IfState: Reproducible MAC Addresses¶

Linux assigns random MAC addresses when virtual interfaces are created (except for bond, macsec or vlan interfaces). When operating a firewall or cluster this might become an issue when the interfaces need to be recreated, like on every host reboot. With IfState 2.4, virtual interfaces get a reproducible MAC address which will stay stable for the lifecycle of the host.

About¶

The reproducible MAC addresses are based on the output of the SHAKE256 extendable-output function. The SHAKE256 input for an interface is build by concatenating the following values, depending on the configuration:

EBNF for SHAKE256 input string

No implicit link.address setting will be enforced if:

the interface does not support ethernet addressing (ipip, sit, vti, …) or
the mac_seed option for the current netns is set to null

Examples for a host with the machine-id of c5826ec0bb89fe5ca3af4e183d51e636:

a VLAN subinterface vl42 in a netns with the mac_seed set to ha-service01 will use the digest of the following string: SHAKE256("link\000\000ha-service01\000vl42") ⇒ ee:65:a3:17:74:99
a VLAN subinterface vl42 in the root netns will use the digest of the following string: SHAKE256("link\000c5826ec0bb89fe5ca3af4e183d51e636\000\000vl42") ⇒ 9e:12:25:18:4e:31
a VLAN subinterface vl42 in the netns foo will use the digest of the following string: SHAKE256("link\000c5826ec0bb89fe5ca3af4e183d51e636\000foo\000vl42") ⇒ 0a:13:9b:fc:bc:6d

MAC Address Defaults¶

For some interface kinds it is possible to change how IfState determines the default MAC address. This allows you to adopt IfState to your use cases and might help to get around with physical TCAM resource limits found in some switchdev hardware.

parameters:
  link_address_default:
    # use the parents interface address
    macsec: inherited
    # use the permanent address of the device
    physical: permanent
    # use reproducible address
    vlan: generated

interfaces: …