Re: [Bonding-devel] 2.6.29 regression? Bonding tied to IPV6 in 29-rc5

[Stephen Hemminger <shemminger@vyatta.com>]

On Wed, 18 Feb 2009 21:21:07 +0000
John Dykstra <john.dykstra1@gmail.com> wrote:

> On Wed, 2009-02-18 at 14:57 -0500, Brian Haley wrote: 
> > Vlad Yasevich wrote:
> > > Having worked in other environments where ipv6 has to be explicitly
> > > enabled per interface, I've thought that this level of control was
> > > always missing from linux.  
> > 
> > There does seem to be a sysctl for it, just doesn't seem to work.
> 
> While this sysctl is definitely useful, I don't think it meets the needs
> of those users and distributions that are currently blacklisting the
> ipv6 module.  Even if you disable IPv6 on all interfaces, apps will
> still be able to create AF_INET6 sockets, and thus some apps will break
> or do inappropriate things because there isn't real IPv6 connectivity.
> 
> I've tried to put together an RFC patch that turned off all
> externally-visible IPv6 behavior that could break something, but I keep
> running into distasteful choices.
> 
> The current default behavior must be preserved--if you drop this patch
> into an existing distribution, the IPv6 stack must come up the way it
> always has.  Thus the knob (let's call it ip6_disable) must default
> false.
> 
> It seems desirable to make this a per-net-namespace knob.  But that
> means each new net will be initialized before the distribution has a
> chance to disable the IPv6 part.  This will lead to neighbor solicits
> going out for link-local addresses, which some people can't accept.
> 
> The only alternative I can think of is to make it a module parameter,
> which would leverage people's current habit to disable IPv6 via the
> module configuration files, but doesn't fit well into a virtualized
> world.
> 
> Exactly what to disable is unclear too.  Turning off neighbor and router
> solicits, responding to same, etc.--almost certainly.  Refusing to
> create AF_INET6 sockets--definitely.  Erroring on ioctl() and netlink
> API calls related to IPv6--probably.  Hiding /proc entries for IPv6--I
> don't know.  
> 
> Ideally, once ip6_disable was set true, every API, /proc and /sys
> entries, etc. would look just like the ipv6 module was not loaded.  But
> to do this, while still initializing most of the IPv6 code (so that
> those hooks from other modules won't do unexpected things) is very
> invasive.
> 
> So it seems to me that the only practical solution is to live with
> blacklisting module ipv6 until the apps are fixed and sending IPv6
> packets isn't considered a crime.
> 
>   --  John

There are also ipv6 purists who would like to see the same mechanism
exist to force ipv6 only (no ipv4). So any long term solution should
support both.