[lxc-devel] [lxd/master] More routed nictype fixes

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 301 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200327/074fa519/attachment.bin>
-------------- next part --------------
From ce2e6bc02772f5ae9a168fa802bd5046a18695a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Fri, 27 Mar 2020 21:31:29 -0400
Subject: [PATCH 1/2] lxd/device/nic_routed: Don't fail on missing IPv6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/device/nic_routed.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lxd/device/nic_routed.go b/lxd/device/nic_routed.go
index ba226eb5d4..10f558944b 100644
--- a/lxd/device/nic_routed.go
+++ b/lxd/device/nic_routed.go
@@ -2,6 +2,7 @@ package device
 
 import (
 	"fmt"
+	"os"
 	"strings"
 
 	deviceConfig "github.com/lxc/lxd/lxd/device/config"
@@ -283,7 +284,7 @@ func (d *nicRouted) postStart() error {
 	if v["host_name"] != "" {
 		// Attempt to disable IPv6 router advertisement acceptance.
 		err := util.SysctlSet(fmt.Sprintf("net/ipv6/conf/%s/accept_ra", v["host_name"]), "0")
-		if err != nil {
+		if err != nil && !os.IsNotExist(err) {
 			return err
 		}
 

From bad2748788a711183e2cd5a26cea9470716abe3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Fri, 27 Mar 2020 21:32:58 -0400
Subject: [PATCH 2/2] lxd/device/nic_routed: Set rp_filter=1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Suggested-by: Etienne Champetier
Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/device/nic_routed.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lxd/device/nic_routed.go b/lxd/device/nic_routed.go
index 10f558944b..0e1b3a7e6e 100644
--- a/lxd/device/nic_routed.go
+++ b/lxd/device/nic_routed.go
@@ -288,6 +288,12 @@ func (d *nicRouted) postStart() error {
 			return err
 		}
 
+		// Prevent source address spoofing by requiring a return path.
+		err = util.SysctlSet(fmt.Sprintf("net/ipv4/conf/%s/rp_filter", v["host_name"]), "1")
+		if err != nil && !os.IsNotExist(err) {
+			return err
+		}
+
 		if d.config["ipv4.address"] != "" {
 			_, err := shared.RunCommand("ip", "-4", "addr", "add", fmt.Sprintf("%s/32", d.ipv4HostAddress()), "dev", v["host_name"])
 			if err != nil {