Prevent binding IPv6 addresses to Neutron interfaces
Explicitly disable IPv6 on Neutron created interfaces in the default
namespace before setting link up. Since the default behavior of IPv6 is
to bind to all interfaces as opposed to IPv4 where an address must be
explicitly configured we disable IPv6 on each interface before enabling
the interface. This avoids leaving a time window between when the
interface is enabled and when it is attached to bridge device during
which the host could be access from a tenant network.
Move disable_ipv6() from BridgeDevice to base IPDevice class so it is
usable by all interfaces. Then we explicitly disable IPv6 on veth
interfaces in the default namespaces and VXLAN and VLAN interfaces
created by the LinuxBridge agent.
In addition vlan interface is moved from LinuxBridgeManager to IPWrapper
so it can return an IPDevice object.
Reviewed: https:/ /review. openstack. org/291275 /git.openstack. org/cgit/ openstack/ neutron/ commit/ ?id=ccdfd176666 98b81074ead89dc 865949074295e5
Committed: https:/
Submitter: Jenkins
Branch: stable/liberty
commit ccdfd17666698b8 1074ead89dc8659 49074295e5
Author: Dustin Lundquist <email address hidden>
Date: Thu Jan 14 23:04:43 2016 -0800
Prevent binding IPv6 addresses to Neutron interfaces
Explicitly disable IPv6 on Neutron created interfaces in the default
namespace before setting link up. Since the default behavior of IPv6 is
to bind to all interfaces as opposed to IPv4 where an address must be
explicitly configured we disable IPv6 on each interface before enabling
the interface. This avoids leaving a time window between when the
interface is enabled and when it is attached to bridge device during
which the host could be access from a tenant network.
Move disable_ipv6() from BridgeDevice to base IPDevice class so it is
usable by all interfaces. Then we explicitly disable IPv6 on veth
interfaces in the default namespaces and VXLAN and VLAN interfaces
created by the LinuxBridge agent.
In addition vlan interface is moved from LinuxBridgeManager to IPWrapper
so it can return an IPDevice object.
Conflicts: agent/linux/ bridge_ lib.py tests/unit/ plugins/ ml2/drivers/ linuxbridge/ agent/test_ linuxbridge_ neutron_ agent.py
neutron/
neutron/
Closes-Bug: #1534652 2f8ff153e813e75 19a4424447b 596951cdfc5cb42 59501d84f2)
Change-Id: Id879075f2d5ee4
(cherry picked from commit fc8ebae0351f5b6