networkd: optinally use DHCP lease domain info for routing only This changes the UseDomains= setting of .network files to take an optional third value "route", in addition to the boolean values. If set, the passed domain information is used for routing rules only, but not for the search path logic.

networkd: rework Domains= setting Previously, .network files only knew a vaguely defined "Domains=" concept, for which the documentation declared it was the "DNS domain" for the network connection, without specifying what that means. With this the Domains setting is reworked, so that there are now "routing" domains and "search" domains. The former are to be used by resolved to route DNS request to specific network interfaces, the latter is to be used for searching single-label hostnames with (in addition to being used for routing). Both settings are configured in the "Domains=" setting. Normal domain names listed in it are now considered search domains (for compatibility with existing setups), while those prefixed with "~" are considered routing domains only. To route all lookups to a specific interface the routing domain "." may be used, referring to the root domain. An alternative syntax for this is the "*", as was already implemented before using the "wildcard" domain concept. This commit adds proper parsers for this new logic, and exposes this via the sd-network API. This information is not used by resolved yet, this will be added in a later commit.

resolved: introduce support for per-interface negative trust anchors

resolved,networkd: add a per-interface DNSSEC setting This adds a DNSSEC= setting to .network files, and makes resolved honour them.

man: document that DNS= and Domains= is implemented by resolved

networkd,resolved: add a per-interface mdns configuration option

man: fix typos

networkd: stop managing per-interface IP forwarding settings As it turns out the kernel does not support per-interface IPv6 packet forwarding controls (unlike as it does for IPv4), but only supports a global option (#1597). Also, the current per-interface management of the setting isn't really useful, as you want it to propagate to at least one more interface than the one you configure it on. This created much grief (#1411, #1808). Hence, let's roll this logic back and simplify this again, so that we can expose the same behaviour on IPv4 and IPv6 and things start to work automatically again for most folks: if a network with this setting set is set up we propagate the setting into the global setting, but this is strictly one-way: we never reset it again, and we do nothing for network interfaces where this setting is not enabled. Fixes: #1808, #1597.

networkd: IPv6 router discovery - follow IPv6AcceptRouterAdvertisemnt= The previous behavior: When DHCPv6 was enabled, router discover was performed first, and then DHCPv6 was enabled only if the relevant flags were passed in the Router Advertisement message. Moreover, router discovery was performed even if AcceptRouterAdvertisements=false, moreover, even if router advertisements were accepted (by the kernel) the flags indicating that DHCPv6 should be performed were ignored. New behavior: If RouterAdvertisements are accepted, and either no routers are found, or an advertisement is received indicating DHCPv6 should be performed, the DHCPv6 client is started. Moreover, the DHCP option now truly enables the DHCPv6 client regardless of router discovery (though it will probably not be very useful to get a lease withotu any routes, this seems the more consistent approach). The recommended default setting should be to set DHCP=ipv4 and to leave IPv6AcceptRouterAdvertisements unset.

man: add man for IPV6 hop limit

doc: correct orthography, word forms and missing/extraneous words

doc: correct punctuation and improve typography in documentation

man: add man for IPV6 DAD

man: describe IPv6AcceptRouterAdvertisements= better With the previous description it wasn't clear that the kernel default is being described. Add link to kernel docs.

man: include numeric prefixes in example file names for .link, .netdev, .network files In order to avoid confusion with the default files we ship, let's use a low prefix number for all examples. Fixes #1409.

networkd: add support to configure preferred source of static routes

man: add support for accept ra man

networkd: dhcp-server - allow configuration of the pool The constraints we place on the pool is that it is a contiguous sequence of addresses in the same subnet as the server address, not including the subnet nor broadcast addresses, but possibly including the server address itself. If the server address is included in the pool it is (obviously) reserved and not handed out to clients.

man: document the new DHCP settings added in the past commits

Adding bonding examples for systemd-networkd This commit provides some basic bonding configuration examples for .netdev and .network files.

man: typo fixes

man: describe masking of .network files better This should clear up some confusion in https://github.com/systemd/systemd/issues/717. This basically copies the description from systemd.unit to this man page. Masking can happen also in /run, so strike the part about /etc, and also add the magic work "mask".

networkd: rename RootBlock to AllowPortToBeRoot Justification is similar to BPDUGuard rename. "Positive" values are easier. This is a rather uncommon option, so using a slightly longer name should not be a problem, and may in fact may make it easier to guess what the option does without reading the documentation.

