Proxmox/pve-manager
5
0
Fork 0
Code Pull Requests Releases Activity

ship default link config to disable systemd link mac-policy

Browse Source 
since debian 11, systemd is changing behaviour of MAC address of
bridge, but also bond, where the mac is generated randomly instead
inherit from the first slave.

We tried to fix that with ifupdown2, but that seems to produce some
regressions and independent of that there was still another problem.
Namely, if a bridge don't have any slaves, systemd is keeping bridge
offline.

https://www.justinsteven.com/posts/2023/03/26/virtualbox-bridge-ports-none-no-carrier-debian-11/

That mean that a dhcp daemon like kea can't bind on a standalone
bridge (used for s-nat for example), until a tap interface is started.

So, set up a systemd link config to disable the systemd mac policy by
default (this don't break already fixed ifupdown2 mac).

Funnily CentOS && Fedora also disable it already:
https://fedoraproject.org/wiki/Changes/MAC_Address_Policy_none
c895351950/0028-udev-net-setup-link-change-the-default-MACAddressPol.patch (L43)

Before this patch:
```
~ ip a sh dev vmbr1
vmbr1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 10
```

After this patch:
```
~ ip a sh dev vmbr1
vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
```

Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
 [ TL: move to /usr/lib/.. where distro files belong and add comment ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Alexandre Derumier 2023-09-17 15:44:44 +02:00 committed by Thomas Lamprecht
parent 51fcf81434
commit 5caa663f3e
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
configs/Makefile
View File

@ -13,6 +13,7 @@ install: country.dat vzdump.conf pve-sources.list pve-initramfs.conf pve-blackli
install -D -m 0644 vzdump.conf $(DESTDIR)/etc/vzdump.conf
install -D -m 0644 pve-initramfs.conf $(DESTDIR)/etc/initramfs-tools/conf.d/pve-initramfs.conf
install -D -m 0644 country.dat $(DESTDIR)/usr/share/$(PACKAGE)/country.dat
install -D -m 0644 proxmox-ve-default.link $(DESTDIR)/usr/lib/systemd/network/98-proxmox-ve-default.link
clean:
rm -f country.dat

11
configs/proxmox-ve-default.link Normal file
View File

@ -0,0 +1,11 @@
[Match]
OriginalName=*
[Link]
# Fixes two issues for Proxmox VE systems:
# 1. inheriting MAC from the first slave, instead of using a random one, avoids
# that locked down network environments (e.g., at most hosting providers)
# will block traffic due to a unexpected MAC in the outgoing network packets
# 2. Avoids that systemd keeps bridge offline if there are no slaves connected,
# failing, e.g., setting up s-NAT if no guest is (yet) started.
MACAddressPolicy=none