feat: grammar validators for MAC / hardware-address directives (#501) (#502)

SJrX · Steve Ramage · claude · web-flow · commit fbe0f29af818 · 2026-07-02T16:42:51.000-07:00
* feat: grammar validators for MAC / hardware-address directives (#501) Nine networkd/.link/.netdev directives took a MAC or hardware address but had no value validator (key recognized, value accepted unconditionally). Add grammar-based validators faithful to how systemd actually parses each, verified against src/basic/ether-addr-util.c. Two shared combinators: MAC_ADDRESS — a 6-byte Ethernet MAC (parse_ether_addr): colon, hyphen, or dot separators. HARDWARE_ADDRESS — parse_hw_addr_full(expected_len=0): 4/6/16/20-byte hardware addresses in colon/hyphen (1-byte) or dot (2-byte) fields, AND — since the parser tries in_addr_from_string first — IPv4/IPv6 literals. Wired up (parser, ltype) -> validator: hw_addrs Match.MACAddress / PermanentMACAddress (list, hw addr) hw_addr Link.MACAddress (single hw addr) neighbor_section Neighbor.LinkLayerAddress (+dep MACAddress) (hw addr) sr_iov_mac SR-IOV.MACAddress (6-byte MAC) fdb_hwaddr BridgeFDB.MACAddress (6-byte MAC) dhcp_static_lease DHCPServerStaticLease.MACAddress (6-byte MAC) netdev_hw_addr NetDev/Peer.MACAddress (6-byte MAC) macsec_hw_address MACsec*.MACAddress (6-byte MAC) ether_addrs MACVLAN/MACVTAP.SourceMACAddress (list, 6-byte MAC) Longest group-count alternatives come first so the classic first-full-match matcher never stops on a shorter prefix. Purely additive: these previously resolved to NullOptionValue. Covered by a new-engine grammar test and a classic-engine inspection wiring test; whole suite green under both engines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: verify IPv6 canonicalization composes with hardware-address fields (#501) Because a HARDWARE_ADDRESS field (Match=, Link=, Neighbor=) accepts IPv6 literals via the shared IPV6_ADDR combinator — which carries SemanticTag.IPV6 — the RFC 5952 canonicalization inspection and its quick-fix work there too. Add tests proving: a non-canonical IPv6 in Match=/Link= is flagged and rewritten (including rewriting only the IPv6 within a list, exercising the quick-fix offset); a plain MAC is untouched; and a strict 6-byte MAC field (SR-IOV=) never triggers it. Also assert both combinators colour as a single Role.LITERAL span. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor: wrap only the raw-hex hardware-address forms in the literal label (#501) HARDWARE_ADDRESS wrapped its whole alternation in Labeled(Role.LITERAL), but two branches — IPV4_ADDR and IPV6_ADDR — are already Labeled (IPv6 also carries SemanticTag.IPV6). So an IP literal got a redundant second literal region over the same span. Move the wrapper down onto just the raw-hex forms (RAW_HARDWARE_ADDRESS) and let the already-labeled IP forms sit beside it, so every accepted value now colours as exactly one region. No matching change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Steve Ramage <gitcommits@sjrx.net> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/AiGenerated.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/AiGenerated.kt
@@ -273,6 +273,17 @@ fun getAllAIGeneratedValidators(): Map<Validator, OptionValueInformation> {
     Validator("config_parse_fdname", "0") to ConfigParseFdnameOptionValue() as OptionValueInformation,
     Validator("config_parse_udev_property_name", "0") to ConfigParseUdevPropertyNameOptionValue() as OptionValueInformation,
 
+    // MAC / hardware address directives (#501).
