From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 442841FF0A5 for ; Fri, 04 Sep 2026 11:27:55 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 536C7215FE; Fri, 04 Sep 2026 11:27:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=glanzmann.de; s=infra26101010; t=1788512368; bh=XjUPuTvH2VbcHW3zVIMzOGKPeirDFj2KvOpQ7AnlaXA=; h=Date:From:To:Subject:From; b=Ik9cXwBN23YVlst3dE0xUfLdWGiABdEQrbIL1CFoC8I1PJ0foFlSMRr0lgsNueIVq bOTdV+GNTqXSLUeU90V3A9fe9AjMcMFvu/H8WBlVmIJLD/3jhkXG9GbMvVpzaldmW1 BVNNHLKyJhBTaF1NBdOS/RAFr2Og5R+bfW6ltQnprSEsfclFx4vjO8yFfR3sEr41Q5 iDgBZhFgtYf4SRj98kxLhOrDW7oXtinXKVwLTDsB5p49xNvEiiRd/eIJK9ujwATiRk CAooGyl/t+G3sWT+vE2RT55fgKm52OkHFQqKNGgLdKP2Ux4eKM0t0Pgz9h4Et4NogX aFx8WpS33YITJ0pvtSa4uhFhsIMX49OMdWGvsZFKseO8NEEYh+dgwdCXIr4ZC3pKwZ JZTkZab3Fmr4YcOAO0kKXyNpBocKtx7Qr3bcQqvCF1Wo+7dBk68JJxuXe9/0Z9F+xV Ue1PfLQBIeUXzNVjoNZkKc4i3p4CbPPgijBxcbzbi/Mnwl8ytfl7HlnfivbWAbtdoK JREjsOphgd/gFnzxuxVet7UL1HJHxp4FTLopliOuHceq1qhlWlA1n1Dpq3caF/uCp/ UZmAy3idQVRW7xhU/rx5cFnYpqeyQ+eyyeSUa2uAkteie/x7YyQhLL0PC2PfQckYI8 Ul4VZUNTdhoWxKL5QsS0BDJU= Date: Fri, 4 Sep 2026 10:59:28 +0200 From: Thomas Glanzmann To: pve-devel@lists.proxmox.com Subject: [PATCH] sdn: qinq: apply zone MTU to the notag vnet veth pair Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: thomas@glanzmann.de X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: NHWPM72D2JILKUS4ES4ZUMJJEFL3QAKS X-Message-ID-Hash: NHWPM72D2JILKUS4ES4ZUMJJEFL3QAKS X-Mailman-Approved-At: Fri, 04 Sep 2026 11:27:28 +0200 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The QinQ zone applies its configured MTU to the zone bridge and to the vnet bridge, but not to the ln_/pr_ veth pair it creates as the uplink for an untagged vnet. Both ends therefore stay at the kernel default of 1500. For a vnet without a tag, pr_ is a port of the vnet bridge itself, so that veth sits directly in the guest data path and silently caps the whole zone at 1500 while every other interface in the chain reports the configured MTU. Frames above the limit are dropped by the bridge with no error and no counter. Guests hit the ceiling at ping -M do -s 1476, since br_forward() still permits mtu + hard_header_len + VLAN_HLEN bytes of frame. Tagged vnets are unaffected, as they attach through z_. and never traverse the veth. That also makes the bug easy to miss when trying to reproduce it. Set the MTU on both ends of the pair. Guarding on $mtu keeps the generated config byte-identical for zones without an explicit MTU. Signed-off-by: Thomas Glanzmann --- src/PVE/Network/SDN/Zones/QinQPlugin.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/PVE/Network/SDN/Zones/QinQPlugin.pm b/src/PVE/Network/SDN/Zones/QinQPlugin.pm index a75940c..00f8814 100644 --- a/src/PVE/Network/SDN/Zones/QinQPlugin.pm +++ b/src/PVE/Network/SDN/Zones/QinQPlugin.pm @@ -150,11 +150,13 @@ sub generate_sdn_config { @iface_config = (); push @iface_config, "link-type veth"; push @iface_config, "veth-peer-name $zone_notag_uplinkpeer"; + push @iface_config, "mtu $mtu" if $mtu; push(@{ $config->{$zone_notag_uplink} }, @iface_config) if !$config->{$zone_notag_uplink}; @iface_config = (); push @iface_config, "link-type veth"; push @iface_config, "veth-peer-name $zone_notag_uplink"; + push @iface_config, "mtu $mtu" if $mtu; push(@{ $config->{$zone_notag_uplinkpeer} }, @iface_config) if !$config->{$zone_notag_uplinkpeer}; -- 2.53.0