Re: Disabling IPv6 by default when creating a new namespace in Linux
Dheeraj Kandula <[email protected]> Wed, 8 Jun 2022 11:11:36 -0400
| Newsgroups | gmane.linux.debian.devel.ipv6 |
|---|---|
| Message-ID | <CA+qNgxTM81mKHx108d_mo9p3utji-1ZCpUJgSMMmzb-o98eLEw@mail.gmail.com> |
--000000000000b74a0205e0f11f4a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I looked into the code to figure out where the IPv6 configuration is copied
from for a new namespace.
I came across this function addrconf_init_net. I assume this is the
function that is invoked when a new namespace is created.
Inside this function, I came across this code,
if (IS_ENABLED
<https://elixir.bootlin.com/linux/latest/C/ident/IS_ENABLED>(CONFIG_SYSCTL
<https://elixir.bootlin.com/linux/latest/K/ident/CONFIG_SYSCTL>) &&
!net_eq <https://elixir.bootlin.com/linux/latest/C/ident/net_eq>(net,
&init_net <https://elixir.bootlin.com/linux/latest/C/ident/init_net>))
{
switch <https://elixir.bootlin.com/linux/latest/C/ident/switch>
(sysctl_devconf_inherit_init_net
<https://elixir.bootlin.com/linux/latest/C/ident/sysctl_devconf_inherit_ini=
t_net>)
{
case 1: /* copy from init_net */
memcpy <https://elixir.bootlin.com/linux/latest/C/ident/memcpy>(all
<https://elixir.bootlin.com/linux/latest/C/ident/all>, init_net
<https://elixir.bootlin.com/linux/latest/C/ident/init_net>.ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6>.devconf_all
<https://elixir.bootlin.com/linux/latest/C/ident/devconf_all>,
sizeof(ipv6_devconf
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6_devconf>));
memcpy <https://elixir.bootlin.com/linux/latest/C/ident/memcpy>(dflt
<https://elixir.bootlin.com/linux/latest/C/ident/dflt>, init_net
<https://elixir.bootlin.com/linux/latest/C/ident/init_net>.ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6>.devconf_dflt
<https://elixir.bootlin.com/linux/latest/C/ident/devconf_dflt>,
sizeof(ipv6_devconf_dflt
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6_devconf_dflt>));
break <https://elixir.bootlin.com/linux/latest/C/ident/break>;
case 3: /* copy from the current netns */
memcpy <https://elixir.bootlin.com/linux/latest/C/ident/memcpy>(all
<https://elixir.bootlin.com/linux/latest/C/ident/all>, current
<https://elixir.bootlin.com/linux/latest/C/ident/current>->nsproxy
<https://elixir.bootlin.com/linux/latest/C/ident/nsproxy>->net_ns
<https://elixir.bootlin.com/linux/latest/C/ident/net_ns>->ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6>.devconf_all
<https://elixir.bootlin.com/linux/latest/C/ident/devconf_all>,
sizeof(ipv6_devconf
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6_devconf>));
memcpy <https://elixir.bootlin.com/linux/latest/C/ident/memcpy>(dflt
<https://elixir.bootlin.com/linux/latest/C/ident/dflt>,
current
<https://elixir.bootlin.com/linux/latest/C/ident/current>->nsproxy
<https://elixir.bootlin.com/linux/latest/C/ident/nsproxy>->net_ns
<https://elixir.bootlin.com/linux/latest/C/ident/net_ns>->ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6>.devconf_dflt
<https://elixir.bootlin.com/linux/latest/C/ident/devconf_dflt>,
sizeof(ipv6_devconf_dflt
<https://elixir.bootlin.com/linux/latest/C/ident/ipv6_devconf_dflt>));
break <https://elixir.bootlin.com/linux/latest/C/ident/break>;
case 0:
case 2:
/* use compiled values */
break <https://elixir.bootlin.com/linux/latest/C/ident/break>;
}
}
If I set the value of net.core.devconf_inherit_init_net to 1, when a
new namespace is created the values in init_net(which again I assume
is init process' namespace value - global/default namespace)
will be copied into the new namespace. A few lines later, the
following code is present.
dflt <https://elixir.bootlin.com/linux/latest/C/ident/dflt>->disable_ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/disable_ipv6> =3D
ipv6_defaults <https://elixir.bootlin.com/linux/latest/C/ident/ipv6_default=
s>.disable_ipv6
<https://elixir.bootlin.com/linux/latest/C/ident/disable_ipv6>;
<<<<< This ipv6_defaults.disable_ipv6 comes from the GRUB command line
value of disable_ipv6.