networkd: turn UnicastFlood on by default Looking at the kernel commit, "on" seems to be the default value: commit 867a59436fc35593ae0e0efcd56cc6d2f8506586 Author: Vlad Yasevich <vyasevic@redhat.com> Date: Wed Jun 5 10:08:01 2013 -0400 bridge: Add a flag to control unicast packet flood. Add a flag to control flood of unicast traffic. By default, flood is on and the bridge will flood unicast traffic if it doesn't know the destination. When the flag is turned off, unicast traffic without an FDB will not be forwarded to the specified port. ... and it seems to be the reasonable thing to do by default.

networkd: rename BPDUGuard to UseBPDU Rename to follow the follow the style of other options. In general "positive" options are preferred to "negative" ones, because they are easier to describe and easier for humans to parse (c.f. the shortening on the man page entry).

man: reword new Bridge descriptions

man: reword description of Hostname= Also add dots at the end of sentences.

man: add man for bridge params

man: add manual for DHCP override hostname

networkd: various fixes for the IPv6 privacy extensions support - Make sure that the IPv6PrivacyExtensions=yes results in prefer-temporary, not prefer-public. - Introduce special enum value "kernel" to leave setting unset, similar how we have it for the IP forwarding settings. - Bring the enum values in sync with the the strings we parse for them, to the level this makes sense (specifically, rename "disabled" to "no", and "prefer-temporary" to "yes"). - Make sure we really set the value to to "no" by default, the way it is already documented in the man page. - Fix whitespace error. - Make sure link_ipv6_privacy_extensions() actually returns the correct enum type, rather than implicitly casting it to "bool". - properly size formatting buffer for ipv6 sysctl value - Don't complain if /proc/sys isn't writable - Document that the enum follows the kernel's own values (0 = off, 1 = prefer-public, 2 = prefer-temporary) - Drop redundant negating of error code passed to log_syntax() - Manpage fixes This fixes a number of issues from PR #417

man: add manual for ipv6 privacy extension

man: fix sysctl references in networkd-manpage We refer to the same sysctl-setting twice, which is misleading. Correctly list all global forwarding options. As we _always_ change the forwarding setting on links, they will get disabled by default. The global sysctl defaults thus will not have any effect.

man: revert dynamic paths for split-usr setups This did not really work out as we had hoped. Trying to do this upstream introduced several problems that probably makes it better suited as a downstream patch after all. At any rate, it is not releaseable in the current state, so we at least need to revert this before the release. * by adjusting the path to binaries, but not do the same thing to the search path we end up with inconsistent man-pages. Adjusting the search path too would be quite messy, and it is not at all obvious that this is worth the effort, but at any rate it would have to be done before we could ship this. * this means that distributed man-pages does not make sense as they depend on config options, and for better or worse we are still distributing man pages, so that is something that definitely needs sorting out before we could ship with this patch. * we have long held that split-usr is only minimally supported in order to boot, and something we hope will eventually go away. So before we start adding even more magic/effort in order to make this work nicely, we should probably question if it makes sense at all.

man: document IPForward=kernel option

Revert "networkd: create "kernel" setting for IPForwarding"

man: document IPForward=kernel option

man: replace hard-coded /usr/lib Replace some /usr/lib occurences in man/ with &rootprefix;/lib.

man: generate configured paths in manpages In particular, use /lib/systemd instead of /usr/lib/systemd in distributions like Debian which still have not adopted a /usr merge setup. Use XML entities from man/custom-entities.ent to replace configured paths while doing XSLT processing of the original XML files. There was precedent of some files (such as systemd.generator.xml) which were already using this approach. This addresses most of the (manual) fixes from this patch: http://anonscm.debian.org/cgit/pkg-systemd/systemd.git/tree/debian/patches/Fix-paths-in-man-pages.patch?h=experimental-220 The idea of using generic XML entities was presented here: http://lists.freedesktop.org/archives/systemd-devel/2015-May/032240.html This patch solves almost all the issues, with the exception of: - Path to /bin/mount and /bin/umount. - Generic statements about preference of /lib over /etc. These will be handled separately by follow up patches. Tested: - With default configure settings, ran "make install" to two separate directories and compared the output to confirm they matched exactly. - Used a set of configure flags including $CONFFLAGS from Debian: http://anonscm.debian.org/cgit/pkg-systemd/systemd.git/tree/debian/rules Installed the tree and confirmed the paths use /lib/systemd instead of /usr/lib/systemd and that no other unexpected differences exist. - Confirmed that `make distcheck` still passes.

man: explain UseDomains a bit more https://bugs.freedesktop.org/show_bug.cgi?id=85397

man: IPMasquerade only implies IPForward=ipv4 at least that's what the code does.

