[LXD] Make IPv6 filtering configurable
@@ -40,6 +40,7 @@ var (
lxdExecUID = int64(1000)
lxdDockerPool = ""
lxdDockerDisk = "10GB"
+ lxdNetworkIPv6Filtering = "true"
lxdHelp = map[string]string{
"EXEC_CMD": fmt.Sprintf("command to run via exec/ssh (default %q)", lxdExecCmd),
@@ -60,6 +61,7 @@ var (
"DOCKER_DISK": fmt.Sprintf("disk size to use for Docker (default %q)", lxdDockerDisk),
"NETWORK_STATIC": fmt.Sprintf("whether to statically set network configuration (default %v)", lxdNetworkStatic),
"NETWORK_DNS": fmt.Sprintf("comma separated list of DNS servers (requires NETWORK_STATIC) (default %q)", lxdNetworkDns),
+ "NETWORK_IPV6_FILTERING": fmt.Sprintf("prevent the containers from spoofing another's IPv6 address (default %s)", lxdNetworkIPv6Filtering),
}
)
@@ -105,6 +107,7 @@ type lxdProvider struct {
networkDNS []string
networkLeases map[string]string
networkLeasesLock sync.Mutex
+ networkIPv6Filtering string
pool string
dockerCache string
@@ -155,6 +158,11 @@ func newLXDProvider(cfg *config.ProviderConfig) (Provider, error) {
limitNetwork = cfg.Get("NETWORK")
}
+ networkIPv6Filtering := lxdNetworkIPv6Filtering
+ if cfg.IsSet("NETWORK_IPV6_FILTERING") {
+ networkIPv6Filtering = cfg.Get("NETWORK_IPV6_FILTERING")
+ }
+
networkStatic := lxdNetworkStatic
networkMTU := "1500"
var networkGateway string
@@ -313,6 +321,7 @@ func newLXDProvider(cfg *config.ProviderConfig) (Provider, error) {
networkMTU: networkMTU,
networkDNS: networkDNS,
networkLeases: networkLeases,
+ networkIPv6Filtering: networkIPv6Filtering,
pool: pool,
dockerCache: dockerCache,
@@ -653,7 +662,7 @@ func (p *lxdProvider) Start(ctx gocontext.Context, startAttributes *StartAttribu
container.Devices["eth0"]["limits.max"] = p.limitNetwork
container.Devices["eth0"]["security.mac_filtering"] = "true"
container.Devices["eth0"]["security.ipv4_filtering"] = "true"
- container.Devices["eth0"]["security.ipv6_filtering"] = "true"
+ container.Devices["eth0"]["security.ipv6_filtering"] = p.networkIPv6Filtering
// Docker storage
if p.dockerPool != "" {
