Move argument validation to root handlers

The netroot hook is no longer used.
---
This is a left over from before Philippe's multinic work.

 dracut                      |    2 +-
 modules.d/40network/netroot |    3 ---
 2 files changed, 1 insertions(+), 4 deletions(-)

dracut +1 -1

index f10af83..c71cc63 100755
@@ -102,7 +102,7 @@ if [[ -f $outfile && ! $force ]]; then
     exit 1
 fi
 
-hookdirs="cmdline pre-udev pre-trigger netroot pre-mount pre-pivot mount emergency"
+hookdirs="cmdline pre-udev pre-trigger pre-mount pre-pivot mount emergency"
 
 readonly initdir=$(mktemp -d -t initramfs.XXXXXX)
 trap 'rm -rf "$initdir"' 0 # clean up after ourselves no matter how we die.

modules.d/40network/netroot +0 -0

index f719d93..645bbba 100755

The argument checks for the network root handlers are not very useful, as there is no error message; things just fail to work. Since this should only ever be a problem when developing dracut, it is not too unfriendly to expect developers to add rdnetdebug to the command line when working on this area.

Remove them for now, as the arguments will be going through some flux and we can add them back later with more helpful messages if it is desired.

---
 modules.d/95iscsi/iscsiroot |   10 ----------
 modules.d/95nbd/nbdroot     |    9 ---------
 modules.d/95nfs/nfsroot     |    9 ---------
 3 files changed, 0 insertions(+), 28 deletions(-)

modules.d/95iscsi/iscsiroot +0 -10

index c66f9d2..2b041cc 100755
@@ -16,16 +16,6 @@ if getarg rdnetdebug; then
     set -x
 fi
 
-# Huh? Empty $1?
-[ -z "$1" ] && exit 1
-
-# Huh? Empty $2?
-[ -z "$2" ] && exit 1
-
-# Huh? Empty $3? This isn't really necessary, since NEWROOT isn't 
-# used here. But let's be consistent
-[ -z "$3" ] && exit 1
-
 # root is in the form root=iscsi:[<servername>]:[<protocol>]:[<port>]:[<LUN>]:<targetname>
 netif="$1"
 root="$2"

modules.d/95nbd/nbdroot +0 -9

index 90f6ef8..c7f24e8 100755
@@ -10,15 +10,6 @@ if getarg rdnetdebug; then
     set -x
 fi
 
-# Huh? Empty $1?
-[ -z "$1" ] && exit 1
-
-# Huh? Empty $2?
-[ -z "$2" ] && exit 1
-
-# Huh? Empty $3?
-[ -z "$3" ] && exit 1
-
 # root is in the form root=nbd:srv:port[:fstype[:rootflags[:nbdopts]]]
 netif="$1"
 root="$2"

modules.d/95nfs/nfsroot +0 -2

index 0da8ee3..f005378 100755
@@ -48,15 +48,6 @@ if getarg rdnetdebug ; then
     set -x
 fi
 
-# Huh? Empty $1?
-[ -z "$1" ] && exit 1

Now that netroot is serialized and only one interface can be configured at a time, netif is almost completely unneeded by the netroot handlers. The remaining hold out is nfsroot, which uses it to get the command line overrides and the DHCP root information.

By adding that information to the calling convention, we can get rid of netif, and prepare for the next steps of moving parsing and validation into the handlers themselves.

---
 modules.d/40network/netroot |   16 ++++++++++------
 modules.d/95iscsi/iscsiroot |    7 +++----
 modules.d/95nbd/nbdroot     |    9 ++++-----
 modules.d/95nfs/nfsroot     |   20 ++++++++------------
 4 files changed, 25 insertions(+), 27 deletions(-)

modules.d/40network/netroot +10 -6

index 645bbba..c9ebf4c 100755
@@ -44,15 +44,20 @@ done
 netif=$1
 [ -e "/tmp/net.bootdev" ] && read netif < /tmp/net.bootdev
 
+# Load command line overrides to get the server override
+[ -e /tmp/net.$netif.override ] && . /tmp/net.$netif.override
+[ -n "$srv" ] && server_id=$srv
+
+# Load dhcp options and get the first fallback to the server
+[ -e /tmp/dhclient.$netif.dhcpopts ] && . /tmp/dhclient.$netif.dhcpopts
+[ -z "$server_id" ] && server_id=$new_dhcp_server_identifier
+
 # Figure out the handler for root=dhcp by recalling all netroot cmdline 
 # handlers
 if [ "$netroot" = "dhcp" ] ; then
     # Unset root so we can check later
     unset root
 
-    # Load dhcp options
-    [ -e /tmp/dhclient.$netif.dhcpopts ] && . /tmp/dhclient.$netif.dhcpopts
-
     # If we have a specific bootdev with no dhcpoptions or empty root-path, 
     # we die. Otherwise we just warn
     if [ -z "$new_root_path" ] ; then

@@ -92,9 +97,8 @@ done
 [ -e /tmp/net.$netif.hostname ]    && . /tmp/net.$netif.hostname
 [ -e /tmp/net.$netif.resolv.conf ] && cp -f /tmp/net.$netif.resolv.conf /etc/resolv.conf
 
-# Run the handler; don't store the root, it may change from device to device
-# XXX other variables to export?
-if $handler $netif $netroot $NEWROOT; then
+# Run the handler to mount/login into the root device
+if $handler "$netroot" "$server_id" "$new_root_path" $NEWROOT; then
     # Network rootfs mount successful
     for iface in $IFACES ; do
 	[ -f /tmp/dhclient.$iface.lease ] &&    cp /tmp/dhclient.$iface.lease    /tmp/net.$iface.lease

modules.d/95iscsi/iscsiroot +0 -0

index 2b041cc..923141c 100755

modules.d/95iscsi/iscsiroot +1 -2

 # root is in the form root=iscsi:[<servername>]:[<protocol>]:[<port>]:[<LUN>]:<targetname>
-netif="$1"
-root="$2"
+root="$1"
 
 # read static conf settings
 for conf in conf/conf.d/*; do

modules.d/95nbd/nbdroot +0 -0

index c7f24e8..f76211c 100755

modules.d/95nbd/nbdroot +2 -3

 # root is in the form root=nbd:srv:port[:fstype[:rootflags[:nbdopts]]]
-netif="$1"
-root="$2"
-NEWROOT="$3"
+root="$1"
+NEWROOT="$4"
 
 # If it's not nbd we don't continue
 [ "${root%%:*}" = "nbd" ] || return

modules.d/95nfs/nfsroot +0 -0

index f005378..847ec60 100755

modules.d/95nfs/nfsroot +5 -8

 # root is in the form root=nfs[4]:[server:]path[:options], either from
 # cmdline or dhcp root-path
-netif="$1"
-root="$2"
-NEWROOT="$3"
+root="$1"
+server_id=$2
+root_path=$3
+NEWROOT="$4"
 
 # Continue if nfs prefix
 case "${root%%:*}" in

@@ -62,20 +63,15 @@ esac
 
 root_to_var $root
 
-#Load other data that might provide info
-[ -f /tmp/net.$netif.override ] && . /tmp/net.$netif.override
-[ -f /tmp/dhclient.$netif.dhcpopts ] && . /tmp/dhclient.$netif.dhcpopts
-
 #Empty path means try dhcp root-path, this is ok here since parse-nfsroot.sh
 #already takes care of nfs:... formatted root-path
-[ -z "$path" ] && root_to_var $nfs:$new_root_path
+[ -z "$path" ] && root_to_var $nfs:$root_path
 

Quoted 4 lines · David Dillow

Now that netroot is serialized and only one interface can be configured at a time, netif is almost completely unneeded by the netroot handlers. The remaining hold out is nfsroot, which uses it to get the command line overrides and the DHCP root information.

Loosing arguments is always good.

The only thing I don't like about this is that netroot needs to implement a few specialities just for NFS. I'd prefer netroot to be (mount-)protocol independent.

On the other hand, I like the idea that network root handlers shouldn't care a thing about network configuration and options.

Question: Is it possible that other netroot handlers we haven't implemented or thought about might need to know about interfaces?

Discussion: Instead of implementing the dhcp options server failover just for nfs, why not extend this to all protocols?

Quoted 5 lines

modules.d/95iscsi/iscsiroot +0 -0

@@ -11,14 +11,13 @@
 PATH=$PATH:/sbin:/usr/sbin
 

modules.d/95iscsi/iscsiroot line 17

Quoted 7 lines

modules.d/95iscsi/iscsiroot +2 -2

 if getarg rdnetdebug; then
-    exec > /tmp/iscsiroot.$1.$$.out
-    exec 2>> /tmp/iscsiroot.$1.$$.out
+    exec > /tmp/iscsiroot.$$.out
+    exec 2>> /tmp/iscsiroot.$$.out
     set -x
 fi

Maybe this is just me nagging around, but do the changes above have anything to do with removing netif?

