{ "$id": "https://ifstate.net/schema/ifstate.conf.schema.json", "$schema": "http://json-schema.org/draft-07/schema#", "title": "ifstate.conf", "description": "IfState 2.4 Configuration Schema", "type": "object", "required": [ "interfaces" ], "$defs": { "condition-vrrp": { "description": "configure depending on vrrp status", "type": "object", "required": [ "name", "type", "states" ], "additionalProperties": false, "properties": { "name": { "description": "related vrrp INSTANCE or GROUP name", "type": "string" }, "type": { "description": "failover type", "type": "string", "enum": [ "instance", "group" ] }, "states": { "description": "states at which the interface should be configured", "type": "array", "items": [ { "type": "string", "enum": [ "unknown", "fault", "backup", "master" ] } ] } } }, "ignore-fdb": { "description": "fdb entries matching this list of regex will be ignored", "type": "array", "items": { "description": "regex to match link-local addresses", "examples": [ "^33:33:", "^01:00:5e:" ], "type": "string" } }, "ignore-ipaddr": { "description": "list of ip address prefixes to be ignored", "type": "array", "items": { "oneOf": [ { "description": "ip prefix the destination matches", "type": "string", "examples": [ "2001:db8::/64" ] }, { "type": "object", "additionalProperties": false, "properties": { "prefix": { "description": "prefix that must contain the destination address", "type": "string", "examples": [ "2001:db8::/64" ] }, "dev": { "description": "regex to match the interface name", "type": "string", "examples": [ "eth0" ] }, "label": { "description": "regex to match the label value", "type": "string" }, "proto": { "type": [ "integer", "string" ], "description": "routing protocol number (`/etc/iproute2/rt_addrprotos`) to match" }, "scope": { "description": "scope (`/etc/iproute2/rt_scopes`) to match", "type": [ "integer", "string" ] } } } ] } }, "ignore-ifname": { "description": "interface names matching this list of regex will be ignored", "type": "array", "items": { "description": "regex to match interface name", "examples": [ "^br-[\\da-f]{12}", "^docker\\d+", "^lo$", "^ppp\\d+$", "^veth", "^virbr\\d+", "^vrrp\\d*\\.\\d+$" ], "type": "string" } }, "ignore-routes": { "description": "filter routes by options", "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "dev": { "type": [ "integer", "string" ] }, "onlink": { "type": "boolean" }, "proto": { "type": [ "integer", "string" ], "default": "boot" }, "realm": { "type": [ "integer", "string" ] }, "scope": { "type": [ "integer", "string" ] }, "table": { "type": [ "integer", "string" ], "default": "main" }, "to": { "type": "string" }, "via": { "type": "string" } } } }, "ignore-rules": { "description": "filter rules by options", "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "action": { "type": [ "integer", "string" ], "description": "the type of this rule", "enum": [ "to_tbl", "blackhole", "unreachable", "prohibit" ], "default": "to_tbl" }, "table": { "type": [ "integer", "string" ], "minimum": 0, "maximum": 4294967295 }, "priority": { "type": "integer", "description": "the priority of this rule", "minimum": 0, "maximum": 4294967295 }, "from": { "type": "string", "description": "select the source prefix to match" }, "to": { "type": "string", "description": "select the destination prefix to match" }, "iif": { "type": "string", "description": "select the incoming device to match" }, "oif": { "type": "string", "description": "select the outgoing device to match" }, "proto": { "type": [ "integer", "string" ], "default": "unspec", "description": "routing protocol number (`/etc/iproute2/rt_protos`)" }, "fwmark": { "type": "integer", "description": "select the *fwmark* value to match" }, "ipproto": { "type": [ "integer", "string" ], "description": "select the ip protocol to match" } } } }, "iface-name": { "type": "string", "pattern": "^[^/ ]{1,15}$" }, "iface-ethtool": { "description": "network driver and hardware settings via [ethtool(8)](https://man7.org/linux/man-pages/man8/ethtool.8.html)", "type": "object", "additionalProperties": false, "properties": { "pause": { "type": "object", "additionalProperties": false, "description": "pause parameters", "properties": { "autoneg": { "description": "enable pause autonegotiation", "$ref": "#/$defs/iface-ethtool_onoff" }, "rx": { "description": "enable Rx pause", "$ref": "#/$defs/iface-ethtool_onoff" }, "tx": { "description": "enable Tx pause", "$ref": "#/$defs/iface-ethtool_onoff" } } }, "coalesce": { "type": "object", "additionalProperties": false, "description": "interrupt coalescing", "properties": { "adaptive-rx": { "$ref": "#/$defs/iface-ethtool_onoff" }, "adaptive-tx": { "$ref": "#/$defs/iface-ethtool_onoff" }, "rx-usecs": { "type": "integer" }, "rx-frames": { "type": "integer" }, "rx-usecs-irq": { "type": "integer" }, "rx-frames-irq": { "type": "integer" }, "tx-usecs": { "type": "integer" }, "tx-frames": { "type": "integer" }, "tx-usecs-irq": { "type": "integer" }, "tx-frames-irq": { "type": "integer" }, "stats-block-usecs": { "type": "integer" }, "pkt-rate-low": { "type": "integer" }, "rx-usecs-low": { "type": "integer" }, "rx-frames-low": { "type": "integer" }, "tx-usecs-low": { "type": "integer" }, "tx-frames-low": { "type": "integer" }, "pkt-rate-high": { "type": "integer" }, "rx-usecs-high": { "type": "integer" }, "rx-frames-high": { "type": "integer" }, "tx-usecs-high": { "type": "integer" }, "tx-frames-high": { "type": "integer" }, "sample-interval": { "type": "integer" } } }, "ring": { "type": "object", "additionalProperties": false, "description": "rx/tx ring parameters", "properties": { "rx": { "description": "number of ring entries for the Rx ring", "type": "integer" }, "rx-mmini": { "description": "number of ring entries for the Rx Mini ring", "type": "integer" }, "rx-jumbo": { "description": "number of ring entries for the Rx Jumbo ring", "type": "integer" }, "tx": { "description": "number of ring entries for the Tx ring", "type": "integer" } } }, "features": { "type": "object", "additionalProperties": false, "description": "offload parameters and other features", "properties": { "esp-hw-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads IPsec ESP encryption and decryption to the NIC, reducing CPU load for encrypted traffic" }, "esp-tx-csum-hw-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads checksum computation for IPsec ESP transmit packets to the NIC hardware" }, "highdma": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Allows the NIC to DMA directly to high memory, avoiding costly bounce buffering on 32-bit systems" }, "hsr-dup-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads duplication of outgoing HSR or PRP frames to the NIC hardware to save CPU cycles" }, "hsr-fwd-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Delegates forwarding of redundancy frames between HSR ring ports to hardware, reducing CPU load" }, "hsr-tag-ins-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads insertion of HSR or PRP redundancy tags onto outgoing frames to save CPU" }, "hsr-tag-rm-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Removes HSR or PRP redundancy tags from received frames in hardware, reducing CPU load" }, "hw-tc-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads traffic control classifiers and actions to hardware, reducing CPU load for packet processing" }, "l2-fwd-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads unicast packet forwarding between physical and virtual interfaces to hardware" }, "loopback": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Transmits packets to the internal receive path so the NIC retains them without sending onto the physical link" }, "macsec-hw-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads MACsec encryption and authentication to the NIC hardware to reduce CPU load" }, "rx-all": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Receives all frames including errored ones, useful for sniffing links with bad packets" }, "rx-checksum": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads incoming TCP and UDP checksum verification to the NIC, reducing CPU load" }, "rx-fcs": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Appends the Ethernet frame checksum to received packets for inspection by packet analyzers" }, "rx-gro": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Merges packets from the same flow into a single larger buffer to reduce receive-side CPU load" }, "rx-gro-hw": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads GRO packet coalescing to NIC hardware to reduce CPU load" }, "rx-gro-list": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Chains forwarded TCP packets in frag lists during GRO to bypass coalesce-resegment CPU on router paths" }, "rx-hashing": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Computes a hash of packet headers to steer received flows across multiple queues and CPUs" }, "rx-lro": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Coalesces incoming TCP packets into larger buffers to reduce CPU load; disable on router or bridge interfaces" }, "rx-ntuple-filter": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Directs matching packets to specific receive queues using programmable hardware flow filters" }, "rx-udp-gro-forwarding": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Coalesces incoming UDP packets into larger buffers on the forwarding path to reduce per-packet CPU load" }, "rx-udp_tunnel-port-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Programs the NIC to recognize UDP encapsulation ports for hardware tunnel offload" }, "rx-vlan-filter": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads VLAN ID filtering to the NIC so packets for unregistered VLANs are dropped in hardware" }, "rx-vlan-hw-parse": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Lets the NIC strip VLAN tags from received packets and pass tag metadata to the kernel, reducing CPU load" }, "rx-vlan-stag-filter": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Filters incoming packets by S-tag (service VLAN) ID so unregistered frames are dropped in hardware" }, "rx-vlan-stag-hw-parse": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Enables the NIC to parse and strip incoming 802.1ad service VLAN tags in hardware, saving CPU on double-tagged traffic" }, "tls-hw-record": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Delegates TLS record encryption and TCP connection management to the NIC, bypassing the kernel stack for that socket" }, "tls-hw-rx-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads TLS record decryption and authentication to the NIC, reducing CPU load on receiving encrypted traffic" }, "tls-hw-tx-offload": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads TLS record encryption to the NIC to reduce CPU usage on outbound connections" }, "tx-checksum-fcoe-crc": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads FCoE CRC32c checksum computation to the NIC, reducing CPU load on transmit" }, "tx-checksum-ip-generic": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads transport-layer checksum calculation to the NIC for all protocols and encapsulations" }, "tx-checksum-ipv4": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads TCP and UDP checksum computation for outgoing IPv4 packets to the NIC hardware" }, "tx-checksum-ipv6": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads TCP and UDP checksum calculation for IPv6 packets to the NIC hardware, reducing CPU load per transmitted packet" }, "tx-checksum-sctp": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads CRC32c checksum computation for outgoing SCTP packets to the NIC hardware" }, "tx-esp-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments large IPsec ESP packets into MTU-sized frames to reduce CPU load on encrypted tunnels" }, "tx-fcoe-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments large Fibre Channel frames in hardware to reduce CPU load for FCoE storage traffic" }, "tx-generic-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments oversized network packets into MTU-sized chunks in software as a fallback for hardware offloads" }, "tx-gre-csum-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments large TCP packets inside GRE tunnels with an outer checksum, offloading segmentation to the NIC" }, "tx-gre-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads segmentation of large TCP packets tunneled inside GRE to the NIC" }, "tx-gso-list": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments chained sub-packet buffers via GSO to reduce CPU load for SCTP traffic" }, "tx-gso-partial": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Enables hardware segmentation of inner TCP payload in tunneled packets to reduce CPU load" }, "tx-gso-robust": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Recalculates segmentation metadata for GSO packets from untrusted sources" }, "tx-ipxip4-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads segmentation of large TCP packets tunneled over IPv4, reducing CPU load on tunnel endpoints" }, "tx-ipxip6-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads segmentation of large TCP packets tunneled over IPv6, reducing CPU load on tunnel endpoints" }, "tx-nocache-copy": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Uses cache-bypassing stores when copying transmit data from user space to reduce CPU cache pollution" }, "tx-scatter-gather": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Allows the NIC to read packet data from discontiguous memory, reducing CPU load from copying" }, "tx-scatter-gather-fraglist": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Lets the NIC DMA from a list of chained skbs instead of a single buffer with page fragments" }, "tx-sctp-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments large SCTP messages into MTU-sized chunks to reduce per-packet CPU load" }, "tx-tcp-accecn-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Permits TSO for Accurate ECN flows where CWR carries feedback instead of being cleared per segment" }, "tx-tcp-ecn-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments ECN-marked TCP packets in hardware for CPU savings; disable if NIC corrupts CWR flags" }, "tx-tcp-mangleid-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Permits the NIC to reuse or arbitrarily assign IPv4 IDs across TSO segments, enabling hardware segmentation for tunneled TCP flows" }, "tx-tcp-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Lets the NIC split large TCP sends into MTU-sized segments to reduce CPU load" }, "tx-tcp6-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Lets the NIC split large TCPv6 segments into MSS-sized frames to reduce per-packet CPU load" }, "tx-tunnel-remcsum-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Defers inner checksum verification to the remote endpoint when segmenting tunneled packets to reduce CPU load" }, "tx-udp-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Segments large UDP datagrams into MTU-sized packets in hardware to reduce CPU load" }, "tx-udp_tnl-csum-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads segmentation of large tunneled TCP packets and outer UDP checksum computation to the NIC" }, "tx-udp_tnl-segmentation": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads segmentation of oversized TCP packets inside UDP tunnels to NIC hardware, reducing CPU load" }, "tx-vlan-hw-insert": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads 802.1Q VLAN tag insertion to the NIC hardware, reducing CPU load on outgoing tagged traffic" }, "tx-vlan-stag-hw-insert": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Offloads 802.1ad service VLAN tag insertion to the NIC hardware, reducing CPU load on outgoing Q-in-Q traffic" }, "vlan-challenged": { "$ref": "#/$defs/iface-ethtool_onoff", "description": "Indicates the device hardware cannot process 802.1Q VLAN-tagged packets" } } }, "change": { "type": "object", "additionalProperties": false, "description": "device settings", "properties": { "speed": { "description": "speed in Mbps", "type": "integer" }, "duplex": { "description": "full or half duplex mode", "type": "string", "enum": [ "half", "full" ] }, "port": { "description": "device port selection", "type": "string", "enum": [ "tp", "aui", "bnc", "mii" ] }, "mdix": { "description": "MDI-X mode for port", "type": [ "boolean", "string" ], "enum": [ "auto", "on", "off", true, false ] }, "autoneg": { "description": "enable autonegotation", "$ref": "#/$defs/iface-ethtool_onoff" }, "advertise": { "description": "speed and duplex advertised by autonegotation", "type": "integer" }, "phyad": { "description": "PHY address", "type": "integer" }, "xcvr": { "description": "transceiver type", "type": "string", "enum": [ "internal", "external" ] }, "wol": { "description": "Wake-on-LAN options", "type": "string", "pattern": "^[pumbagsfd]+$" }, "sopass": { "description": "SecureOn\u2122 password", "type": "string", "pattern": "^[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}$" }, "msglvl": { "description": "driver message flags", "oneOf": [ { "description": "driver message flags by number", "type": "integer" }, { "description": "driver message flags by name", "type": "array", "items": [ { "description": "flag name", "type": "string", "enum": [ "drv", "probe", "link", "timer", "ifdown", "ifup", "rx_err", "tx_err", "tx_queued", "intr", "tx_done", "rx_status", "pktdata", "hw", "wol" ] }, { "description": "enable flag", "$ref": "#/$defs/iface-ethtool_onoff" } ] } ] } } }, "channels": { "type": "object", "additionalProperties": false, "description": "number of channels", "properties": { "rx": { "description": "number of channels with only receive queues", "type": "integer" }, "tx": { "description": "number of channels with only transmit queues", "type": "integer" }, "other": { "description": "number of channels used only for other purposes", "type": "integer" }, "combined": { "description": "number of multi-purpose channels", "type": "integer" } } }, "eee": { "type": "object", "additionalProperties": false, "description": "Energy-Efficient Ethernet (according to the IEEE 802.3az specifications)", "properties": { "eee": { "description": "enable EEE support", "$ref": "#/$defs/iface-ethtool_onoff" }, "tx-lpi": { "description": "assert Tx LPI", "$ref": "#/$defs/iface-ethtool_onoff" }, "advertise": { "description": "sets the speed for which EEE should be enabled (see also `change.advertise`)", "type": "integer" }, "tx-timer": { "description": "amount of idle time prior asserting Tx LPI (in microseconds)", "type": "integer" } } }, "phy-tunable": { "type": "object", "additionalProperties": false, "description": "PHY tunable parameters", "properties": { "downshift": { "description": "enable downshift", "oneOf": [ { "description": "enable downshift", "$ref": "#/$defs/iface-ethtool_onoff" }, { "type": "array", "minItems": 3, "maxItems": 3, "items": [ { "description": "enable downshift", "$ref": "#/$defs/iface-ethtool_onoff" }, { "description": "*REQUIRED*", "type": "string", "enum": [ "count" ] }, { "description": "PHY downshift re-tries count", "type": "integer" } ] } ] }, "fast-link-down": { "description": "enable Fast Link Down", "oneOf": [ { "description": "enable Fast Link Down", "$ref": "#/$defs/iface-ethtool_onoff" }, { "type": "array", "minItems": 3, "maxItems": 3, "items": [ { "description": "enable Fast Link Down", "$ref": "#/$defs/iface-ethtool_onoff" }, { "description": "*REQUIRED*", "type": "string", "enum": [ "msec" ] }, { "description": "period after which the link is reported as down", "type": "integer" } ] } ] }, "energy-detect-power-down": { "description": "enable Energy Detect Power Down (EDPD)", "oneOf": [ { "description": "enable EDPD", "$ref": "#/$defs/iface-ethtool_onoff" }, { "type": "array", "minItems": 3, "maxItems": 3, "items": [ { "description": "enable EDPD", "$ref": "#/$defs/iface-ethtool_onoff" }, { "description": "*REQUIRED*", "type": "string", "enum": [ "msec" ] }, { "description": "wake-up interval for Tx pulses", "type": "integer" } ] } ] } } }, "priv-flags": { "type": "object", "description": "private flags" }, "fec": { "type": "object", "additionalProperties": false, "description": "Forward Error Correction", "properties": { "encoding": { "description": "FEC encoding", "type": [ "string", "array" ], "enum": [ "auto", "off", "RS", "BaseR", "LLRS" ], "items": { "type": "string", "enum": [ "auto", "RS", "BaseR", "LLRS" ] } } } } } }, "iface-link_address": { "type": "string", "description": "link mac address (xx:xx:xx:xx:xx:xx)", "pattern": "^([a-fA-F0-9]{2}([:-]?)([a-fA-F0-9]{2}\\2){4}[a-fA-F0-9]{2}|[a-fA-F0-9]{4}\\.[a-fA-F0-9]{4}\\.[a-fA-F0-9]{4})$" }, "iface-link_bind-netns": { "type": [ "string", "null" ], "description": "specifies the netns name or null where the tunnel or underlay should be bind, if not set the binding will happen in the netns namespace of the link" }, "iface-link_group": { "type": [ "integer", "string" ], "description": "specifies a device group name or index" }, "iface-link_link": { "type": [ "integer", "string" ], "description": "specifies the base link name or index" }, "iface-link_link-netns": { "type": [ "string", "null" ], "description": "specifies the base link's netns name or null if the link isn't in a netns namespace" }, "iface-link_master": { "type": [ "integer", "string", "null" ], "description": "specifies a master device name or index, use *null* to remove the master" }, "iface-link_master-netns": { "type": [ "string", "null" ], "description": "specifies the master's netns name or null if the master isn't in a netns namespace" }, "iface-link_mtu": { "type": "integer", "description": "change the mtu of the device", "minimum": 68, "maximum": 65536 }, "iface-link_state": { "type": "string", "description": "set device state", "enum": [ "up", "down" ] }, "iface-link_txqlen": { "type": "integer", "description": "the transmit queue length of the device" }, "iface-link_ifalias": { "type": [ "null", "string" ], "description": "symbolic name for easy reference" }, "iface-link_tun-remote4": { "type": "string", "description": "remote IPv4 address of the tunnel", "format": "ipv4" }, "iface-link_tun-local4": { "type": "string", "description": "local IPv4 address of the tunnel", "format": "ipv4" }, "iface-link_tun-remote6": { "type": "string", "description": "remote IPv4 address of the tunnel", "format": "ipv6" }, "iface-link_tun-local6": { "type": "string", "description": "local IPv4 address of the tunnel", "format": "ipv6" }, "iface-link_tun-dev": { "$ref": "#/$defs/iface-link_link", "description": "interface to use for tunnel endpoint communication" }, "iface-sysctl-ipv4": { "type": "object", "description": "settings in `/proc/sys/net/ipv4//conf/`", "properties": { "accept_local": { "type": "integer" }, "accept_redirects": { "type": "integer" }, "accept_source_route": { "type": "integer" }, "arp_accept": { "type": "integer" }, "arp_announce": { "type": "integer" }, "arp_filter": { "type": "integer" }, "arp_ignore": { "type": "integer" }, "arp_notify": { "type": "integer" }, "bc_forwarding": { "type": "integer" }, "bootp_relay": { "type": "integer" }, "disable_policy": { "type": "integer" }, "disable_xfrm": { "type": "integer" }, "drop_gratuitous_arp": { "type": "integer" }, "drop_unicast_in_l2_multicast": { "type": "integer" }, "force_igmp_version": { "type": "integer" }, "forwarding": { "type": "integer" }, "igmpv2_unsolicited_report_interval": { "type": "integer" }, "igmpv3_unsolicited_report_interval": { "type": "integer" }, "ignore_routes_with_linkdown": { "type": "integer" }, "log_martians": { "type": "integer" }, "mc_forwarding": { "type": "integer" }, "medium_id": { "type": "integer" }, "promote_secondaries": { "type": "integer" }, "proxy_arp": { "type": "integer" }, "proxy_arp_pvlan": { "type": "integer" }, "route_localnet": { "type": "integer" }, "rp_filter": { "type": "integer" }, "secure_redirects": { "type": "integer" }, "send_redirects": { "type": "integer" }, "shared_media": { "type": "integer" }, "src_valid_mark": { "type": "integer" }, "tag": { "type": "integer" } } }, "iface-sysctl-ipv6": { "type": "object", "description": "settings in `/proc/sys/net/ipv6//conf/`", "additionalProperties": false, "properties": { "accept_dad": { "type": "integer" }, "accept_ra": { "type": "integer" }, "accept_ra_defrtr": { "type": "integer" }, "accept_ra_from_local": { "type": "integer" }, "accept_ra_min_hop_limit": { "type": "integer" }, "accept_ra_mtu": { "type": "integer" }, "accept_ra_pinfo": { "type": "integer" }, "accept_ra_rt_info_max_plen": { "type": "integer" }, "accept_ra_rt_info_min_plen": { "type": "integer" }, "accept_ra_rtr_pref": { "type": "integer" }, "accept_redirects": { "type": "integer" }, "accept_source_route": { "type": "integer" }, "addr_gen_mode": { "type": "integer" }, "autoconf": { "type": "integer" }, "dad_transmits": { "type": "integer" }, "disable_ipv6": { "type": "integer" }, "disable_policy": { "type": "integer" }, "drop_unicast_in_l2_multicast": { "type": "integer" }, "drop_unsolicited_na": { "type": "integer" }, "enhanced_dad": { "type": "integer" }, "force_mld_version": { "type": "integer" }, "force_tllao": { "type": "integer" }, "forwarding": { "type": "integer" }, "hop_limit": { "type": "integer" }, "ignore_routes_with_linkdown": { "type": "integer" }, "keep_addr_on_down": { "type": "integer" }, "max_addresses": { "type": "integer" }, "max_desync_factor": { "type": "integer" }, "mc_forwarding": { "type": "integer" }, "mldv1_unsolicited_report_interval": { "type": "integer" }, "mldv2_unsolicited_report_interval": { "type": "integer" }, "mtu": { "type": "integer" }, "ndisc_notify": { "type": "integer" }, "ndisc_tclass": { "type": "integer" }, "optimistic_dad": { "description": "perform Optimistic Duplicate Address Detection (RFC 4429); *This option is enabled by default in ifstate!*", "type": "integer" }, "proxy_ndp": { "type": "integer" }, "regen_max_retry": { "type": "integer" }, "router_probe_interval": { "type": "integer" }, "router_solicitation_delay": { "type": "integer" }, "router_solicitation_interval": { "type": "integer" }, "router_solicitation_max_interval": { "type": "integer" }, "router_solicitations": { "type": "integer" }, "seg6_enabled": { "type": "integer" }, "seg6_require_hmac": { "type": "integer" }, "stable_secret": { "type": "string", "format": "ipv6" }, "suppress_frag_ndisc": { "type": "integer" }, "temp_prefered_lft": { "type": "integer" }, "temp_valid_lft": { "type": "integer" }, "use_oif_addrs_only": { "type": "integer" }, "use_optimistic": { "type": "integer" }, "use_tempaddr": { "type": "integer" } } }, "iface-sysctl-mpls": { "description": "MPLS [sysctl settings](https://www.kernel.org/doc/Documentation/networking/mpls-sysctl.txt) in `/proc/sys/net/mpls/`", "type": "object", "additionalProperties": false, "properties": { "platform_labels": { "type": "integer", "description": "number of entries in the platform label table", "minimum": 0, "maximum": 1048575 }, "ip_ttl_propagate": { "type": "integer", "description": "control whether TTL is propagated", "minimum": 0, "maximum": 1 }, "default_ttl": { "type": "integer", "description": "default TTL value to use for MPLS packets", "minimum": 1, "maximum": 255 } } }, "iface-sysctl-mpls-link": { "description": "MPLS [interface sysctl settings](https://www.kernel.org/doc/Documentation/networking/mpls-sysctl.txt) in `/proc/sys/net/mpls//`", "type": "object", "additionalProperties": false, "properties": { "input": { "type": "integer", "description": "control whether packets can be input on this interface", "minimum": 0, "maximum": 1 } } }, "iface-sysctl-mptcp": { "description": "Multipath TCP [sysctl settings](https://www.kernel.org/doc/Documentation/networking/mptcp-sysctl.rst) in `/proc/sys/net/mptcp/`", "type": "object", "additionalProperties": false, "properties": { "add_addr_timeout": { "type": "integer", "default": 120, "description": "timeout in seconds after which an ADD_ADDR control message will be resent", "minimum": -8589934, "maximum": 8589934 }, "allow_join_initial_addr_port": { "type": "boolean", "default": true, "description": "allow peers to send join requests to the IP address and port number used by the initial subflow" }, "blackhole_timeout": { "type": "integer", "default": 3600, "description": "initial time period in second to disable MPTCP on active MPTCP sockets when a MPTCP firewall blackhole issue happens", "minimum": 0, "maximum": 2147483647 }, "checksum_enabled": { "type": "boolean", "default": false, "description": "control whether DSS checksum can be enabled" }, "close_timeout": { "type": "integer", "default": 60, "description": "set the make-after-break timeout", "minimum": -8589934, "maximum": 8589934 }, "enabled": { "type": "boolean", "default": true, "description": "control whether MPTCP sockets can be created" }, "path_manager": { "type": "string", "default": "kernel", "description": "control whether MPTCP sockets can be created", "enum": [ "kernel", "userspace" ] }, "pm_type": { "type": "integer", "description": "set the default path manager type to use for each new MPTCP socket", "enum": [ 0, 1 ], "deprecated": true }, "scheduler": { "type": "string", "default": "default", "description": "select the scheduler of your choice" }, "stale_loss_cnt": { "type": "integer", "default": 4, "description": "number of MPTCP-level retransmission intervals with no traffic and pending outstanding data on a given subflow required to declare it stale", "minimum": 0, "maximum": 4294967295 }, "syn_retrans_before_tcp_fallback": { "type": "integer", "default": 2, "description": "number of SYN + MP_CAPABLE retransmissions before falling back to TCP", "minimum": 0 } } }, "iface-ethtool_onoff": { "type": [ "boolean", "string" ], "enum": [ "on", "off", true, false ] }, "iface-tc_qid": { "type": "string", "description": "qdisc id", "format": "^(root|[0-9a-f]+:[0-9a-f]*)$" }, "iface-tc_protocol": { "type": [ "string", "integer" ], "description": "protocol selector", "minLength": 2, "minimum": 0, "maximum": 255, "default": 3 }, "iface-tc_prio": { "type": "integer", "description": "priority", "minimum": 0, "maximum": 65535 }, "iface-tc_qdisc": { "description": "traffic control queueing discipline", "type": "object", "required": [ "handle" ], "properties": { "handle": { "description": "unique id", "$ref": "#/$defs/iface-tc_qid" } }, "oneOf": [ { "description": "generic classless qdisc", "required": [ "kind" ], "properties": { "kind": { "type": "string", "description": "qdisk type", "enum": [ "gred", "hhf", "mqprio", "multiq", "netem", "pfifo_fast", "pie", "red", "sfb", "sfq", "tbf" ] } } }, { "$ref": "#/$defs/tc-cake" }, { "description": "[choke](https://man7.org/linux/man-pages/man8/tc-choke.8.html) - choose and keep scheduler", "required": [ "kind", "limit", "min", "max", "avpkt", "burst", "probability" ], "properties": { "kind": { "const": "choke", "description": "qdisk type" } } }, { "description": "[CoDel](https://man7.org/linux/man-pages/man8/tc-codel.8.html) - Controlled-Delay Active Queue Management algorithm", "required": [ "kind" ], "properties": { "kind": { "const": "codel", "description": "qdisk type" } } }, { "description": "[bfifo](https://man7.org/linux/man-pages/man8/tc-bfifo.8.html) - Byte limited First In, First Out queue; [pfifo](https://man7.org/linux/man-pages/man8/tc-pfifo.8.html) - Packet limited First In, First Out queue", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "qdisk type", "enum": [ "bfifo", "pfifo" ] }, "limit": { "type": "number", "description": "queue size in bytes or packets" } } }, { "description": "[fq](https://man7.org/linux/man-pages/man8/tc-fq.8.html) - Fair Queue traffic policing", "required": [ "kind" ], "properties": { "kind": { "const": "fq", "description": "qdisk type" }, "limit": { "type": "number", "description": "hard limit on the real queue size (number of packets)" }, "flow_limit": { "type": "number", "description": "hard limit on the max number of packets per flow" } } }, { "description": "[fq_codel](https://man7.org/linux/man-pages/man8/tc-fq_codel.8.html) - Fair Queuing (FQ) with Controlled Delay (CoDel)", "required": [ "kind" ], "properties": { "kind": { "const": "fq_codel", "description": "qdisk type" }, "limit": { "type": "number", "description": "hard limit on the real queue size (number of packets)" }, "flows": { "type": "number", "description": "number of flows" } } }, { "description": "generic classful qdisc", "required": [ "kind" ], "properties": { "kind": { "type": "string", "description": "qdisk type", "enum": [ "atm", "cbq", "drr", "dsmark", "hfsc", "htb", "prio", "qfq" ] } } }, { "description": "classful multiqueue dummy scheduler", "required": [ "kind", "children" ], "properties": { "kind": { "const": "mq", "description": "qdisk type" }, "children": { "description": "list child qdiscs for each device TX queue", "type": "array", "items": { "description": "child qdiscs for the nth device TX queue", "$ref": "#/$defs/iface-tc_qdisc" } } } } ] }, "tc-cake": { "description": "[cake](https://man7.org/linux/man-pages/man8/tc-cake.8.html) - common applications kept enhanced (CAKE)", "required": [ "kind" ], "properties": { "kind": { "const": "cake", "description": "qdisk type" }, "handle": { "description": "unique id", "$ref": "#/$defs/iface-tc_qid" }, "ack_filter": { "description": "ACKnowledge filter", "type": [ "boolean", "string" ], "enum": [ "aggressive", true, false ] }, "atm_mode": { "description": "ATM mode", "type": [ "boolean", "string" ], "enum": [ "ptm", true, false ] }, "autorate": { "type": "boolean", "description": "autorate-ingress" }, "diffserv_mode": { "type": "string", "description": "diffserv mode", "enum": [ "diffserv3", "diffserv4", "diffserv8", "besteffort", "precedence" ] }, "ingress": { "description": "ingress", "type": "boolean" }, "overhead": { "description": "overhead", "type": "integer", "minimum": -64, "maximum": 256 }, "flow_mode": { "description": "flow mode", "type": "string", "enum": [ "flowblind", "srchost", "dsthost", "hosts", "flows", "dual-srchost", "dual-dsthost", "triple-isolated" ] }, "fwmark": { "description": "fwmark", "type": "integer", "minimum": 0 }, "memlimit": { "description": "memlimit", "type": "integer", "minimum": 0 }, "mpu": { "description": "MPU", "type": "integer", "minimum": 0, "maximum": 256 }, "nat": { "description": "NAT", "type": "boolean" }, "raw": { "description": "RAW", "type": "boolean" }, "rtt": { "oneOf": [ { "type": "string", "description": "well-known RTT", "enum": [ "datacentre", "lan", "metro", "regional", "internet", "oceanic", "satellite", "interplanetary" ] }, { "type": "integer", "description": "manually specify an RTT (us)", "minimum": 1 } ] }, "split_gso": { "description": "split GSO", "type": "boolean" }, "target": { "type": "integer", "description": "target", "minimum": 1 }, "wash": { "description": "wash", "type": "boolean" } } }, "iface-tc_action": { "description": "traffic control filter action", "type": "array", "items": { "type": "object", "required": [ "kind" ], "properties": { "kind": { "type": "string", "enum": [ "mirred", "vlan" ] } }, "oneOf": [ { "description": "[mirred](https://man7.org/linux/man-pages/man8/tc-mirred.8.html) - mirror/redirect action", "additionalProperties": false, "required": [ "direction", "action", "dev" ], "properties": { "kind": { "const": "mirred" }, "direction": { "description": "packet direction", "type": "string", "enum": [ "ingress", "egress" ] }, "action": { "description": "copy (`mirror`) or move (`redirect`) packets to the destination interface", "type": "string", "enum": [ "mirror", "redirect" ] }, "dev": { "description": "destination interface where packets are redirected or mirrored to", "$ref": "#/$defs/iface-link_link" }, "index": { "description": "unique action ID", "type": "integer", "minimum": 0, "maximum": 4294967295 } } }, { "description": "[vlan](https://man7.org/linux/man-pages/man8/tc-vlan.8.html) - vlan manipulation module", "additionalProperties": false, "required": [ "v_action" ], "properties": { "kind": { "const": "vlan" }, "v_action": { "type": "string", "enum": [ "pop", "push", "modify" ] }, "action": { "type": "string", "enum": [ "unspec", "ok", "reclassify", "shot", "drop", "pipe" ] }, "id": { "description": "VLAN id", "type": "integer", "minimum": 0, "maximum": 4095 }, "priority": { "description": "VLAN priority", "type": "integer", "minimum": 0, "maximum": 7 }, "protocol": { "type": "string", "enum": [ "802.1Q", "802.1ad" ] } } } ] } }, "mac_seed": { "oneOf": [ { "description": "The `mac_seed` is used to assign reproducible MAC addresses to virtual interfaces. The default `mac_seed` is based on the host's `machine-id` and the network namespace of the interface. Interfaces with identical names and `mac_seed` gets the same MAC addresses.", "type": "string", "minLength": 1 }, { "description": "Do not handle MAC addresses for virtual interfaces. If an interfaces has no `link.address` property, it will get a random MAC addresses assigned by the Linux kernel.", "type": "null" } ] }, "xdp_mode": { "mode": { "oneOf": [ { "description": "force attach mode of the XDP program (`auto`: let the kernel choose, `xdp`: run inside driver, `xdpgeneric`: driver-independent before SKB allocation, `xdpoffload`: offload to SmartNIC co-processor)", "type": "string", "enum": [ "auto", "xdp", "xdpgeneric", "xdpoffload" ], "default": "auto" }, { "description": "allowed attach modes of the XDP program (`xdp`: run inside driver, `xdpgeneric`: driver-independent before SKB allocation, `xdpoffload`: offload to SmartNIC co-processor)", "type": "array", "items": { "type": "string", "enum": [ "xdp", "xdpgeneric", "xdpoffload" ] } } ] } } }, "additionalProperties": false, "properties": { "parameters": { "description": "adjust the implicit behaviour of ifstate", "type": "object", "additionalProperties": false, "properties": { "cshaper": { "description": "cshaper templates", "type": "object", "patternProperties": { "": { "description": "cshaper profile", "type": "object", "additionalProperties": false, "required": [ "egress_qdisc", "ingress_qdisc", "ingress_ifname" ], "properties": { "egress_qdisc": { "$ref": "#/$defs/tc-cake" }, "ingress_qdisc": { "$ref": "#/$defs/tc-cake" }, "ingress_ifname": { "description": "build a ifb ifname using a regex on the ifname", "type": "object", "additionalProperties": false, "required": [ "search", "replace" ], "properties": { "search": { "description": "pattern to search", "type": "string" }, "replace": { "description": "replace pattern by string", "type": "string" } } } } } }, "required": [ "default" ] }, "defaults": { "description": "default settings for configured interfaces", "type": "array", "items": { "description": "first matching entry will be used, settings will be overriden by explicit configured interface settings", "type": "object", "required": [ "match" ], "additionalProperties": false, "properties": { "match": { "description": "apply default settings for interfaces matching any list item (OR)", "type": "array", "items": { "description": "all conditions that must match (AND)", "type": "object", "additionalProperties": false, "properties": { "ifname": { "description": "regex to match interface name", "examples": [ "^eth\\d+$" ], "type": "string" }, "kind": { "description": "regex to match link type", "examples": [ "^physical$", "^(physical|vlan)$" ], "type": "string" } } } }, "clear_addresses": { "description": "implicit remove all ip addresses", "type": "boolean", "default": false }, "clear_fdb": { "description": "implicit remove all permanent fdb entries", "type": "boolean", "default": false }, "clear_neighbours": { "description": "implicit remove all permanent ip neighbours", "type": "boolean", "default": false }, "clear_tc": { "description": "implicit remove all tc qdiscs", "type": "boolean", "default": false }, "ethtool": { "$ref": "#/$defs/iface-ethtool" }, "link": { "description": "implicit link settings for matching interfaces", "type": "object", "additionalProperties": false, "properties": { "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "link": { "$ref": "#/$defs/iface-link_link" }, "link_netns": { "$ref": "#/$defs/iface-link_link-netns" } } } } } }, "defaults_builtin": { "$ref": "#/properties/parameters/properties/defaults" }, "hooks": { "description": "hooks are executed on interface configuration and can be used to spawn commands like DHCP client, wpa_supplicant or pppd.", "type": "object", "patternProperties": { "": { "description": "hook properties", "type": "object", "additionalProperties": false, "properties": { "script": { "description": "filename to be executed on interface configuration: the hook name will be used by default; relatives file are based on `/etc/ifstate/hooks`", "type": "string", "minLength": 1 }, "vrrp": { "description": "specify if the activation of this hook should follow the vrrp state for interfaces with a vrrp constraint", "type": "string", "enum": [ "follow", "ignore" ], "default": "follow" }, "provides": { "description": "aliases for dependency tracking", "type": "array", "default": [] }, "after": { "description": "hooks which should to be run before executing this script (hook names and provides)", "type": "array", "default": [] } } } } }, "ignore": { "description": "ignore patterns to skip interface, ip address or routing objects", "type": "object", "additionalProperties": false, "properties": { "ipaddr_builtin": { "$ref": "#/$defs/ignore-ipaddr" }, "ipaddr": { "$ref": "#/$defs/ignore-ipaddr" }, "ipaddr_dynamic": { "description": "ignore dynamic assigned ip addresses", "type": "boolean", "default": true }, "ifname_builtin": { "$ref": "#/$defs/ignore-ifname" }, "ifname": { "$ref": "#/$defs/ignore-ifname" }, "fdb_builtin": { "$ref": "#/$defs/ignore-fdb" }, "fdb": { "$ref": "#/$defs/ignore-fdb" }, "routes_builtin": { "$ref": "#/$defs/ignore-routes" }, "routes": { "$ref": "#/$defs/ignore-routes" }, "rules_builtin": { "$ref": "#/$defs/ignore-rules" }, "rules": { "$ref": "#/$defs/ignore-rules" }, "netns": { "description": "netns namespaces matching this list of regex will be ignored", "type": "array", "items": { "description": "regex to match interface name", "examples": [ "^tenant-\\d+" ], "type": "string" } } } }, "machine_id": { "description": "Use this [machine-id](https://www.freedesktop.org/software/systemd/man/latest/machine-id.html) instead of the value from `/etc/machine-id` or `/var/lib/dbus/machine-id`.", "type": "string", "minLength": 1 } } }, "bpf": { "description": "load and pin eBPF programs (i.e. for XDP)", "type": "object", "patternProperties": { "": { "description": "BPF program", "type": "object", "additionalProperties": false, "required": [ "object", "section" ], "properties": { "object": { "description": "BPF ELF file to load", "type": "string" }, "section": { "description": "BPF program's section name", "type": "string" } } } } }, "interfaces": { "description": "dictionary of interfaces related settings, the name of the interface needs to be specified as key", "type": "object", "additionalProperties": false, "patternProperties": { "^[^/ ]{1,15}$": { "type": "object", "required": [ "link" ], "additionalProperties": false, "properties": { "identify": { "description": "netlink and devicetree attributes to identify a specific physical interface; **all** given attributes must match; if more than a single interface does match, any one is taken; `ifstatecli identify` can be used to show available attributes", "additionalProperties": false, "properties": { "perm_address": { "description": "select interface by permanent address [ethtool -P]", "$ref": "#/$defs/iface-link_address" }, "parent_dev_name": { "description": "select interface by bus info [ethtool -i]", "type": "string" }, "parent_dev_bus_name": { "description": "select interface by bus name", "type": "string" }, "phys_port_id": { "description": "identifier of the physical port", "type": "string" }, "phys_port_name": { "description": "name of the physical port", "type": "string" }, "phys_switch_id": { "description": "identifier of the physical switch", "type": "string" }, "of_node": { "description": "path to the device node in the open firmware devicetree; this is only available if the platform has devicetree support" } } }, "addresses": { "description": "ip addresses of the interface", "type": "array", "items": { "oneOf": [ { "description": "ip address with prefix length in CIDR notation", "type": "string", "examples": [ "192.0.2.1", "192.168.0.1/24", "2001:db8::1/64" ] }, { "type": "object", "additionalProperties": false, "properties": { "address": { "type": "string", "description": "ip address with prefix length in CIDR notation", "examples": [ "192.0.2.1", "192.168.0.1/24", "2001:db8::1/64" ] }, "label": { "description": "set label string", "type": "string", "maxLength": 15 }, "local": { "description": "configures the local IP address on a point-to-point link, making `address` the peer's network", "type": "string", "oneOf": [ { "format": "ipv4" }, { "format": "ipv6" } ], "examples": [ "192.0.2.1", "2001:db8::1" ] }, "proto": { "type": [ "integer", "string" ], "description": "set protocol instance (`/etc/iproute2/rt_addrprotos`)" }, "scope": { "description": "the scope (`/etc/iproute2/rt_scopes`) where the address is valid", "type": [ "integer", "string" ] } }, "required": [ "address" ] } ] } }, "token": { "description": "IPv6 tokenized interface identifier (`draft-chown-6man-tokenised-ipv6-identifiers-02`)", "type": "string", "format": "ipv6" }, "brport": { "description": "settings for bridge ports", "type": "object", "additionalProperties": false, "properties": { "priority": { "description": "set port priority", "type": "integer", "minimum": 0, "maximum": 63 }, "cost": { "description": "set port cost", "minimum": 1, "maximum": 65535 }, "guard": { "description": "filter BPDU packets", "type": "boolean" }, "mode": { "description": "enable hairpin mode", "type": "boolean" }, "fast_leave": { "description": "enable multicast fast leave", "type": "boolean" }, "protect": { "description": "prevent to become a root port", "type": "boolean" }, "learning": { "description": "allow MAC address learning", "type": "boolean" }, "unicast_flood": { "description": "flood unknown unicasts", "type": "boolean" }, "bcast_flood": { "description": "flood broadcasts", "type": "boolean" }, "mcast_flood": { "description": "flood multicasts", "type": "boolean" }, "mcast_to_ucast": { "description": "clone multicast packets into unicasts", "type": "boolean" }, "proxyarp": { "description": "enable proxy ARP", "type": "boolean" }, "proxyarp_wifi": { "description": "enable proxy ARP (IEEE 802.11 and Hotspot 2.0)", "type": "boolean" }, "neigh_suppress": { "description": "ARP and ND suppression", "type": "boolean" }, "vlan_tunnel": { "description": "VLAN to tunnel mapping", "type": "boolean" }, "backup_port": { "description": "backup bridge port on loss carrier", "$ref": "#/$defs/iface-link_link" }, "isolated": { "description": "isolated port, can communicate only with non-isolated ports", "type": "boolean" } } }, "brvlan": { "description": "bridge VLAN membership for bridge ports", "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "vid" ], "properties": { "vid": { "description": "VLAN ID", "type": "integer", "minimum": 1, "maximum": 4094 }, "pvid": { "description": "VLAN is the port VLAN ID (PVID)", "type": "boolean" }, "untagged": { "description": "egress traffic for this VLAN is sent untagged", "type": "boolean" }, "self": { "description": "VLAN entry on the bridge device itself instead of a bridge port (equivalent to `bridge vlan add ... self`)", "type": "boolean" } } } }, "fdb": { "description": "forwarding database for bridge interfaces, the entries are distinct by the `lladdr` property", "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "lladdr" ], "properties": { "lladdr": { "description": "destination link layer address", "$ref": "#/$defs/iface-link_address", "default": null }, "dst": { "description": "ip address of the destination VXLAN tunnel endpoint", "type": "string", "oneOf": [ { "format": "ipv4" }, { "format": "ipv6" } ] }, "nhid": { "description": "ecmp nexthop group for the VXLAN device driver", "type": "integer", "minimum": 1 }, "port": { "description": "destination port number to use to connect to the remote VXLAN tunnel endpoint", "type": "integer", "minimum": 0, "maximum": 65535 }, "vni": { "description": "virtual network identifier this entry belongs to", "type": "integer", "minimum": 0, "maximum": 16777215 }, "vlan": { "description": "the VLAN ID this entry belongs to", "type": "integer", "minimum": 0, "maximum": 4096 }, "flags": { "type": "array", "items": [ { "type": "string", "enum": [ "self", "master", "router", "use", "sticky" ] } ] }, "state": { "type": "array", "items": [ { "type": "string", "enum": [ "permanent", "noarp" ] } ] } } } }, "hooks": { "description": "list of hook names enabled for the interfaces", "type": "array", "items": [ { "type": "object", "additionalProperties": false, "required": [ "name" ], "properties": { "name": { "description": "name of the hook defined in [$.parameters.hooks](#parameters_hooks)`", "type": "string", "minLength": 1 }, "args": { "description": "dictonary to be passed to hooks as environment variables", "type": "object", "default": {} }, "timeout": { "description": "hook execution timeout in seconds", "type": "integer", "default": 3 } } } ], "default": [] }, "vrrp": { "$ref": "#/$defs/condition-vrrp" }, "link": { "description": "link settings of the interface", "type": "object", "required": [ "kind" ], "oneOf": [ { "description": "Intermediate Functional Block device", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "const": "ifb", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual tunnel interface IPv4|IPv6 over IPv6", "required": [ "kind" ], "properties": { "kind": { "const": "ip6tnl", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "IP over Infiniband device", "required": [ "kind" ], "properties": { "kind": { "const": "ipoib", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Interface for L3 (IPv6/IPv4) based VLANs", "required": [ "kind" ], "properties": { "kind": { "const": "ipvlan", "description": "link type" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual interface base on link layer address (MAC)", "required": [ "kind" ], "properties": { "kind": { "const": "macvlan", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual interface based on link layer address (MAC) and TAP", "required": [ "kind" ], "properties": { "kind": { "const": "macvtap", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Team network device", "required": [ "kind" ], "properties": { "kind": { "const": "team", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual software device (TUN/TAP)", "required": [ "kind", "tun_type" ], "additionalProperties": false, "properties": { "kind": { "const": "tun", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "tun_type": { "description": "device mode (Ethernet headers)", "default": "tap", "enum": [ 1, "tun", 2, "tap" ] }, "tun_pi": { "description": "provide packet information", "type": [ "boolean", "integer" ], "default": false, "enum": [ 0, false, 1, true ] }, "tun_persist": { "description": "persistent device; non-persistent devices cannot be created", "type": [ "boolean", "integer" ], "default": false, "enum": [ 0, false, 1, true ] }, "tun_vnet_hdr": { "description": "prepend frames with struct virtio_net_hdr", "default": false, "enum": [ 0, false, 1, true ] }, "tun_multi_queue": { "description": "enable multiqueue tuntap", "type": [ "boolean", "integer" ], "default": false, "enum": [ 0, false, 1, true ] }, "tun_owner": { "description": "device owner", "type": [ "integer", "string" ] }, "tun_group": { "description": "device group", "type": [ "integer", "string" ] } } }, { "description": "Virtual Routing and Forwarding device", "required": [ "kind", "vrf_table" ], "additionalProperties": false, "properties": { "kind": { "const": "vrf", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "vrf_table": { "description": "routing table associated with the VRF device", "type": [ "integer", "string" ], "minimum": 1, "maximum": 4294967295 }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual tunnel interface over IPv4", "required": [ "kind" ], "properties": { "kind": { "const": "vti", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Virtual tunnel interface over IPv6", "required": [ "kind" ], "properties": { "kind": { "const": "vti6", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Bonding network interface", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "const": "bond", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "bond_mode": { "enum": [ 0, "balance-rr", 1, "active-backup", 2, "balance-xor", 3, "broadcast", 4, "802.3ad", 5, "balance-tlb", 6, "balance-alb" ], "default": "balance-rr", "description": "the bonding policy" }, "bond_miimon": { "type": "integer", "minimum": 0, "default": 0, "description": "MII link monitoring frequency in milliseconds" }, "bond_updelay": { "type": "integer", "minimum": 0, "default": 0, "description": "time, in milliseconds, to wait before enabling a slave after a link recovery has been detected" }, "bond_downdelay": { "type": "integer", "minimum": 0, "default": 0, "description": "time, in milliseconds, to wait before disabling a slave after a link failure has been detected" }, "bond_use_carrier": { "enum": [ 0, 1 ], "default": 1, "description": "use MII or ETHTOOL ioctls vs. netif_carrier_ok() to determine the link status" }, "bond_arp_interval": { "type": "integer", "minimum": 0, "default": 0, "description": "ARP link monitoring frequency in milliseconds" }, "bond_arp_validate": { "enum": [ 0, "none", 1, "active", 2, "backup", 3, "all", 4, "filter", 5, "filter_active", 6, "filter_backup" ], "default": "none", "description": "arp validation for arp monitoring" }, "bond_arp_all_targets": { "enum": [ 0, "any", 1, "all" ], "default": "any", "description": "quantity of arp_ip_targets that must be reachable" }, "bond_primary_reselect": { "enum": [ 0, "always", 1, "better", 2, "failure" ], "default": "always", "description": "reselection policy for the primary slave" }, "bond_fail_over_mac": { "enum": [ 0, "none", 1, "active", 2, "follow" ], "default": "none", "description": "slave mac address selection" }, "bond_xmit_hash_policy": { "enum": [ 0, "layer2", 1, "layer3+4", 2, "layer2+3", 3, "encap2+3", 4, "encap3+4", 5, "vlan+srcmac" ], "default": "layer2", "description": "transmit hash policy to use for slave selection" }, "bond_resend_igmp": { "type": "integer", "minimum": 0, "maximum": 255, "default": 1, "description": "number of IGMP membership reports to be issued after a failover event" }, "bond_num_peer_notif": { "type": "integer", "minimum": 0, "default": 1 }, "bond_all_slaves_active": { "enum": [ 0, 1 ], "default": 1, "description": "dropped (0) or delivered (1) duplicate frames" }, "bond_min_links": { "type": "integer", "minimum": 0, "default": 0, "description": "number of links that must be active before asserting carrier" }, "bond_lp_interval": { "type": "integer", "minimum": 0, "maximum": 2147483647, "default": 1, "description": "number of seconds between instances where the bonding driver sends learning packets to each slaves peer switch" }, "bond_packets_per_slave": { "type": "integer", "minimum": 0, "maximum": 65535, "default": 1, "description": "number of packets to transmit through a slave before moving to the next one" }, "bond_ad_lacp_rate": { "enum": [ 0, "slow", 1, "fast" ], "default": "slow", "description": "requested LACPDU packet rate in 802.3ad mode" }, "bond_ad_select": { "enum": [ 0, "stable", 1, "bandwidth", 2, "count" ], "default": "stable", "description": "802.3ad aggregation selection logic to use" }, "bond_tlb_dynamic_lb": { "enum": [ 0, 1 ], "default": 1, "description": "dynamic shuffling of flows in tlb mode" } } }, { "description": "Bridge network interface", "required": [ "kind" ], "properties": { "kind": { "const": "bridge", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "br_ageing_time": { "type": "integer", "minimum": 0, "default": 30000, "description": "FDB entry ageing time in milliseconds" }, "br_vlan_protocol": { "enum": [ 33024, "802.1q", 34984, "802.1ad" ], "default": "802.1q", "description": "802.1q or 802.1ad (Q-in-Q)" }, "br_vlan_filtering": { "type": "boolean", "default": false, "description": "enable VLAN filtering on bridge" }, "br_vlan_stats_enabled": { "type": "boolean", "default": false, "description": "enable per-VLAN stats on bridge" }, "br_vlan_stats_per_port": { "type": "boolean", "default": false, "description": "enable per-VLAN per-port stats on bridge" }, "br_vlan_default_pvid": { "type": "integer", "minimum": 0, "maximum": 4094, "default": 1, "description": "bridge default PVID" } } }, { "description": "Distributed Switch Architecture (DSA) user interface", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "link type", "enum": [ "dsa" ] }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "link": { "$ref": "#/$defs/iface-link_link" }, "link_netns": { "$ref": "#/$defs/iface-link_link-netns" } } }, { "description": "MACSEC interface", "required": [ "kind", "link" ], "additionalProperties": false, "properties": { "kind": { "const": "macsec", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "link": { "$ref": "#/$defs/iface-link_link" }, "link_netns": { "$ref": "#/$defs/iface-link_link-netns" } } }, { "description": "Physical network interface", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "link type", "enum": [ "physical" ] }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "Dummy network interface", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "link type", "enum": [ "dummy" ] }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "oneOf": [ { "description": "VETH/VXCAN interface", "required": [ "kind", "peer" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "link type", "enum": [ "veth", "vxcan" ] }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "peer": { "$ref": "#/$defs/iface-link_link" }, "peer_netns": { "type": [ "string", "null" ], "description": "specifies the peer's netns name or null if the peer isn't in a netns namespace" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "external created VETH/VXCAN interface", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "type": "string", "description": "link type", "enum": [ "veth", "vxcan" ] }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "peer": { "type": "null" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } } ] }, { "description": "VLAN interface", "required": [ "kind", "link", "vlan_id" ], "additionalProperties": false, "properties": { "kind": { "const": "vlan", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "link": { "$ref": "#/$defs/iface-link_link" }, "link_netns": { "$ref": "#/$defs/iface-link_link-netns" }, "vlan_flags": { "type": "object", "additionalProperties": false, "properties": { "reorder_hdr": { "description": "whether ethernet headers are reordered or not", "type": "boolean", "default": true }, "gvrp": { "description": "whether this VLAN should be registered using *GARP VLAN Registration Protocol*", "type": "boolean" }, "loose_binding": { "description": "whether the VLAN device state is bound to the physical device state", "type": "boolean" }, "mvrp": { "description": "whether this VLAN should be registered using *Multiple VLAN Registration Protocol*", "type": "boolean" }, "bridge_binding": { "description": "whether the VLAN device link state tracks the state of bridge ports that are members of the VLAN", "type": "boolean" } } }, "vlan_id": { "type": [ "integer" ], "minimum": 0, "maximum": 4094, "description": "specifies the VLAN identifier to use" }, "vlan_protocol": { "enum": [ 33024, "802.1q", 34984, "802.1ad" ], "default": "802.1q", "description": "802.1q or 802.1ad (Q-in-Q)" } } }, { "description": "VXLAN interface", "required": [ "kind", "vxlan_id" ], "additionalProperties": false, "properties": { "kind": { "const": "vxlan", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "vxlan_id": { "type": "integer", "minimum": 0, "maximum": 16777215, "description": "specifies the VNI" }, "vxlan_ageing": { "type": "integer", "minimum": 0, "maximum": 4294967296, "description": "specifies the lifetime in seconds of FDB entries learnt by the kernel (0: none)", "default": 300 }, "vxlan_df": { "enum": [ 0, "unset", 1, "set", 2, "inherit" ], "default": "unset", "description": "specifies the usage of the DF bit in outgoing packets with IPv4 headers" }, "vxlan_label": { "type": "integer", "minimum": 0, "maximum": 1048575, "description": "specifies a fixed flowlabel" }, "vxlan_learning": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if unknown source link layer addresses and IP addresses are entered into the VXLAN device fdb", "default": 1 }, "vxlan_limit": { "type": "integer", "minimum": 0, "maximum": 4294967296, "description": "specifies the maximum number of FDB entries (0: none)", "default": 0 }, "vxlan_port": { "description": "specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint", "type": "integer", "minimum": 0, "maximum": 65535 }, "vxlan_port_range": { "description": "specifies the range of port numbers to use as UDP source ports to communicate to the remote VXLAN tunnel endpoint", "required": [ "low", "high" ], "additionalProperties": false, "properties": { "low": { "type": "integer", "minimum": 0, "maximum": 65535 }, "high": { "type": "integer", "minimum": 0, "maximum": 65535 } } }, "vxlan_proxy": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if ARP proxy is turned on", "default": 0 }, "vxlan_rsc": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if route short circuit is turned on", "default": 0 }, "vxlan_l2miss": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if netlink LLADDR miss notifications are generated", "default": 0 }, "vxlan_l3miss": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if netlink IP ADDR miss notifications are generated", "default": 0 }, "vxlan_udp_csum": { "type": "integer", "minimum": 0, "maximum": 1, "description": "specifies if UDP checksum is calculated for tx packets over IPv4", "default": 1 }, "vxlan_link": { "$ref": "#/$defs/iface-link_tun-dev" }, "vxlan_local": { "type": "string", "description": "tunnel source IPv4 address", "format": "ipv4" }, "vxlan_local6": { "type": "string", "description": "tunnel source IPv6 address", "format": "ipv6" }, "vxlan_group": { "type": "string", "description": "remote unicast destination or multicast group IPv4 address", "format": "ipv4" }, "vxlan_group6": { "type": "string", "description": "remote unicast destination or multicast group IPv6 address", "format": "ipv6" }, "vxlan_tos": { "type": "integer", "description": "specifies the TOS value to use in outgoing packets (0: inherit)", "minimum": 0, "maximum": 255, "default": 0 }, "vxlan_ttl": { "type": "integer", "description": "specifies the TTL value to use in outgoing packets (0: auto)", "minimum": 0, "maximum": 255, "default": 0 }, "vxlan_ttl_inherit": { "type": "boolean", "description": "control whether TTL is propagated", "default": false } }, "anyOf": [ { "oneOf": [ { "required": [ "vxlan_group" ] }, { "required": [ "vxlan_local" ] }, { "required": [ "vxlan_local", "vxlan_group" ] }, { "required": [ "vxlan_group6" ] }, { "required": [ "vxlan_local6" ] }, { "required": [ "vxlan_group6", "vxlan_local6" ] } ] }, { "not": { "required": [ "vxlan_group", "vxlan_group6", "vxlan_local", "vxlan_local6" ] } } ] }, { "description": "IPIP interface", "required": [ "kind", "ipip_remote", "ipip_local" ], "additionalProperties": false, "properties": { "kind": { "const": "ipip", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "ipip_remote": { "$ref": "#/$defs/iface-link_tun-remote4" }, "ipip_local": { "$ref": "#/$defs/iface-link_tun-local4" } } }, { "description": "SIT interface", "required": [ "kind", "sit_remote", "sit_local" ], "additionalProperties": false, "properties": { "kind": { "const": "sit", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "sit_remote": { "$ref": "#/$defs/iface-link_tun-remote4" }, "sit_local": { "$ref": "#/$defs/iface-link_tun-local4" } } }, { "description": "GRE interface", "required": [ "kind", "gre_remote", "gre_local" ], "additionalProperties": false, "properties": { "kind": { "const": "gre", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "gre_remote": { "$ref": "#/$defs/iface-link_tun-remote4" }, "gre_local": { "$ref": "#/$defs/iface-link_tun-local4" }, "gre_link": { "$ref": "#/$defs/iface-link_tun-dev" } } }, { "description": "GRETAP interface", "required": [ "kind", "gre_remote", "gre_local" ], "additionalProperties": false, "properties": { "address": { "$ref": "#/$defs/iface-link_address" }, "kind": { "const": "gretap", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "gre_remote": { "$ref": "#/$defs/iface-link_tun-remote4" }, "gre_local": { "$ref": "#/$defs/iface-link_tun-local4" }, "gre_link": { "$ref": "#/$defs/iface-link_tun-dev" } } }, { "description": "IP6GRE interface", "required": [ "kind", "ip6gre_remote", "ip6gre_local" ], "additionalProperties": false, "properties": { "kind": { "const": "ip6gre", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "ip6gre_remote": { "$ref": "#/$defs/iface-link_tun-remote6" }, "ip6gre_local": { "$ref": "#/$defs/iface-link_tun-local6" }, "ip6gre_link": { "$ref": "#/$defs/iface-link_tun-dev" } } }, { "description": "IP6GRETAP interface", "required": [ "kind", "ip6gre_remote", "ip6gre_local" ], "additionalProperties": false, "properties": { "kind": { "const": "ip6gretap", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "ip6gre_remote": { "$ref": "#/$defs/iface-link_tun-remote6" }, "ip6gre_local": { "$ref": "#/$defs/iface-link_tun-local6" }, "ip6gre_link": { "$ref": "#/$defs/iface-link_tun-dev" } } }, { "description": "GENEVE interface over IPv4", "additionalProperties": false, "required": [ "kind", "geneve_id", "geneve_remote" ], "properties": { "kind": { "const": "geneve", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "geneve_id": { "type": [ "integer" ], "minimum": 0, "maximum": 16777215, "description": "specifies the VNI to use" }, "geneve_remote": { "$ref": "#/$defs/iface-link_tun-remote4" } } }, { "description": "GENEVE interface over IPv6", "additionalProperties": false, "required": [ "kind", "geneve_id", "geneve_remote6" ], "properties": { "kind": { "const": "geneve", "description": "link type" }, "address": { "$ref": "#/$defs/iface-link_address" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "geneve_id": { "type": [ "integer" ], "minimum": 0, "maximum": 16777215, "description": "specifies the VNI to use" }, "geneve_remote6": { "$ref": "#/$defs/iface-link_tun-remote6" } } }, { "description": "WireGuard interface; WireGuard settings can be configured using a `wireguard` block", "required": [ "kind" ], "additionalProperties": false, "properties": { "kind": { "const": "wireguard", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" } } }, { "description": "XFRM interface", "required": [ "kind", "xfrm_if_id" ], "additionalProperties": false, "properties": { "kind": { "const": "xfrm", "description": "link type" }, "bind_netns": { "$ref": "#/$defs/iface-link_bind-netns" }, "group": { "$ref": "#/$defs/iface-link_group" }, "state": { "$ref": "#/$defs/iface-link_state" }, "master": { "$ref": "#/$defs/iface-link_master" }, "mtu": { "$ref": "#/$defs/iface-link_mtu" }, "txqlen": { "$ref": "#/$defs/iface-link_txqlen" }, "ifalias": { "$ref": "#/$defs/iface-link_ifalias" }, "xfrm_link": { "$ref": "#/$defs/iface-link_tun-dev", "description": "underlying interface used to send and receive the transformed traffic" }, "xfrm_if_id": { "type": [ "integer" ], "minimum": 0, "maximum": 4294967295, "default": 0, "description": "lookup key to match xfrm policies" } } } ] }, "neighbours": { "description": "static ARP or NDISC cache entries", "type": "array", "items": { "type": "object", "required": [ "dst" ], "additionalProperties": false, "properties": { "dst": { "description": "protocol address of the neighbour", "type": "string", "format": "ipv4" }, "lladdr": { "description": "link layer address of the neighbour", "$ref": "#/$defs/iface-link_address", "default": null } } } }, "sysctl": { "description": "interface sysctl settings", "type": "object", "additionalProperties": false, "properties": { "ipv4": { "$ref": "#/$defs/iface-sysctl-ipv4" }, "ipv6": { "$ref": "#/$defs/iface-sysctl-ipv6" }, "mpls": { "$ref": "#/$defs/iface-sysctl-mpls-link" } } }, "ethtool": { "$ref": "#/$defs/iface-ethtool" }, "cshaper": { "description": "simple shaper setup based on the [cake](https://man7.org/linux/man-pages/man8/tc-cake.8.html) queue discipline; replaces any tc settings", "type": "object", "additionalProperties": false, "properties": { "ingress": { "description": "target ingress bandwidth", "type": "string", "default": "unlimited" }, "egress": { "description": "target egress bandwidth", "type": "string", "default": "unlimited" }, "profile": { "description": "cshaper profile", "type": "string", "default": "default" } } }, "tc": { "description": "settings for traffic control", "type": "object", "additionalProperties": false, "properties": { "ingress": { "description": "enable the ingress qdisc for policing and shaping in ingress", "type": "boolean" }, "qdisc": { "description": "root queueing disciplines", "$ref": "#/$defs/iface-tc_qdisc" }, "filter": { "description": "filter used by qdiscs", "type": "array", "items": { "type": "object", "required": [ "kind" ], "properties": { "kind": { "type": "string", "description": "filter type", "enum": [ "basic", "flow", "fw", "matchall" ] } }, "oneOf": [ { "description": "[basic](https://man7.org/linux/man-pages/man8/tc-basic.8.html) - basic traffic control filter", "additionalProperties": false, "properties": { "kind": { "type": "string", "enum": [ "basic" ] }, "parent": { "$ref": "#/$defs/iface-tc_qid" }, "protocol": { "$ref": "#/$defs/iface-tc_protocol" }, "prio": { "$ref": "#/$defs/iface-tc_prio" }, "action": { "$ref": "#/$defs/iface-tc_action" }, "match": { "description": "match packets using the [extended match infrastructure](https://man7.org/linux/man-pages/man8/tc-ematch.8.html)", "type": "array", "items": { "type": "object" } } } }, { "description": "[flow](https://man7.org/linux/man-pages/man8/tc-flow.8.html) - flow based traffic control filter", "properties": { "kind": { "type": "string", "enum": [ "flow" ] }, "parent": { "$ref": "#/$defs/iface-tc_qid" }, "protocol": { "$ref": "#/$defs/iface-tc_protocol" }, "prio": { "$ref": "#/$defs/iface-tc_prio" }, "action": { "$ref": "#/$defs/iface-tc_action" }, "baseclass": { "description": "offset for the class ID calculation", "type": "integer", "minimum": 0, "maximum": 65535, "default": 1 }, "divisor": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "or": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "and": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "xor": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "rshift": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "addend": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "oneOf": [ { "required": [ "kind", "mode", "key" ], "properties": { "mode": { "description": "filter mode", "type": "string", "enum": [ "map" ] }, "key": { "description": "map to class ID by key", "type": "string", "enum": [ "src", "dst", "proto", "proto-src", "proto-dst", "iif", "priority", "mark", "nfct", "nfct-src", "nfct-dst", "nfct-proto-src", "nfct-proto-dst", "rt-classid", "sk-uid", "sk-gid", "vlan-tag", "rxhash" ] } } }, { "required": [ "kind", "mode", "keys" ], "properties": { "mode": { "description": "filter mode", "type": "string", "enum": [ "hash" ] }, "keys": { "description": "hash over keys for class ID calculation", "type": "array", "items": { "type": "string", "enum": [ "src", "dst", "proto", "proto-src", "proto-dst", "iif", "priority", "mark", "nfct", "nfct-src", "nfct-dst", "nfct-proto-src", "nfct-proto-dst", "rt-classid", "sk-uid", "sk-gid", "vlan-tag", "rxhash" ] } }, "perturb": { "description": "rehashing interval (in seconds)", "type": "integer", "minimum": 0, "maximum": 294967295 } } } ] }, { "description": "[fw](https://man7.org/linux/man-pages/man8/tc-fw.8.html) - fwmark traffic control filter", "additionalProperties": false, "required": [ "kind", "handle" ], "properties": { "kind": { "type": "string", "enum": [ "fw" ] }, "parent": { "$ref": "#/$defs/iface-tc_qid" }, "protocol": { "$ref": "#/$defs/iface-tc_protocol" }, "prio": { "$ref": "#/$defs/iface-tc_prio" }, "action": { "$ref": "#/$defs/iface-tc_action" }, "handle": { "description": "fwmark (iptables) to match", "type": "integer", "minimum": 0 } } }, { "description": "[matchall](https://man7.org/linux/man-pages/man8/tc-matchall.8.html) - traffic control filter that matches every packet", "additionalProperties": false, "properties": { "kind": { "type": "string", "enum": [ "matchall" ] }, "parent": { "$ref": "#/$defs/iface-tc_qid" }, "protocol": { "$ref": "#/$defs/iface-tc_protocol" }, "prio": { "$ref": "#/$defs/iface-tc_prio" }, "action": { "$ref": "#/$defs/iface-tc_action" }, "classid": { "description": "push matching packets into class", "type": "integer", "minimum": 0, "maximum": 4294967295 }, "flags": { "description": "process flags (1: SKIP_HW, 2: SKIP_SW)", "type": "integer", "minimum": 0, "maximum": 4294967295 } } } ] } } } }, "wireguard": { "description": "settings for WireGuard interfaces", "type": "object", "additionalProperties": false, "required": [ "private_key" ], "properties": { "private_key": { "description": "local private key (consider to use the `!include` tag to read the key from file)", "type": "string" }, "listen_port": { "description": "port for listening", "type": "integer", "minimum": 0, "maximum": 65535 }, "fwmark": { "description": "fwmark for outgoing packets", "type": "integer", "minimum": 0, "maximum": 4294967295 }, "table": { "description": "add routes for peer's prefixes to the specified routing table, required routing quirks for peer endpoint addresses (i.e. when the default route points into wireguard) are not added automatically", "type": [ "integer", "string" ], "default": null, "minimum": 0, "maximum": 4294967295, "examples": [ "main" ] }, "peers": { "description": "dictonary with peers: the keys of the dictionary are the public keys of the peers (base64 encoded)", "type": "object", "additionalProperties": false, "patternProperties": { "^[-A-Za-z0-9+/]{43}=$": { "type": "object", "additionalProperties": false, "properties": { "preshared_key": { "description": "preshared key for post-quantum resistance (consider to use the `!include` tag to read the key from file)", "type": "string" }, "endpoint": { "description": "initial endpoint IP or hostname", "type": "string" }, "persistent_keepalive_interval": { "description": "keepalive interval seconds", "type": "integer", "minimum": 0, "maximum": 65535 }, "allowedips": { "description": "list of prefixes in CIDR notation", "type": "array", "items": { "type": "string" } } } } } } } }, "xdp": { "description": "settings for XDP (\"eXpress Data Path\") BPF program", "oneOf": [ { "description": "remove attached XDP program", "type": "boolean", "enum": [ false ] }, { "description": "attach already pinned XDP program", "type": "object", "additionalProperties": false, "required": [ "pinned" ], "properties": { "mode": { "$ref": "#/$defs/xdp_mode" }, "pinned": { "description": "path to already pinned XDP program", "type": "string", "format": "^/sys/fs/bfd/." } } }, { "description": "BPF program from ifstate's bpf config section", "type": "object", "additionalProperties": false, "required": [ "bpf" ], "properties": { "mode": { "$ref": "#/$defs/xdp_mode" }, "bpf": { "description": "BPF program (key in bpf config section)", "type": "string" } } } ] } } } } }, "mac_seed": { "$ref": "#/$defs/mac_seed" }, "routing": { "type": "object", "additionalProperties": false, "properties": { "routes": { "type": "array", "items": { "type": "object", "required": [ "to" ], "additionalProperties": false, "properties": { "type": { "description": "the type of this route", "type": [ "integer", "string" ], "enum": [ "unicast", "local", "broadcast", "anycast", "multicast", "blackhole", "unreachable", "prohibit", "throw", "nat", "xresolve" ], "minimum": 1, "maximum": 11, "default": "unicast" }, "dev": { "description": "the output device name", "type": [ "integer", "string" ] }, "onlink": { "description": "the nexthop router is forced on link", "type": "boolean", "default": false }, "proto": { "description": "the routing protool identifier of this route", "type": [ "integer", "string" ], "default": "boot" }, "realm": { "description": "the realm to which this route is assigned", "type": [ "integer", "string" ] }, "scope": { "description": "the scope (`/etc/iproute2/rt_scopes`) of the destinations covered by the route prefix", "type": [ "integer", "string" ] }, "table": { "description": "the table to add this route to", "type": [ "integer", "string" ], "default": "main" }, "to": { "description": "the destination prefix of the route", "type": "string" }, "via": { "description": "address of the nexthop router", "type": "string", "oneOf": [ { "format": "ipv4" }, { "format": "ipv6" } ] }, "vrrp": { "$ref": "#/$defs/condition-vrrp" }, "src": { "description": "the source address to prefer", "type": "string", "oneOf": [ { "format": "ipv4" }, { "format": "ipv6" } ] }, "preference": { "description": "preference of the route", "type": "integer", "minimum": 0, "maximum": 4294967295, "default": 0 } } } }, "rules": { "type": "array", "items": { "type": "object", "if": { "properties": { "action": { "const": "to_tbl" } } }, "then": { "required": [ "table", "priority" ] }, "else": { "required": [ "priority" ] }, "additionalProperties": false, "properties": { "action": { "type": [ "integer", "string" ], "description": "the type of this rule", "enum": [ "to_tbl", "blackhole", "unreachable", "prohibit" ], "default": "to_tbl" }, "table": { "type": [ "integer", "string" ], "minimum": 0, "maximum": 4294967295 }, "priority": { "type": "integer", "description": "the priority of this rule", "minimum": 0, "maximum": 4294967295 }, "from": { "type": "string", "description": "select the source prefix to match" }, "to": { "type": "string", "description": "select the destination prefix to match" }, "iif": { "type": "string", "description": "select the incoming device to match" }, "oif": { "type": "string", "description": "select the outgoing device to match" }, "proto": { "type": [ "integer", "string" ], "default": "unspec", "description": "routing protocol number (`/etc/iproute2/rt_protos`)" }, "fwmark": { "type": "integer", "description": "select the *fwmark* value to match" }, "ipproto": { "type": [ "integer", "string" ], "description": "select the ip protocol to match" }, "vrrp": { "$ref": "#/$defs/condition-vrrp" }, "family": { "type": [ "integer", "string" ], "enum": [ "AF_INET", "AF_INET6", "inet", "inet6", 2, 10 ], "description": "IP family (IPv4 or IPv6) to add the rule to. One of `AF_INET`, `inet`, `2` for IPv4 or `AF_INET6`, `inet6`, `10` for IPv6. Leave undefined to let ifstate and pyroute2 automatically detect it from the 'to' and 'from' addresses, defaulting to IPv4." } } } } } }, "sysctl": { "description": "network sysctl settings", "type": "object", "additionalProperties": false, "properties": { "all": { "description": "overrides [per interface sysctl settings](https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt) in `/proc/sys/net/ipv*/conf/all/`", "type": "object", "additionalProperties": false, "properties": { "ipv4": { "$ref": "#/$defs/iface-sysctl-ipv4" }, "ipv6": { "$ref": "#/$defs/iface-sysctl-ipv6" } } }, "default": { "description": "default [per interface sysctl settings](https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt) in `/proc/sys/net/ipv*/conf/default/`", "type": "object", "additionalProperties": false, "properties": { "ipv4": { "$ref": "#/$defs/iface-sysctl-ipv4" }, "ipv6": { "$ref": "#/$defs/iface-sysctl-ipv6" } } }, "mpls": { "$ref": "#/$defs/iface-sysctl-mpls" }, "mptcp": { "$ref": "#/$defs/iface-sysctl-mptcp" } } }, "namespaces": { "type": "object", "additionalProperties": false, "patternProperties": { ".+": { "type": "object", "additionalProperties": false, "required": [ "interfaces" ], "properties": { "bpf": { "$ref": "#/properties/bpf" }, "interfaces": { "$ref": "#/properties/interfaces" }, "mac_seed": { "$ref": "#/$defs/mac_seed" }, "routing": { "$ref": "#/properties/routing" }, "sysctl": { "$ref": "#/properties/sysctl" } } } } } } }