fix: Refine MAC validation using interface name

When a user provides both an interface name and a MAC address, the
current validation process retrieves sysfs link info separately using
the interface name and the MAC address, then compares the results. If
the information doesn't match, an error is raised.

However, this approach may trigger false alarms because retrieving the
link info by MAC might return data that only matches the current MAC
instead of the permanent MAC. Since the interface name is unique within
the kernel, a more robust validation method is to fetch the MAC address
using the interface name and then compare it directly with the
user-provided MAC address.

Signed-off-by: Wen Liang <[email protected]>

Author: liangwen12year

library/network_connections.py

@@ -167,6 +167,16 @@ def _link_read_address(ifname):
         c = SysUtil._sysctl_read("/sys/class/net/" + ifname + "/address")
         return Util.mac_norm(c.strip())
 
+    @staticmethod
+    def _link_read_bond_port_perm_hwaddr(ifname):
+        filename = os.path.join(
+            "/sys/class/net", ifname, "bonding_slave", "perm_hwaddr"
+        )
+        if not os.path.exists(filename):
+            return None
+        c = SysUtil._sysctl_read(filename)
+        return Util.mac_norm(c.strip())
+
     @staticmethod
     def _link_read_permaddress(ifname):
         return ethtool.get_perm_addr(ifname)
@@ -187,6 +197,13 @@ def _link_infos_fetch():
                 "ifname": ifname,
                 "address": SysUtil._link_read_address(ifname),
                 "perm-address": SysUtil._link_read_permaddress(ifname),
+                # When an interface is added as a port of a bonding device, its MAC
+                # address might change, we need to retrieve and preserve the original
+                # MAC address to ensure the user-provided interface name and MAC match
+                # correctly.
+                "bond-port-perm-hwaddr": SysUtil._link_read_bond_port_perm_hwaddr(
+                    ifname
+                ),
             }
         return links
 
@@ -2180,13 +2197,23 @@ def run_prepare(self):
                                     "infiniband interface exists"
                                     % (connection["interface_name"]),
                                 )
-                if li_mac and li_ifname and li_mac != li_ifname:
-                    self.log_fatal(
-                        idx,
-                        "profile specifies interface_name '%s' and mac '%s' but no "
-                        "such interface exists"
-                        % (connection["interface_name"], connection["mac"]),
-                    )
+                    elif connection["mac"]:
+                        perm_address = li_ifname.get("perm-address", NULL_MAC)
+                        current_address = li_ifname.get("address", NULL_MAC)
+                        bond_port_perm_hwaddr = li_ifname.get(
+                            "bond-port-perm-hwaddr", NULL_MAC
+                        )
+                        if (perm_address not in {NULL_MAC, connection["mac"]}) or (
+                            perm_address == NULL_MAC
+                            and connection["mac"]
+                            not in {current_address, bond_port_perm_hwaddr}
+                        ):
+                            self.log_fatal(
+                                idx,
+                                "profile specifies interface_name '%s' and mac '%s' "
+                                "but no such interface exists"
+                                % (connection["interface_name"], connection["mac"]),
+                            )
 
     def start_transaction(self):
         """Hook before making changes"""