Quoted 10 lines · Seewer Philippe

Quoted 4 lines · David Dillow

Now that netroot is serialized and only one interface can be configured at a time, netif is almost completely unneeded by the netroot handlers. The remaining hold out is nfsroot, which uses it to get the command line overrides and the DHCP root information.

Loosing arguments is always good.

The only thing I don't like about this is that netroot needs to implement a few specialities just for NFS. I'd prefer netroot to be (mount-)protocol independent.

Well, it still is protocol independent, it just gives the handlers the DHCP info instead of having them need to go find it themselves.

Quoted 5 lines

On the other hand, I like the idea that network root handlers shouldn't care a thing about network configuration and options.

Question: Is it possible that other netroot handlers we haven't implemented or thought about might need to know about interfaces?

FCoE support comes to mind... had not thought about it too much, we need to see what it really wants.

Quoted 2 lines

Discussion: Instead of implementing the dhcp options server failover just for nfs, why not extend this to all protocols?

This does implement it for all protocols, if they choose to use it.

Quoted 5 lines

Quoted 5 lines

modules.d/95iscsi/iscsiroot +0 -0

@@ -11,14 +11,13 @@
 PATH=$PATH:/sbin:/usr/sbin
 

Quoted 9 lines

modules.d/95iscsi/iscsiroot line 17

Quoted 7 lines

modules.d/95iscsi/iscsiroot +2 -2

 if getarg rdnetdebug; then
-    exec > /tmp/iscsiroot.$1.$$.out
-    exec 2>> /tmp/iscsiroot.$1.$$.out
+    exec > /tmp/iscsiroot.$$.out
+    exec 2>> /tmp/iscsiroot.$$.out
     set -x
 fi

Maybe this is just me nagging around, but do the changes above have anything to do with removing netif?

$1 used to be $netif, so we'd get /tmp/iscsiroot.eth0.1234.out. Now we'd get /tmp/iscsiroot.root=iscsi:..:blah.1234.out instead. Hence the removal of $1.

--
To unsubscribe from this list: send the line "unsubscribe initramfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 5 lines · David Dillow

Quoted 2 lines · Seewer Philippe

Discussion: Instead of implementing the dhcp options server failover just for nfs, why not extend this to all protocols?

This does implement it for all protocols, if they choose to use it.

Yes, that is correct. I meant it more like, why should only nfs choose to use it? We could insert the server into the root argument for each handler inside netroot instead of just "delegating" it.

Quoted 3 lines

$1 used to be $netif, so we'd get /tmp/iscsiroot.eth0.1234.out. Now we'd get /tmp/iscsiroot.root=iscsi:..:blah.1234.out instead. Hence the removal of $1.

Oh, didn't realize that. Thanks for claryfing.

Quoted 6 lines · Seewer Philippe

Quoted 4 lines · David Dillow

Quoted 2 lines · Seewer Philippe

Discussion: Instead of implementing the dhcp options server failover just for nfs, why not extend this to all protocols?

This does implement it for all protocols, if they choose to use it.

Yes, that is correct. I meant it more like, why should only nfs choose to use it? We could insert the server into the root argument for each handler inside netroot instead of just "delegating" it.

Sorry, I misunderstood.

I like the concept of other protocols using server_id as a fall back when no server IP is given in their arguments (ie nbd::9000 would use port 9000 on the DHCP server) as it makes it easier to share configs among DHCP servers.

I suspect others will find it confusing, though.

Quoted 4 lines

Quoted 3 lines

$1 used to be $netif, so we'd get /tmp/iscsiroot.eth0.1234.out. Now we'd get /tmp/iscsiroot.root=iscsi:..:blah.1234.out instead. Hence the removal of $1.

Oh, didn't realize that. Thanks for claryfing.

If this series looks to be worth it, I'll try to do better on the commit message regarding this point.

This reduces the argument parsers in the cmdline hook to giving warnings about usage and translating legacy syntaxes to dracut's syntax. The root handlers themselves become responsible for validating the dracut syntax. This simplifies the cmdline parsers and centralizes the syntax parsers, which keeps them from multiplying as new functionality is added.

Quoted 5 lines · David Dillow

This reduces the argument parsers in the cmdline hook to giving warnings about usage and translating legacy syntaxes to dracut's syntax. The root handlers themselves become responsible for validating the dracut syntax. This simplifies the cmdline parsers and centralizes the syntax parsers, which keeps them from multiplying as new functionality is added.

I don't think that centralizing code is that important. Dracut is module based after all and the central point to find code is the module directory.

But there's a two things about this approach that bug me:
- The netroot handlers become some sort of multi-call utilities, doing possibly entirely different things depending on arguments. From a functional point of view netroot handlers should only care about the actual mount/login.

- Arguments are constantly reparsed. This is unnecessary but applies to the current implementation as well

Suggestion: We don't use the netroot argument inside netroot. Instead, the different parsers should write out /tmp/netroot.info in a similar format to net.ethX.override or dhclient.ethX.dhcpopts. Netroot modules would have to provide three files: Legacy cmdline parser (optional), dracut-syntax parser (for netroot= and dhcp root-path), mount/login handler.

This would work like this:
cmdline step 1: All legacy parsers run first, validating if necessary
and/or reformat arguments into netroot= if possible
cmdline step 2: call proto-validate.sh which parses and validates
dracut-syntax
==> After this step, if all parameters are correct and root!=dhcp,
/tmp/netroot.info should be available.

netroot step 1: If root=dhcp do the same as cmdline step 2 ==> After this step and if all parameters are correct /tmp/netroot.info
should be available.

netroot step 2: Source /tmp/netroot.info and use "$server" for STP arping.
If it's empty, issue a warning, use dhcp server and rewrite the file with the new server=.

netroot step 3: Just call the mount/login handler without any arguments.
Everything it needs is in /tmp/netroot.info

What do you think?

When operating on a switch running a spanning tree, it can take up to 100 seconds for our port to start forwarding traffic after comming up. Normally, this can be eaten by DHCP's request for an IP, but if we have a static configuration or need to down the interface to change the MTU, we will have to eat the timeout again.

Most of the network root protocols will timeout while waiting for traffic to flow again in this case, so we use ARP pings to determine when the link is available prior to trying the mount/disk login.

---
 modules.d/40network/dhclient-script |   11 ++++--
 modules.d/40network/ifup            |    8 +++-
 modules.d/40network/install         |    2 +-
 modules.d/40network/netroot         |   67 +++++++++++++++++++++++++++++------
 modules.d/95iscsi/iscsiroot         |   28 +++++++++-----
 modules.d/95nbd/nbdroot             |   12 +++++--
 modules.d/95nfs/nfsroot             |    9 +++--
 7 files changed, 104 insertions(+), 33 deletions(-)

modules.d/40network/dhclient-script +0 -0

index 5b36a40..e440df9 100755

modules.d/40network/dhclient-script +0 -1

     if [ -n "$mtu" ] ; then
 	echo ip link set $netif down
 	echo ip link set $netif mtu $mtu
 	echo ip link set $netif up
-    fi > /tmp/net.$netif.up

modules.d/40network/dhclient-script +0 -0

     [ -n "${search}${domain}" ] && echo search $search $domain > /tmp/net.$netif.resolv.conf
     if  [ -n "$namesrv" ] ; then

modules.d/40network/ifup +0 -0

index 89017bb..404d6d8 100755

modules.d/40network/ifup +4 -1

 	echo ip link set $netif up 
 	echo ip addr flush dev $netif
 	echo ip addr add $ip/$mask dev $netif
     } > /tmp/net.$netif.up
 
-    [ -n "$gw" ] && echo ip route add default via $gw dev $netif > /tmp/net.$netif.gw
+    if [ -n "$gw" ]; then
+	 echo gw=$gw > /tmp/net.$netif.gw
+	 echo ip route add default via $gw dev $netif >> /tmp/net.$netif.gw
+    fi
     [ -n "$hostname" ] && echo hostname $hostname > /tmp/net.$netif.hostname
 
     echo online > /sys/class/net/$netif/uevent

modules.d/40network/install +1 -1

index 0b76cbd..20e8963 100755
@@ -1,5 +1,5 @@
 #!/bin/bash
-dracut_install ip dhclient hostname
+dracut_install ip dhclient hostname arping date
 # Include wired net drivers, excluding wireless
 for modname in $(find "/lib/modules/$kernel/kernel/drivers" -name '*.ko'); do
   if nm -uPA $modname | grep -q eth_type_trans; then

modules.d/40network/netroot +28 -2

index 2cf51fa..58bbd2e 100755
@@ -1,5 +1,29 @@
 #!/bin/sh
 
+apply_mask() {
+    local ip=$1
+    local mask=$2
+    local out i
+
+    for i in 1 2 3 4; do
+	out=$out.$(( ${ip%%.*} & ${mask%%.*} ))
+	ip=${ip#*.}
+	mask=${mask#*.}
+    done
+    echo ${out#.}
+}
+
+is_local() {
+    local server=$1
+    local mynet=$2
+    local mask net
+
+    mask=${mynet#*/}
+    mynet=$(apply_mask ${mynet%/*} $mask)
+    net=$(apply_mask $server $mask)
+    [ "$net" = "$mynet" ]
+}
+
 PATH=$PATH:/sbin:/usr/sbin
 
 . /lib/dracut-lib.sh

@@ -75,8 +99,10 @@ if [ -z "$netroot" ] || [ ! -e "$handler" ] ; then
     die "No handler for netroot type '$netroot'"
 fi
 
-# Now that we have DHCP information, we can fully validate netroot
-$handler checkdhcp $netroot "$server_id" "$new_root_path" || exit 1
+# Now that we have DHCP information, we can get our server
+$handler server $netroot "$server_id" "$new_root_path" || exit 1
+[ -s /tmp/server ] || die "Bug in $handler: did not create /tmp/server"
+read target < /tmp/server
 
 # We're here, so we can assume that upping interfaces is now ok
 [ -z "$IFACES" ] && IFACES="$netif"

modules.d/40network/netroot +10 -9

+
 # Run the handler to mount/login into the root device
-if $handler mount "$netroot" "$server_id" "$new_root_path" $NEWROOT; then
+if [ -n "$proceed" ] &&
+	$handler mount "$netroot" "$server_id" "$new_root_path" $NEWROOT;
+then
     # Network rootfs mount successful
     for iface in $IFACES ; do
 	[ -f /tmp/dhclient.$iface.lease ] &&    cp /tmp/dhclient.$iface.lease    /tmp/net.$iface.lease

@@ -98,14 +137,20 @@ if $handler mount "$netroot" "$server_id" "$new_root_path" $NEWROOT; then
 
     # Save used netif for later use
     [ ! -f /tmp/net.ifaces ] && echo $netif > /tmp/net.ifaces
-else 
+    exit 0
+fi
+
+if [ -n "$proceed" ]; then
     warn "Mounting root via '$netif' failed"
-    # If we're trying with multiple interfaces, put that one down.
-    # ip down/flush ensures that routeing info goes away as well
-    if [ -z "$BOOTDEV" ] ; then
-	ip link set $netif down
-	ip addr flush dev $netif
-	echo "#empty" > /etc/resolv.conf
-    fi
+else
+    warn "Unable to ARP ping $target via $netif"

modules.d/95iscsi/iscsiroot +18 -10

index d79b663..7f2efa2 100755
@@ -17,9 +17,10 @@ if getarg rdnetdebug; then
 fi
 
 case "$1" in
-    check|checkdhcp)	check_only=1 ;;
-    mount)		;;
-    *)			die "$0 called with invalid command '$1'" ;;
+    check)	check_only=1 ;;
+    server)	server_only=1 ;;
+    mount)	;;
+    *)		die "$0 called with invalid command '$1'" ;;
 esac
 
 # root is in the form

@@ -55,13 +56,6 @@ if [ ! -e /sys/devices/virtual/iscsi_transport ]; then
     fi
 fi
 
-[ -n "$check_only" ] && exit 0
-
-if getarg iscsi_firmware ; then
-	iscsistart -b
-	exit 0
-fi
-
 # override conf settings by command line options
 arg=$(getarg iscsi_initiator)
 [ -n "$arg" ] && iscsi_initiator=$arg

@@ -100,6 +94,20 @@ iscsi_lun=$1; shift
 iscsi_target_name=$*
 IFS="$OLDIFS"
 
