From b37cd794324b1b3c99a0f312b2d251e038d5fecf Mon Sep 17 00:00:00 2001 From: Michal Date: Sun, 16 Aug 2026 00:13:19 +0100 Subject: [PATCH] fix(migration): refuse an unprobeable delta instead of warning past it The ARP guard against two devices holding the same gateway address is the one check that prevents this script's worst outcome. It reads the addresses to probe out of the delta -- so a delta with no VIP lines made the guard inert, and it previously warned and carried on. That was a testing convenience (the lab delta has no VIPs) weakening a production safety check, which is backwards. It now refuses by default. ALLOW_NO_VIP_DELTA=1 is the explicit lab override. The guard's probing path had never actually executed before this: every sim run took the no-VIPs branch. Verified against the live USG from vyos001: arping is present on VyOS, the regex extracts all six gateway addresses from the real delta (192.168.1.1, 192.168.8.1, 192.168.3.1, 10.0.9.0, 10.0.0.1, 192.168.2.1), and every one of them answers ARP right now -- so on the real boxes, with the USG connected, the guard fires. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH --- migration/vyos-unifi-switch | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/migration/vyos-unifi-switch b/migration/vyos-unifi-switch index b4848e5..c4e1d67 100755 --- a/migration/vyos-unifi-switch +++ b/migration/vyos-unifi-switch @@ -117,9 +117,18 @@ usg_still_alive() { local found=0 ip dev targets targets="$(grep -oE "vrrp group [a-z0-9]+ address [0-9.]+" "$DELTA" 2>/dev/null | awk '{print $NF}')" if [ -z "$targets" ]; then - warn "this delta claims no VIPs, so there is nothing to probe." - warn "That is expected in the lab and WRONG for the real cutover." - return 1 + # A delta with no VIPs cannot be probed, which means the single guard + # against two devices sharing a gateway address is inert. Refuse by + # default: an unprobeable delta on the real boxes is a broken delta, and + # "warn and continue" would let the one failure this script exists to + # prevent through unnoticed. The override is for the lab only. + if [ "${ALLOW_NO_VIP_DELTA:-0}" = "1" ]; then + warn "delta claims no VIPs; proceeding because ALLOW_NO_VIP_DELTA=1 (lab only)" + return 1 + fi + die "this delta claims no VIPs, so the gateway-address guard cannot run. + On the real boxes that means a broken delta. If this really is a lab + run, re-invoke with ALLOW_NO_VIP_DELTA=1." fi for ip in $targets; do dev="$(ip -4 route get "$ip" 2>/dev/null | sed -n 's/.* dev \([^ ]*\).*/\1/p' | head -1)"