From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id C5F021FF09C for ; Mon, 02 Nov 2026 12:07:17 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D21A221701; Mon, 02 Nov 2026 12:07:05 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network 07/10] sdn: ipam: look a MAC up within the vnet's subnets Date: Mon, 2 Nov 2026 12:06:01 +0100 Message-ID: <20261102110604.915693-8-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261102110604.915693-1-h.laimer@proxmox.com> References: <20261102110604.915693-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793617580729 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.370 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 6WXYYA4EMZLN476XDCBCMZEYRC6JEB43 X-Message-ID-Hash: 6WXYYA4EMZLN476XDCBCMZEYRC6JEB43 X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: A MAC only has to be unique within its vnet, so two vnets can carry the same one. The IPAM lookup by MAC searched every subnet of the zone, with NetBox the whole inventory, so a lookup for one vnet could return the address the MAC has on another, and the guest then got no address allocated on its own vnet. The built-in IPAM and NetBox are now searched only within the subnets of the vnet the lookup is for. Signed-off-by: Hannes Laimer --- src/PVE/Network/SDN/Ipams.pm | 4 +-- src/PVE/Network/SDN/Ipams/NetboxPlugin.pm | 34 +++++++++++++--------- src/PVE/Network/SDN/Ipams/PVEPlugin.pm | 7 ++--- src/PVE/Network/SDN/Ipams/PhpIpamPlugin.pm | 2 +- src/PVE/Network/SDN/Ipams/Plugin.pm | 3 +- src/PVE/Network/SDN/Vnets.pm | 3 +- src/test/run_test_vnets_blackbox.pl | 25 ++++++++++++++++ 7 files changed, 55 insertions(+), 23 deletions(-) diff --git a/src/PVE/Network/SDN/Ipams.pm b/src/PVE/Network/SDN/Ipams.pm index 1476c4236be0..9a31eaf39f58 100644 --- a/src/PVE/Network/SDN/Ipams.pm +++ b/src/PVE/Network/SDN/Ipams.pm @@ -169,7 +169,7 @@ sub complete_sdn_vnet { } sub get_ips_from_mac { - my ($mac, $zoneid, $zone) = @_; + my ($mac, $zoneid, $zone, $subnets) = @_; PVE::Cluster::cfs_update(); # the lock refreshes, so the snapshot must too my $version = PVE::Cluster::cfs_file_version($macdb_filename); @@ -181,7 +181,7 @@ sub get_ips_from_mac { my $plugin_config = get_plugin_config($zone); my $plugin = PVE::Network::SDN::Ipams::Plugin->lookup($plugin_config->{type}); - my ($ip4, $ip6) = $plugin->get_ips_from_mac($plugin_config, $mac, $zoneid); + my ($ip4, $ip6) = $plugin->get_ips_from_mac($plugin_config, $mac, $zoneid, $subnets); # an empty answer is not cached, since the record may simply not exist yet return if !defined($ip4) && !defined($ip6); diff --git a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm index e118d03e1eb0..01e7f347d796 100644 --- a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm +++ b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm @@ -379,26 +379,32 @@ sub del_ip { } sub get_ips_from_mac { - my ($class, $plugin_config, $mac, $zoneid, $noerr) = @_; + my ($class, $plugin_config, $mac, $zoneid, $subnets, $noerr) = @_; my $ip4 = undef; my $ip6 = undef; - my $data = eval { - netbox_api_request($plugin_config, "GET", "/ipam/ip-addresses/?description__ic=$mac"); - }; - if ($@) { - return if $noerr; - die "could not query ip address entry for mac $mac: $@"; - } - - for my $ip (@{ $data->{results} }) { - if ($ip->{family}->{value} == 4 && !$ip4) { - ($ip4, undef) = split(/\//, $ip->{address}); + for my $cidr (sort map { $_->{cidr} } values %{ $subnets // {} }) { + my $data = eval { + netbox_api_request( + $plugin_config, + "GET", + "/ipam/ip-addresses/?parent=$cidr&description__ic=$mac", + ); + }; + if ($@) { + return if $noerr; + die "could not query ip address entry for mac $mac in $cidr: $@"; } - if ($ip->{family}->{value} == 6 && !$ip6) { - ($ip6, undef) = split(/\//, $ip->{address}); + for my $ip (@{ $data->{results} }) { + if ($ip->{family}->{value} == 4 && !