commit 4eacf4179d03cd2102cac4abf14e80eae440c2d3
Author: Dan Sneddon <email address hidden>
Date: Wed Oct 12 12:38:21 2016 -0700
Disable IPv6 RAs & Autoconf For All (Not Just Default)
The current kernel sysctl settings modify the
net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
to both be '0'. However, this is overridden by the settings in
net.ipv6.conf.all, so no matter what setting is in the ifcfg file
for the IPv6 interface, autoconfiguration and accept_ra will be
enabled. This causes a security vulnerability where rogue RAs
could be used to intercept traffic from the controllers.
This change sets both default and all settings to '0' for IPv6
accept_ra and autoconf.
Reviewed: https:/ /review. openstack. org/385603 /git.openstack. org/cgit/ openstack/ tripleo- heat-templates/ commit/ ?id=4eacf4179d0 3cd2102cac4abf1 4e80eae440c2d3
Committed: https:/
Submitter: Jenkins
Branch: master
commit 4eacf4179d03cd2 102cac4abf14e80 eae440c2d3
Author: Dan Sneddon <email address hidden>
Date: Wed Oct 12 12:38:21 2016 -0700
Disable IPv6 RAs & Autoconf For All (Not Just Default)
The current kernel sysctl settings modify the ipv6.conf. default. accept_ ra and net.ipv6. conf.default. autoconf ipv6.conf. all, so no matter what setting is in the ifcfg file
net.
to both be '0'. However, this is overridden by the settings in
net.
for the IPv6 interface, autoconfiguration and accept_ra will be
enabled. This causes a security vulnerability where rogue RAs
could be used to intercept traffic from the controllers.
This change sets both default and all settings to '0' for IPv6
accept_ra and autoconf.
Closes-Bug: 1632830 0dfa5103ffbddb9 e85ac567bbb
Change-Id: I95b86c5c6feed3