Hence if I enable IPv6 before creating a new namespace, the new
namespace still will have IPv6 disabled, because of the above single
line of code. Is this correct?
net.ipv6.conf.all.disable_ipv6 is used to change the IPv6 state for
all the currently available interfaces.
net.ipv6.conf.default.disable_ipv6 has the default value from
ipv6_defaults.disable_ipv6 i.e. the grub one. If I change this sysctl,
what impact does it have?
Dheeraj
On Tue, Jun 7, 2022 at 4:25 PM Dheeraj Kandula <[email protected]> wrote:
> Thanks a lot Bjorn for pointing this out. I now have IPv6 disabled by
> default in newly created namespaces too.
>
> However, when I enable IPv6 globally it is not enabled inside the already
> created namespaces. Maybe it has to be done explicitly. I will see if thi=
s
> behavior is acceptable.
>
> Thanks a lot Bjorn. I really appreciate your time and patience.
>
> Thanks, Marc too for taking the time to respond to my emails.
>
> Dheeraj
>
> On Tue, Jun 7, 2022 at 4:05 PM Bj=C3=B8rn Mork <[email protected]> wrote:
>
>> Dheeraj Kandula <[email protected]> writes:
>>
>> > Thanks Bj=C3=B8rn for the reply. But with the grub command line, IPv6 =
option
>> is
>> > not available i.e.* net.ipv6.conf.all.disable_ipv6* i.e. net.ipv6
>> itself is
>> > not available.
>> >
>> > $ sudo sysctl net.ipv6
>> > sysctl: cannot stat /proc/sys/net/ipv6: No such file or directory
>>
>> Huh? Did you set ipv6.disable instead og ipv6.disable_ipv6? Those are
>> very different, as documented in the module:
>>
>>
>> bjorn@miraculix:~$ modinfo ipv6
>> name: ipv6
>> filename: (builtin)
>> alias: net-pf-10
>> license: GPL
>> file: net/ipv6/ipv6
>> description: IPv6 protocol stack for Linux
>> author: Cast of dozens
>> parm: disable:Disable IPv6 module such that it is
>> non-functional (int)
>> parm: disable_ipv6:Disable IPv6 on all interfaces (int)
>> parm: autoconf:Enable IPv6 address autoconfiguration on all
>> interfaces (int)
>>
>>
>>
>>
>> Bj=C3=B8rn
>>
>
--000000000000b74a0205e0f11f4a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>I looked into the code to figure out where the IPv6 c=
onfiguration is copied from for a new namespace.<br></div><div><br></div><d=
iv>I came across this function addrconf_init_net. I assume this is the func=
tion that is invoked when a new namespace is created.</div><div><br></div><=
div>Inside this function, I came across this code, <br></div><div><br></div=
><div><pre> <span class=3D"gmail-k">if</span> <span class=3D"gmail-p">(</sp=
an><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/IS_ENABLED">IS_ENABLED</a></span><span class=3D"gmail-p">(</span=
><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest=
/K/ident/CONFIG_SYSCTL">CONFIG_SYSCTL</a></span><span class=3D"gmail-p">)</=
span> <span class=3D"gmail-o">&&</span>
<span class=3D"gmail-o">!</span><span class=3D"gmail-n"><a href=3D"htt=
ps://elixir.bootlin.com/linux/latest/C/ident/net_eq">net_eq</a></span><span=
class=3D"gmail-p">(</span><span class=3D"gmail-n">net</span><span class=3D=
"gmail-p">,</span> <span class=3D"gmail-o">&</span><span class=3D"gmail=
-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident/init_net">in=
it_net</a></span><span class=3D"gmail-p">))</span> <span class=3D"gmail-p">=
{</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lates=
t/C/ident/switch">switch</a></span> <span class=3D"gmail-p">(</span><span c=
lass=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident=
/sysctl_devconf_inherit_init_net">sysctl_devconf_inherit_init_net</a></span=
><span class=3D"gmail-p">)</span> <span class=3D"gmail-p">{</span>
<span class=3D"gmail-k">case</span> <span class=3D"gmail-mi">1</span><spa=
n class=3D"gmail-o">:</span> <span class=3D"gmail-cm">/* copy from init_ne=
t */</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/memcpy">memcpy</a></span><span class=3D"gmail-p">(</span><span c=
lass=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident=
/all">all</a></span><span class=3D"gmail-p">,</span> <span class=3D"gmail-n=
"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident/init_net">init=
_net</a></span><span class=3D"gmail-p">.</span><span class=3D"gmail-n"><a h=
ref=3D"https://elixir.bootlin.com/linux/latest/C/ident/ipv6">ipv6</a></span=
><span class=3D"gmail-p">.</span><span class=3D"gmail-n"><a href=3D"https:/=
/elixir.bootlin.com/linux/latest/C/ident/devconf_all">devconf_all</a></span=