$ip4) { + ($ip4, undef) = split(/\//, $ip->{address}); + } + + if ($ip->{family}->{value} == 6 && !$ip6) { + ($ip6, undef) = split(/\//, $ip->{address}); + } } } diff --git a/src/PVE/Network/SDN/Ipams/PVEPlugin.pm b/src/PVE/Network/SDN/Ipams/PVEPlugin.pm index 77a7b2a7c144..43d0a3daaf9a 100644 --- a/src/PVE/Network/SDN/Ipams/PVEPlugin.pm +++ b/src/PVE/Network/SDN/Ipams/PVEPlugin.pm @@ -279,7 +279,7 @@ sub del_ip { } sub get_ips_from_mac { - my ($class, $plugin_config, $mac, $zoneid) = @_; + my ($class, $plugin_config, $mac, $zoneid, $subnets) = @_; #just in case, as this should already be cached in local macs.db @@ -289,13 +289,12 @@ sub get_ips_from_mac { my $db = read_db(); die "zone $zoneid don't exist in ipam db" if !$db->{zones}->{$zoneid}; my $dbzone = $db->{zones}->{$zoneid}; - my $subnets = $dbzone->{subnets}; - for my $subnet (keys %$subnets) { + for my $subnet (sort map { $_->{cidr} } values %{ $subnets // {} }) { # subnet keys are CIDRs, Net::IP only recognizes bare IPs my ($network) = split(m|/|, $subnet); next if Net::IP::ip_is_ipv4($network) ? $ip4 : $ip6; - my $ips = $subnets->{$subnet}->{ips}; + my $ips = $dbzone->{subnets}->{$subnet}->{ips} // next; for my $ip (keys %$ips) { my $ipobject = $ips->{$ip}; if ($ipobject->{mac} && $ipobject->{mac} eq $mac) { diff --git a/src/PVE/Network/SDN/Ipams/PhpIpamPlugin.pm b/src/PVE/Network/SDN/Ipams/PhpIpamPlugin.pm index 395d72c9494c..c3f014d45585 100644 --- a/src/PVE/Network/SDN/Ipams/PhpIpamPlugin.pm +++ b/src/PVE/Network/SDN/Ipams/PhpIpamPlugin.pm @@ -260,7 +260,7 @@ sub del_ip { } sub get_ips_from_mac { - my ($class, $plugin_config, $mac, $zoneid) = @_; + my ($class, $plugin_config, $mac, $zoneid, $subnets) = @_; my $url = $plugin_config->{url}; my $token = $plugin_config->{token}; diff --git a/src/PVE/Network/SDN/Ipams/Plugin.pm b/src/PVE/Network/SDN/Ipams/Plugin.pm index 26d093139703..14f8fe9e67fe 100644 --- a/src/PVE/Network/SDN/Ipams/Plugin.pm +++ b/src/PVE/Network/SDN/Ipams/Plugin.pm @@ -138,8 +138,9 @@ sub del_ip { die "please implement inside plugin"; } +# the addresses of a MAC within the given subnets of the zone, one per family sub get_ips_from_mac { - my ($class, $plugin_config, $mac, $zone) = @_; + my ($class, $plugin_config, $mac, $zoneid, $subnets) = @_; die "please implement inside plugin"; } diff --git a/src/PVE/Network/SDN/Vnets.pm b/src/PVE/Network/SDN/Vnets.pm index 8453a2781ae9..b1a2192ac767 100644 --- a/src/PVE/Network/SDN/Vnets.pm +++ b/src/PVE/Network/SDN/Vnets.pm @@ -201,7 +201,8 @@ sub get_ips_from_mac { return if !$zone->{ipam} || !$zone->{dhcp}; - return PVE::Network::SDN::Ipams::get_ips_from_mac($mac, $zoneid, $zone); + my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid); + return PVE::Network::SDN::Ipams::get_ips_from_mac($mac, $zoneid, $zone, $subnets); } sub del_ips_from_mac { diff --git a/src/test/run_test_vnets_blackbox.pl b/src/test/run_test_vnets_blackbox.pl index bde61f2d3401..27b1295ed556 100755 --- a/src/test/run_test_vnets_blackbox.pl +++ b/src/test/run_test_vnets_blackbox.pl @@ -1276,4 +1276,29 @@ sub test_mapping_edit_target { run_test(\&test_mapping_edit_target); +sub test_ipam_per_vnet { + my $test_name = (split(/::/, (caller(0))[3]))[-1]; + my $zoneid = "TESTZONE"; + my $mac = "da:65:8f:18:9b:6f"; + + # the same MAC on two vnets of one zone has an address on each, and a + # lookup for a vnet answers with that vnet's address only + create_zone({ type => "simple", dhcp => "dnsmasq", ipam => "pve", zone => $zoneid }); + for my $n (1, 2) { + create_dhcp_vnet($zoneid, "vnet$n", "10.$n.0.0/24"); + create_ip({ zone => $zoneid, vnet => "vnet$n", mac => $mac, ip => "10.$n.0.50" }); + } + + for my $n (1, 2) { + $test_state->{macdb} = {}; + is_deeply( + [PVE::Network::SDN::Vnets::get_ips_from_mac("vnet$n", $mac)], + ["10.$n.0.50", undef], + "$test_name: vnet$n answers with its own address", + ); + } +} + +run_test(\&test_ipam_per_vnet); + done_testing(); -- 2.47.3