ethernet: T4538: fix wrong systemd unit used for EAPoL

When MACsec was bound to an ethernet interface and the underlaying
source-interface got changed (even description only) this terminated the
MACsec session running on top of it.

The root cause is when EAPoL was implemented in commit d59354e52a8a7f we
re-used the same systemd unit which is responsible for MACsec. That indeed lead
to the fact that wpa_supplicant was always stopped when anything happened on
the underlaying source-interface that was not related to EAPoL.

1 files changed, 14 insertions, 9 deletions

diff --git a/src/conf_mode/interfaces-ethernet.py b/src/conf_mode/interfaces-ethernet.py
index 30e7a2af7..e02841831 100755
--- a/src/conf_mode/interfaces-ethernet.py
+++ b/src/conf_mode/interfaces-ethernet.py
@@ -153,11 +153,20 @@ def verify(ethernet):
     return None
 
 def generate(ethernet):
-    if 'eapol' in ethernet:
-        render(wpa_suppl_conf.format(**ethernet),
-               'ethernet/wpa_supplicant.conf.j2', ethernet)
+    # render real configuration file once
+    wpa_supplicant_conf = wpa_suppl_conf.format(**ethernet)
+
+    if 'deleted' in ethernet:
+        # delete configuration on interface removal
+        if os.path.isfile(wpa_supplicant_conf):
+            os.unlink(wpa_supplicant_conf)
+        return None
 
+    if 'eapol' in ethernet:
         ifname = ethernet['ifname']
+
+        render(wpa_supplicant_conf, 'ethernet/wpa_supplicant.conf.j2', ethernet)
+
         cert_file_path = os.path.join(cfg_dir, f'{ifname}_cert.pem')
         cert_key_path = os.path.join(cfg_dir, f'{ifname}_cert.key')
 
@@ -184,10 +193,6 @@ def generate(ethernet):
 
             write_file(ca_cert_file_path,
                        '\n'.join(encode_certificate(c) for c in ca_full_chain))
-    else:
-        # delete configuration on interface removal
-        if os.path.isfile(wpa_suppl_conf.format(**ethernet)):
-            os.unlink(wpa_suppl_conf.format(**ethernet))
 
     return None
 
@@ -203,9 +208,9 @@ def apply(ethernet):
     else:
         e.update(ethernet)
         if 'eapol' in ethernet:
-            eapol_action='restart'
+            eapol_action='reload-or-restart'
 
-    call(f'systemctl {eapol_action} wpa_supplicant-macsec@{ifname}')
+    call(f'systemctl {eapol_action} wpa_supplicant-wired@{ifname}')
 
 if __name__ == '__main__':
     try: