From 3c97325d61079985bb242c59828210adde7368d3 Mon Sep 17 00:00:00 2001
From: nvazquez <nicovazquez90@gmail.com>
Date: Wed, 7 Oct 2026 07:04:34 -0300
Subject: [PATCH 1/2] Fix External-DHCP IP fetch records Windows APIPA address
 on L2 networks

---
 .../LibvirtGetVmIpAddressCommandWrapper.java  | 14 +++++-
 ...bvirtGetVmIpAddressCommandWrapperTest.java | 50 +++++++++++++++++++
 .../java/com/cloud/vm/UserVmManagerImpl.java  | 12 ++++-
 .../java/com/cloud/utils/net/NetUtils.java    | 27 ++++++++++
 .../com/cloud/utils/net/NetUtilsTest.java     | 22 ++++++++
 5 files changed, 122 insertions(+), 3 deletions(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java
index c7fde1414101..6e5e71f56bd8 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java
@@ -130,10 +130,20 @@ private Pair<String, String> getIpAddresses(String output, String macAddress) {
             found = true;
             String ipFamily = parts[parts.length - 2];
             String ipPart = parts[parts.length - 1].split("/")[0];
+            // Skip link-local addresses (e.g. Windows APIPA 169.254.0.0/16 before a DHCP lease is obtained),
+            // they are not routable and must not be reported as the instance IP
             if (ipFamily.equals("ipv4")) {
-                ipv4 = ipPart;
+                if (NetUtils.isLinkLocalIp4(ipPart)) {
+                    logger.debug(String.format("Ignoring link-local ipv4 %s with mac address %s", ipPart, macAddress));
+                } else {
+                    ipv4 = ipPart;
+                }
             } else if (ipFamily.equals("ipv6")) {
-                ipv6 = ipPart;
+                if (NetUtils.isLinkLocalIp6(ipPart)) {
+                    logger.debug(String.format("Ignoring link-local ipv6 %s with mac address %s", ipPart, macAddress));
+                } else {
+                    ipv6 = ipPart;
+                }
             }
         }
         logger.debug(String.format("Found ipv4: %s and ipv6: %s with mac address %s", ipv4, ipv6, macAddress));
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapperTest.java
index f104eadd18be..b1d6e8d99643 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapperTest.java
@@ -58,6 +58,24 @@ public class LibvirtGetVmIpAddressCommandWrapperTest {
             " Loopback Pseudo-Interface 1    ipv6         ::1/128\n" + //
             " -     -       ipv4        127.0.0.1/8\n";
 
+    // Windows guest that has not obtained a DHCP lease yet and self-assigned an APIPA address
+    private static String VIRSH_DOMIF_OUTPUT_WINDOWS_APIPA = " Name       MAC address          Protocol     Address\n" + //
+            "-------------------------------------------------------------------------------\n" + //
+            " Ethernet   02:01:00:d0:00:87    ipv6         fe80::df84:2984:e396:8ac3%6/64\n" + //
+            " -          -                    ipv4         169.254.149.120/16\n" + //
+            " Loopback Pseudo-Interface 1                      ipv6         ::1/128\n" + //
+            " -          -                    ipv4         127.0.0.1/8\n";
+
+    // Same Windows guest once the DHCP lease has been obtained
+    private static String VIRSH_DOMIF_OUTPUT_WINDOWS_DHCP = " Name       MAC address          Protocol     Address\n" + //
+            "-------------------------------------------------------------------------------\n" + //
+            " Ethernet   02:01:00:d0:00:87    ipv6         fd00:ac19:0:1910:0:d3fc:4177:2c32/128\n" + //
+            " -          -                    ipv6         fe80::df84:2984:e396:8ac3%6/64\n" + //
+            " -          -                    ipv4         172.25.16.236/22\n" + //
+            " -          -                    ipv4         169.254.149.120/16\n" + //
+            " Loopback Pseudo-Interface 1                      ipv6         ::1/128\n" + //
+            " -          -                    ipv4         127.0.0.1/8\n";
+
     @Before
     public void setUp() {
         MockitoAnnotations.openMocks(this);
@@ -324,6 +342,38 @@ public void testIpFromWindowsRegistryCommandExecutionFailure() {
         }
     }
 