networkd: don't touch global forwarding setting This reverts commit 43c6d5abacaebf813845934ec8d5e5ee3c431854 (and a small part of 4046d8361c55c80ab8577aea52523b9e6eab0d0c) It turns out we don't actually need to set the global ip_forward setting. The only relevant setting is the one on each interface. What the global toggle actually does is switch forwarding on/off for all currently present interfaces and change the default for new ones. That means that by setting the global ip_forward we - Introduce a race condition, because if the interface with IPForward=yes is brought up after one with IPForward=no, both will have forwarding enabled, because the global switch turns it on for all interfaces. If the other interface comes up first networkd correctly sets forward=0 and it doesn't get overridden. - Change the forwarding setting for interfaces that networkd is not configured to touch, even if the user disabled forwarding via sysctl, either globally or per-interface As forwarding works fine without this, as long as all relevant interfacest individually set IPForward=yes: just drop it This means that non-networkd interfaces use the global default while networkd interfaces default to off if IPForward isn't given.

man: clarify that only the first .network file with a matching [Match] matters http://lists.freedesktop.org/archives/systemd-devel/2015-April/031294.html

man: extend documentation on IPForward= and IPMasquerade= Mention the default values, and clarify how this relates to the underlying sysctls.

network: add UseNTP DHCP option Despite having the internal logic in place to enable/disable using NTP servers provided by DHCP the network config didn't expose the option.

man: fix a bunch of links All hail linkchecker!

man: update example 2 in systemd.network(5) none/both/v4/v6 are deprecated in favour of no/yes/ipv4/ipv6. https://bugs.freedesktop.org/show_bug.cgi?id=89221

Fix typos

networkd: Make DHCP client ID creation configurable

networkd: add support for Uplink Failure Detection Introduce BindCarrier= to indicate the set of links that determine if the current link should be brought UP or DOWN. [tomegun: add a bit to commit message]

networkd: .network - rename LinkLocal to LinkLocalAddressing Makes it a bit less ambiguous.

man: systemd.network - document IPv6Token

net: support globbing and disjunction in Match logic Match{Name,OrginalName,Type,Driver,Path} can now take a space-separated glob of matches.

networkd: support route scopes For now we only support the hardcoded values RT_SCOPE_{UNIVERSE,LOCAL,HOST}, and not numerical values or values from /etc/iproute2/rt_scopes. This addresses https://bugs.freedesktop.org/show_bug.cgi?id=88508.

networkd: generalize IPv4LL to LinkLocal This allows both IPv4 and IPv6 link-local addresses to be enabled or disabled. By default we still enable IPv6LL and disable IPv4LL. The old config option is kept for backwards compatibility, but removed from the documentation.

Reindent man pages to 2ch

networkd: make IP forwarding for IPv4 and IPv6 individually configurable

networkd: introduce an AddressFamilyBoolean enum type This introduces am AddressFamilyBoolean type that works more or less like a booleaan, but can optionally turn on/off things for ipv4 and ipv6 independently. THis also ports the DHCP field over to it.

doc: add cross-references between systemd.{link, netdev, network}

networkd: add minimal IP forwarding and masquerading support to .network files This adds two new settings to networkd's .network files: IPForwarding=yes and IPMasquerade=yes. The former controls the "forwarding" sysctl setting of the interface, thus controlling whether IP forwarding shall be enabled on the specific interface. The latter controls whether a firewall rule shall be installed that exposes traffic coming from the interface as coming from the local host to all other interfaces. This also enables both options by default for container network interfaces, thus making "systemd-nspawn --network-veth" have network connectivity out of the box.

networkd: integrate LLDP This patch integrates LLDP with networkd. Example conf: file : lldp.network [Match] Name=em1 [Network] LLDP=yes

networkd: add FDB support

networkd: rename section [BridgePort] → [Bridge] Let's stick to generic sections that describe the general technology, instead of specific per-object sections, unless we really have a reason to do that otherwise.

networkd: update manpage for optional Gateway= Following commit 59580681f5f.

networkd: add basic [Link] settings to .network files This allows the default link settings (set in .link files) to be overridden per Network. Only MTU and MACAddress is supported for now.

networkd: add support for source routing

networkd: Add bridge port path cost This patch add support to specify path cost of the bridge port to be configured via conf file. Exampe: conf file: br.netdev [NetDev] Name=br-test Kind=bridge file: br.network [Match] Name=em1 [Network] Bridge=br-test [BridgePort] Cost=332 bridge link 2: em1 state UP : <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br-test state disabled priority 32 cost 332

networkd: allow specification of DHCP route metric This lets the routing metric for links to be specified per-network, still defaulting to DHCP_ROUTE_METRIC (1024) if unspecified. Hopefully this helps with multiple interfaces configured via DHCP.

