[PATCH docs/manager/network/proxmox{-ve-rs,-perl-rs} 0/5] Add MTU setting to WireGuard interfaces

[PATCH docs/manager/network/proxmox{-ve-rs,-perl-rs} 0/5] Add MTU setting to WireGuard interfaces

[Stefan Hanreich]

This patch series adds support for configuring the MTU for WireGuard interfaces.
Since changing the default value in the API would be breaking, make it a soft
default by pre-filling the MTU value in the UI with 1420, which should work for
most use-cases, as it is the maximum MTU possible if using Ethernet with IPv6.


proxmox-ve-rs:

Stefan Hanreich (1):
  wireguard: add mtu option to wireguard interface properties

 .../sdn/fabric/section_config/protocol/wireguard.rs | 13 +++++++++++++
 1 file changed, 13 insertions(+)


proxmox-perl-rs:

Stefan Hanreich (1):
  fabrics: wireguard: render mtu to interface config

 pve-rs/src/bindings/sdn/fabrics.rs | 5 +++++
 1 file changed, 5 insertions(+)


pve-network:

Stefan Hanreich (1):
  fabrics: wireguard: add mtu to interface properties

 src/PVE/Network/SDN/Fabrics.pm | 7 +++++++
 1 file changed, 7 insertions(+)


pve-manager:

Stefan Hanreich (1):
  fabrics: wireguard: add mtu to interface properties

 www/manager6/sdn/fabrics/wireguard/InterfacePanel.js | 9 +++++++++
 1 file changed, 9 insertions(+)


pve-docs:

Stefan Hanreich (1):
  sdn: fabrics: wireguard: document mtu option

 pvesdn.adoc | 2 ++
 1 file changed, 2 insertions(+)


Summary over all repositories:
  5 files changed, 36 insertions(+), 0 deletions(-)

-- 
Generated by murpp 0.12.0

[PATCH proxmox-ve-rs 1/5] wireguard: add mtu option to wireguard interface properties

[Stefan Hanreich]

This allows users to explicitly set the MTU that should be configured
for the WireGuard interface.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 .../sdn/fabric/section_config/protocol/wireguard.rs | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs b/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
index a2d8c6e..aaeef35 100644
--- a/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
+++ b/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
@@ -529,6 +529,10 @@ pub struct WireGuardInterfaceProperties {
     /// whether to generate an IPv6 link-local address for this interface
     #[serde(skip_serializing_if = "Option::is_none")]
     pub(crate) ip6_ll: Option<bool>,
+
+    /// The MTU for this WireGuard interface.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) mtu: Option<u16>,
 }
 
 impl WireGuardInterfaceProperties {
@@ -551,6 +555,11 @@ impl WireGuardInterfaceProperties {
     pub fn ip6(&self) -> Option<&Ipv6Cidr> {
         self.ip6.as_ref()
     }
+
+    /// Get the MTU set for this interface
+    pub fn mtu(&self) -> Option<u16> {
+        self.mtu
+    }
 }
 
 /// Determines whether the given `PersistentKeepalive` value means that it is
@@ -590,6 +599,10 @@ pub struct WireGuardInterfaceCreateProperties {
     /// whether to generate an IPv6 link-local address for this interface
     #[serde(skip_serializing_if = "Option::is_none")]
     pub(crate) ip6_ll: Option<bool>,
+
+    /// The MTU for this WireGuard interface.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) mtu: Option<u16>,
 }
 
 pub mod private_keys {
-- 
2.47.3

[PATCH proxmox-perl-rs 2/5] fabrics: wireguard: render mtu to interface config

[Stefan Hanreich]

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 pve-rs/src/bindings/sdn/fabrics.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pve-rs/src/bindings/sdn/fabrics.rs b/pve-rs/src/bindings/sdn/fabrics.rs
index f96b6b1..f4301af 100644
--- a/pve-rs/src/bindings/sdn/fabrics.rs
+++ b/pve-rs/src/bindings/sdn/fabrics.rs
@@ -563,6 +563,11 @@ pub mod pve_rs_sdn_fabrics {
 
         writeln!(interface, "\tlink-type wireguard")?;
         writeln!(interface, "\tip-forward 1")?;
+
+        if let Some(mtu) = wireguard_interface.mtu() {
+            writeln!(interface, "\tmtu {mtu}")?;
+        }
+
         writeln!(
             interface,
             "\tpost-up wg syncconf {name} /etc/wireguard/proxmox/{name}.conf"
-- 
2.47.3

[PATCH pve-network 3/5] fabrics: wireguard: add mtu to interface properties

[Stefan Hanreich]

The minimum value is based on the minimum datagram size of an IPv4
packet, as mandated by RFC 791.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 src/PVE/Network/SDN/Fabrics.pm | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/PVE/Network/SDN/Fabrics.pm b/src/PVE/Network/SDN/Fabrics.pm
index 4f842f10..6fa9b150 100644
--- a/src/PVE/Network/SDN/Fabrics.pm
+++ b/src/PVE/Network/SDN/Fabrics.pm
@@ -104,6 +104,13 @@ PVE::JSONSchema::register_format(
             minimum => 1,
             maximum => 65535,
         },
+        mtu => {
+            type => 'number',
+            description => 'The MTU to use for this interface.',
+            optional => 1,
+            minimum => 576,
+            maximum => 65535,
+        },
     },
 );
 
-- 
2.47.3

[PATCH pve-manager 4/5] fabrics: wireguard: add mtu to interface properties

[Stefan Hanreich]

The minimum value of 576 is based on the minimum datagram size a node
must be able to handle, as according to RFC 791. In practice, MTU
values should be significantly higher anyway. Make 1420 a soft-default
by prefilling the MTU field. This allows for making it the de-facto
default without breaking the current behavior of the API.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 www/manager6/sdn/fabrics/wireguard/InterfacePanel.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/www/manager6/sdn/fabrics/wireguard/InterfacePanel.js b/www/manager6/sdn/fabrics/wireguard/InterfacePanel.js
index 80fe6919f..1969ceced 100644
--- a/www/manager6/sdn/fabrics/wireguard/InterfacePanel.js
+++ b/www/manager6/sdn/fabrics/wireguard/InterfacePanel.js
@@ -368,6 +368,14 @@ Ext.define('PVE.sdn.Fabric.WireGuard.InterfacePanel', {
                     emptyText: '2001:db8::1/64',
                     isFormField: false,
                 },
+                {
+                    fieldLabel: gettext('MTU'),
+                    bind: '{selectedInterface.mtu}',
+                    xtype: 'proxmoxintegerfield',
+                    minValue: 576,
+                    maxValue: 65535,
+                    isFormField: false,
+                },
                 {
                     xtype: 'pveSDNWireGuardPeerSelector',
                     reference: 'peerSelector',
@@ -413,6 +421,7 @@ Ext.define('PVE.sdn.Fabric.WireGuard.InterfacePanel', {
                 peers: [],
                 listen_port: listenPort,
                 isCreate: true,
+                mtu: 1420,
             });
 
             let interfaceGrid = me.lookupReference('interfaceGrid');
-- 
2.47.3

[PATCH pve-docs 5/5] sdn: fabrics: wireguard: document mtu option

[Stefan Hanreich]

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 pvesdn.adoc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pvesdn.adoc b/pvesdn.adoc
index a09a443..b5e500b 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -933,6 +933,8 @@ Peers:: A list of peers that should be configured for that interface. All nodes
 that are part of the fabric can be selected as peers - the peer definition will
 be auto-generated from the configuration in the node.
 
+Listen Port:: The MTU that should be configured for this interface.
+
 When defining an interface, Proxmox VE automatically generates a private key
 for it in `/etc/pve/priv/wg-keys.cfg` upon saving the interface, and stores the
 matching public key alongside the interface in the fabric configuration so it
-- 
2.47.3