[PATCH qemu-server v3 13/17] network: sdn: keep the DHCP backends current on guest NICs

[Hannes Laimer <h.laimer@proxmox.com>]

A DHCP backend that serves the guest's tap itself has to hear of
every plug and removal of that tap. The plug now carries the NIC's
MAC, so the backend can look up the NIC's record. Removing a tap now
goes through the SDN layer as well, so the backend drops its entry
for that tap.

A bridge change allocated the NIC's address in the new vnet, but
unlike a start or a hotplug it never pushed the mapping to the
backend of that vnet's zone. It now does.

During a live migration the cluster lists the guest on the source
until its config moves. A mapping edited in that window is sent to
the source, while the target keeps the record it plugged the NIC
with. When the target resumes the guest after the migration, it
first pushes the current mapping of every NIC.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/CLI/qm.pm              |  4 ++--
 src/PVE/QemuServer.pm          |  4 ++++
 src/PVE/QemuServer/Network.pm  | 19 +++++++++++++++++--
 src/PVE/QemuServer/RunState.pm |  2 ++
 src/usr/pve-bridge             |  8 +++++++-
 src/usr/pve-bridgedown         |  4 ++--
 6 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index b903c1f1..6c53581a 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -22,7 +22,7 @@ use PVE::GuestHelpers;
 use PVE::GuestImport::OVF;
 use PVE::INotify;
 use PVE::JSONSchema qw(get_standard_option);
-use PVE::Network;
+use PVE::Network::SDN::Zones;
 use PVE::RPCEnvironment;
 use PVE::SafeSyslog;
 use PVE::Tools qw(extract_param file_get_contents);
@@ -1143,7 +1143,7 @@ __PACKAGE__->register_method({
                     foreach my $opt (keys %$conf) {
                         next if $opt !~ m/^net(\d+)$/;
                         my $interface = $1;
-                        PVE::Network::tap_unplug("tap${vmid}i${interface}");
+                        PVE::Network::SDN::Zones::tap_unplug("tap${vmid}i${interface}");
                     }
                 }
 
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 135c993f..39bdfc8b 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4975,6 +4975,9 @@ sub vmconfig_update_net {
                     PVE::Network::SDN::Vnets::add_next_free_cidr(
                         $newnet->{bridge}, $conf->{name}, $newnet->{macaddr}, $vmid, undef, 1,
                     );
+                    PVE::Network::SDN::Vnets::add_dhcp_mapping(
+                        $newnet->{bridge}, $newnet->{macaddr}, $vmid, $conf->{name},
+                    );
                 }
 
                 PVE::QemuServer::Network::tap_plug(
@@ -4984,6 +4987,7 @@ sub vmconfig_update_net {
                     $newnet->{firewall},
                     $newnet->{trunks},
                     $newnet->{rate},
+                    { mac => $newnet->{macaddr} },
                 );
 
             } elsif (safe_num_ne($oldnet->{rate}, $newnet->{rate})) {
diff --git a/src/PVE/QemuServer/Network.pm b/src/PVE/QemuServer/Network.pm
index b4893c01..e95fa62d 100644
--- a/src/PVE/QemuServer/Network.pm
+++ b/src/PVE/QemuServer/Network.pm
@@ -8,6 +8,7 @@ use PVE::Firewall::Helpers;
 use PVE::JSONSchema qw(get_standard_option parse_property_string);
 use PVE::Network::SDN::Vnets;
 use PVE::Network::SDN::Zones;
+use PVE::Network::SDN::Dhcp;
 use PVE::RESTEnvironment qw(log_warn);
 use PVE::Tools qw($IPV6RE file_read_firstline);
 
@@ -272,6 +273,20 @@ sub add_random_macs {
     }
 }
 
+# an edit made while the VM migrated went to the source, which the vmlist
+# still named. The target pushes every NIC's current mapping once it runs here
+# for good
+sub add_nets_dhcp_mapping {
+    my ($conf, $vmid) = @_;
+
+    for my $opt (keys %$conf) {
+        next if $opt !~ m/^net\d+$/;
+        my $net = parse_net($conf->{$opt}, 1) or next;
+        next if !$net->{bridge} || !$net->{macaddr};
+        PVE::Network::SDN::Dhcp::update_mapping($net->{bridge}, $net->{macaddr}, $vmid);
+    }
+}
+
 sub add_nets_bridge_fdb {
     my ($conf, $vmid) = @_;
 
@@ -349,10 +364,10 @@ sub delete_ifaces_ipams_ips {
 }
 
 sub tap_plug {
-    my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_;
+    my ($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts) = @_;
 
     $firewall = $firewall && PVE::Firewall::Helpers::needs_fwbr($bridge);
-    PVE::Network::SDN::Zones::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate);
+    PVE::Network::SDN::Zones::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts);
 }
 
 sub get_nets_host_mtu {
diff --git a/src/PVE/QemuServer/RunState.pm b/src/PVE/QemuServer/RunState.pm
index 889ddd28..0fdd8807 100644
--- a/src/PVE/QemuServer/RunState.pm
+++ b/src/PVE/QemuServer/RunState.pm
@@ -181,6 +181,8 @@ sub vm_resume($vmid, $skiplock = undef, $nocheck = undef) {
 
             PVE::QemuServer::Network::add_nets_bridge_fdb($conf, $vmid)
                 if $resume_cmd eq 'cont';
+            PVE::QemuServer::Network::add_nets_dhcp_mapping($conf, $vmid)
+                if $nocheck && $resume_cmd eq 'cont';
 
             mon_cmd($vmid, $resume_cmd);
         },
diff --git a/src/usr/pve-bridge b/src/usr/pve-bridge
index c7260c6b..20724271 100755
--- a/src/usr/pve-bridge
+++ b/src/usr/pve-bridge
@@ -43,7 +43,13 @@ die "unable to parse network config '$netid'\n" if !$net;
 PVE::Network::SDN::Vnets::add_dhcp_mapping($net->{bridge}, $net->{macaddr}, $vmid, $conf->{name});
 PVE::Network::SDN::Zones::tap_create($iface, $net->{bridge});
 PVE::QemuServer::Network::tap_plug(
-    $iface, $net->{bridge}, $net->{tag}, $net->{firewall}, $net->{trunks}, $net->{rate},
+    $iface,
+    $net->{bridge},
+    $net->{tag},
+    $net->{firewall},
+    $net->{trunks},
+    $net->{rate},
+    { mac => $net->{macaddr} },
 );
 
 exit 0;
diff --git a/src/usr/pve-bridgedown b/src/usr/pve-bridgedown
index e867b640..79a3722b 100755
--- a/src/usr/pve-bridgedown
+++ b/src/usr/pve-bridgedown
@@ -2,7 +2,7 @@
 
 use strict;
 use warnings;
-use PVE::Network;
+use PVE::Network::SDN::Zones;
 
 my $iface = shift;
 
@@ -11,6 +11,6 @@ die "no interface specified\n" if !$iface;
 die "got strange interface name '$iface'\n"
     if $iface !~ m/^tap(\d+)i(\d+)$/;
 
-PVE::Network::tap_unplug($iface);
+PVE::Network::SDN::Zones::tap_unplug($iface);
 
 exit 0;
-- 
2.47.3