Direct Routed networks: audit fixes after the isolation-model overhaul

Reviewing every path the overhaul touches surfaced four fixes:

- SystemVM public IPv6 is now computed directly in PublicNetworkGuru
  (EUI-64 from the range's ip6_cidr and the NIC MAC, then /128 + fe80::1).
  The previously planned ipv6Service.updateNicIpv6() path is unusable
  here: it is gated on the public network offering's internet protocol
  (never set on the system public offering) and reserves through one
  placeholder NIC per network -- on the shared Public network, every
  SystemVM would have received the same address.
- Guest networks and public ranges share one routed-id space (a routed
  id names a bridge on every host), so collisions between them would
  merge L2 domains. Both directions are now rejected: a guest network
  cannot take an id a public range carries, and a public range cannot
  take an id a guest network holds.
- Creating an L3 network on a physical network without the ROUTED
  isolation method now fails early with a clear message, instead of an
  opaque no-guru error deep in setupNetwork().
- A direct routed guest NIC's isolation URI now mirrors its routed://
  broadcast URI instead of the misleading vlan://<tag> inherited from
  the Shared allocation path.

GuestType.L3 itself was re-verified as still required: some thirty
management-server branches (offering validation, subnet handling,
zone-wide overlap checks, secondary-IP host routes, security groups)
key on the guest type in places where no physical network -- and thus
no isolation method -- is in scope. The guest type says what a network
is; the isolation method says where it may live.

Author: wido

docs/design/direct-routed-networks.md

@@ -570,8 +570,11 @@ range (`_dcDao.findVnet()`), and must not collide with another network's broadca
 **Uniqueness must be zone-wide, not per physical network.** Bridge names are global on a host, so
 two networks with routed id 5828 anywhere in the zone would share `brdr-5828` and merge their L2
 domains. The existing zone-wide URI overlap check
-(`_networksDao.listByZoneAndUriAndGuestType()`) covers this; with a single `ROUTED` physical
-network per zone — the expected deployment — it is equivalent to the per-physnet check anyway.
+(`_networksDao.listByZoneAndUriAndGuestType()`) covers guest-vs-guest; with a single `ROUTED`
+physical network per zone — the expected deployment — it is equivalent to the per-physnet check
+anyway. **Guest networks and public ranges (§8.5) share the same id space** and are guarded in
+both directions: creating a guest network whose routed id a public range already carries is
+rejected, and so is creating a public range whose id a guest network holds.
 
 Either way the URI is set at creation and **stable for the network's life**: the bridge name never
 changes, which is what makes it something host policy can reference.
@@ -816,15 +819,17 @@ systemvm:
    must instead receive the host-route form (as `DirectRoutedNetworkGuru.applyDirectRoutedAddressing()`
    does for guests) plus `BroadcastDomainType.Routed` and a `routed://<id>` URI — which is also
    exactly what steers `BridgeVifDriver`'s Public branch into the brdr-bridge + `modifymacip.sh`
-   path instead of the public bridge (today that handling sits only in the Guest branch). The IPv6
-   side needs no new allocation logic: `ipv6Service.updateNicIpv6()` (`PublicNetworkGuru.java:166`)
-   already computes the address with EUI-64 from the range's subnet and the NIC's MAC (§6.3.4);
-   only the /128 + `fe80::1` reshaping applies on top, exactly as for guest NICs. Mechanism sketch:
-   the public IP range's vlan row already carries a tag that `getIp()` copies into the broadcast
-   URI, so a range created with `routed://<id>` as its "vlan" flows through with almost no new
-   plumbing (verify `updateNicIpv6()`'s range lookup by broadcast URI matches such a row); the
-   zone's public network carries one routed id (and thus one `brdr-<id>`) of its own, and systemvm
-   /32s and /128s are advertised by the host's routing daemon exactly like guest addresses.
+   path instead of the public bridge (today that handling sits only in the Guest branch). **IPv6
+   is computed directly in the guru** — `NetUtils.EUI64Address(range ip6_cidr, NIC MAC)` per
+   §6.3.4, then the /128 + `fe80::1` form. Deliberately *not* via `ipv6Service.updateNicIpv6()`:
+   auditing that path showed it is gated on the public network offering's internet protocol
+   (never set on the system public offering, so a no-op in practice) and reserves through **one
+   placeholder NIC per network** — on the shared Public network every SystemVM would receive the
+   *same* address. Neither the gate nor the reservation decides anything here: the MAC already
+   makes the address unique. Mechanism: the public IP range's vlan row carries `routed://<id>` as
+   its tag, which `getIp()` copies into the broadcast URI; the zone's public network carries one
+   routed id (and thus one `brdr-<id>`) of its own, and systemvm /32s and /128s are advertised by
+   the host's routing daemon exactly like guest addresses.
 
