<?xml version='1.0'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
-
-<!--
- SPDX-License-Identifier: LGPL-2.1+
--->
+<!-- SPDX-License-Identifier: LGPL-2.1+ -->
<refentry id="systemd.network" conditional='ENABLE_NETWORKD'>
is applied, all later files are ignored, even if they match as
well.</para>
- <para>A network file is said to match a device if each of the
- entries in the <literal>[Match]</literal> section matches, or if
- the section is empty. The following keys are accepted:</para>
+ <para>A network file is said to match a network interface if all matches specified by the
+ <literal>[Match]</literal> section are satisfied. When a network file does not contain valid
+ settings in <literal>[Match]</literal> section, then the file will match all interfaces and
+ <command>systemd-networkd</command> warns about that. Hint: to avoid the warning and to make it
+ clear that all interfaces shall be matched, add the following:
+ <programlisting>Name=*</programlisting>
+ The following keys are accepted:</para>
<variablelist class='network-directives'>
<varlistentry>
<varlistentry>
<term><varname>Host=</varname></term>
<listitem>
- <para>Matches against the hostname or machine ID of the
- host. See <literal>ConditionHost=</literal> in
+ <para>Matches against the hostname or machine ID of the host. See
+ <literal>ConditionHost=</literal> in
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- for details.
+ for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
+ If an empty string is assigned, then previously assigned value is cleared.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>Virtualization=</varname></term>
<listitem>
- <para>Checks whether the system is executed in a virtualized
- environment and optionally test whether it is a specific
- implementation. See <literal>ConditionVirtualization=</literal> in
+ <para>Checks whether the system is executed in a virtualized environment and optionally test
+ whether it is a specific implementation. See <literal>ConditionVirtualization=</literal> in
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- for details.
+ for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
+ If an empty string is assigned, then previously assigned value is cleared.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>KernelCommandLine=</varname></term>
<listitem>
- <para>Checks whether a specific kernel command line option is
- set (or if prefixed with the exclamation mark unset). See
+ <para>Checks whether a specific kernel command line option is set. See
<literal>ConditionKernelCommandLine=</literal> in
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- for details.
+ for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
+ If an empty string is assigned, then previously assigned value is cleared.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>KernelVersion=</varname></term>
<listitem>
- <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a certain
- expression (or if prefixed with the exclamation mark does not match it). See
- <literal>ConditionKernelVersion=</literal> in
- <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
- details.
+ <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a
+ certain expression. See <literal>ConditionKernelVersion=</literal> in
+ <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
+ If an empty string is assigned, then previously assigned value is cleared.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>Architecture=</varname></term>
<listitem>
- <para>Checks whether the system is running on a specific
- architecture. See <literal>ConditionArchitecture=</literal> in
+ <para>Checks whether the system is running on a specific architecture. See
+ <literal>ConditionArchitecture=</literal> in
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- for details.
+ for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
+ If an empty string is assigned, then previously assigned value is cleared.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>RequiredForOnline=</varname></term>
<listitem>
- <para>Takes a boolean. When <literal>yes</literal>, the network is deemed
- required when determining whether the system is online when running
- <literal>systemd-networkd-wait-online</literal>.
- When <literal>no</literal>, the network is ignored when checking for
- online state. Defaults to <literal>yes</literal>.</para>
+ <para>Takes a boolean or operational state. Please see
+ <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+ for possible operational states. When <literal>yes</literal>, the network is deemed required when
+ determining whether the system is online when running
+ <command>systemd-networkd-wait-online</command>. When <literal>no</literal>, the network is ignored
+ when checking for online state. When an operational state is set, <literal>yes</literal> is implied,
+ and this controls the operational state required for the network interface to be considered online.
