If link_ipv6ll_gained() fails after ipv6ll_address is set, the address
remains non-null and the null-guard in address_update() never triggers
again, permanently suppressing SLAAC, DHCPv6 and RA on that link.
Clear ipv6ll_address on the failure path so the guard can fire when
the address is re-announced.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
When the tracked IPv6 link-local address is removed, networkd clears
link->ipv6ll_address, but keeps DHCPv6, NDisc, and RADV running. These
engines keep using a stale source identity which affects the following:
- DHCPv6 client continues to send Solicit/Renew/Rebind from a nonexistent
source address.
- NDisc continues to send Router Solicitations from a nonexistent source
address. Router Advertisements cannot be received properly.
- RADV continues to advertise with a stale source address. This can lead
to downstream hosts configuring invalid routes.
- DHCP-PD prefixes remain configured without a valid upstream DHCPv6 path.
Added link_ipv6ll_lost() to stop IPv6 dynamic engines and related states:
- sd_dhcp6_client_stop()
- ndisc_stop() + ndisc_flush()
- sd_radv_stop()
This is called from address_drop() when the dropped address matches the
tracked IPv6LL. After clearing the tracked address, it scans for another
ready link-local address on the interface. If found, this is set as
link->ipv6ll_address and link_ipv6ll_gained() is called to restart the
engines with the new source identity.
This resolves the FIXME in address_drop().
Signed-off-by: Aritra Basu <aritrbas+gh@cisco.com>
network_adjust_dhcp_server() searches network->addresses_by_section,
hence without this change, an address entry picked by
network_adjust_dhcp_server() may be detached and freed by the cleanup
function.
The updated parsing_hacks.h file uncovered a bunch of extra
things that the check-pointer-deref coccinelle script flags.
This commit fixes them to make the tree check-pointer-deref clean.
The 'NFTSet' directive in various units adds and removes entries in nftables
sets, it does not add or remove entire sets. The logging messages should
indicate that an entry was added or removed, not that a set was added or
removed.
This renames and splits link_may_have_ipv6ll() into
link_ipv6ll_enabled_harder() and link_multicast_enabled(),
as they are completely irrelevant to each other.
Also, this makes link_ipv6ll_enabled_harder() work non-Wireguard
interfaces.
When a reconfiguration of an interface is triggered, previously we
call link_foreignize_config(), which sets all static configurations as
foreign, then later call link_drop_foreign_config(), which drops
unnecessary foreign configurations.
This commit merges these two steps into one, link_drop_unmanaged_config(),
which drops unnecessary static and foreign configurations.
Also, this renames link_drop_managed_configs() to
link_drop_static_config(), as it only drops static configurations.
Note that dynamically aquired configurations are dropped by
link_stop_engines().
Limits should be enforced, but not in a way real setups collide with
them.
There have been multiple reports that current limits are too low, hence
raise them 8x.
Fixes: #24852
The family will be checked later in
address_section_verify() -> address_section_adjust_broadcast(),
hence it is not necessary to set here.
Follow-up for 5d15c7b19c.
Fixes oss-fuzz#372994449.
Fixes#34748.
- make it accept an empty string,
- use config_parse_in_addr_prefix(),
- move null address checker to address_section_verify().
No functional change, just refactoring.
Previously, the below was refused and the IPv6 address would not assigned.
===
[Address]
Address=2001:db8:0:f101::15/64
Broadcast=192.168.0.255
===
However, in the following case, networkd warned about the broadcast
address would be ignored, and the IPv6 address would be configured.
===
[Address]
Broadcast=192.168.0.255
Address=2001:db8:0:f101::15/64
===
This also
- rename variable n -> address,
- use log_syntax_parse_error() where applicable,
- add one more assertion for lvalue in config_parse_address().
As all callers do not care if the address has peer address.
This also drops prefixlen argument as it is always zero.
Fixes a bug introduced by 42f8b6a808.
Fixes#31950.
IPv4 addresses are managed with local and peer addresses and prefix
length. So, potentially, the same address with different prefix length
can be assigned on a link, e.g. 192.168.0.1/24 and 192.168.0.1/26.
If one of the address is configured with ACD but the other is not,
then previously ACD might be unexpectedly disabled or enabled on them,
as we managed ACD engines with only local addresses.
This makes ACD engines managed with the corresponding Address objects.
If a generated address with IPv6Token=prefixstable conflicts with the
one on another node or interface, let's generate another address and try
to assign it.
This improves support of RFC 7217.
Fixes#31605.
On my system, networkd would report that interface ve-rawhide is "Failed"
without anything in the logs:
systemd-networkd[651095]: ve-rawhide: Trying to reconfigure the interface.
systemd-networkd[651095]: ve-rawhide: Gained IPv6LL
systemd-networkd[651095]: ve-rawhide: Link DOWN
systemd-networkd[651095]: ve-rawhide: Lost carrier
systemd-networkd[651095]: ve-rawhide: Configuring with /usr/lib/systemd/network/80-container-ve.network.
systemd-networkd[651095]: ve-rawhide: Link UP
systemd-networkd[651095]: ve-rawhide: Gained carrier
systemd-networkd[651095]: ve-rawhide: Failed
At debug level:
systemd-networkd[799993]: dhcp-server-lease/ve-rawhide:1:1: Missing object field 'Address'.
$ jq </var/lib/systemd/network/dhcp-server-lease/ve-rawhide
{
"BootID": "5d86b34b98894322bfd4ae8443ce59b3",
"Leases": [
{
"ClientId": [ ... ],
"Address": [ 192, 168, 120, 179 ],
"Hostname": "rawhide",
"ExpirationUSec": 966046821158,
"ExpirationRealtimeUSec": 1711203197266940
}
]
}
I'm not sure why "Address" is missing, but anyway, in this case, we should ignore the
lease file rather than refusing to configure the interface. Also, warn at the point
where we know what the filename is.
I didn't know that this helper existed… It is very similar to strdup_to_full(),
but all callers can actually be replaced by strdup_to(), which has more fitting
semantics.
If the DHCP server on an interface is configured with its server
address is null, then let's reuse the previous server address if
possible.
Otherwise, if networkd is restarted or the host is rebooted, then
possibly new subnet is picked, and clients that already have addresses
in the previous subnet cannot access the server.
Prompted by https://github.com/systemd/systemd/pull/30021#discussion_r1518478633.
Previously, if an [Address] section is configured with a null address,
e.g. Address=0.0.0.0/24, then we acquired a free address in
link_request_address().
With this commit, we queue a request with the null address as is, and
acquire a free address later in address_process_request(). Similary,
now IPv4ACD daemon is configured in address_process_request().
With this change, we can make the address acquisition depend on other
conditions, e.g. if the persistent storage is ready or not.
dongshengyuan
Daan De Meyer
Aritra Basu
Yu Watanabe
Michael Vogt
Mike Yuan
Daan De Meyer
Dr. David Alan Gilbert
Kevin P. Fleming
Jelle van der Waa
Lennart Poettering
Zbigniew Jędrzejewski-Szmek
Luca Boccassi