 Minor, noted for completeness: `setup_interface_ipv6()` writes `accept_ra 1` — harmless on an
 RA-less bridge, but the static default must not depend on it (and may be set to 0 for direct
@@ -1347,8 +1352,9 @@ Checklist to work through:
 - [ ] `systemvm/.../setup/common.sh` — `onlink` on the v4 default route for link-local gateways;
       install the v6 default route from `IP6GW` instead of relying on RA (§8.5)
 - [ ] `PublicNetworkGuru` / `createVlanIpRange` — direct routed public range for systemvm IPs,
-      dual-stack: host-route NIC form (v4 and v6), `Routed` broadcast URI; `BridgeVifDriver` Public
-      branch handles it; verify `updateNicIpv6()`'s range lookup accepts a `routed://` tag (§8.5)
+      dual-stack: host-route NIC form (v4 and v6, EUI-64 computed in the guru), `Routed` broadcast
+      URI; `BridgeVifDriver` Public branch handles it; routed ids guarded against guest/public
+      collisions in both directions (§8.5, §6.7.2)
 - [ ] `createNetwork`/`createVlanIpRange` — reject an IPv6 CIDR with a prefix longer than /64 for
       L3 networks; EUI-64 needs 64 interface-identifier bits (§6.3.4)
 - [ ] `NetworkServiceImpl.java:657` — stop rejecting DNS for this type as it does for L2 (§6.4)

engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java

@@ -2950,6 +2950,15 @@ private Network createGuestNetwork(final long networkOfferingId, final String na
 
             if (vlanSpecified) {
                 URI uri = encodeVlanIdIntoBroadcastUri(vlanId, pNtwk);
+                // A routed id names a bridge on every host (brdr-<id>): a guest network and a
+                // public range sharing one id would merge their L2 domains. Public ranges store
+                // the routed://<id> URI as their vlan tag; reject any id one already carries.
+                // (Guest-vs-guest collisions are caught by the zone-wide URI check below.)
+                if (BroadcastDomainType.getSchemeValue(uri) == BroadcastDomainType.Routed
+                        && _vlanDao.findByZoneAndVlanId(zoneId, uri.toString()) != null) {
+                    throw new InvalidParameterValueException(String.format(
+                            "The routed id %s is already used by a public IP range in zone %s", vlanId, zone.getName()));
+                }
                 // Aux: generate secondary URI for secondary VLAN ID (if provided) for performing checks
                 URI secondaryUri = StringUtils.isNotBlank(isolatedPvlan) ? BroadcastDomainType.fromString(isolatedPvlan) : null;
                 if (isSharedNetworkWithoutSpecifyVlan(ntwkOff) || isL3NetworkWithoutSpecifyVlan(ntwkOff) || isPrivateGatewayWithoutSpecifyVlan(ntwkOff)) {

server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java

@@ -5935,6 +5935,15 @@ public Vlan createVlanAndPublicIpRange(final long zoneId, final long networkId,
                     + zone.getName());
         }
 
+        // A routed id names a bridge on every host (brdr-<id>): a public range and a guest
+        // network sharing one id would merge their L2 domains. The guest-side creation rejects
+        // ids held by public ranges; this is the same guard in the other direction.
+        if (vlanId != null && vlanId.startsWith(BroadcastDomainType.Routed.scheme() + "://")
+                && !_networkDao.listByZoneAndUriAndGuestType(zoneId, vlanId, null).isEmpty()) {
+            throw new InvalidParameterValueException(String.format(
+                    "The routed id %s is already used by a guest network in zone %s", vlanId, zone.getName()));
+        }
+
         String ipRange = null;
 
         if (ipv4) {

server/src/main/java/com/cloud/network/NetworkServiceImpl.java

@@ -1573,6 +1573,16 @@ public Network createGuestNetwork(CreateNetworkCmd cmd) throws InsufficientCapac
 
         ACLType aclType = getAclType(caller, cmd.getAclType(), ntwkOff);
 
+        // Fail here with a clear message rather than deep in setupNetwork(), where no guru
+        // claiming the network produces an opaque error. The physical network is the network
+        // operator's opt-in: without ROUTED it carries no direct routed networks.
+        if (ntwkOff.getGuestType() == GuestType.L3
+                && (pNtwk.getIsolationMethods() == null || !pNtwk.getIsolationMethods().contains("ROUTED"))) {
+            throw new InvalidParameterValueException(String.format(
+                    "Networks of guest type %s can only be created on a physical network with isolation method ROUTED; physical network %s carries %s",
+                    GuestType.L3, pNtwk.getName(), pNtwk.getIsolationMethods()));
+        }
+
         if (ntwkOff.getGuestType() != GuestType.Shared && (!StringUtils.isAllBlank(routerIPv4, routerIPv6))) {
             throw new InvalidParameterValueException("Router IP can be specified only for Shared networks");
         }

server/src/main/java/com/cloud/network/guru/DirectRoutedNetworkGuru.java

@@ -184,6 +184,12 @@ protected void applyDirectRoutedAddressing(NicProfile nic) {
         if (nic == null) {
             return;
         }
+        // The inherited allocation labels the NIC's isolation URI vlan://<tag> from the vlan
+        // row, as a Shared network needs; here there is no VLAN — the only isolation-shaped
+        // fact about this NIC is its routed://<id> broadcast domain.
+        if (nic.getBroadCastUri() != null && BroadcastDomainType.getSchemeValue(nic.getBroadCastUri()) == BroadcastDomainType.Routed) {
+            nic.setIsolationUri(nic.getBroadCastUri());
+        }
         if (nic.getIPv4Address() != null) {
             nic.setIPv4Netmask(NetUtils.IPV4_HOST_NETMASK);
             nic.setIPv4Gateway(NetUtils.getLinkLocalGateway());

server/src/main/java/com/cloud/network/guru/PublicNetworkGuru.java

@@ -18,6 +18,8 @@
 
 import javax.inject.Inject;
 