+    Validator("config_parse_hw_addrs", "0") to ConfigParseHwAddrsOptionValue() as OptionValueInformation,
+    Validator("config_parse_hw_addr", "0") to ConfigParseHwAddrOptionValue() as OptionValueInformation,
+    Validator("config_parse_neighbor_section", "NEIGHBOR_LINK_LAYER_ADDRESS") to ConfigParseNeighborLinkLayerAddressOptionValue() as OptionValueInformation,
+    Validator("config_parse_sr_iov_mac", "0") to ConfigParseSrIovMacOptionValue() as OptionValueInformation,
+    Validator("config_parse_fdb_hwaddr", "0") to ConfigParseFdbHwaddrOptionValue() as OptionValueInformation,
+    Validator("config_parse_dhcp_static_lease_hwaddr", "0") to ConfigParseDhcpStaticLeaseHwaddrOptionValue() as OptionValueInformation,
+    Validator("config_parse_netdev_hw_addr", "ETH_ALEN") to ConfigParseNetdevHwAddrOptionValue() as OptionValueInformation,
+    Validator("config_parse_macsec_hw_address", "0") to ConfigParseMacsecHwAddressOptionValue() as OptionValueInformation,
+    Validator("config_parse_ether_addrs", "0") to ConfigParseEtherAddrsOptionValue() as OptionValueInformation,
+
   )
 
   return allValidators
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseDhcpStaticLeaseHwaddrOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseDhcpStaticLeaseHwaddrOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [DHCPServerStaticLease] MACAddress= (.network).
+ * C Function: config_parse_dhcp_static_lease_hwaddr -> parse_ether_addr (a single 6-byte Ethernet MAC).
+ */
+class ConfigParseDhcpStaticLeaseHwaddrOptionValue : SimpleGrammarOptionValues(
+    "config_parse_dhcp_static_lease_hwaddr",
+    SequenceCombinator(MAC_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseEtherAddrsOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseEtherAddrsOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [MACVLAN] SourceMACAddress= and [MACVTAP] SourceMACAddress= (.netdev).
+ * C Function: config_parse_ether_addrs -> a whitespace-separated list of 6-byte Ethernet MACs.
+ */
+class ConfigParseEtherAddrsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_ether_addrs",
+    SequenceCombinator(MAC_ADDRESS, ZeroOrMore(SequenceCombinator(WhitespaceTerminal(), MAC_ADDRESS)), EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseFdbHwaddrOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseFdbHwaddrOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [BridgeFDB] MACAddress= (.network).
+ * C Function: config_parse_fdb_hwaddr -> parse_ether_addr (a single 6-byte Ethernet MAC).
+ */
+class ConfigParseFdbHwaddrOptionValue : SimpleGrammarOptionValues(
+    "config_parse_fdb_hwaddr",
+    SequenceCombinator(MAC_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseHwAddrOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseHwAddrOptionValue.kt
@@ -0,0 +1,14 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [Link] MACAddress= (.network, .link).
+ * C Function: config_parse_hw_addr (ltype 0) -> parse_hw_addr_full(expected_len = 0): a single 4/6/16/20-byte
+ * hardware address in colon/hyphen/dot notation, or an IPv4/IPv6 address literal.
+ */
+class ConfigParseHwAddrOptionValue : SimpleGrammarOptionValues(
+    "config_parse_hw_addr",
+    SequenceCombinator(HARDWARE_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseHwAddrsOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseHwAddrsOptionValue.kt
@@ -0,0 +1,14 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [Match] MACAddress= and [Match] PermanentMACAddress= (.network, .link).
+ * C Function: config_parse_hw_addrs (ltype 0) -> a whitespace-separated list of hardware addresses, each
+ * a 4/6/16/20-byte address in colon/hyphen/dot notation, or an IPv4/IPv6 address literal.
+ */
+class ConfigParseHwAddrsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_hw_addrs",
+    SequenceCombinator(HARDWARE_ADDRESS, ZeroOrMore(SequenceCombinator(WhitespaceTerminal(), HARDWARE_ADDRESS)), EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseMacsecHwAddressOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseMacsecHwAddressOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [MACsecReceiveChannel] MACAddress= and [MACsecReceiveAssociation] MACAddress= (.netdev).
+ * C Function: config_parse_macsec_hw_address -> parse_ether_addr (a single 6-byte Ethernet MAC).
