openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Disable IPv6 RAs & Autoconf For All (Not Just Default) 

The current kernel sysctl settings modify the
net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
to both be '0'. However, this is overridden by the settings in
net.ipv6.conf.all, so no matter what setting is in the ifcfg file
for the IPv6 interface, autoconfiguration and accept_ra will be
enabled. This causes a security vulnerability where rogue RAs
could be used to intercept traffic from the controllers.

This change sets both default and all settings to '0' for IPv6
accept_ra and autoconf.

Closes-Bug: 1632830
Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
(cherry picked from commit 4eacf4179d)
This commit is contained in:
Dan Sneddon 2016-10-12 12:38:21 -07:00
parent 7fe61c92fb
commit b5d94be6d1
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
puppet/services/kernel.yaml
View File

@ -39,8 +39,12 @@ outputs:
net.netfilter.nf_conntrack_max:
value: 500000
# prevent neutron bridges from autoconfiguring ipv6 addresses
net.ipv6.conf.all.accept_ra:
value: 0
net.ipv6.conf.default.accept_ra:
value: 0
net.ipv6.conf.all.autoconf:
value: 0
net.ipv6.conf.default.autoconf:
value: 0
net.core.netdev_max_backlog: