From 7a6a1ad44141c66b93637aa995e729440ecfa1e1 Mon Sep 17 00:00:00 2001
From: Jonathon Anderson <janderson@ciq.com>
Date: Wed, 3 Sep 2025 06:17:22 -0600
Subject: [PATCH] Disable ipv4 in NetworkManager if no address or route is
 specified

- Closes: #1986

Signed-off-by: Jonathon Anderson <janderson@ciq.com>
---
 CHANGELOG.md                                  |  1 +
 .../internal/networkmanager_test.go           | 25 +++++++++++++------
 .../system-connections/ww4-managed.ww         | 22 +++++++++-------
 3 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3191dfdf..b704c046 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   (After #1886 better resolves the underlying issue from #1473.) #1946
 - Prevent brp-mangle-shebangs from changing files in overlays.
 - The NetworkManager overlay now only adds an `[ethernet]` section for ethernet interfaces.
+- The NetworkManager overlay now sets `ipv4:method=disabled` if no address or route is specified. #1986
 
 ### Fixed
 
diff --git a/overlays/NetworkManager/internal/networkmanager_test.go b/overlays/NetworkManager/internal/networkmanager_test.go
index 79bacd73..498cb7ea 100644
--- a/overlays/NetworkManager/internal/networkmanager_test.go
+++ b/overlays/NetworkManager/internal/networkmanager_test.go
@@ -91,14 +91,15 @@ type=ethernet
 autoconnect=true
 [ethernet]
 mac-address=e6:92:39:49:7b:03
+
 [ipv4]
 method=manual
 address=192.168.3.21/24
 gateway=192.168.3.1
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 backupFile: true
 writeFile: true
@@ -112,6 +113,7 @@ type=ethernet
 autoconnect=true
 [ethernet]
 mac-address=9a:77:29:73:14:f1
+
 [ipv4]
 method=manual
 address=192.168.3.22/24
@@ -120,8 +122,8 @@ dns=8.8.8.8;8.8.4.4;
 dns-search=example.com;example.net;
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 `,
 		},
@@ -160,14 +162,15 @@ type=ethernet
 autoconnect=true
 [ethernet]
 mac-address=e6:92:39:49:7b:03
+
 [ipv4]
 method=manual
 address=192.168.3.21/24
 gateway=192.168.3.1
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 backupFile: true
 writeFile: true
@@ -180,6 +183,7 @@ type=ethernet
 autoconnect=true
 [ethernet]
 mac-address=9a:77:29:73:14:f1
+
 [ipv4]
 method=manual
 address=192.168.3.22/24
@@ -188,8 +192,8 @@ dns=8.8.8.8;8.8.4.4;
 dns-search=example.com;example.net;
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 `,
 		},
@@ -259,13 +263,14 @@ id=tagged
 interface-name=eth0.902
 type=vlan
 autoconnect=true
+
 [ipv4]
 method=manual
 route1=192.168.1.0/24,192.168.2.254
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 [vlan]
 interface-name=eth0.902
@@ -282,12 +287,13 @@ interface-name=eth0
 type=ethernet
 autoconnect=true
 [ethernet]
+
 [ipv4]
-method=manual
+method=disabled
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 `,
 		},
@@ -330,13 +336,14 @@ miimon=100
 mode=balance-rr
 xmit_hash_policy=layer2+3
 updelay=0
+
 [ipv4]
 method=manual
 address=192.168.3.110/24
 
 [ipv6]
-addr-gen-mode=stable-privacy
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 backupFile: true
 writeFile: true
@@ -352,6 +359,7 @@ slave-type=bond
 autoconnect=true
 [ethernet]
 mac-address=e6:92:39:49:7b:03
+
 [ipv4]
 method=disabled
 
@@ -371,6 +379,7 @@ slave-type=bond
 autoconnect=true
 [ethernet]
 mac-address=9a:77:29:73:14:f1
+
 [ipv4]
 method=disabled
 
diff --git a/overlays/NetworkManager/rootfs/etc/NetworkManager/system-connections/ww4-managed.ww b/overlays/NetworkManager/rootfs/etc/NetworkManager/system-connections/ww4-managed.ww
index 4855a94d..f3781a7f 100644
--- a/overlays/NetworkManager/rootfs/etc/NetworkManager/system-connections/ww4-managed.ww
+++ b/overlays/NetworkManager/rootfs/etc/NetworkManager/system-connections/ww4-managed.ww
@@ -39,18 +39,19 @@ mtu={{ $netdev.MTU }}
 {{- end }}
 {{- end }}
 
-{{- if $netdev.Tags.master }}
-[ipv4]
-method=disabled
-
-[ipv6]
-method=disabled
-{{- else }}
 [ipv4]
+{{- $hasRoutes := false }}
+{{- range $tk, $tv := $netdev.Tags }}
+{{- if eq (substr 0 5 $tk) "route" }}{{ $hasRoutes = true }}{{ end }}
+{{- end }}
+{{- if and (or $netdev.Ipaddr $hasRoutes) (not $netdev.Tags.master) }}
 method=manual
-{{- if $netdev.IpCIDR }}
+{{- if $netdev.Ipaddr }}
 address={{ $netdev.IpCIDR }}
 {{- end }}
+{{- else }}
+method=disabled
+{{- end }}
 {{- if $netdev.Gateway }}
 gateway={{ $netdev.Gateway }}
 {{- end }}
@@ -70,8 +71,11 @@ dns-search={{ join ";" (without (regexSplit "[ ;]+" $netdev.Tags.DNSSEARCH -1) "
 {{- end }}
 
 [ipv6]
-addr-gen-mode=stable-privacy
+{{- if $netdev.Tags.master }}
+method=disabled
+{{- else }}
 method=ignore
+addr-gen-mode=stable-privacy
 never-default=true
 {{- if $netdev.Ipaddr6 }}
 ipaddr="{{ $netdev.Ipaddr6 }}"