[PATCH] sdn: qinq: apply zone MTU to the notag vnet veth pair

[PATCH] sdn: qinq: apply zone MTU to the notag vnet veth pair

[Thomas Glanzmann]

The QinQ zone applies its configured MTU to the zone bridge and to the
vnet bridge, but not to the ln_<zone>/pr_<zone> veth pair it creates as
the uplink for an untagged vnet. Both ends therefore stay at the kernel
default of 1500.

For a vnet without a tag, pr_<zone> is a port of the vnet bridge itself,
so that veth sits directly in the guest data path and silently caps the
whole zone at 1500 while every other interface in the chain reports the
configured MTU. Frames above the limit are dropped by the bridge with no
error and no counter. Guests hit the ceiling at ping -M do -s 1476,
since br_forward() still permits mtu + hard_header_len + VLAN_HLEN bytes
of frame.

Tagged vnets are unaffected, as they attach through z_<zone>.<ctag> and
never traverse the veth. That also makes the bug easy to miss when
trying to reproduce it.

Set the MTU on both ends of the pair. Guarding on $mtu keeps the
generated config byte-identical for zones without an explicit MTU.

Signed-off-by: Thomas Glanzmann <thomas@glanzmann.de>
---
 src/PVE/Network/SDN/Zones/QinQPlugin.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/PVE/Network/SDN/Zones/QinQPlugin.pm b/src/PVE/Network/SDN/Zones/QinQPlugin.pm
index a75940c..00f8814 100644
--- a/src/PVE/Network/SDN/Zones/QinQPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/QinQPlugin.pm
@@ -150,11 +150,13 @@ sub generate_sdn_config {
     @iface_config = ();
     push @iface_config, "link-type veth";
     push @iface_config, "veth-peer-name $zone_notag_uplinkpeer";
+    push @iface_config, "mtu $mtu" if $mtu;
     push(@{ $config->{$zone_notag_uplink} }, @iface_config) if !$config->{$zone_notag_uplink};
 
     @iface_config = ();
     push @iface_config, "link-type veth";
     push @iface_config, "veth-peer-name $zone_notag_uplink";
+    push @iface_config, "mtu $mtu" if $mtu;
     push(@{ $config->{$zone_notag_uplinkpeer} }, @iface_config)
         if !$config->{$zone_notag_uplinkpeer};
 
-- 
2.53.0