+    private Answer executeOnL2Network(String domIfOutput, boolean windows) {
+        LibvirtComputingResource libvirtComputingResource = mock(LibvirtComputingResource.class);
+        GetVmIpAddressCommand getVmIpAddressCommand = mock(GetVmIpAddressCommand.class);
+        LibvirtGetVmIpAddressCommandWrapper commandWrapper = new LibvirtGetVmIpAddressCommandWrapper();
+        try (MockedStatic<Script> scriptMock = mockStatic(Script.class)) {
+            when(getVmIpAddressCommand.getVmName()).thenReturn("i-2-187-VM");
+            // L2 networks have no CIDR
+            when(getVmIpAddressCommand.getVmNetworkCidr()).thenReturn(null);
+            when(getVmIpAddressCommand.getMacAddress()).thenReturn("02:01:00:d0:00:87");
+            when(getVmIpAddressCommand.isWindows()).thenReturn(windows);
+            when(Script.executePipedCommands(anyList(), anyLong())).thenReturn(new Pair<>(0, domIfOutput));
+
+            return commandWrapper.execute(getVmIpAddressCommand, libvirtComputingResource);
+        }
+    }
+
+    @Test
+    public void testExecuteWithWindowsVmOnlyApipaAddressOnL2Network() {
+        Answer answer = executeOnL2Network(VIRSH_DOMIF_OUTPUT_WINDOWS_APIPA, true);
+
+        assertFalse(answer.getResult());
+        assertNull(answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteWithWindowsVmDhcpAndApipaAddressOnL2Network() {
+        Answer answer = executeOnL2Network(VIRSH_DOMIF_OUTPUT_WINDOWS_DHCP, true);
+
+        assertTrue(answer.getResult());
+        assertEquals("172.25.16.236", answer.getDetails());
+    }
+
     @Test
     public void testInit() {
         MockedStatic<Script> scriptMock = null;
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 7636ef6b152c..24688443c439 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -808,6 +808,15 @@ protected void runInContext() {
                             nic.setIPv4Address(null);
                             _nicDao.update(nicId, nic);
                         }
+                    } else if (NetUtils.isLinkLocalIp4(vmIp)) {
+                        // a link-local (APIPA) address means the guest has not obtained a DHCP lease yet; do not record it,
+                        // clear any previously recorded link-local address and keep retrying within the retry budget
+                        logger.debug("Instance [ID: {}, UUID: {}, name: {}] - ignoring link-local IP {}, DHCP lease not obtained yet",
+                                vmId, vmUuid, vmName, vmIp);
+                        if (nic != null && NetUtils.isLinkLocalIp4(nic.getIPv4Address())) {
+                            nic.setIPv4Address(null);
+                            _nicDao.update(nicId, nic);
+                        }
                     } else if (NetUtils.isValidIp4(vmIp)) {
                         // set this vm ip addr in vm nic.
                         if (nic != null) {
@@ -2522,7 +2531,8 @@ private void loadVmDetailsInMapForExternalDhcpIp() {
                 List<NicVO> nics = _nicDao.listByNetworkId(network.getId());
 
                 for (NicVO nic : nics) {
-                    if (nic.getIPv4Address() == null) {
+                    // also retry NICs holding a link-local (APIPA) address recorded before the guest obtained its DHCP lease
+                    if (nic.getIPv4Address() == null || NetUtils.isLinkLocalIp4(nic.getIPv4Address())) {
                         long nicId = nic.getId();
                         long vmId = nic.getInstanceId();
                         VMInstanceVO vmInstance = _vmInstanceDao.findById(vmId);
diff --git a/utils/src/main/java/com/cloud/utils/net/NetUtils.java b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
index d89d9fa2d93c..8e65f4afe4b2 100644
--- a/utils/src/main/java/com/cloud/utils/net/NetUtils.java
+++ b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
@@ -1039,6 +1039,33 @@ public static String getLinkLocalCIDR() {
         return "169.254.0.0/16";
     }
 
+    /**
+     * Returns true if the given address is a valid IPv4 link-local (APIPA, RFC 3927) address, i.e. within 169.254.0.0/16.
+     * Such an address is self-assigned by a guest when no DHCP lease has been obtained.
+     */
+    public static boolean isLinkLocalIp4(final String ip) {
+        return isValidIp4(ip) && isIpWithInCidrRange(ip, getLinkLocalCIDR());
+    }
+
+    /**
+     * Returns true if the given address is a valid IPv6 link-local address, i.e. within fe80::/10.
+     * A zone index suffix (e.g. "fe80::1%6") is accepted and ignored.
+     */
+    public static boolean isLinkLocalIp6(final String ip) {
+        if (ip == null) {
+            return false;
+        }
+        final String address = ip.split("%")[0];
+        if (!isValidIp6(address)) {
+            return false;
+        }
+        try {
+            return InetAddress.getByName(address).isLinkLocalAddress();
+        } catch (final UnknownHostException e) {
+            return false;
+        }
+    }
+
     public static String getLinkLocalFirstAddressFromCIDR(final String cidr) {
         SubnetUtils subnetUtils = new SubnetUtils(cidr);
         return subnetUtils.getInfo().getLowAddress();
diff --git a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
index 5c9d41f90a25..7c1413e376a4 100644
--- a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
+++ b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
@@ -955,4 +955,26 @@ public void testVpnIpRange() {
         String cidr = NetUtils.transformCidr(startIp + "/" + cidrSize);
         Assert.assertEquals("10.1.2.0/28", cidr);
     }
+
+    @Test
+    public void testIsLinkLocalIp4() {
+        Assert.assertTrue(NetUtils.isLinkLocalIp4("169.254.149.120"));
+        Assert.assertTrue(NetUtils.isLinkLocalIp4("169.254.0.1"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp4("172.25.16.236"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp4("169.255.0.1"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp4("fe80::1"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp4("not-an-ip"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp4(null));
+    }
+
+    @Test
+    public void testIsLinkLocalIp6() {
+        Assert.assertTrue(NetUtils.isLinkLocalIp6("fe80::df84:2984:e396:8ac3"));
+        Assert.assertTrue(NetUtils.isLinkLocalIp6("fe80::df84:2984:e396:8ac3%6"));
+        Assert.assertTrue(NetUtils.isLinkLocalIp6("febf::1"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6("fd00:ac19:0:1910:0:d3fc:4177:2c32"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6("::1"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6("169.254.149.120"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6(null));
+    }
 }

