From ba60266ab18969d588179b3acff3bccc078b2ee8 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 19 Dec 2025 21:16:22 +0100 Subject: ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2) Add a safeguard to block MAC address changes when the underlying driver is ENA (used on AWS EC2), and display a clear error message instead of raising "OSError: [Errno 95] Operation not supported." --- python/vyos/ethtool.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'python') diff --git a/python/vyos/ethtool.py b/python/vyos/ethtool.py index 22e066def..76c5b29f0 100644 --- a/python/vyos/ethtool.py +++ b/python/vyos/ethtool.py @@ -25,6 +25,10 @@ _drivers_without_speed_duplex_flow = ['vmxnet3', 'virtio_net', 'xen_netfront', 'iavf', 'ice', 'i40e', 'hv_netvsc', 'veth', 'ixgbevf', 'tun', 'vif'] +_drivers_without_mac_change = ['ena'] +# enable interface bonding will change the interface MAC address, thus all drivers +# not supporting MAC address change, also do not support bonding + class Ethtool: """ Class is used to retrive and cache information about an ethernet adapter @@ -222,3 +226,7 @@ class Ethtool: matches = re.findall(rf'{rx_tx_comb}:\s+(\d+)', self._channels) return [int(value) for value in matches] + + def check_mac_change(self) -> bool: + """ Check if ethernet drivers supports changing MAC address """ + return bool(self.get_driver_name() not in _drivers_without_mac_change) -- cgit v1.2.3 From 066d2be8b3d57b2171aa2056c7d953810f50dcb8 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 19 Dec 2025 21:19:11 +0100 Subject: bond: T8084: disallow bond members that do not support MAC changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Building on commit ba60266ab1896 (“ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2)”), add safeguards to prevent interfaces from being used as bond members if they: * do not support MAC address changes, or * appear on a denylist of interfaces invalid for bonding (currently empty) --- python/vyos/ethtool.py | 5 +++++ src/conf_mode/interfaces_bonding.py | 5 +++++ 2 files changed, 10 insertions(+) (limited to 'python') diff --git a/python/vyos/ethtool.py b/python/vyos/ethtool.py index 76c5b29f0..d0495df43 100644 --- a/python/vyos/ethtool.py +++ b/python/vyos/ethtool.py @@ -28,6 +28,7 @@ _drivers_without_speed_duplex_flow = ['vmxnet3', 'virtio_net', 'xen_netfront', _drivers_without_mac_change = ['ena'] # enable interface bonding will change the interface MAC address, thus all drivers # not supporting MAC address change, also do not support bonding +_drivers_without_bonding_support = _drivers_without_mac_change + [] class Ethtool: """ @@ -230,3 +231,7 @@ class Ethtool: def check_mac_change(self) -> bool: """ Check if ethernet drivers supports changing MAC address """ return bool(self.get_driver_name() not in _drivers_without_mac_change) + + def check_bonding(self) -> bool: + """ Check if ethernet drivers supports bonding """ + return bool(self.get_driver_name() not in _drivers_without_bonding_support) diff --git a/src/conf_mode/interfaces_bonding.py b/src/conf_mode/interfaces_bonding.py index 3f6450076..e6aaa3440 100755 --- a/src/conf_mode/interfaces_bonding.py +++ b/src/conf_mode/interfaces_bonding.py @@ -30,6 +30,7 @@ from vyos.configverify import verify_mirror_redirect from vyos.configverify import verify_mtu_ipv6 from vyos.configverify import verify_vlan_config from vyos.configverify import verify_vrf +from vyos.ethtool import Ethtool from vyos.frrender import FRRender from vyos.frrender import get_frrender_dict from vyos.ifconfig import BondIf @@ -251,6 +252,10 @@ def verify(bond): raise ConfigError('Configured MTU is less then member '\ f'interface "{interface}" minimum of {min_mtu}!') + # not all ethernet drivers support interface bonding + if not Ethtool(interface).check_bonding(): + raise ConfigError(error_msg + 'driver is not supported!') + if 'primary' in bond: if bond['primary'] not in bond['member']['interface']: raise ConfigError(f'Primary interface of bond "{bond_name}" must be a member interface') -- cgit v1.2.3