networkd: surprising behaviour of .network files with only commented content

[puleglot]

If network config contains only empty and/or commented out lines, then networkd begins to manage all interfaces:

$ sudo networkctl --all
IDX LINK             TYPE               OPERATIONAL SETUP     
  1 lo               loopback           carrier     unmanaged 
  2 tunl0            tunnel             off         unmanaged 
  3 sit0             sit                off         unmanaged 
  4 ip6tnl0          tunnel6            off         unmanaged 
  5 wlp12s0          wlan               routable    unmanaged 
  6 enp9s0           ether              no-carrier  unmanaged 

6 links listed.
$ sudo touch /etc/systemd/network/foo.network
$ sudo systemctl restart systemd-networkd.service
$ sudo networkctl --all
IDX LINK             TYPE               OPERATIONAL SETUP     
  1 lo               loopback           carrier     unmanaged 
  2 tunl0            tunnel             off         unmanaged 
  3 sit0             sit                off         unmanaged 
  4 ip6tnl0          tunnel6            off         unmanaged 
  5 wlp12s0          wlan               routable    unmanaged 
  6 enp9s0           ether              no-carrier  unmanaged 

6 links listed.
$ echo | sudo tee /etc/systemd/network/foo.network 

$ sudo systemctl restart systemd-networkd.service
$ sudo networkctl --all
IDX LINK             TYPE               OPERATIONAL SETUP     
  1 lo               loopback           carrier     configured
  2 tunl0            tunnel             carrier     configured
  3 sit0             sit                routable    configured
  4 ip6tnl0          tunnel6            degraded    configured
  5 wlp12s0          wlan               routable    configured
  6 enp9s0           ether              no-carrier  configured

6 links listed.

Real world example of problematic network config:

$ cat /etc/systemd/network/enp3s0.network 
#[Match]
#Name=enp3s0

#[Network]
#Address=192.168.1.5/24
#Gateway=192.168.1.1
#DNS=192.168.1.1

[poettering]

Well. That's really expected behaviour. An empty .network file means a file with an empty match section and default settings for everything. An empty match section means it applies to every interface. hence you get the behaviour you are seeing.

It probably would make sense to document this as a caveat though, since it is indeed surprising at first.

[puleglot]

Yes, I understand this. But an empty (zero sized) .network file actually gets skipped by network_load_one(). TBH, this behaviour is not consistent. :)

[keszybz]

@puleglot empty network files are a special case of a general rule in systemd: empty files and symlinks to /dev/null are used to "mask" a file. This is (partially) documented in network.network(5).

OTOH, I understand how the case of fully commented-out files can be confusing. It would be nice to at least emit a warning in this case.

(If I have a file with [Match] Name=a* Name=b_, I'll match two interfaces. If I have a file with [Match] Name=a_, I'll match one interface. But then if I have a file with [Match], all interfaces will be matched.)

[puleglot]

Refusing .network files with an empty [Match] section is a good idea IMHO. It really should be a required section.

[poettering]

I would warn, but not refuse I must say.

[dkg]

the fact that someone as experienced as @kesyzbz could "get bit" by this problem (see #9895) suggests that the problem is in fact in the codebase and not in the user.

a non-empty .network file with no [Match] section and no other section should either be treated the same way as an empty file, or it should be treated as an error and ignored (probably, warnings should be emitted either way).

Fixing this would provide sensible guard-rails to any reasonable system administrator, and removes no functionality, because an administrator who wants this particular (very odd) behavior of configuring nothing but matching on all interfaces can always explicitly create universally-matching config file with something like this:

[Match]
Name=*

Please consider making systemd less user-hostile in this case.

[keszybz]

We now emit a warning if no matches are found, see 84ea567. This opens the possibility to turn it into an error a few releases down the road.

[sebunger]

This broke compatibility with netplan! Now you cannot configure networkd to configure all interfaces through DHCP4 via netplan anymore because netplan refuses a simple * as a name glob.