+ */
+class ConfigParseMacsecHwAddressOptionValue : SimpleGrammarOptionValues(
+    "config_parse_macsec_hw_address",
+    SequenceCombinator(MAC_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseNeighborLinkLayerAddressOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseNeighborLinkLayerAddressOptionValue.kt
@@ -0,0 +1,14 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [Neighbor] LinkLayerAddress= (and the deprecated [Neighbor] MACAddress= alias) (.network).
+ * C Function: config_parse_neighbor_section (ltype NEIGHBOR_LINK_LAYER_ADDRESS) -> config_parse_hw_addr with
+ * expected_len = 0: a single 4/6/16/20-byte hardware address, or an IPv4/IPv6 address literal.
+ */
+class ConfigParseNeighborLinkLayerAddressOptionValue : SimpleGrammarOptionValues(
+    "config_parse_neighbor_section",
+    SequenceCombinator(HARDWARE_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseNetdevHwAddrOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseNetdevHwAddrOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [NetDev] MACAddress= and [Peer] MACAddress= (.netdev).
+ * C Function: config_parse_netdev_hw_addr (ltype ETH_ALEN) -> a single 6-byte Ethernet MAC.
+ */
+class ConfigParseNetdevHwAddrOptionValue : SimpleGrammarOptionValues(
+    "config_parse_netdev_hw_addr",
+    SequenceCombinator(MAC_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseSrIovMacOptionValue.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseSrIovMacOptionValue.kt
@@ -0,0 +1,13 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.*
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+
+/**
+ * Validator for [SR-IOV] MACAddress= (.network, .link).
+ * C Function: config_parse_sr_iov_mac -> parse_ether_addr (a single 6-byte Ethernet MAC).
+ */
+class ConfigParseSrIovMacOptionValue : SimpleGrammarOptionValues(
+    "config_parse_sr_iov_mac",
+    SequenceCombinator(MAC_ADDRESS, EOF())
+)
diff --git a/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/grammar/Combinators.kt b/src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/grammar/Combinators.kt
@@ -107,3 +107,47 @@ var IPV4_ADDR_PREFIX_LIST = SequenceCombinator(IPV4_ADDR_AND_PREFIX_OR_SPECIAL,
 var IPV6_ADDR_PREFIX_LIST = SequenceCombinator(IPV6_ADDR_AND_PREFIX_OR_SPECIAL, ZeroOrMore(SequenceCombinator(WhitespaceTerminal(), IPV6_ADDR_AND_PREFIX_OR_SPECIAL)))
 
 
+// ---------------------------------------------------------------------------------------------------
+// Hardware / MAC addresses (systemd src/basic/ether-addr-util.c). systemd's parse_hw_addr_full accepts
+// three separator styles for the raw hex form:
+//   colon / hyphen — 1-byte fields (1-2 hex digits each):   00:11:22:33:44:55  /  00-11-22-33-44-55
+//   dot            — 2-byte fields (1-4 hex digits each):    0011.2233.4455
+val HYPHEN = LiteralChoiceTerminal("-")
+private val HW_ADDR_BYTE = RegexTerminal("[0-9a-fA-F]{1,2}", "[0-9a-fA-F]{1,2}")   // one 1-byte field
+private val HW_ADDR_WORD = RegexTerminal("[0-9a-fA-F]{1,4}", "[0-9a-fA-F]{1,4}")   // one 2-byte field
+
+// [count] groups of [group] separated by [sep]:  group (sep group){count-1}.
+private fun hwAddrGroups(group: Combinator, sep: Combinator, count: Int): Combinator =
+  SequenceCombinator(group, Repeat(SequenceCombinator(sep, group), count - 1, count - 1))
+
+// A 6-byte Ethernet MAC address, i.e. systemd parse_ether_addr (expected_len == ETH_ALEN). Used by
+// SR-IOV=, BridgeFDB=, DHCPServerStaticLease=, MACsec*=, NetDev/Peer= and MACVLAN/MACVTAP source.
