is related to the mac address and therefore to
> the eui64 option?

yes.


> BTW, please can you update docs/misc/xl-network-configuration.markdown
> to reflect the ipv6 behaviour.

Ok, I will.


Cheers,

    Sylvain

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel