Add option to control MAC address reuse for VR public NICs#13001
Open
bernardodemarco wants to merge 1 commit intoapache:mainfrom
Open
Add option to control MAC address reuse for VR public NICs#13001bernardodemarco wants to merge 1 commit intoapache:mainfrom
bernardodemarco wants to merge 1 commit intoapache:mainfrom
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #13001 +/- ##
============================================
+ Coverage 18.01% 18.02% +0.01%
- Complexity 16607 16622 +15
============================================
Files 6029 6029
Lines 542160 542269 +109
Branches 66451 66462 +11
============================================
+ Hits 97682 97756 +74
- Misses 433461 433493 +32
- Partials 11017 11020 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Member
Author
|
@blueorangutan package |
|
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 17451 |
bernardodemarco
force-pushed
the
change-mac-address-of-public-nics-of-vrs
branch
from
82d70a0 to
0cd6426
Compare
Member
Author
|
@blueorangutan package |
|
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 17452 |
Member
|
@bernardodemarco
If the public ip services are down for only 1 second or so, I think this PR is good. |
bernardodemarco
force-pushed
the
change-mac-address-of-public-nics-of-vrs
branch
from
0cd6426 to
1144978
Compare
Member
Author
|
Hello, @weizhouapache
Sure! Below are described some connectivity stress tests that I performed in my local environment. They were executed over a VPC (CIDR 10.0.0.0/16), with a tier (CIDR 10.0.0.0/24) whose ACL was configured to allow all ingress and egress network traffic. I acquired a public IP (192.168.122.15) for the VPC and assigned it to a VM provisioned in the tier. In the VM, I configured a UDP server with Node.js and started it as a daemon: UDP Serverconst udp = require('dgram')
const fs = require('fs')
const server = udp.createSocket('udp4')
const port = 2222
const logStream = fs.createWriteStream('udp.log', { flags: 'a' })
server.on('error', (error) => {
logStream.write('Error: ' + error)
server.close()
})
server.on('message', (msg, info) => {
const message = msg.toString()
const logEntry = `[${new Date().toISOString()}] ${info.address}:${info.port} - ${message}\n`
logStream.write(logEntry)
console.log(logEntry.trim())
})
server.on('listening', () => {
logStream.write('Server is listening at port ' + port)
})
server.on('close', () => {
logStream.write('Socket is closed')
logStream.end()
})
server.bind(port)Next, I developed a client script to send UDP datagrams to the server every 100 milliseconds: UDP Clientconst udp = require('dgram')
const host = '192.168.122.15'
const port = 2222
const sleepInterval = 100
const client = udp.createSocket('udp4')
function randomIntFromInterval(min, max) {
return Math.floor(Math.random() * (max - min + 1) + min)
}
let i = 0
async function sendDataToServer() {
const message = 'load test #' + (i++).toString() + ' -- data:' + Date.now().toString(36).repeat(randomIntFromInterval(100, 150))
console.log(message)
const data = Buffer.from(message)
client.send(data, port, host, (error) => {
console.log('sending data to the server')
if (error) {
console.log('error - closing socket')
client.close()
}
})
}
setInterval(sendDataToServer, sleepInterval)Non-redundant VPC cleanupReusing the same MAC address
LogsNetwork traffic obtained from
|
Member
Author
|
@blueorangutan package |
|
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17471 |
Member
thanks @bernardodemarco can you grep "arping" in the /var/log/cloud.log in the backup VR (now it should be primary VR) ? |
Member
Author
|
Hello, @weizhouapache
Sure, here are the
|
Member
|
@bernardodemarco |
Contributor
|
@bernardodemarco , all looks good. Do you have some 3rd person testing this? |
Member
Author
|
Hello, @DaanHoogland
Not actually. Maybe @erikbocks or @GaOrtiga could help testing this one? Let's see |
Collaborator
|
@bernardodemarco @DaanHoogland, I will try to test this one on the weekend. |
Member
Author
|
@erikbocks, thanks! |
Collaborator
|
CLGTM. Tested it locally, and below are the test cases and their results:
|
erikbocks
approved these changes
Apr 19, 2026
Member
Author
|
@erikbocks, thanks for testing it! @weizhouapache, I believe this one is ready for merge, right? |
Member
@bernardodemarco btw: there is a simulator CI failure related to persistent network, I have restarted the test, let's wait it to be finished. |
Member
Author
|
@weizhouapache, it seems that the simulator test succeeded now |
Member
|
@DaanHoogland @weizhouapache could we run the CI here? |
Member
|
@blueorangutan package |
Member
Sure. I did not realize smoke tests are not run yet. |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17557 |
Member
|
@blueorangutan test matrix |
|
@weizhouapache a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests |
|
[SF] Trillian Build Failed (tid-15917) |
|
[SF] Trillian test result (tid-15916)
|
|
[SF] Trillian test result (tid-15919)
|
bernardodemarco
force-pushed
the
change-mac-address-of-public-nics-of-vrs
branch
from
1144978 to
b0bb69e
Compare
Member
Author
|
I have rebased the PR's branch with |
Member
Author
|
@blueorangutan package |
|
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17576 |
|
[SF] Trillian test result (tid-15918)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ACS currently uses the same MAC address for the public NICs of VRs when implementing redundant VRs or when restarting an isolated network or VPC with cleanup. In the case of restarts with cleanup, ACS initializes a new VR with its NICs and subsequently applies the corresponding configuration and IP addresses.
In this scenario, when VRs are cleaned up while there is intensive traffic on the public network, traffic may still be directed to the same MAC address as the previous VR before the new VR’s public NIC is fully configured. As a result, the VR’s operating system may interpret this traffic as a spoofing attack and begin dropping packets. To address these cases, the MAC address of the public NIC can be changed when VRs are recreated during cleanup. This ensures that network traffic is only directed to the new VR once it is fully configured.
To support this behavior in ACS, the
keepmacaddressonpublicnicparameter has been added to thecreateNetwork,createVPC,updateNetwork, andupdateVPCAPIs. When set to true (the default, preserving existing behavior), ACS reuses the same MAC address for the public NIC across VRs during redundancy or recreation. When set to false, newly created public NICs are always assigned a new MAC address.Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Screenshots (if appropriate):
How Has This Been Tested?
Authorization validation
Adminaccounts have permission to manipulate thekeepmacaddressonpublicnicparameter in the following APIs:createNetwork;updateNetwork;createVPC;updateVPC.Network connectivity tests
See #13001 (comment)
Behavior validation
Isolated networks
keepmacaddressonpublicnicparameter set totrue1e:01:89:00:00:0efalseand performed a network clean up1e:01:ee:00:00:0eand1e:01:26:00:00:0ekeepmacaddressonpublicnicparameter set tofalse1e:01:73:00:00:0d1e:01:32:00:00:0dand1e:01:82:00:00:0dRedundant isolated networks
keepmacaddressonpublicnicparameter set totruekeepmacaddressonpublicnicparameter set tofalse.VPCs
keepmacaddressonpublicnicparameter set totrue1e:01:3a:00:00:0dfalseand performed a VPC clean upRedundant VPCs
keepmacaddressonpublicnicparameter set totruekeepmacaddressonpublicnicparameter set tofalse