+val MAC_ADDRESS = Labeled(Role.LITERAL, AlternativeCombinator(
+  hwAddrGroups(HW_ADDR_BYTE, COLON, 6),
+  hwAddrGroups(HW_ADDR_BYTE, HYPHEN, 6),
+  hwAddrGroups(HW_ADDR_WORD, DOT, 3),
+))
+
+// The raw hex forms of a hardware address (colon/hyphen use 1-byte fields → 4/6/16/20 groups; dot uses
+// 2-byte fields → 2/3/8/10 groups). Longest group counts come first so the classic (first-full-match)
+// matcher never stops on a shorter prefix. Wrapped once so the whole address reads as a single literal
+// span rather than per-field.
+private val RAW_HARDWARE_ADDRESS = Labeled(Role.LITERAL, AlternativeCombinator(
+  hwAddrGroups(HW_ADDR_BYTE, COLON, 20), hwAddrGroups(HW_ADDR_BYTE, COLON, 16), hwAddrGroups(HW_ADDR_BYTE, COLON, 6), hwAddrGroups(HW_ADDR_BYTE, COLON, 4),
+  hwAddrGroups(HW_ADDR_BYTE, HYPHEN, 20), hwAddrGroups(HW_ADDR_BYTE, HYPHEN, 16), hwAddrGroups(HW_ADDR_BYTE, HYPHEN, 6), hwAddrGroups(HW_ADDR_BYTE, HYPHEN, 4),
+  hwAddrGroups(HW_ADDR_WORD, DOT, 10), hwAddrGroups(HW_ADDR_WORD, DOT, 8), hwAddrGroups(HW_ADDR_WORD, DOT, 3), hwAddrGroups(HW_ADDR_WORD, DOT, 2),
+))
+
+// A hardware address as accepted by parse_hw_addr_full with expected_len == 0 (Match=, Link=,
+// Neighbor.LinkLayerAddress=). Besides 6-byte MACs it accepts 4-, 16- and 20-byte (Infiniband)
+// hardware addresses, and — because the parser first tries in_addr_from_string — plain IPv4 and IPv6
+// address literals. IPV4_ADDR / IPV6_ADDR are already Labeled (IPv6 also carries SemanticTag.IPV6), so
+// they sit alongside the wrapped raw forms rather than inside a second wrapper — a whole-alternation
+// Labeled would emit a redundant second literal region over an IP literal's span.
+val HARDWARE_ADDRESS = AlternativeCombinator(
+  IPV6_ADDR,
+  IPV4_ADDR,
+  RAW_HARDWARE_ADDRESS,
+)
+
+
diff --git a/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/inspections/ai/MacAddressInspectionTest.kt b/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/inspections/ai/MacAddressInspectionTest.kt
@@ -0,0 +1,79 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.inspections.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.AbstractUnitFileTest
+import net.sjrx.intellij.plugins.systemdunitfiles.inspections.InvalidValueInspection
+import org.junit.Test
+
+/**
+ * End-to-end (default/classic engine) wiring tests for the MAC / hardware-address validators (#501):
+ * each directive resolves to its grammar validator, accepts a well-formed value, and flags a bad one.
+ * The grammar itself is covered in depth by MacAddressGrammarTest; this proves the section/key -> parser
+ * mapping and that the grammar also matches under the original SyntacticMatch/SemanticMatch path.
+ */
+class MacAddressInspectionTest : AbstractUnitFileTest() {
+
+  private fun highlights(fileName: String, text: String): Int {
+    setupFileInEditor(fileName, text)
+    enableInspection(InvalidValueInspection::class.java)
+    return myFixture.doHighlighting().size
+  }
+
+  // A well-formed value must produce no InvalidValue highlights.
+  private fun assertAccepted(fileName: String, text: String) = assertEquals(0, highlights(fileName, text))
+
+  // A malformed value must be flagged. The classic path can report a partial match as more than one
+  // region, so we only require "at least one" here; MacAddressGrammarTest pins the new-engine outcome.
