improvement(network-legacy): change ip=any to mean dual stack DHCP

systemd-network-generator tries to support the same IP configuration
syntax as Dracut. One difference is that Dracut supports multiple
comma-separated autoconf values (e.g. `dhcp,dhcp6`) whereas systemd only
permits one. Fixing this in systemd may not be straightforward.

This matters because Afterburn can emit `dhcp,dhcp6` for KubeVirt, and
it is now being adapted to support systemd-network-generator as well as
Dracut's network-legacy module.

Even if systemd-network-generator did support multiple values, the
behaviour would not be the same. Both systemd-networkd and
NetworkManager always try both IPv4 and IPv6, normally requiring just
one of them to work, whereas network-legacy will not even try IPv6 if
IPv4 works, or vice-versa depending on the order given. It is not
currently possible to make network-legacy always try both.

To workaround the lack of multi-value support in systemd and to mirror
how systemd and NetworkManager behave, I am changing `ip=any` to always
try both protocols, requiring just one to work. They are tried in
parallel to avoid the cost of a double timeout. Despite the name, this
is currently treated by network-legacy as IPv4-only. The history of
ifup.sh reveals that `any` was supported before IPv6 was, and that IPv6
was initially added with "preliminary" support. Perhaps the author
didn't want to change the behaviour of `any` until that support was
better established and then forgot, or perhaps it was merely an
oversight.

systemd-network-generator also treats `ip=on` as dual stack, but that
would be a more controversial change. Users may not expect IPv6 alone to
be considered successful. NetworkManager even treats `ip=dhcp` as dual
stack, but I feel that is wrong. With `ip=any`, the intent is clearer,
and this at least gives us one option where the behaviour is consistent.

Much of this change is adjusting the dhclient PID and lease paths to be
protocol-specific so that IPv4 and IPv6 instances can be run
simultaneously.

There were no tests for explicit IP configuration at all, but I felt it
was important to have this covered, so some have been added. To avoid
unnecessary overhead, this spins up just one VM with several differently
configured interfaces.

The module changes were mostly written by me with a little help from AI.
The tests were entirely written by AI.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>

Author: chewi

.github/workflows/daily-network-legacy.yml

@@ -42,6 +42,7 @@ jobs:
                     - gentoo:latest
                 test:
                     - "50"
+                    - "51"
                     - "60"
         container:
             image: ghcr.io/dracut-ng/${{ matrix.container }}

man/dracut.cmdline.7.adoc

@@ -607,9 +607,12 @@ options; refer to the documentation of the specific network module in use. For
 NetworkManager, see man:nm-initrd-generator[8].
 
 **ip=**__{dhcp|on|any|dhcp6|auto6|either6|link6|single-dhcp}__::
-    dhcp|on|any::: get ip from dhcp server from all interfaces. If netroot=dhcp,
-    loop sequentially through all interfaces (eth0, eth1, ...) and use the first
-    with a valid DHCP root-path.
+    More than one of the following options can be given, separated by commas.
+    Each is tried in turn until one succeeds.
+
+    dhcp|on::: Get an IP from an IPv4 DHCP server for each interface. If
+    netroot=dhcp, loop sequentially through all interfaces (eth0, eth1, ...)
+    and use the first with a valid DHCP root-path.
 
     single-dhcp::: Send DHCP on all available interfaces in parallel, as
     opposed to one after another. After the first DHCP response is received,
@@ -625,32 +628,26 @@ NetworkManager, see man:nm-initrd-generator[8].
 
     link6::: bring up interface for IPv6 link-local addressing
 
-**ip=**__<interface>__:__{dhcp|on|any|dhcp6|auto6|link6}__[:[__<mtu>__][:__<macaddr>__]]::
+    any::: Get an IP from an IPv4 and an IPv6 DHCP server on each interface.
+    Both protocols are tried in parallel, but only one is required to succeed.
+
+**ip=**__<interface>__:__{dhcp|on|any|dhcp6|auto6|either6|link6}__[:[__<mtu>__][:__<macaddr>__]]::
     This parameter can be specified multiple times.
 +
 =====================
-dhcp|on|any|dhcp6::: get ip from dhcp server on a specific interface
-auto6::: do IPv6 autoconfiguration
-link6::: bring up interface for IPv6 link local address
 <macaddr>::: optionally **set** <macaddr> on the <interface>. This
 cannot be used in conjunction with the **ifname** argument for the
 same <interface>.
 =====================
 
-**ip=**__<client-IP>__:[__<peer>__]:__<gateway-IP>__:__<netmask>__:__<client_hostname>__:__<interface>__:__{none|off|dhcp|on|any|dhcp6|auto6|ibft}__[:[__<mtu>__][:__<macaddr>__]]::
+**ip=**__<client-IP>__:[__<peer>__]:__<gateway-IP>__:__<netmask>__:__<client_hostname>__:__<interface>__:__{none|off|dhcp|on|any|dhcp6|auto6|either6|link6|ibft}__[:[__<mtu>__][:__<macaddr>__]]::
     explicit network configuration. If you want do define a IPv6 address, put it
     in brackets (e.g. [2001:DB8::1]). This parameter can be specified multiple
     times. __<peer>__ is optional and is the address of the remote endpoint
     for pointopoint interfaces and it may be followed by a slash and a decimal
     number, encoding the network prefix length.
-+
-=====================
-<macaddr>::: optionally **set** <macaddr> on the <interface>. This
-cannot be used in conjunction with the **ifname** argument for the
-same <interface>.
-=====================
 
-**ip=**__<client-IP>__:[__<peer>__]:__<gateway-IP>__:__<netmask>__:__<client_hostname>__:__<interface>__:__{none|off|dhcp|on|any|dhcp6|auto6|ibft}__[:[__<dns1>__][:__<dns2>__]]::
+**ip=**__<client-IP>__:[__<peer>__]:__<gateway-IP>__:__<netmask>__:__<client_hostname>__:__<interface>__:__{none|off|dhcp|on|any|dhcp6|auto6|either6|link6|ibft}__[:[__<dns1>__][:__<dns2>__]]::
     explicit network configuration. If you want do define a IPv6 address, put it
     in brackets (e.g. [2001:DB8::1]). This parameter can be specified multiple
     times. __<peer>__ is optional and is the address of the remote endpoint

modules.d/35network-legacy/dhclient-script.sh

@@ -75,12 +75,12 @@ setup_interface() {
     fi
 
     if getargbool 1 rd.peerdns; then
-        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf
+        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".IPv4.resolv.conf
         if [ -n "$namesrv" ]; then
             for s in $namesrv; do
                 echo nameserver "$s"
             done
-        fi >> /tmp/net."$netif".resolv.conf
+        fi >> /tmp/net."$netif".IPv4.resolv.conf
     fi
     # Note: hostname can be fqdn OR short hostname, so chop off any
     # trailing domain name and explicitly add any domain if set.
@@ -107,12 +107,12 @@ setup_interface6() {
         ${preferred_lft:+preferred_lft ${preferred_lft}}
 
     if getargbool 1 rd.peerdns; then
-        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf
+        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".IPv6.resolv.conf
         if [ -n "$namesrv" ]; then
             for s in $namesrv; do
                 echo nameserver "$s"
             done
-        fi >> /tmp/net."$netif".resolv.conf
+        fi >> /tmp/net."$netif".IPv6.resolv.conf
     fi
 
     # Note: hostname can be fqdn OR short hostname, so chop off any
@@ -237,20 +237,26 @@ case $reason in
         fi
         unset layer2
         setup_interface
+
+        # Classless static routes (DHCP option 121) are IPv4-only. Record them
+        # alongside the default route in the per-interface gw file, which
+        # setup_net sources, rather than embedding them in the setup_net hook
+        # below (which a concurrent IPv6 lease would overwrite).
+        if [ -n "$new_classless_static_routes" ]; then
+            OLDIFS="$IFS"
+            IFS=".$IFS"
+            parse_option_121 "$new_classless_static_routes" >> /tmp/net."$netif".gw
+            IFS="$OLDIFS"
+        fi
+
         set | while read -r line || [ -n "$line" ]; do
             [ "${line#new_}" = "$line" ] && continue
             echo "$line"
-        done > /tmp/dhclient."$netif".dhcpopts
+        done > /tmp/dhclient."$netif".IPv4.dhcpopts
 
         {
             echo '. /lib/net-lib.sh'
             echo "setup_net $netif"
-            if [ -n "$new_classless_static_routes" ]; then
-                OLDIFS="$IFS"
-                IFS=".$IFS"
-                parse_option_121 "$new_classless_static_routes"
-                IFS="$OLDIFS"
-            fi
             echo "source_hook initqueue/online $netif"
             [ -e /tmp/net."$netif".manualup ] || echo "/sbin/netroot $netif"
             echo "rm -f -- $hookdir/initqueue/setup_net_$netif.sh"
@@ -282,7 +288,7 @@ case $reason in
         set | while read -r line || [ -n "$line" ]; do
             [ "${line#new_}" = "$line" ] && continue
             echo "$line"
-        done > /tmp/dhclient."$netif".dhcpopts
+        done > /tmp/dhclient."$netif".IPv6.dhcpopts
 