+ Defaults to <literal>yes</literal>.</para>
+
<para>The network will be brought up normally in all cases, but in
the event that there is no address being assigned by DHCP or the
cable is not plugged in, the link will simply remain offline and be
- skipped automatically by <literal>systemd-networkd-wait-online</literal>
+ skipped automatically by <command>systemd-networkd-wait-online</command>
if <literal>RequiredForOnline=no</literal>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>DHCPServer=</varname></term>
<listitem>
- <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be start. Defaults
+ <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be started. Defaults
to <literal>no</literal>. Further settings for the DHCP
server may be set in the <literal>[DHCPServer]</literal>
section described below.</para>
<varlistentry>
<term><varname>LinkLocalAddressing=</varname></term>
<listitem>
- <para>Enables link-local address autoconfiguration. Accepts
- <literal>yes</literal>, <literal>no</literal>,
- <literal>ipv4</literal>, or <literal>ipv6</literal>. Defaults to
- <literal>ipv6</literal>.</para>
+ <para>Enables link-local address autoconfiguration. Accepts <literal>yes</literal>,
+ <literal>no</literal>, <literal>ipv4</literal>, <literal>ipv6</literal>,
+ <literal>fallback</literal>, or <literal>ipv4-fallback</literal>. If
+ <literal>fallback</literal> or <literal>ipv4-fallback</literal> is specified, then an IPv4
+ link-local address is configured only when DHCPv4 fails. If <literal>fallback</literal>,
+ an IPv6 link-local address is always configured, and if <literal>ipv4-fallback</literal>,
+ the address is not configured. Note that, the fallback mechanism works only when DHCPv4
+ client is enabled, that is, it requires <literal>DHCP=yes</literal> or
+ <literal>DHCP=ipv4</literal>. If <varname>Bridge=</varname> is set, defaults to
+ <literal>no</literal>, and if not, defaults to <literal>ipv6</literal>.
+ </para>
</listitem>
</varlistentry>
<varlistentry>
specified more than once.
</para>
- <para>If the specified address is 0.0.0.0 (for IPv4) or
- [::] (for IPv6), a new address range of the requested size
- is automatically allocated from a system-wide pool of
- unused ranges. The allocated range is checked against all
- current network interfaces and all known network
- configuration files to avoid address range conflicts. The
- default system-wide pool consists of 192.168.0.0/16,
- 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fc00::/7 for
- IPv6. This functionality is useful to manage a large
- number of dynamically created network interfaces with the
- same network configuration and automatic address range
- assignment.</para>
+ <para>If the specified address is <literal>0.0.0.0</literal> (for IPv4) or <literal>::</literal>
+ (for IPv6), a new address range of the requested size is automatically allocated from a
+ system-wide pool of unused ranges. Note that the prefix length must be equal or larger than 8 for
+ IPv4, and 64 for IPv6. The allocated range is checked against all current network interfaces and
+ all known network configuration files to avoid address range conflicts. The default system-wide
+ pool consists of 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8 for IPv6.
+ This functionality is useful to manage a large number of dynamically created network interfaces
+ with the same network configuration and automatic address range assignment.</para>
</listitem>
</varlistentry>
url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
<constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
+
+ <para>Note that if this option is enabled a userspace implementation of the IPv6 RA protocol is
+ used, and the kernel's own implementation remains disabled, since `networkd` needs to know all
+ details supplied in the advertisements, and these are not available from the kernel if the kernel's
+ own implementation is used.</para>
</listitem>
</varlistentry>
<varlistentry>
This option may be specified more than once.</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>MACsec=</varname></term>
+ <listitem>
+ <para>The name of a MACsec device to create on the link. See
+ <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+ This option may be specified more than once.</para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term><varname>ActiveSlave=</varname></term>
<listitem>
<varlistentry>
<term><varname>Address=</varname></term>
<listitem>
- <para>As in the <literal>[Network]</literal> section. This
- key is mandatory.</para>
+ <para>As in the <literal>[Network]</literal> section. This key is mandatory. Each
+ <literal>[Address]</literal> section can contain one <varname>Address=</varname> setting.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>Peer=</varname></term>
<listitem>
<para>The peer address in a point-to-point connection.