+  private fun assertRejected(fileName: String, text: String) = assertTrue(highlights(fileName, text) >= 1)
+
+  @Test
+  fun testMatchMacAddressListAcceptsMacsAndIpLiterals() {
+    // config_parse_hw_addrs: whitespace-separated hardware addresses, IP literals allowed.
+    assertAccepted("f.network", "[Match]\nMACAddress=00:11:22:33:44:55 aa-bb-cc-dd-ee-ff 192.168.1.1\n")
+    assertAccepted("f.network", "[Match]\nPermanentMACAddress=0011.2233.4455\n")
+    assertRejected("f.network", "[Match]\nMACAddress=zz:zz:zz:zz:zz:zz\n")
+  }
+
+  @Test
+  fun testLinkMacAddressAcceptsIpLiteralButNotBadLength() {
+    // config_parse_hw_addr (expected_len == 0): single hardware address or IP literal.
+    assertAccepted("f.network", "[Link]\nMACAddress=2001:db8::1\n")
+    assertAccepted("f.link", "[Link]\nMACAddress=00:11:22:33:44:55\n")
+    assertRejected("f.network", "[Link]\nMACAddress=00:11:22\n")
+  }
+
+  @Test
+  fun testNeighborLinkLayerAddress() {
+    // config_parse_neighbor_section / NEIGHBOR_LINK_LAYER_ADDRESS -> hardware address or IP literal.
+    assertAccepted("f.network", "[Neighbor]\nLinkLayerAddress=192.168.1.1\n")
+    assertRejected("f.network", "[Neighbor]\nLinkLayerAddress=nonsense\n")
+  }
+
+  @Test
+  fun testSrIovMacRejectsIpLiteral() {
+    // config_parse_sr_iov_mac -> strict 6-byte MAC; an IP literal is invalid here.
+    assertAccepted("f.link", "[SR-IOV]\nMACAddress=00:11:22:33:44:55\n")
+    assertRejected("f.network", "[SR-IOV]\nMACAddress=192.168.1.1\n")
+  }
+
+  @Test
+  fun testBridgeFdbAndDhcpStaticLeaseMac() {
+    assertAccepted("f.network", "[BridgeFDB]\nMACAddress=00-11-22-33-44-55\n")
+    assertRejected("f.network", "[BridgeFDB]\nMACAddress=00:11:22:33\n")
+    assertAccepted("f.network", "[DHCPServerStaticLease]\nMACAddress=de:ad:be:ef:00:01\n")
+  }
+
+  @Test
+  fun testNetdevPeerAndMacsecMac() {
+    // config_parse_netdev_hw_addr (ETH_ALEN) and config_parse_macsec_hw_address -> strict 6-byte MAC.
+    assertAccepted("f.netdev", "[NetDev]\nMACAddress=00:11:22:33:44:55\n")
+    assertRejected("f.netdev", "[NetDev]\nMACAddress=192.168.1.1\n")
+    assertAccepted("f.netdev", "[MACsecReceiveChannel]\nMACAddress=0011.2233.4455\n")
+  }
+
+  @Test
+  fun testMacvlanSourceMacAddressList() {
+    // config_parse_ether_addrs: whitespace-separated list of strict 6-byte MACs (no IP literals).
+    assertAccepted("f.netdev", "[MACVLAN]\nSourceMACAddress=00:11:22:33:44:55 aa:bb:cc:dd:ee:ff\n")
+    assertRejected("f.netdev", "[MACVLAN]\nSourceMACAddress=00:11:22:33:44:55 192.168.1.1\n")
+  }
+}
diff --git a/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/inspections/ai/MacAddressIpv6QuickFixTest.kt b/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/inspections/ai/MacAddressIpv6QuickFixTest.kt
@@ -0,0 +1,81 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.inspections.ai
+
+import com.intellij.lang.annotation.HighlightSeverity
+import net.sjrx.intellij.plugins.systemdunitfiles.AbstractUnitFileTest
+import net.sjrx.intellij.plugins.systemdunitfiles.inspections.Ipv6CanonicalFormInspection
+import net.sjrx.intellij.plugins.systemdunitfiles.settings.ExperimentalSettings
+import org.junit.Test
+
+/**
+ * A hardware-address field (Match=, Link=) accepts IPv6 literals, and those literals carry the
+ * SemanticTag.IPV6 from the shared IPV6_ADDR combinator — so the RFC 5952 canonicalization inspection
+ * and its quick-fix compose with the new MAC validators (#501). A strict 6-byte MAC field, which does
+ * not accept IP literals, must never be touched.
