Skip to content

Commit

Permalink
Assume IPv6 is disabled unless proven otherwise
Browse files Browse the repository at this point in the history
This ensures that errors cause IPv6 to be disabled, which is safer.
  • Loading branch information
DemiMarie committed Dec 21, 2021
1 parent 09d785d commit ec98afd
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions network/vif-route-qubes
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ case "$command" in
ipcmd='add'
iptables_cmd='-I PREROUTING 1'
cmdprefix=''
ipv6_disabled=$(cat /proc/sys/net/ipv6/conf/"${vif}"/disable_ipv6 || echo 1)
ipv6_disabled=$(cat "/proc/sys/net/ipv6/conf/$vif/disable_ipv6" || echo 1)
# without a MAC address we will fail later with a confusing error
mac=$(xenstore-read "backend/vif/$domid/$sub/mac") || exit 1
;;
Expand Down Expand Up @@ -185,7 +185,7 @@ if [ "${ip}" ]; then
# the guest using those addresses.
for addr in ${ip};
do
if [[ "$addr" = *:* ]] && [[ "$ipv6_disabled" = 1 ]]; then
if [[ "$addr" = *:* ]] && [[ "$ipv6_disabled" != '0' ]]; then
log error "Cannot set IPv6 route to ${addr}, IPv6 disabled in the kernel"
continue
fi
Expand All @@ -194,7 +194,7 @@ if [ "${ip}" ]; then
network_hooks "${command}" "${vif}" "${addr}"
done
${cmdprefix} ip addr "${ipcmd}" "${back_ip}/32" dev "${vif}"
if [ "${back_ip6}" ] && [[ "${back_ip6}" != "fe80:"* ]] && [[ "$ipv6_disabled" != 1 ]]; then
if [ "${back_ip6}" ] && [[ "${back_ip6}" != "fe80:"* ]] && [[ "$ipv6_disabled" = '0' ]]; then
${cmdprefix} ip addr "${ipcmd}" "${back_ip6}/128" dev "${vif}"
fi
else
Expand Down

0 comments on commit ec98afd

Please sign in to comment.