[lxc-devel] [PATCH] Add IPv6 support to lxc-net
Serge Hallyn
serge.hallyn at ubuntu.com
Fri Apr 24 14:10:55 UTC 2015
Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>
> ---
> config/init/common/lxc-net.in | 28 +++++++++++++++++++++++++++-
> 1 file changed, 27 insertions(+), 1 deletion(-)
>
> diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
> index 988d2f9..ea115a4 100644
> --- a/config/init/common/lxc-net.in
> +++ b/config/init/common/lxc-net.in
> @@ -17,6 +17,11 @@ LXC_DHCP_MAX="253"
> LXC_DHCP_CONFILE=""
> LXC_DOMAIN=""
>
> +LXC_IPV6_ADDR=""
> +LXC_IPV6_MASK=""
> +LXC_IPV6_NETWORK=""
> +LXC_IPV6_NAT="false"
> +
> [ ! -f $distrosysconfdir/lxc ] || . $distrosysconfdir/lxc
>
> if [ -d "$localstatedir"/lock/subsys ]; then
> @@ -80,6 +85,11 @@ start() {
> iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
> iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
> iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
> +
> + if [ "$LXC_IPV6_NAT" = "true" ]; then
> + ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE || true
> + fi
> +
> ifdown ${LXC_BRIDGE}
> brctl delbr ${LXC_BRIDGE} || true
> }
> @@ -104,6 +114,17 @@ start() {
> fi
>
> ifup ${LXC_BRIDGE} ${LXC_ADDR} ${LXC_NETMASK}
> +
> + LXC_IPV6_ARG=""
> + if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
> + echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
> + echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
> + ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
> + if [ "$LXC_IPV6_NAT" = "true" ]; then
> + ip6tables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
> + fi
> + LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
> + fi
> iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
> iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
> iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
> @@ -125,7 +146,7 @@ start() {
> break
> fi
> done
> - dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
> + dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative $LXC_IPV6_ARG || cleanup
> touch "${varrun}"/network_up
> touch "${lockdir}"/lxc-net
> }
> @@ -149,6 +170,11 @@ stop() {
> iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
> iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
> iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
> +
> + if [ "$LXC_IPV6_NAT" = "true" ]; then
> + ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE || true
> + fi
> +
> pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid || true
> rm -f "${varrun}"/dnsmasq.pid
> brctl delbr ${LXC_BRIDGE}
> --
> 2.1.4
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
More information about the lxc-devel
mailing list