+ */
+class MacAddressIpv6QuickFixTest : AbstractUnitFileTest() {
+
+  override fun tearDown() {
+    try {
+      ExperimentalSettings.getInstance(project).state.useGrammarParseEngine = false
+    } finally {
+      super.tearDown()
+    }
+  }
+
+  private fun enableNewEngine() {
+    ExperimentalSettings.getInstance(project).state.useGrammarParseEngine = true
+  }
+
+  private fun hasCanonicalWarning() = myFixture.doHighlighting().any {
+    it.severity == HighlightSeverity.WEAK_WARNING && it.description?.contains("canonical form") == true
+  }
+
+  @Test
+  fun testNonCanonicalIpv6InMatchIsFlagged() {
+    enableNewEngine()
+    setupFileInEditor("f.network", "[Match]\nMACAddress=2001:DB8::1\n")
+    enableInspection(Ipv6CanonicalFormInspection::class.java)
+    assertTrue(hasCanonicalWarning())
+  }
+
+  @Test
+  fun testPlainMacIsNotFlagged() {
+    enableNewEngine()
+    setupFileInEditor("f.network", "[Match]\nMACAddress=00:11:22:33:44:55\n")
+    enableInspection(Ipv6CanonicalFormInspection::class.java)
+    assertFalse(hasCanonicalWarning())
+  }
+
+  @Test
+  fun testStrictMacFieldNeverColorsAnIpv6() {
+    // SR-IOV.MACAddress is a strict 6-byte MAC: an IPv6 literal is invalid there and, crucially, is
+    // NOT a labeled IPv6 span, so the canonicalization inspection must not fire.
+    enableNewEngine()
+    setupFileInEditor("f.link", "[SR-IOV]\nMACAddress=2001:DB8::1\n")
+    enableInspection(Ipv6CanonicalFormInspection::class.java)
+    assertFalse(hasCanonicalWarning())
+  }
+
+  @Test
+  fun testQuickFixRewritesSingleIpv6() {
+    enableNewEngine()
+    setupFileInEditor("f.network", "[Link]\nMACAddress=2001:D${COMPLETION_POSITION}B8::1\n")
+    enableInspection(Ipv6CanonicalFormInspection::class.java)
+    myFixture.doHighlighting()
+
+    myFixture.launchAction(myFixture.findSingleIntention("Convert to canonical IPv6"))
+    myFixture.checkResult("[Link]\nMACAddress=2001:db8::1\n")
+  }
+
+  @Test
+  fun testQuickFixRewritesOnlyTheIpv6WithinAList() {
+    // Offset handling: the IPv6 sits after a MAC in a Match= list; only it should be rewritten.
+    enableNewEngine()
+    setupFileInEditor("f.network", "[Match]\nMACAddress=00:11:22:33:44:55 2001:D${COMPLETION_POSITION}B8::1\n")
+    enableInspection(Ipv6CanonicalFormInspection::class.java)
+    myFixture.doHighlighting()
+
+    myFixture.launchAction(myFixture.findSingleIntention("Convert to canonical IPv6"))
+    myFixture.checkResult("[Match]\nMACAddress=00:11:22:33:44:55 2001:db8::1\n")
+  }
+}
diff --git a/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/grammar/MacAddressGrammarTest.kt b/src/test/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/grammar/MacAddressGrammarTest.kt
