[pve-devel] [PATCH qemu-server 0/7] RFC: sdn: add ipam support

[pve-devel] [PATCH qemu-server 0/7] RFC: sdn: add ipam support

[Alexandre Derumier]

Hi,

This is an RFC to implement ipam support on qemu-server.

This don't change the cloud-init current working.

As I need to manage pending ip registration configuration, to follow the pending netX interfaces.

I have added ip,ip6,gw,gw6 field to netX interfaces options. (same than LXC).

(as current ipconfigX pending, is pending cloudinit generation)


so the workflow is:

--> update netX=...,ip=.... 
   --> ip is registered as pending
         --> hotplug/coldplug succesful
               ---> pending ip replace current conf oldip
                       ---->the ip set in cloudinit pending ipconfigX
                            ------> cloudinit regeneration
                                 ---> ipconfigX is remove from pending

As documentation said than ipconfigX is for cloudinit config,
I think it could be ok.

Some users could use the sdn features without cloudinit(allow some subnets only, and autogenerate firewall ipfilter).

Also, for ipam, I need bridge && mac from the netX, and ip need to follow pending states of the nic.


The main code is the same than the lxc serie, and can be shared in a common module
https://lists.proxmox.com/pipermail/pve-devel/2021-May/048160.html

(I don't have implemented yet snasphot rollback, vm restore, vm destroy,..)


Alexandre Derumier (7):
  add ipam module
  add print_ipconfig
  add ip options to netdescr
  add vmconfig_update_net_ip on device hotplug
  add vmconfig_delete_net_ip on device unplug
  api2: add update ip support
  api2: add revert ip support

 PVE/API2/Qemu.pm        |  21 ++++++
 PVE/QemuServer.pm       |  93 +++++++++++++++++++++++
 PVE/QemuServer/Ipam.pm  | 158 ++++++++++++++++++++++++++++++++++++++++
 PVE/QemuServer/Makefile |   1 +
 4 files changed, 273 insertions(+)
 create mode 100644 PVE/QemuServer/Ipam.pm

-- 
2.20.1

[pve-devel] [PATCH qemu-server 1/7] add ipam module

[Alexandre Derumier]

This is the same code than lxc, it can be move to a common module later

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/QemuServer/Ipam.pm  | 158 ++++++++++++++++++++++++++++++++++++++++
 PVE/QemuServer/Makefile |   1 +
 2 files changed, 159 insertions(+)
 create mode 100644 PVE/QemuServer/Ipam.pm

diff --git a/PVE/QemuServer/Ipam.pm b/PVE/QemuServer/Ipam.pm
new file mode 100644
index 0000000..37b1595
--- /dev/null
+++ b/PVE/QemuServer/Ipam.pm
@@ -0,0 +1,158 @@
+package PVE::QemuServer::Ipam;
+
+use strict;
+use warnings;
+
+my $have_sdn;
+eval {
+    require PVE::Network::SDN::Zones;
+    $have_sdn = 1;
+};
+
+sub is_static_ip {
+    my ($ip) = @_;
+
+    return 1 if $ip !~ m/(dhcp|manual|auto)$/;
+}
+
+
+sub ip_has_changed {
+    my ($oldip, $ip) = @_;
+
+    return 1 if !$oldip && $ip;
+    return 1 if !$ip && $oldip;
+    return 1 if $ip && $oldip && $ip ne $oldip;
+}
+
+my $add_net_ip = sub {
+    my ($version, $net, $oldnet, $hostname, $oldhostname, $description) = @_;
+
+    my $oldbridge = $oldnet->{bridge};
+    my $bridge = $net->{bridge};
+    my $mac = $net->{hwaddr};
+    my $ipfield = $version == 4 ? "ip" : "ip6";
+    my $ip = $net->{$ipfield};
+    my $oldip = $oldnet->{$ipfield};
+    my $subnets = PVE::Network::SDN::Vnets::get_subnets($bridge);
+    return if !keys %{$subnets};
+
+    eval {
+        if (!$ip) {
+            my $next_free_ip = PVE::Network::SDN::Vnets::get_next_free_cidr($bridge, $hostname, $mac, $description, $version);
+            $net->{$ipfield} = $next_free_ip if $next_free_ip;
+        } elsif (is_static_ip($ip)) {
+            if (!ip_has_changed($oldip, $ip)) {
+                #update ip attributes if no ip address change
+                PVE::Network::SDN::Vnets::update_cidr($bridge, $ip, $hostname, $oldhostname, $mac, $description);
+            } else {
+                PVE::Network::SDN::Vnets::add_cidr($bridge, $ip, $hostname, $mac, $description);
+            }
+        }
+    };
+    if ($@) {
+        die $@;
+    }
+};
+
+
+my $del_net_ip = sub {
+    my ($version, $oldnet, $net, $hostname, $description) = @_;
+
+    my $oldbridge = $oldnet->{bridge};
+    my $bridge = $net->{bridge};
+    my $ip = $version == 4 ? $net->{ip} : $net->{ip6};
+    my $oldip = $version == 4 ? $oldnet->{ip} : $oldnet->{ip6};
+
+    return if !$oldip || !is_static_ip($oldip);
+
+    my $subnets = PVE::Network::SDN::Vnets::get_subnets($oldbridge);
+    return if !keys %{$subnets};
+
+    eval {
+        PVE::Network::SDN::Vnets::del_cidr($oldbridge, $oldip, $hostname, $description) if !$bridge || $bridge ne $oldbridge || !$ip || $ip ne $oldip;
+    };
+    warn $@ if $@;
+};
+
+
+my $update_net_gateway = sub {
+    my ($version, $net) = @_;
+
+    my $bridge = $net->{bridge};
+    my $netip = $version == 4 ? $net->{ip} : $net->{ip6};
+    my $gwfield = $version == 4 ? "gw" : "gw6";
+
+    return if (!$netip || !is_static_ip($netip));
+
+    my $subnets = PVE::Network::SDN::Vnets::get_subnets($bridge);
+    return if !keys %{$subnets};
+
+    #update gateway
+    my ($ip, $mask) = split(/\//, $netip);
+    my ($subnetid, $subnet) = PVE::Network::SDN::Subnets::find_ip_subnet($ip, $mask, $subnets);
+    my $gw = $subnet->{gateway} if $subnet->{gateway};
+    $net->{$gwfield} = $gw if $gw;
+
+};
+
+sub destroy_net_ip {
+    my ($conf) = @_;
+
+    return if !$have_sdn;
+
+    foreach my $opt (keys %$conf) {
+        next if $opt !~ m/^net(\d+)$/;
+        my $netid = $1;
+        my $oldnet = PVE::LXC::Config->parse_lxc_network($conf->{$opt});
+        my $hostname = $conf->{hostname};
+        my $description = '';
+        delete_net_ip($hostname, $oldnet, undef, $description);
+    }
+}
+
+sub update_net_ip {
+    my ($net, $oldnet, $hostname, $oldhostname, $description) = @_;
+
+    return if !$have_sdn;
+
+    eval {
+        &$add_net_ip(4, $net, $oldnet, $hostname, $oldhostname, $description);
+    };
+    if ($@) {
+        $net->{ip} = $oldnet->{ip};
+        die "can't change ip4: $@\n";
+    }
+
+    eval {
+        &$add_net_ip(6, $net, $oldnet, $hostname, $oldhostname, $description);
+    };
+    if ($@) {
+        my $err = $@;
+        #if error, delete previously added ipv4
+        eval {
+            PVE::Network::SDN::Vnets::del_cidr($net->{bridge}, $net->{ip}, $hostname, $description) if ip_has_changed($oldnet->{ip}, $net->{ip});
+        };
+        $net->{ip6} = $oldnet->{ip6};
+        $net->{ip} = $oldnet->{ip};
+
+        die "error change ipv6: $err\n";
+    }
+
+    delete_net_ip($oldhostname, $oldnet, $net, $description);
+
+    &$update_net_gateway(4, $net);
+    &$update_net_gateway(6, $net);
+}
+
+
+
+sub delete_net_ip {
+    my ($hostname, $oldnet, $net, $description) = @_;
+
+    return if !$have_sdn;
+
+    &$del_net_ip(4, $oldnet, $net, $hostname, $description);
+    &$del_net_ip(6, $oldnet, $net, $hostname, $description);
+}
+
+1;
\ No newline at end of file
diff --git a/PVE/QemuServer/Makefile b/PVE/QemuServer/Makefile
index e4ed184..0292383 100644
--- a/PVE/QemuServer/Makefile
+++ b/PVE/QemuServer/Makefile
@@ -11,6 +11,7 @@ SOURCES=PCI.pm		\
 	CPUConfig.pm	\
 	CGroup.pm	\
 	Drive.pm	\
+	Ipam.pm		\
 
 .PHONY: install
 install: ${SOURCES}
-- 
2.20.1

[pve-devel] [PATCH qemu-server 2/7] add print_ipconfig

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/QemuServer.pm | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 25ac052..a5b6fe8 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -1883,6 +1883,12 @@ sub parse_ipconfig {
     return $res;
 }
 
+sub print_ipconfig {
+    my $ipconfig = shift;
+
+    return PVE::JSONSchema::print_property_string($ipconfig, $ipconfig_fmt);
+}
+
 sub print_net {
     my $net = shift;
 
