From 9354d385e2c033e82eb285fec16e6dc771b8a336 Mon Sep 17 00:00:00 2001
From: Egor Savkin <es@m-labs.hk>
Date: Thu, 31 Oct 2024 10:29:18 +0800
Subject: [PATCH 1/2] network: Fix cycle dependency causing race of netdev and
 address configuration

This changes the following chain after `nixos-rebuild switch` with modified tunnel interfaces:
stop network-setup -> stop TUN-netdev -> stop network-addresses-TUN -> start network-addresses-TUN (fails since it depends on TUN-netdev which is off).

Chain after this change:
stop TUN-netdev -> stop network-setup -> stop network-addresses-TUN -> start TUN-netdev -> start network-addresses-TUN -> start network-setup

Signed-off-by: Egor Savkin <es@m-labs.hk>
---
 nixos/modules/tasks/network-interfaces-scripted.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 83c0dc27885e..13721c2c0b40 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -260,7 +260,6 @@ let
             bindsTo = optional (!config.boot.isContainer) "dev-net-tun.device";
             after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
             wantedBy = [ "network-setup.service" (subsystemDevice i.name) ];
-            partOf = [ "network-setup.service" ];
             before = [ "network-setup.service" ];
             path = [ pkgs.iproute2 ];
             serviceConfig = {
@@ -411,7 +410,6 @@ let
           { description = "Bond Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
-            partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps
               ++ map (i: "network-addresses-${i}.service") v.interfaces;
             before = [ "network-setup.service" ];
@@ -450,7 +448,6 @@ let
           { description = "MACVLAN Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
-            partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";
@@ -485,7 +482,6 @@ let
           { description = "FOU endpoint ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
-            partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";
@@ -508,7 +504,6 @@ let
           { description = "6-to-4 Tunnel Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
-            partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";
@@ -542,7 +537,6 @@ let
           { description = "GRE Tunnel Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
-            partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";

From 8bda6ea01c1aea2e905301e36a1e1bf126ac2ea7 Mon Sep 17 00:00:00 2001
From: Egor Savkin <es@m-labs.hk>
Date: Thu, 21 Nov 2024 16:29:04 +0800
Subject: [PATCH 2/2] tests: network: update
 `nixosTests.networking.scripted.virtual` to match correct behavior

First, `stop network-addresses-X` should clean up the addresses without deleting the interfaces. And only `stop tap0-netdev` should fully delete the interfaces.

Signed-off-by: Egor Savkin <es@m-labs.hk>
---
 nixos/tests/networking/networkd-and-scripted.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index 407cfed4bb75..be73e543e284 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -660,11 +660,23 @@ let
             assert "02:de:ad:be:ef:01" in machine.succeed("ip link show dev tap0")
       '' # network-addresses-* only exist in scripted networking
       + lib.optionalString (!networkd) ''
-        with subtest("Test interfaces clean up"):
+        with subtest("Test interfaces' addresses clean up"):
             machine.succeed("systemctl stop network-addresses-tap0")
             machine.sleep(10)
             machine.succeed("systemctl stop network-addresses-tun0")
             machine.sleep(10)
+            residue = machine.succeed("ip tuntap list | sort").strip()
+            assert (
+                residue == targetList
+            ), "Some virtual interface has been removed:\n{}".format(residue)
+            assert "192.168.1.1" not in machine.succeed("ip address show dev tap0"), "tap0 interface address has not been removed"
+            assert "192.168.1.2" not in machine.succeed("ip address show dev tun0"), "tun0 interface address has not been removed"
+
+        with subtest("Test interfaces clean up"):
+            machine.succeed("systemctl stop tap0-netdev")
+            machine.sleep(10)
+            machine.succeed("systemctl stop tun0-netdev")
+            machine.sleep(10)
             residue = machine.succeed("ip tuntap list")
             assert (
                 residue == ""