- Accepts the same format as the <literal>Address</literal>
+ Accepts the same format as the <varname>Address=</varname>
key.</para>
</listitem>
</varlistentry>
described in
<citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
This key only applies to IPv4 addresses. If it is not
- given, it is derived from the <literal>Address</literal>
+ given, it is derived from the <varname>Address=</varname>
key.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>InvertRule=</varname></term>
<listitem>
- <para>A boolean. Specifies wheather the rule to be inverted. Defaults to false.</para>
+ <para>A boolean. Specifies whether the rule to be inverted. Defaults to false.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
- <term><varname>GatewayOnlink=</varname></term>
+ <term><varname>GatewayOnLink=</varname></term>
<listitem>
<para>Takes a boolean. If set to true, the kernel does not have
to check if the gateway is reachable directly by the current machine (i.e., the kernel does
<varlistentry>
<term><varname>InitialAdvertisedReceiveWindow=</varname></term>
<listitem>
- <para>The TCP initial advertised receive window is the amount of receive data (in bytes) that can initally be buffered at one time
+ <para>The TCP initial advertised receive window is the amount of receive data (in bytes) that can initially be buffered at one time
on a connection. The sending host can send only that amount of data before waiting for an acknowledgment and window update
from the receiving host. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual suffixes K, M, G are supported
and are understood to the base of 1024. When unset, the kernel's default will be used.
<varname>UseRoutes=</varname>, <varname>SendHostname=</varname>,
<varname>UseMTU=</varname>, <varname>VendorClassIdentifier=</varname>,
<varname>UseTimezone=</varname>.</para>
+
+ <para>With this option enabled DHCP requests will mimic those generated by Microsoft Windows, in
+ order to reduce the ability to fingerprint and recognize installations. This means DHCP request
+ sizes will grow and lease data will be more comprehensive than normally, though most of the
+ requested data is not actually used.</para>
</listitem>
</varlistentry>
<varlistentry>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>MaxAttempts=</varname></term>
+ <listitem>
+ <para>Specifies how many times the DHCPv4 client configuration should be attempted. Takes a
+ number or <literal>infinity</literal>. Defaults to <literal>infinity</literal>.
+ Note that the time between retries is increased exponentially, so the network will not be
+ overloaded even if this number is high.</para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>DUIDType=</varname></term>
<listitem>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>BlackList=</varname></term>
+ <listitem>
+ <para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are rejected.</para>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>MulticastFlood=</varname></term>
+ <listitem>
+ <para>Takes a boolean. Controls whether the bridge should flood
+ traffic for which an MDB entry is missing and the destination
+ is unknown through this port. When unset, the kernel's default will be used.
+ </para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term><varname>MulticastToUnicast=</varname></term>
<listitem>
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>NeighborSuppression=</varname></term>
+ <listitem>
+ <para>Takes a boolean. Configures whether ARP and ND neighbor suppression is enabled for
+ this port. When unset, the kernel's default will be used.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>Learning=</varname></term>
+ <listitem>
+ <para>Takes a boolean. Configures whether MAC address learning is enabled for
+ this port. When unset, the kernel's default will be used.
+ </para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term><varname>HairPin=</varname></term>
<listitem>
key is mandatory.</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>Destination=</varname></term>
+ <listitem>
+ <para>Takes an IP address of the destination VXLAN tunnel endpoint.</para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term><varname>VLANId=</varname></term>
<listitem>
table entry.</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>VNI=</varname></term>
+ <listitem>
+ <para>The VXLAN Network Identifier (or VXLAN Segment ID) to use to connect to
+ the remote VXLAN tunnel endpoint. Takes a number in the range 1-16777215.
+ Defaults to unset.</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
automatic restart off. By default automatic restart is disabled.</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>TripleSampling=</varname></term>
+ <listitem>
+ <para>Takes a boolean. When <literal>yes</literal>, three samples (instead of one) are used to determine
+ the value of a received bit by majority rule. When unset, the kernel's default will be used.</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
projects / thirdparty / systemd.git / blobdiff