fix: filter IPv6 link-local addresses and routes from host netns - #256
fix: filter IPv6 link-local addresses and routes from host netns#256lyuyun wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces changes to skip IPv6 link-local addresses and routes (fe80::/10) to prevent them from being manually configured inside the guest, as they are auto-generated by the kernel. The feedback suggests a significant improvement: replacing the custom bitwise operations and constants with the standard library's built-in Ipv6Addr::is_unicast_link_local() method, which would make the code more idiomatic, readable, and less error-prone across the implementation and unit tests.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Pull request overview
This PR updates the sandbox network discovery logic to avoid copying non-portable IPv6 link-local configuration (fe80::/10) from the host network namespace into the guest/sandbox.
Changes:
- Filter IPv6 link-local interface addresses (
fe80::/10) when collecting link addresses. - Filter IPv6 link-local destination routes (
fe80::/10) when collecting routes. - Add constants and unit tests to validate the
fe80::/10mask/prefix boundary behavior, plus route-level tests for the new filter.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| vmm/sandbox/src/network/route.rs | Skips fe80::/10 destination routes during route parsing and adds unit tests for route filtering. |
| vmm/sandbox/src/network/mod.rs | Introduces shared constants for fe80::/10 detection and tests their correctness at the boundaries. |
| vmm/sandbox/src/network/link.rs | Skips fe80::/10 IPv6 addresses when collecting interface IPs to avoid pushing host link-local config into the guest. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
842ee4b to
3cd3d55
Compare
fe80::/10 link-local addresses and their connected routes (fe80::/64) are auto-generated by the Linux kernel from the interface MAC address (EUI-64) and must not be manually configured inside the guest via setup_sandbox. Pushing them caused EOPNOTSUPP (errno 95) failures when the guest kernel has IPv6 disabled. Signed-off-by: lyuyun <lyuyun068@gmail.com>
3cd3d55 to
466defb
Compare
Summary
Filter IPv6 link-local network configuration copied from the host network namespace into the sandbox.
This change excludes:
fe80::/10fe80::/10Motivation
IPv6 link-local addresses are scoped to a specific link/interface and are not portable across network namespaces. Copying host-side
fe80::/10addresses or link-local destination routes into the sandbox can produce invalid or misleading guest network configuration.If IPv6 is enabled inside the sandbox, the guest kernel should create its own link-local address for the guest-side interface instead of inheriting the host-side one.
Notes
This intentionally filters only link-local interface addresses and destination routes. Routes whose next-hop/gateway is link-local are not treated as equivalent here, since those can have different semantics, such as IPv6 default routes using a link-local gateway.
Testing
fe80::/10for both interface addresses and destination routes.