From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 193B71FF0AE for ; Tue, 13 Oct 2026 14:22:40 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 14F1821326; Tue, 13 Oct 2026 14:22:36 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 smtp.infra.comaite.com CAA6E62C0E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comaite.com; s=377A38C6-3A8D-11E5-A0EC-E97757B27CB3; t=1791893673; bh=/ijGaFEKPgY09YWuYVagrEnfcfmuWDND4dOJI87cUVc=; h=From:To:Date:Message-ID:MIME-Version; b=PJz458OIAjGl9iQgRJ4bNSso2abmkUiCBRSl58PIFb9ReDCPZEacZcXzQgSD1SxCU nGRdZUbJgT4++dYOy78i9QAOSkJWFj2XXrPjbZKVGTlcPLuFQlwYzf2jM23LMm1ebR rFCjf+9qhQCYMhpSx5RFfh0XeKkD4ecqxw74BQpx8T3KjQINo8WuGB0T0Kv2cwj+yO 8lo7f37qkQIMA2ZgSe0pg0tAxsotQrtABMa+LnHLWQOkkMStb0K5LxMZ8+AcCJIMYl hvztTU5oz3ECJd3VpCtMS258RPQgH1Gv3W1eXKpkqOfRdcefzLpH36ESyfWn6SJer1 45JWvo0bclhbw== From: =?UTF-8?q?R=C3=A9mi=20PAETA?= To: pve-devel@lists.proxmox.com Subject: [RFC PATCH network 08/16] sdn: subnets: refuse gateway, snat and dhcp on ovn zones Date: Tue, 13 Oct 2026 14:14:24 +0200 Message-ID: <20261013121432.2642979-9-remi.paeta@comaite.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261013121432.2642979-1-remi.paeta@comaite.com> References: <1116090294.1714263.1791537779868.JavaMail.zimbra@comaite.com> <20261013121432.2642979-1-remi.paeta@comaite.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: B4GEG6VUM43IMIZKHQ6BTSXLZ6H3WQQW X-Message-ID-Hash: B4GEG6VUM43IMIZKHQ6BTSXLZ6H3WQQW X-MailFrom: remi.paeta@comaite.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: OVN zones do not route nor serve DHCP yet, so a subnet gateway, SNAT or DHCP ranges would have no effect on them. Refuse them instead of silently ignoring them. Signed-off-by: Rémi PAETA --- src/PVE/Network/SDN/SubnetPlugin.pm | 9 +++++++++ src/test/run_test_ovn.pl | 12 ++++++++++++ 2 files changed, 21 insertions(+) diff --git a/src/PVE/Network/SDN/SubnetPlugin.pm b/src/PVE/Network/SDN/SubnetPlugin.pm index e2a0e50..7de40aa 100644 --- a/src/PVE/Network/SDN/SubnetPlugin.pm +++ b/src/PVE/Network/SDN/SubnetPlugin.pm @@ -217,6 +217,15 @@ sub on_update_hook { $mac = $vnet->{mac}; } + # OVN zones neither route nor serve DHCP (yet), so these options would have no effect + if (($zone->{type} // '') eq 'ovn') { + for my $option ('gateway', 'snat', 'dhcp-range') { + my $value = $subnet->{$option}; + next if !$value || (ref($value) eq 'ARRAY' && !@$value); + raise_param_exc({ $option => "$option is not supported on OVN zones" }); + } + } + my $pointopoint = Net::IP::ip_is_ipv4($gateway) && $mask == 32; #for /32 pointopoint, we allow gateway outside the subnet diff --git a/src/test/run_test_ovn.pl b/src/test/run_test_ovn.pl index 9f191b3..cb36a0f 100755 --- a/src/test/run_test_ovn.pl +++ b/src/test/run_test_ovn.pl @@ -12,6 +12,7 @@ use Test::MockModule; use PVE::Network::SDN; use PVE::Network::SDN::Ovn; use PVE::Network::SDN::Controllers::OvnPlugin; +use PVE::Network::SDN::SubnetPlugin; use PVE::Network::SDN::Zones::OvnPlugin; my $controller = { @@ -511,6 +512,17 @@ eval { }; like($@, qr/isolate-ports is not supported/, 'vnet_update_hook: isolate-ports refused'); +for my $option (['gateway', '10.0.0.1'], ['snat', 1], ['dhcp-range', ['start-address=a']]) { + eval { + PVE::Network::SDN::SubnetPlugin->on_update_hook( + { type => 'ovn' }, + 'zone1-10.0.0.0-24', + { cidr => '10.0.0.0/24', mask => 24, $option->[0] => $option->[1] }, + ); + }; + like($@, qr/$option->[0] is not supported on OVN zones/, "subnet: $option->[0] refused"); +} + # chassis is( -- 2.47.3