Bug 509852 – net-misc/netifrc-0.1: bridge interfaces shouldn't keep their ipv6 address

• Product: Gentoo Linux
• Status: UNCONFIRMED ---

[Description Sven 2014-05-08 14:32:03 UTC]

In /etc/conf.d/net, I have configured a bridge br0 and interface eth0 is one of the interfaces in the bridge. So in /etc/conf.d/net I have

  config_eth0="null"
  bridge_br0="eth0"

but eth0 keeps one of those fe80:: ipv6 addresses. There does not seem to be any way to disable IPv6 for bridge interfaces other than writing a custom preup() function that does

  echo 1 > /proc/sys/net/ipv6/conf/eth0/disable_ipv6


I'd like to see a way of disabling ipv6 for certain interfaces. Since you might not want to change the behaviour of config_eth0="null" for backwards compatibility, you might think of some new option that does it.

Maybe, people also want to disable IPv6 for interfaces that actually are not part of a bridge and have a regular IPv4 address.



Reproducible: Always

[Comment 1 Taahir Ahmed 2014-07-05 21:08:33 UTC]

Does the link-local address actually harm anything?  It's not routable from outside the link, and my testing seems to indicate that traffic bound for eth0's link-local address is handled properly by the bridge.

[Comment 2 Sven 2014-07-05 21:37:31 UTC]

After setting up a bridge, the computer should only respond to the link local address that corresponds to the MAC of the bridge interface (it could be different from the MAC of any interface in the bridge). The reason is that logically, from a network topology point of view, the computer that is running the bridge only has one network interface (namely the bridge interface itself).

Unless we disable IPv6 for bridge interfaces, a computer with 3 bridged network cards has 4 link local IPv6 address in the worst case: one for the MAC of each network interface and one for the MAC of the bridge interface. Does that seem OK to you?

Would it be possible for a process to reach computers attached to interface eth1 via the link-local address corresponding to the MAC of interface eth0? Note that packets sent via eth0 and eth1 don't go through the bridging layer. I don't think this will work. And if it works, I would accuse someone of black magic. (It really shouldn't work!)


But if it helps, disabling IPv6 selectively per interface should be a feature of general use, beyond bridging. Maybe I just want IPv4 but no IPv6 on an interface. Having no IPv4 address is totally possible (simply but not setting one) but the kernel currently forced IPv6 link local address on us for no good reason. The reason that I don't want an IPv6 address could be that I don't have or want an IPv6 firewall for example.

[Comment 3 David Duchesne 2021-05-13 18:47:15 UTC]

Hello,
After many hours struggling to understand why I was getting a fe80:: ipv6 on my disabled eth0, I stumbled upon this great bug report.
I have the exact same configuration, so I added the function and no more trouble now.

----
config_eth0="null"
preup() {
  echo 1 > /proc/sys/net/ipv6/conf/eth0/disable_ipv6
  return 0
}

bridge_br0="eth0"
config_br0="dhcp"
bridge_forward_delay_br0=0
bridge_hello_time_br0=1000
----

I don't know if that's the right way to do it, I tried the sysctl.conf method but for some reason, it didn't work.
Anyway, thanks Sven.

[Comment 4 Sven 2021-05-13 18:57:12 UTC]

Hi David,
you may want to switch to systemd-networkd. I am using the following config:

# cat 00-br0.netdev
[NetDev]
Name=br0
Kind=bridge
MACAddress=XX:XX:XX:XX:XX:XX

# cat 20-wired.network
[Match]
Name=enp[56]s0*
[Network]
Bridge=br0
ConfigureWithoutCarrier=yes

# cat 21-bridge.network 
[Match]
Name=br0
[Network]
DHCP=yes


Adjust that to your needs. The enp?s0* interfaces do not have IPv4 or IPv6 enabled with that config. I don't remember that I had to do anything special for that. It worked properly out of the box.