><span class=3D"gmail-p">,</span>
<span class=3D"gmail-k">sizeof</span><span class=3D"gmail-p">(</s=
pan><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lat=
est/C/ident/ipv6_devconf">ipv6_devconf</a></span><span class=3D"gmail-p">))=
;</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/memcpy">memcpy</a></span><span class=3D"gmail-p">(</span><span c=
lass=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident=
/dflt">dflt</a></span><span class=3D"gmail-p">,</span> <span class=3D"gmail=
-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident/init_net">in=
it_net</a></span><span class=3D"gmail-p">.</span><span class=3D"gmail-n"><a=
href=3D"https://elixir.bootlin.com/linux/latest/C/ident/ipv6">ipv6</a></sp=
an><span class=3D"gmail-p">.</span><span class=3D"gmail-n"><a href=3D"https=
://elixir.bootlin.com/linux/latest/C/ident/devconf_dflt">devconf_dflt</a></=
span><span class=3D"gmail-p">,</span>
<span class=3D"gmail-k">sizeof</span><span class=3D"gmail-p">(</s=
pan><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lat=
est/C/ident/ipv6_devconf_dflt">ipv6_devconf_dflt</a></span><span class=3D"g=
mail-p">));</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/break">break</a></span><span class=3D"gmail-p">;</span>
<span class=3D"gmail-k">case</span> <span class=3D"gmail-mi">3</span><spa=
n class=3D"gmail-o">:</span> <span class=3D"gmail-cm">/* copy from the curr=
ent netns */</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/memcpy">memcpy</a></span><span class=3D"gmail-p">(</span><span c=
lass=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident=
/all">all</a></span><span class=3D"gmail-p">,</span> <span class=3D"gmail-n=
"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident/current">curre=
nt</a></span><span class=3D"gmail-o">-></span><span class=3D"gmail-n"><a=
href=3D"https://elixir.bootlin.com/linux/latest/C/ident/nsproxy">nsproxy</=
a></span><span class=3D"gmail-o">-></span><span class=3D"gmail-n"><a hre=
f=3D"https://elixir.bootlin.com/linux/latest/C/ident/net_ns">net_ns</a></sp=
an><span class=3D"gmail-o">-></span><span class=3D"gmail-n"><a href=3D"h=
ttps://elixir.bootlin.com/linux/latest/C/ident/ipv6">ipv6</a></span><span c=
lass=3D"gmail-p">.</span><span class=3D"gmail-n"><a href=3D"https://elixir.=
bootlin.com/linux/latest/C/ident/devconf_all">devconf_all</a></span><span c=
lass=3D"gmail-p">,</span>
<span class=3D"gmail-k">sizeof</span><span class=3D"gmail-p">(</s=
pan><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lat=
est/C/ident/ipv6_devconf">ipv6_devconf</a></span><span class=3D"gmail-p">))=
;</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/memcpy">memcpy</a></span><span class=3D"gmail-p">(</span><span c=
lass=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident=
/dflt">dflt</a></span><span class=3D"gmail-p">,</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/lin=
ux/latest/C/ident/current">current</a></span><span class=3D"gmail-o">-><=
/span><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/l=
atest/C/ident/nsproxy">nsproxy</a></span><span class=3D"gmail-o">-></spa=
n><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lates=
t/C/ident/net_ns">net_ns</a></span><span class=3D"gmail-o">-></span><spa=
n class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/id=
ent/ipv6">ipv6</a></span><span class=3D"gmail-p">.</span><span class=3D"gma=
il-n"><a href=3D"https://elixir.bootlin.com/linux/latest/C/ident/devconf_df=
lt">devconf_dflt</a></span><span class=3D"gmail-p">,</span>
<span class=3D"gmail-k">sizeof</span><span class=3D"gmail-p">(</s=
pan><span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/lat=
est/C/ident/ipv6_devconf_dflt">ipv6_devconf_dflt</a></span><span class=3D"g=
mail-p">));</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/break">break</a></span><span class=3D"gmail-p">;</span>
<span class=3D"gmail-k">case</span> <span class=3D"gmail-mi">0</span><spa=
n class=3D"gmail-o">:</span>
<span class=3D"gmail-k">case</span> <span class=3D"gmail-mi">2</span><spa=
n class=3D"gmail-o">:</span>
<span class=3D"gmail-cm">/* use compiled values */</span>
<span class=3D"gmail-n"><a href=3D"https://elixir.bootlin.com/linux/late=
st/C/ident/break">break</a></span><span class=3D"gmail-p">;</span>
<span class=3D"gmail-p">}</span>
<span class=3D"gmail-p">}<br><br></span></pre><pre><span class=3D"gmail-p"=
>If I set the value of net.core.devconf_inherit_init_net to 1, when a new n=