+[ -n "$check_only" ] && exit 0
+
+# FIXME need support for service discovery if no server given, or
+# parsing the firmware tables for an IP if iscsi_firmware is in effect
+if [ -n "$server_only" ]; then
+    echo $iscsi_target_ip > /tmp/server
+    exit 0
+fi
+
+if getarg iscsi_firmware ; then
+	iscsistart -b
+	exit 0
+fi
+
 # XXX is this needed?
 getarg ro && iscsirw=ro
 getarg rw && iscsirw=rw

modules.d/95nbd/nbdroot +9 -3

index 55c1b88..9450b84 100755
@@ -11,9 +11,10 @@ if getarg rdnetdebug; then
 fi
 
 case "$1" in
-    check|checkdhcp)	check_only=1 ;;
-    mount)		;;
-    *)			die "$0 called with invalid command '$1'" ;;
+    check)	check_only=1 ;;
+    server)	server_only=1 ;;
+    mount)	;;
+    *)		die "$0 called with invalid command '$1'" ;;
 esac
 
 # root is in the form root=nbd:srv:port[:fstype[:rootflags[:nbdopts]]]

@@ -52,6 +53,11 @@ incol2 /proc/devices nbd || modprobe nbd ||
 [ -z "$nbdport" ] && die "NBD root configuration missing port"
 [ -n "$check_only" ] && exit 0
 
+if [ -n "$server_only" ]; then
+    echo $nbdserver > /tmp/server
+    exit 0
+fi
+
 # look through the NBD options and pull out the ones that need to
 # go before the host etc. Append a ',' so we know we terminate the loop
 nbdopts=${nbdopts},

modules.d/95nfs/nfsroot +1 -1

index 8cbfbb8..acfd6b5 100755
@@ -12,7 +12,7 @@ fi
 
 case "$1" in
     check)	basic_check=1 ;;
-    checkdhcp)	full_check=1 ;;
+    server)	server_only=1 ;;
     mount)	;;
     *)		die "$0 called with invalid command '$1'" ;;
 esac

@@ -101,8 +101,11 @@ fi
 [ -z "$server" ] && die "Required parameter 'server' is missing"
 [ -z "$path" ] && die "NFS root requires a path"
 

modules.d/40network/dhclient-script setup_interface() { · line 17

Quoted 2 lines · David Dillow

modules.d/40network/dhclient-script +2 -0

+    echo mynet=$ip/$mask > /tmp/net.$netif.up
+

Please don't do this. $ip/$mask is in .override so we don't need more variables.

modules.d/40network/netroot done · line 121

Quoted 2 lines

modules.d/40network/netroot +2 -0

+# FIXME make 120 configurable
+TIMEOUT=$(( $(date +%s) + 120 ))

Is 120 seconds really necessary? I've worked with 60 seconds and haven't had any problems, even when specifically provoking STP with ip down/up before issuing arping.

Something else: If we really have to use 120 seconds and/or do this on multiple interface we might run into the default udev event timeout of 180 seconds. Netroot should be moved into the new initqueue in that case.

modules.d/40network/netroot done · line 126

Quoted 5 lines

modules.d/40network/netroot +5 -0

+while [ -z "$proceed" -a $(date +%s) -lt $TIMEOUT ]; do
+    for iface in $IFACES; do
+	arping -q -f -c 1 -I $iface $target && proceed=1 && break
+    done
+done

Just so that I understand you correctly: You're trying to arping on all interfaces until one says OK?

If we have multiple interface to up before mount/login, we should take care to try and enable all interfaces:

Quoted 11 lines

modules.d/40network/netroot +3 -7

+if [ -n "$proceed" ]; then
     warn "Mounting root via '$netif' failed"
-    # If we're trying with multiple interfaces, put that one down.
-    # ip down/flush ensures that routeing info goes away as well
-    if [ -z "$BOOTDEV" ] ; then
-	ip link set $netif down
-	ip addr flush dev $netif
-	echo "#empty" > /etc/resolv.conf
-    fi
+else
+    warn "Unable to ARP ping $target via $netif"

modules.d/40network/netroot if $handler mount "$netroot" "$server_id" "$new_root_path" $NEWROOT; then · line 156

Quoted 10 lines

modules.d/40network/netroot +8 -0

+fi
+
+# If we're trying with multiple interfaces, put that one down.
+# ip down/flush ensures that routeing info goes away as well
+if [ -z "$BOOTDEV" ] ; then
+    ip link set $netif down
+    ip addr flush dev $netif
+    echo "#empty" > /etc/resolv.conf
 fi
 exit 0

I'd suggest to move [ -n "$proceed" ] to before mount/login and just do [ -z "$proceed" ] && die "..."

that way loose the if/else.