         {
             echo '. /lib/net-lib.sh'

modules.d/35network-legacy/dhcp-multi.sh

@@ -11,7 +11,9 @@ command -v getarg > /dev/null || . /lib/dracut-lib.sh
 
 netif=$1
 do_vlan=$2
-arg=$3
+_IPv=${3:-4}
+_tmp_prefix="/tmp/dhclient.${netif}.IPv${_IPv}"
+shift 3
 
 # Run dhclient in parallel
 do_dhclient() {
@@ -29,14 +31,14 @@ do_dhclient() {
     fi
 
     while [ $_COUNT -lt "$_DHCPRETRY" ]; do
-        info "Starting dhcp for interface $netif"
-        dhclient "$arg" \
+        info "Starting IPv$_IPv dhcp for interface $netif"
+        dhclient -"${_IPv}" "$@" \
             ${_timeout:+--timeout "$_timeout"} \
             -q \
             -1 \
             -cf /etc/dhclient.conf \
-            -pf /tmp/dhclient."$netif".pid \
-            -lf /tmp/dhclient."$netif".lease \
+            -pf "${_tmp_prefix}.pid" \
+            -lf "${_tmp_prefix}.lease" \
             "$netif" &
         wait $! 2> /dev/null
 
@@ -51,16 +53,16 @@ do_dhclient() {
         # If dhclient exited before wait was called, or it was killed by
         # another thread for interface whose DHCP succeeded, then it will not
         # find the process with that pid and return error code 127. In that
-        # case we need to check if /tmp/dhclient.$netif.lease exists. If it
-        # does, it means dhclient finished executing before wait was called,
-        # and it was successful (return 0). If /tmp/dhclient.$netif.lease
-        # does not exist, then it means dhclient was killed by another thread
-        # or it finished execution but failed dhcp on that interface.
+        # case we need to check if /tmp/dhclient.$netif.IPvX.lease exists. If
+        # it does, it means dhclient finished executing before wait was
+        # called, and it was successful (return 0). If the lease file does not
+        # exist, then it means dhclient was killed by another thread or it
+        # finished execution but failed dhcp on that interface.
 
         if [ $retv -eq 127 ]; then
-            read -r pid < /tmp/dhclient."$netif".pid
+            read -r pid < "${_tmp_prefix}.pid"
             info "PID $pid was not found by wait for $netif"
-            if [ -e /tmp/dhclient."$netif".lease ]; then
+            if [ -e "${_tmp_prefix}.lease" ]; then
                 info "PID $pid not found but DHCP successful on $netif"
                 return 0
             fi
@@ -69,14 +71,13 @@ do_dhclient() {
         _COUNT=$((_COUNT + 1))
         [ $_COUNT -lt "$_DHCPRETRY" ] && sleep 1
     done
-    warn "dhcp for interface $netif failed"
-    # nuke those files since we failed; we might retry dhcp again if it's e.g.
-    # `ip=dhcp,dhcp6` and we check for the PID file earlier
-    rm -f /tmp/dhclient."$netif".pid /tmp/dhclient."$netif".lease
+    warn "IPv$_IPv dhcp for interface $netif failed"
+    # nuke those files since we failed
+    rm -f "${_tmp_prefix}.pid" "${_tmp_prefix}.lease"
     return 1
 }
 
-do_dhclient
+do_dhclient "$@"
 ret=$?
 
 # setup nameserver
@@ -111,22 +112,22 @@ if [ $ret -eq 0 ]; then
 
     if ln -s "$netif" "$IFNETFILE" 2> /dev/null; then
         intf=$(readlink "$IFNETFILE")
-        if [ -e /tmp/dhclient."$intf".lease ]; then
-            info "DHCP successful on interface $intf"
+        if [ -e "/tmp/dhclient.$intf.IPv$_IPv.lease" ]; then
+            info "IPv$_IPv DHCP successful on interface $intf"
             # Kill all existing dhclient calls for other interfaces, since we
             # already got one successful interface
 
-            read -r npid < /tmp/dhclient."$netif".pid
+            read -r npid < "${_tmp_prefix}.pid"
             pidlist=$(pgrep dhclient)
             for pid in $pidlist; do
                 [ "$pid" -eq "$npid" ] && continue
                 kill -9 "$pid" > /dev/null 2>&1
             done
         else
-            echo "ERROR! $IFNETFILE exists but /tmp/dhclient.$intf.lease does not exist!!!"
+            echo "ERROR! $IFNETFILE exists but /tmp/dhclient.$intf.IPv$_IPv.lease does not exist!!!"
         fi
     else
-        info "DHCP success on $netif, and also on $intf"
+        info "IPv$_IPv DHCP success on $netif, and also on $intf"
         exit 0
     fi
     exit $ret