man: fix typos

networkd: add support for Domains= to .network files This allows the search/routing domanis to be specified per link/network and be passed on to resolved.

networkd: rename UseDomainName to UseDomains This option will also apply to the search domains, so make it plural.

networkd: don't respect domainname from DHCP by default Most routers will send garbage, so make this opt-in only.

networkd: disable ipv4ll default routes by default This causes machines without connectivity to hang where they would otherwise fail. Keep it opt-in for now, but consider whether we sholud just drop it.

networkd: add and expose per-link LLMNR config option

man: fix outdated example in systemd.network The docs for the DHCP= was updated, but not the example.

networkd: ipv4ll - configure link-local address independently of DHCPv4 This changes the behavior when both DHCPv4 and IPv4LL are enabled. Before, we would disable IPv4LL when we got a DHCPv4 lease and enable it if the lease was lost. Now we just always set up both, if both are enabled, but the DHCPv4 addresses and routes will always take precedence due to their metric and scope.

networkd: ipv4ll - default to setting up ipv4ll routes This is necessary for non-ipv4ll hosts to communicate with ipv4ll-only hosts on the same link. Defaults to being enabled, but can be opted out. See: <http://avahi.org/wiki/AvahiAutoipd#Routes>

sd-dhcp-client: make request broadcasts opt-in It appears there is no good way to decide whether or not broadcasts should be enabled, there is hardware that must have broadcast, and there are networks that only allow unicast. So we give up and make this configurable. By default, unicast is used, but if the kernel were to inform us abotu certain interfaces requiring broadcast, we could change this to opt-in by default in those cases.

networkd: dhcp add vendor class indentifier option 60 Vendor Class Identifier be used by DHCP clients to identify their vendor type and configuration. When using this option, vendors can define their own specific identifier values, such as to convey a particular hardware or operating system configuration or other identifying information. Vendor-specified DHCP options—features that let administrators assign separate options to clients with similar configuration requirements. For example, if DHCP-aware clients for example we want to separate different gateway and option for different set of people (dev/test/hr/finance) in a org or devices for example web/database servers or let's say in a embedded device etc and require a different default gateway or DNS server than the rest of clients.

networkd: make metric of routes configurable Now route metric can be configuted via conf file: example conf: [Match] Name=em1 [Route] Gateway=192.168.1.12 Metric=10 Test: ip route output default via 192.168.1.12 dev em1 metric 10 [tomegun: squash TODO update and reword man page a bit]

man: network - document Peer key

networkd: send hostname to dhcp server Send hostname (option 12) in DISCOVER and REQUEST messages so the DHCP server could use it to register with dynamic DNS and such. To opt-out of this behaviour set SendHostname to false in [DHCP] section of .network file [tomegun: rebased, made sure a failing set_hostname is a noop and moved config from DHCPv4 to DHCP]

man: bring systemd.network(5) up-to-date Based on diff by 'poma'.

Add support for DHCP static route options This adds support for DHCP options 33 and 121: Static Route and Classless Static Route. To enable this feature, set UseRoutes=true in .network file. Returned routes are added to the routing table.

networkd: merge DHCPv4 and DHCPv6 config If there are v4 or v6 specific options we can keep those in separate sections, but for the common options, we will use only one. Moreovere only use DHCP=[yes/both|no/none|v4|v6] to enable or disable the clients.

doc: typographical improvements and choice of words

doc: grammatical corrections

man: split systemd.network(5) and related into various sections for better readability

man: document automatic networkd IP range allocation

doc: comma placement corrections and word order Set commas where there should be some. Some improvements to word order.

doc: typographical fine tuning

doc: use non-contracted forms in written documents

networkd: smooth transition from ipv4ll to dhcp address Currently when both ipv4ll and dhcp are enabled, ipv4ll address (if one has been claimed) is removed when dhcp address is aquired. This is not the best thing to do since there might be clients unaware of the removal trying to communicate. This patch provides a smooth transition between ipv4ll and dhcp. If ipv4ll address was claimed [1] before dhcp, address is marked as deprecated. Deprecated address is still a valid address and packets can be received on it but address cannot be selected as a source address. If dhcp lease cannot be extended, then ipv4ll address is marked as valid again. [1] If there is no collision, claiming IPv4LL takes between 4 to 7 seconds.

man: networkd - additional examples related to bridging

man: network - clarify which options may be specified more than once.

networkd: allow more than one static DNS server

man: ipv4 link-local

networkd: add basic support for MACVLANs

man: split out systemd.net{work,dev}(5) from systemd-networkd(8)