From 52c4e0d0b2ea93e84a755964b9ef0d34889ba97b Mon Sep 17 00:00:00 2001
From: nvazquez <nicovazquez90@gmail.com>
Date: Tue, 13 Oct 2026 12:10:52 -0300
Subject: [PATCH 2/2] Address review comments

---
 .../main/java/com/cloud/vm/UserVmManagerImpl.java  | 14 +++++++++++---
 .../main/java/com/cloud/utils/net/NetUtils.java    |  3 ++-
 .../java/com/cloud/utils/net/NetUtilsTest.java     |  3 +++
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 24688443c439..5123cc203d35 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -810,9 +810,11 @@ protected void runInContext() {
                         }
                     } else if (NetUtils.isLinkLocalIp4(vmIp)) {
                         // a link-local (APIPA) address means the guest has not obtained a DHCP lease yet; do not record it,
-                        // clear any previously recorded link-local address and keep retrying within the retry budget
+                        // clear any previously recorded link-local address and keep retrying without consuming the retry budget
+                        // (consistent with KVM, which reports this case as a failed answer), so a late DHCP lease is still picked up
                         logger.debug("Instance [ID: {}, UUID: {}, name: {}] - ignoring link-local IP {}, DHCP lease not obtained yet",
                                 vmId, vmUuid, vmName, vmIp);
+                        decrementCount = false;
                         if (nic != null && NetUtils.isLinkLocalIp4(nic.getIPv4Address())) {
                             nic.setIPv4Address(null);
                             _nicDao.update(nicId, nic);
@@ -2531,8 +2533,14 @@ private void loadVmDetailsInMapForExternalDhcpIp() {
                 List<NicVO> nics = _nicDao.listByNetworkId(network.getId());
 
                 for (NicVO nic : nics) {
-                    // also retry NICs holding a link-local (APIPA) address recorded before the guest obtained its DHCP lease
-                    if (nic.getIPv4Address() == null || NetUtils.isLinkLocalIp4(nic.getIPv4Address())) {
+                    // a link-local (APIPA) address recorded before the guest obtained its DHCP lease is not a valid instance IP,
+                    // clear it so it is no longer exposed and the NIC is retried as one without an IP
+                    if (NetUtils.isLinkLocalIp4(nic.getIPv4Address())) {
+                        logger.debug("Clearing link-local IP {} recorded for NIC {}", nic.getIPv4Address(), nic);
+                        nic.setIPv4Address(null);
+                        _nicDao.update(nic.getId(), nic);
+                    }
+                    if (nic.getIPv4Address() == null) {
                         long nicId = nic.getId();
                         long vmId = nic.getInstanceId();
                         VMInstanceVO vmInstance = _vmInstanceDao.findById(vmId);
diff --git a/utils/src/main/java/com/cloud/utils/net/NetUtils.java b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
index 8e65f4afe4b2..b3ef3f523901 100644
--- a/utils/src/main/java/com/cloud/utils/net/NetUtils.java
+++ b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
@@ -1055,7 +1055,8 @@ public static boolean isLinkLocalIp6(final String ip) {
         if (ip == null) {
             return false;
         }
-        final String address = ip.split("%")[0];
+        final int zoneIndex = ip.indexOf('%');
+        final String address = zoneIndex >= 0 ? ip.substring(0, zoneIndex) : ip;
         if (!isValidIp6(address)) {
             return false;
         }
diff --git a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
index 7c1413e376a4..630409838f0a 100644
--- a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
+++ b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
@@ -976,5 +976,8 @@ public void testIsLinkLocalIp6() {
         Assert.assertFalse(NetUtils.isLinkLocalIp6("::1"));
         Assert.assertFalse(NetUtils.isLinkLocalIp6("169.254.149.120"));
         Assert.assertFalse(NetUtils.isLinkLocalIp6(null));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6("%"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6("%6"));
+        Assert.assertFalse(NetUtils.isLinkLocalIp6(""));
     }
 }