[lxc-devel] [PATCH] Add IPv6 support to lxc-net

[Serge Hallyn]

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/init/common/lxc-net.in | 28 +++++++++++++++++++++++++++-
>  1 file changed, 27 insertions(+), 1 deletion(-)
> 
> diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
> index 988d2f9..ea115a4 100644
> --- a/config/init/common/lxc-net.in
> +++ b/config/init/common/lxc-net.in
> @@ -17,6 +17,11 @@ LXC_DHCP_MAX="253"
>  LXC_DHCP_CONFILE=""
>  LXC_DOMAIN=""
>  
> +LXC_IPV6_ADDR=""
> +LXC_IPV6_MASK=""
> +LXC_IPV6_NETWORK=""
> +LXC_IPV6_NAT="false"
> +
>  [ ! -f $distrosysconfdir/lxc ] || . $distrosysconfdir/lxc
>  
>  if [ -d "$localstatedir"/lock/subsys ]; then
> @@ -80,6 +85,11 @@ start() {
>          iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
>          iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
>          iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
> +
> +        if [ "$LXC_IPV6_NAT" = "true" ]; then
> +            ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE || true
> +        fi
> +
>          ifdown ${LXC_BRIDGE}
>          brctl delbr ${LXC_BRIDGE} || true
>      }
> @@ -104,6 +114,17 @@ start() {
>      fi
>  
>      ifup ${LXC_BRIDGE} ${LXC_ADDR} ${LXC_NETMASK}
> +
> +    LXC_IPV6_ARG=""
> +    if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
> +        echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
> +        echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
> +        ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
> +        if [ "$LXC_IPV6_NAT" = "true" ]; then
> +            ip6tables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
> +        fi
> +        LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
> +    fi
>      iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
>      iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
>      iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
> @@ -125,7 +146,7 @@ start() {
>              break
>          fi
>      done
> -    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
> +    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative $LXC_IPV6_ARG || cleanup
>      touch "${varrun}"/network_up
>      touch "${lockdir}"/lxc-net
>  }
> @@ -149,6 +170,11 @@ stop() {
>          iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
>          iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
>          iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
> +
> +        if [ "$LXC_IPV6_NAT" = "true" ]; then
> +            ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE || true
> +        fi
> +
>          pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid || true
>          rm -f "${varrun}"/dnsmasq.pid
>          brctl delbr ${LXC_BRIDGE}
> -- 
> 2.1.4
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel