From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 49F5A1FF0B3 for ; Wed, 09 Sep 2026 12:44:20 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2E09821571; Wed, 09 Sep 2026 12:42:39 +0200 (CEST) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network v2 11/16] sdn: zones: offer dhcp on all zone types, keep dnsmasq simple-only Date: Wed, 9 Sep 2026 12:41:39 +0200 Message-ID: <20260909104144.1110031-12-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260909104144.1110031-1-h.laimer@proxmox.com> References: <20260909104144.1110031-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1788950512951 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.532 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 4VAZLFHXYISQ2DACR6E4OLADPGWQPVGT X-Message-ID-Hash: 4VAZLFHXYISQ2DACR6E4OLADPGWQPVGT X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The dnsmasq backend is confined to simple zones because it is a node-local process on the vnet bridge. On a zone spanning nodes every node's instance would answer the shared broadcast domain. The ebpf backend answers on the guest's own tap and has no such restriction, so the dhcp property is offered on every zone type, with dnsmasq rejected on the others. The backends ask the zone for the guest-facing MTU to serve, so the zone types gaining dhcp report theirs where they have one. Vxlan derived zones take the underlay's MTU minus the encapsulation overhead where their peers name a local interface, the derivation their bridge generation means to apply. Signed-off-by: Hannes Laimer --- src/PVE/API2/Network/SDN/Zones.pm | 8 +- src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 32 +++++++ src/PVE/Network/SDN/Zones/FaucetPlugin.pm | 1 + src/PVE/Network/SDN/Zones/QinQPlugin.pm | 7 ++ src/PVE/Network/SDN/Zones/SimplePlugin.pm | 2 +- src/PVE/Network/SDN/Zones/VlanPlugin.pm | 7 ++ src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 25 +++++ src/test/run_test_vnets_blackbox.pl | 109 +++++++++++++++++++++- 8 files changed, 187 insertions(+), 4 deletions(-) diff --git a/src/PVE/API2/Network/SDN/Zones.pm b/src/PVE/API2/Network/SDN/Zones.pm index 0e90726..2b2aba0 100644 --- a/src/PVE/API2/Network/SDN/Zones.pm +++ b/src/PVE/API2/Network/SDN/Zones.pm @@ -93,7 +93,7 @@ my $ZONE_PROPERTIES = { type => 'string', enum => PVE::Network::SDN::Dhcp->plugin_types(), optional => 1, - description => 'Name of DHCP server backend for this zone.', + description => 'DHCP backend serving the zone, dnsmasq works on simple zones only.', }, 'rt-import' => { type => 'string', @@ -448,6 +448,9 @@ __PACKAGE__->register_method({ raise_param_exc({ ipam => "$ipam not existing" }) if $ipam && !$ipam_cfg->{ids}->{$ipam}; + raise_param_exc({ dhcp => "the dnsmasq backend only supports simple zones" }) + if ($opts->{dhcp} // '') eq 'dnsmasq' && $plugin->type() ne 'simple'; + $zone_cfg->{ids}->{$id} = $opts; $plugin->on_update_hook($id, $zone_cfg, $controller_cfg); @@ -544,6 +547,9 @@ __PACKAGE__->register_method({ raise_param_exc({ ipam => "$ipam not existing" }) if $ipam && !$ipam_cfg->{ids}->{$ipam}; + raise_param_exc({ dhcp => "the dnsmasq backend only supports simple zones" }) + if ($scfg->{dhcp} // '') eq 'dnsmasq' && $plugin->type() ne 'simple'; + $plugin->on_update_hook($id, $zone_cfg, $controller_cfg); PVE::Network::SDN::Zones::write_config($zone_cfg); diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm index 0e79707..60fe788 100644 --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm @@ -125,10 +125,42 @@ sub options { reversedns => { optional => 1 }, dnszone => { optional => 1 }, ipam => { optional => 1 }, + dhcp => { optional => 1 }, }; } # Plugin implementation +# the underlay interface is the one the controller's peers name, found the +# way the bridge generation finds it +sub get_mtu { + my ($class, $plugin_config) = @_; + + return $plugin_config->{mtu} if $plugin_config->{mtu}; + + my $iface; + my $controller_cfg = PVE::Network::SDN::running_config()->{controllers}; + my $controller = $controller_cfg->{ids}->{ $plugin_config->{controller} // '' }; + if ($controller && $controller->{peers}) { + my @peers = PVE::Tools::split_list($controller->{peers}); + my $local_node = PVE::INotify::nodename(); + my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller( + $local_node, $controller_cfg, + ); + my $isisrouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_isis_controller( + $local_node, $controller_cfg, + ); + my $loopback = $bgprouter->{loopback} // $isisrouter->{loopback}; + (undef, $iface) = eval { + PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback); + }; + } + return PVE::Network::SDN::Zones::VxlanPlugin::vxlan_mtu( + $plugin_config, + $iface, + PVE::INotify::read_file('interfaces'), + ); +} + sub generate_sdn_config { my ( $class, diff --git a/src/PVE/Network/SDN/Zones/FaucetPlugin.pm b/src/PVE/Network/SDN/Zones/FaucetPlugin.pm index 5f069ae..4e3f5ef 100644 --- a/src/PVE/Network/SDN/Zones/FaucetPlugin.pm +++ b/src/PVE/Network/SDN/Zones/FaucetPlugin.pm @@ -30,6 +30,7 @@ sub options { reversedns => { optional => 1 }, dnszone => { optional => 1 }, ipam => { optional => 1 }, + dhcp => { optional => 1 }, }; } diff --git a/src/PVE/Network/SDN/Zones/QinQPlugin.pm b/src/PVE/Network/SDN/Zones/QinQPlugin.pm index a75940c..e70912a 100644 --- a/src/PVE/Network/SDN/Zones/QinQPlugin.pm +++ b/src/PVE/Network/SDN/Zones/QinQPlugin.pm @@ -36,6 +36,12 @@ sub properties { }; } +sub get_mtu { + my ($class, $plugin_config) = @_; + + return $plugin_config->{mtu}; +} + sub options { return { nodes => { optional => 1 }, @@ -48,6 +54,7 @@ sub options { reversedns => { optional => 1 }, dnszone => { optional => 1 }, ipam => { optional => 1 }, + dhcp => { optional => 1 }, }; } diff --git a/src/PVE/Network/SDN/Zones/SimplePlugin.pm b/src/PVE/Network/SDN/Zones/SimplePlugin.pm index 347eee9..e8656cc 100644 --- a/src/PVE/Network/SDN/Zones/SimplePlugin.pm +++ b/src/PVE/Network/SDN/Zones/SimplePlugin.pm @@ -31,7 +31,7 @@ sub properties { description => "dns domain zone ex: mydomain.com", }, dhcp => { - description => 'Type of the DHCP backend for this zone', + description => 'DHCP backend serving the zone, dnsmasq works on simple zones only.', type => 'string', enum => PVE::Network::SDN::Dhcp->plugin_types(), }, diff --git a/src/PVE/Network/SDN/Zones/VlanPlugin.pm b/src/PVE/Network/SDN/Zones/VlanPlugin.pm index 9102b34..4f24b2a 100644 --- a/src/PVE/Network/SDN/Zones/VlanPlugin.pm +++ b/src/PVE/Network/SDN/Zones/VlanPlugin.pm @@ -36,6 +36,12 @@ sub properties { }; } +sub get_mtu { + my ($class, $plugin_config) = @_; + + return $plugin_config->{mtu}; +} + sub options { return { @@ -47,6 +53,7 @@ sub options { reversedns => { optional => 1 }, dnszone => { optional => 1 }, ipam => { optional => 1 }, + dhcp => { optional => 1 }, }; } diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm index a408261..0dab5d9 100644 --- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm +++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm @@ -47,6 +47,30 @@ sub properties { }; } +# the vnet bridge takes the underlay interface's MTU minus the vxlan +# encapsulation where the peers name a local interface, the default +# otherwise. An explicit zone MTU wins +sub vxlan_mtu { + my ($plugin_config, $iface, $interfaces_config) = @_; + + return $plugin_config->{mtu} if $plugin_config->{mtu}; + return $interfaces_config->{ifaces}->{$iface}->{mtu} - 50 + if $iface && $interfaces_config->{ifaces}->{$iface}->{mtu}; + return 1450; +} + +sub get_mtu { + my ($class, $plugin_config) = @_; + + my $iface; + if ($plugin_config->{peers}) { + my @peers = PVE::Tools::split_list($plugin_config->{peers}); + (undef, $iface) = + eval { PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers) }; + } + return vxlan_mtu($plugin_config, $iface, PVE::INotify::read_file('interfaces')); +} + sub options { return { nodes => { optional => 1 }, @@ -58,6 +82,7 @@ sub options { dnszone => { optional => 1 }, ipam => { optional => 1 }, fabric => { optional => 1 }, + dhcp => { optional => 1 }, }; } diff --git a/src/test/run_test_vnets_blackbox.pl b/src/test/run_test_vnets_blackbox.pl index 2c11dad..557600a 100755 --- a/src/test/run_test_vnets_blackbox.pl +++ b/src/test/run_test_vnets_blackbox.pl @@ -1438,6 +1438,55 @@ sub test_ipam_cache_case { run_test(\&test_ipam_cache_case); +sub test_zone_dhcp_backends { + my $test_name = (split(/::/, (caller(0))[3]))[-1]; + my $zoneid = "TESTZONE"; + + # dnsmasq answers on the vnet bridge, so it only fits zones confined to + # one node. The ebpf backend answers on the guest's tap and fits any + my $zone = { + type => "vlan", + bridge => "vmbr0", + ipam => "pve", + zone => $zoneid, + }; + eval { PVE::API2::Network::SDN::Zones->create({ %$zone, dhcp => "dnsmasq" }); }; + like( + $@, + qr/dnsmasq backend only supports simple zones/, + "$test_name: dnsmasq is refused on a vlan zone", + ); + + create_zone({ %$zone, dhcp => "ebpf" }); + is(get_zone($zoneid)->{dhcp}, "ebpf", "$test_name: ebpf is accepted on a vlan zone"); + + eval { update_zone($zoneid, { dhcp => "dnsmasq" }); }; + like( + $@, + qr/dnsmasq backend only supports simple zones/, + "$test_name: switching a vlan zone to dnsmasq is refused", + ); + + # every other zone type offers the backend as well + $test_state->{controller_config} = { + ids => { ctrl => { type => 'evpn', asn => 65000, peers => '10.0.0.1' } }, + }; + my $params = { + qinq => { bridge => 'vmbr0', tag => 100 }, + vxlan => { peers => '10.0.0.1' }, + evpn => { controller => 'ctrl', 'vrf-vxlan' => 1000 }, + faucet => { 'dp-id' => 1, controller => 'ctrl' }, + }; + for my $type (sort keys %$params) { + my $id = uc($type) . "Z"; + my $zone = { type => $type, ipam => "pve", zone => $id, %{ $params->{$type} } }; + create_zone({ %$zone, dhcp => "ebpf" }); + is(get_zone($id)->{dhcp}, "ebpf", "$test_name: ebpf is accepted on a $type zone"); + } +} + +run_test(\&test_zone_dhcp_backends); + sub test_dnsmasq_dual_stack_and_sweep { my $test_name = (split(/::/, (caller(0))[3]))[-1]; my $zoneid = "TESTZONE"; @@ -1744,6 +1793,8 @@ sub test_ebpf_backend { ); } +run_test(\&test_ebpf_backend); + sub test_ebpf_backend_edge_cases { my $test_name = (split(/::/, (caller(0))[3]))[-1]; my $zoneid = "TESTZONE"; @@ -1859,7 +1910,7 @@ sub test_ebpf_backend_edge_cases { ); } -run_test(\&test_ebpf_backend); +run_test(\&test_ebpf_backend_edge_cases); sub test_zone_tap_plug { my $test_name = (split(/::/, (caller(0))[3]))[-1]; @@ -1989,7 +2040,6 @@ sub test_zone_tap_plug { } run_test(\&test_zone_tap_plug); -run_test(\&test_ebpf_backend_edge_cases); sub test_ebpf_mac_case { my $test_name = (split(/::/, (caller(0))[3]))[-1]; @@ -2171,6 +2221,61 @@ sub test_ebpf_zone_mtu { run_test(\&test_ebpf_zone_mtu); +sub test_ebpf_vxlan_mtu { + my $test_name = (split(/::/, (caller(0))[3]))[-1]; + my $zoneid = "VXZONE"; + my $vnetid = "vxvnet"; + my $mac = "da:65:8f:18:9b:6f"; + + # a vxlan zone without an MTU of its own answers with the one its bridge + # takes from the underlay, the encapsulation overhead taken off + my $mocked_zone_plugin = Test::MockModule->new('PVE::Network::SDN::Zones::Plugin'); + $mocked_zone_plugin->mock( + find_local_ip_interface_peers => sub { return ('10.10.10.1', 'eno1'); }); + $mocked_pve_inotify->mock( + read_file => sub { return { ifaces => { eno1 => { mtu => 1400 } } }; }); + create_zone({ + type => "vxlan", + peers => "10.10.10.2", + dhcp => "ebpf", + ipam => "pve", + zone => $zoneid, + }); + create_vnet({ + type => "vnet", + zone => $zoneid, + vnet => $vnetid, + tag => 100, + }); + create_subnet({ + type => "subnet", + vnet => $vnetid, + subnet => "10.0.0.0/24", + gateway => "10.0.0.1", + }); + $test_state->{vmlist} = { ids => { 999 => { type => 'qemu', node => 'localnode' } } }; + $test_state->{guest_nets} = { 999 => { net0 => "virtio=$mac,bridge=$vnetid" } }; + $test_state->{macdb} = { macs => { $mac => { ip4 => '10.0.0.100' } } }; + + take_ebpf_calls(); + PVE::Network::SDN::Dhcp::regenerate_config(); + is( + take_ebpf_calls()->[0]->{args}->[0]->[0]->{record}->{mtu}, + 1350, + "$test_name: the underlay's MTU minus the encapsulation is handed out", + ); + update_zone($zoneid, { mtu => 1500 }); + PVE::Network::SDN::Dhcp::regenerate_config(); + is( + take_ebpf_calls()->[0]->{args}->[0]->[0]->{record}->{mtu}, + 1500, + "$test_name: an explicit zone MTU wins", + ); + $mocked_pve_inotify->unmock('read_file'); +} + +run_test(\&test_ebpf_vxlan_mtu); + sub test_ebpf_overlapping_subnets { my $test_name = (split(/::/, (caller(0))[3]))[-1]; my $zoneid = "TESTZONE"; -- 2.47.3