+import org.apache.commons.lang3.StringUtils;
+
 import com.cloud.dc.dao.VlanDetailsDao;
 import com.cloud.network.vpc.dao.VpcDao;
 import com.cloud.network.vpc.dao.VpcOfferingDao;
@@ -63,6 +65,7 @@
 import com.cloud.vm.ReservationContext;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
+import com.googlecode.ipv6.IPv6Address;
 
 public class PublicNetworkGuru extends AdapterBase implements NetworkGuru {
 
@@ -156,6 +159,7 @@ protected void getIp(NicProfile nic, DataCenter dc, VirtualMachineProfile vm, Ne
                 nic.setIsolationUri(BroadcastDomainType.Routed.toUri(ip.getVlanTag()));
                 nic.setBroadcastUri(BroadcastDomainType.Routed.toUri(ip.getVlanTag()));
                 nic.setBroadcastType(BroadcastDomainType.Routed);
+                setRoutedRangeIpv6(nic, dc, ip, network);
             } else if (network.getBroadcastDomainType() == BroadcastDomainType.Vxlan) {
                 nic.setIsolationUri(BroadcastDomainType.Vxlan.toUri(ip.getVlanTag()));
                 nic.setBroadcastUri(BroadcastDomainType.Vxlan.toUri(ip.getVlanTag()));
@@ -175,14 +179,6 @@ protected void getIp(NicProfile nic, DataCenter dc, VirtualMachineProfile vm, Ne
         nic.setIPv4Dns2(dns.second());
 
         ipv6Service.updateNicIpv6(nic, dc, network);
-
-        // The IPv6 address itself is computed with EUI-64 from the range's subnet and the NIC's
-        // MAC (Ipv6ServiceImpl.updateNicIpv6); on a direct routed range only its form changes:
-        // a /128 with the shared link-local gateway, delivered to the systemvm via boot args.
-        if (nic.getBroadcastType() == BroadcastDomainType.Routed && nic.getIPv6Address() != null) {
-            nic.setIPv6Cidr(nic.getIPv6Address() + "/" + NetUtils.IPV6_HOST_PREFIX_LENGTH);
-            nic.setIPv6Gateway(NetUtils.getIpv6LinkLocalGateway());
-        }
     }
 
     /**
@@ -194,6 +190,32 @@ private boolean isRoutedRange(PublicIp ip) {
         return vlanTag != null && vlanTag.startsWith(BroadcastDomainType.Routed.scheme() + "://");
     }
 
+    /**
+     * IPv6 on a direct routed public range is computed with EUI-64 from the range's subnet and
+     * the NIC's MAC — the same stateless model guest NICs use (no pool, no reservation, only the
+     * result on the NIC) — and takes host-route form: a /128 with the shared link-local gateway.
+     *
+     * Deliberately not {@code ipv6Service.updateNicIpv6()}: that path is gated on the public
+     * network offering's internet protocol, and its per-network placeholder reservation would
+     * hand every SystemVM on the shared Public network the same address. Neither the gate nor
+     * the reservation has anything to decide here — the MAC makes the address unique.
+     */
+    private void setRoutedRangeIpv6(NicProfile nic, DataCenter dc, PublicIp ip, Network network) {
+        String ip6Cidr = ip.vlan() != null ? ip.vlan().getIp6Cidr() : null;
+        if (StringUtils.isBlank(ip6Cidr) || nic.getIPv6Address() != null) {
+            return;
+        }
+        IPv6Address ipv6Address = NetUtils.EUI64Address(ip6Cidr, nic.getMacAddress());
+        logger.info("Calculated IPv6 address {} using EUI-64 for direct routed public NIC {}", ipv6Address, nic);
+        nic.setIPv6Address(ipv6Address.toString());
+        nic.setIPv6Cidr(ipv6Address + "/" + NetUtils.IPV6_HOST_PREFIX_LENGTH);
+        nic.setIPv6Gateway(NetUtils.getIpv6LinkLocalGateway());
+        nic.setFormat(AddressFormat.DualStack);
+        Pair<String, String> ip6Dns = networkModel.getNetworkIp6Dns(network, dc);
+        nic.setIPv6Dns1(ip6Dns.first());
+        nic.setIPv6Dns2(ip6Dns.second());
+    }
+
     @Override
     public void updateNicProfile(NicProfile profile, Network network) {
         DataCenter dc = _dcDao.findById(network.getDataCenterId());