-- 
2.20.1

[pve-devel] [PATCH qemu-server 3/7] add ip options to netdescr

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/QemuServer.pm | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index a5b6fe8..8d1f177 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -910,6 +910,38 @@ my $net_fmt = {
 	description => "Force MTU, for VirtIO only. Set to '1' to use the bridge MTU",
 	optional => 1,
     },
+    ip => {
+	type => 'string',
+	format => 'pve-ipv4-config',
+	format_description => 'IPv4Format/CIDR',
+	description => 'IPv4 address in CIDR format.',
+	optional => 1,
+	default => 'dhcp',
+    },
+    gw => {
+	type => 'string',
+	format => 'ipv4',
+	format_description => 'GatewayIPv4',
+	description => 'Default gateway for IPv4 traffic.',
+	optional => 1,
+	requires => 'ip',
+    },
+    ip6 => {
+	type => 'string',
+	format => 'pve-ipv6-config',
+	format_description => 'IPv6Format/CIDR',
+	description => 'IPv6 address in CIDR format.',
+	optional => 1,
+	default => 'dhcp',
+    },
+    gw6 => {
+	type => 'string',
+	format => 'ipv6',
+	format_description => 'GatewayIPv6',
+	description => 'Default gateway for IPv6 traffic.',
+	optional => 1,
+	requires => 'ip6',
+    },
 };
 
 my $netdesc = {
-- 
2.20.1

[pve-devel] [PATCH qemu-server 4/7] add vmconfig_update_net_ip on device hotplug

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/QemuServer.pm | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 8d1f177..d1507d6 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -4709,6 +4709,8 @@ sub vmconfig_hotplug_pending {
 		# some changes can be done without hotplug
 		vmconfig_update_net($storecfg, $conf, $hotplug_features->{network},
 				    $vmid, $opt, $value, $arch, $machine_type);
+
+                vmconfig_update_net_ip($conf, $vmid, $1);
 	    } elsif (is_valid_drivename($opt)) {
 		die "skip\n" if $opt eq 'efidisk0';
 		# some changes can be done without hotplug
@@ -4820,6 +4822,10 @@ sub vmconfig_apply_pending {
 	    if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
 		vmconfig_register_unused_drive($storecfg, $vmid, $conf, parse_drive($opt, $conf->{$opt}))
 	    }
+
+	    if($opt =~ m/net(\d+)$/) {
+		vmconfig_update_net_ip($conf, $vmid, $1);
+	    }
 	};
 	if (my $err = $@) {
 	    $add_apply_error->($opt, $err);
@@ -4832,6 +4838,32 @@ sub vmconfig_apply_pending {
     PVE::QemuConfig->write_config($vmid, $conf);
 }
 
+sub vmconfig_update_net_ip {
+    my ($conf, $vmid, $id) = @_;
+
+    my $netid = "net$id";
+    my $ipconfigid = "ipconfig$id";
+    my $net = PVE::QemuServer::parse_net($conf->{pending}->{$netid});
+    my $oldnet = PVE::QemuServer::parse_net($conf->{$netid}) if $conf->{$netid};
+    my $hostname = $conf->{name};
+    my $oldhostname = "pending.".$hostname;
+
+    PVE::QemuServer::Ipam::update_net_ip($net, $net, $hostname, $oldhostname, "vm:$vmid net:$netid");
+    eval {
+	PVE::QemuServer::Ipam::delete_net_ip($hostname, $oldnet, undef, "vm:$vmid net:$netid") if $oldnet;
+    };
+
+    #set ip info as pending in cloud-init config
+    my $ipconfig = {};
+    $ipconfig->{ip} = $net->{ip} if $net->{ip};
+    $ipconfig->{ip6} = $net->{ip6} if $net->{ip6};
+    $ipconfig->{gw} = $net->{gw} if $net->{gw};
+    $ipconfig->{gw6} = $net->{gw6} if $net->{gw6};
+    my $value = PVE::QemuServer::print_ipconfig($ipconfig);
+    $conf->{pending}->{$ipconfigid} = $value;
+
+}
+
 sub vmconfig_update_net {
     my ($storecfg, $conf, $hotplug, $vmid, $opt, $value, $arch, $machine_type) = @_;
 