amespace is created the values in init_net(which again I assume is init pro=
cess' namespace value - global/default namespace)<br></span></pre><pre>=
<span class=3D"gmail-p">will be copied into the new namespace. A few lines =
later, the following code is present.<br><br><span class=3D"gmail-n"><a hre=
f=3D"https://elixir.bootlin.com/linux/latest/C/ident/dflt">dflt</a></span><=
span class=3D"gmail-o">-></span><span class=3D"gmail-n"><a href=3D"https=
://elixir.bootlin.com/linux/latest/C/ident/disable_ipv6">disable_ipv6</a></=
span> <span class=3D"gmail-o">=3D</span> <span class=3D"gmail-n"><a href=3D=
"https://elixir.bootlin.com/linux/latest/C/ident/ipv6_defaults">ipv6_defaul=
ts</a></span><span class=3D"gmail-p">.</span><span class=3D"gmail-n"><a hre=
f=3D"https://elixir.bootlin.com/linux/latest/C/ident/disable_ipv6">disable_=
ipv6</a></span><span class=3D"gmail-p">; <<<<< This ipv=
6_defaults.disable_ipv6 comes from the GRUB command line value of disable_i=
pv6.</span>
<br></span></pre><pre><span class=3D"gmail-p">Hence if I enable IPv6 before=
creating a new namespace, the new namespace still will have IPv6 disabled,=
because of the above single line of code. Is this correct?<br><br><br></sp=
an></pre><pre><span class=3D"gmail-p">net.ipv6.conf.all.disable_ipv6 is use=
d to change the IPv6 state for all the currently available interfaces.<br><=
/span></pre><pre><span class=3D"gmail-p">net.ipv6.conf.default.disable_ipv6=
has the default value from ipv6_defaults.disable_ipv6 i.e. the grub one. I=
f I change this sysctl, what impact does it have?<br></span></pre><pre><spa=
n class=3D"gmail-p"><br></span></pre><pre><span class=3D"gmail-p">Dheeraj<b=
r></span></pre></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Tue, Jun 7, 2022 at 4:25 PM Dheeraj Kandula <<a =
href=3D"mailto:[email protected]">[email protected]</a>> wrote:<br></d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bord=
er-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>=
Thanks a lot Bjorn for pointing this out. I now have IPv6 disabled by defau=
lt in newly created namespaces too.<br></div><div><br></div><div>However, w=
hen I enable IPv6 globally it is not enabled inside the already created nam=
espaces. Maybe it has to be done explicitly. I will see if this behavior is=
acceptable. <br></div><div><br></div><div>Thanks a lot Bjorn. I really app=
reciate your time and patience. <br></div><div><br></div><div>Thanks, Marc =
too for taking the time to respond to my emails.<br></div><div><br></div><d=
iv>Dheeraj<br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" c=
lass=3D"gmail_attr">On Tue, Jun 7, 2022 at 4:05 PM Bj=C3=B8rn Mork <<a h=
ref=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>> wrote:=
<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8=
ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Dheeraj Kandula=
<<a href=3D"mailto:[email protected]" target=3D"_blank">dkandula@gmail=
.com</a>> writes:<br>
<br>
> Thanks Bj=C3=B8rn for the reply. But with the grub command line, IPv6 =
option is<br>
> not available i.e.* net.ipv6.conf.all.disable_ipv6* i.e. net.ipv6 itse=
lf is<br>
> not available.<br>
><br>
> $ sudo sysctl net.ipv6<br>
> sysctl: cannot stat /proc/sys/net/ipv6: No such file or directory<br>
<br>
Huh?=C2=A0 Did you set ipv6.disable instead og ipv6.disable_ipv6?=C2=A0 Tho=
se are<br>
very different, as documented in the module:<br>
<br>
<br>
bjorn@miraculix:~$ modinfo ipv6<br>
name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ipv6<br>
filename:=C2=A0 =C2=A0 =C2=A0 =C2=A0(builtin)<br>
alias:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 net-pf-10<br>
license:=C2=A0 =C2=A0 =C2=A0 =C2=A0 GPL<br>
file:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0net/ipv6/ipv6<br>
description:=C2=A0 =C2=A0 IPv6 protocol stack for Linux<br>
author:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Cast of dozens<br>
parm:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0disable:Disable IPv6 module s=
uch that it is non-functional (int)<br>
parm:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0disable_ipv6:Disable IPv6 on =
all interfaces (int)<br>
parm:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0autoconf:Enable IPv6 address =
autoconfiguration on all interfaces (int)<br>
<br>
<br>
<br>
<br>
Bj=C3=B8rn<br>
</blockquote></div>
</blockquote></div>
--000000000000b74a0205e0f11f4a--