-- 
2.20.1

[pve-devel] [PATCH qemu-server 5/7] add vmconfig_delete_net_ip on device unplug

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/QemuServer.pm | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index d1507d6..e646503 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -4620,6 +4620,7 @@ sub vmconfig_hotplug_pending {
 	    } elsif ($opt =~ m/^net(\d+)$/) {
 		die "skip\n" if !$hotplug_features->{network};
 		vm_deviceunplug($vmid, $conf, $opt);
+		vmconfig_delete_net_ip($conf, $vmid, $1);
 	    } elsif (is_valid_drivename($opt)) {
 		die "skip\n" if !$hotplug_features->{disk} || $opt =~ m/(ide|sata)(\d+)/;
 		vm_deviceunplug($vmid, $conf, $opt);
@@ -4805,6 +4806,9 @@ sub vmconfig_apply_pending {
 	    } elsif (defined($conf->{$opt}) && is_valid_drivename($opt)) {
 		vmconfig_delete_or_detach_drive($vmid, $storecfg, $conf, $opt, $force);
 	    }
+	    if($opt =~ m/net(\d+)$/) {
+		vmconfig_delete_net_ip($conf, $vmid, $1);
+	    }
 	};
 	if (my $err = $@) {
 	    $add_apply_error->($opt, $err);
@@ -4864,6 +4868,25 @@ sub vmconfig_update_net_ip {
 
 }
 
+sub vmconfig_delete_net_ip {
+    my ($conf, $vmid, $id) = @_;
+
+    my $netid = "net$id";
+    my $ipconfigid = "ipconfig$id";
+    my $net = PVE::QemuServer::parse_net($conf->{pending}->{$netid}) if $conf->{pending}->{$netid};
+    my $oldnet = PVE::QemuServer::parse_net($conf->{$netid}) if $conf->{$netid};
+    my $hostname = $conf->{name};
+    my $pending_hostname = "pending.".$hostname;
+
+    eval {
+	PVE::QemuServer::Ipam::delete_net_ip($hostname, $oldnet, undef, "vm:$vmid net:$netid") if $oldnet;
+    };
+
+    eval {
+	PVE::QemuServer::Ipam::delete_net_ip($pending_hostname, $net, undef, "vm:$vmid net:$netid pending:1") if $net;
+    };
+}
+
 sub vmconfig_update_net {
     my ($storecfg, $conf, $hotplug, $vmid, $opt, $value, $arch, $machine_type) = @_;
 
-- 
2.20.1

[pve-devel] [PATCH qemu-server 6/7] api2: add update ip support

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/API2/Qemu.pm | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 24dba86..e8c7107 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -22,6 +22,7 @@ use PVE::GuestHelpers;
 use PVE::QemuConfig;
 use PVE::QemuServer;
 use PVE::QemuServer::Drive;
+use PVE::QemuServer::Ipam;
 use PVE::QemuServer::CPUConfig;
 use PVE::QemuServer::Monitor qw(mon_cmd);
 use PVE::QemuMigrate;
@@ -1365,6 +1366,23 @@ my $update_vm_api  = sub {
 			die "only root can modify '$opt' config for real devices\n";
 		    }
 		    $conf->{pending}->{$opt} = $param->{$opt};
+		} elsif ($opt =~ m/^net(\d+)/) {
+		    my $netid = $1;
+		    my $net = PVE::QemuServer::parse_net($param->{$opt});
+		    my $hostname = $param->{name} ? $param->{name} : $conf->{name};
+		    if ($conf->{pending}->{$opt}) {
+			my $oldnet = PVE::QemuServer::parse_net($conf->{pending}->{$opt});
+			my $pending_hostname = "pending.".$hostname;
+			PVE::QemuServer::Ipam::update_net_ip($net, $oldnet, $pending_hostname, $pending_hostname, "vm:$vmid net:$netid pending:1");
+		    } elsif ($conf->{$opt}) {
+			my $oldnet = PVE::QemuServer::parse_net($conf->{$opt});
+			my $oldhostname = $conf->{name};
+			PVE::QemuServer::Ipam::update_net_ip($net, $oldnet, $hostname, $oldhostname, "vm:$vmid net:$netid");
+		    } else {
+			PVE::QemuServer::Ipam::update_net_ip($net, undef, $hostname, undef, "vm:$vmid net:$netid");
+		    }
+		    my $value = PVE::QemuServer::print_net($net);
+		    $conf->{pending}->{$opt} = $value;
 		} else {
 		    $conf->{pending}->{$opt} = $param->{$opt};
 
-- 
2.20.1

[pve-devel] [PATCH qemu-server 7/7] api2: add revert ip support

[Alexandre Derumier]

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/API2/Qemu.pm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index e8c7107..014dee6 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -1275,6 +1275,9 @@ my $update_vm_api  = sub {
 		    $modified->{$opt} = 0;
 		    next;
 		}
+		if (defined($conf->{pending}->{$opt}) && $opt =~ m/^net(\d+)$/) {
+		    PVE::QemuServer::vmconfig_delete_net_ip($conf, $vmid, $1);
+		}
 		my $is_pending_val = defined($conf->{pending}->{$opt});
 		delete $conf->{pending}->{$opt};
 
-- 
2.20.1