From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: Re: [PATCH pve-network v3 10/17] sdn: zones: report interface plugs and unplugs to the DHCP backends
Date: Tue, 20 Oct 2026 15:17:57 +0200 [thread overview]
Message-ID: <de23820d-6034-4d21-9162-0cfb67f18d04@proxmox.com> (raw)
In-Reply-To: <20261020080005.470757-11-h.laimer@proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
On 10/20/26 10:01 AM, Hannes Laimer wrote:
> The ebpf DHCP backend answers on each guest interface rather than on
> the bridge, so the zone layer now reports every plug to the DHCP
> backends. The plug takes the guest's MAC along, since the address to
> hand out is recorded per MAC. A plug onto a plain bridge is reported
> too, since a running guest's interface can move there from a vnet.
> A failing backend only warns and the plug goes ahead.
>
> The zone layer also gains an unplug and a veth removal, which report
> the interface to the backends as gone.
>
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
> src/PVE/Network/SDN/Zones.pm | 29 ++++++-
> src/test/run_test_vnets_blackbox.pl | 129 ++++++++++++++++++++++++++++
> 2 files changed, 154 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/Network/SDN/Zones.pm b/src/PVE/Network/SDN/Zones.pm
> index 4229feda..10fc0731 100644
> --- a/src/PVE/Network/SDN/Zones.pm
> +++ b/src/PVE/Network/SDN/Zones.pm
> @@ -326,16 +326,18 @@ sub veth_create {
> }
>
> sub tap_plug {
> - my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_;
> + my ($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts) = @_;
>
> my $vnet = PVE::Network::SDN::Vnets::get_vnet($bridge, 1);
> if (!$vnet) { # fallback for classic bridge
> my $interfaces_config = PVE::INotify::read_file('interfaces');
> - my $opts = {};
> - $opts->{learning} = 0
> + my $bridge_opts = {};
> + $bridge_opts->{learning} = 0
> if $interfaces_config->{ifaces}->{$bridge}
> && $interfaces_config->{ifaces}->{$bridge}->{'bridge-disable-mac-learning'};
> - PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts);
> + # the dhcp backends hear of an interface moving onto a plain bridge as well
> + PVE::Network::SDN::Dhcp::tap_plug($bridge, $iface, $opts->{mac});
> + PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $bridge_opts);
> return;
> }
>
> @@ -346,9 +348,28 @@ sub tap_plug {
> if $plugin_config->{nodes} && !defined($plugin_config->{nodes}->{$nodename});
>
> my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
> +
> + # the dhcp backends act before the interface joins the bridge, so no request slips past
> + # them. Dhcp.pm comes in through Vnets.pm, since a use of it here would create a load-order
> + # cycle
> + PVE::Network::SDN::Dhcp::tap_plug($bridge, $iface, $opts->{mac});
> $plugin->tap_plug($plugin_config, $vnet, $tag, $iface, $bridge, $firewall, $trunks, $rate);
> }
>
> +sub tap_unplug {
> + my ($iface) = @_;
> +
> + PVE::Network::SDN::Dhcp::tap_unplug($iface);
> + PVE::Network::tap_unplug($iface);
> +}
> +
> +sub veth_delete {
> + my ($veth) = @_;
> +
> + PVE::Network::SDN::Dhcp::tap_unplug($veth);
> + PVE::Network::veth_delete($veth);
> +}
> +
> sub add_bridge_fdb {
> my ($iface, $macaddr, $bridge) = @_;
>
> diff --git a/src/test/run_test_vnets_blackbox.pl b/src/test/run_test_vnets_blackbox.pl
> index db6fc472..783d0d47 100755
> --- a/src/test/run_test_vnets_blackbox.pl
> +++ b/src/test/run_test_vnets_blackbox.pl
> @@ -1844,6 +1844,135 @@ sub test_ebpf_backend_edge_cases {
> }
>
> run_test(\&test_ebpf_backend);
> +
> +sub test_zone_tap_plug {
> + my $test_name = (split(/::/, (caller(0))[3]))[-1];
> + my $zoneid = "TESTZONE";
> + my $vnetid = "testvnet";
> + my $mac = "da:65:8f:18:9b:6f";
> +
> + # the zone plug hands the MAC on to the dhcp backends, and a plug onto a
> + # plain bridge tells them where the interface went
> + create_zone({
> + type => "simple",
> + dhcp => "ebpf",
> + ipam => "pve",
> + zone => $zoneid,
> + });
> + create_vnet({
> + type => "vnet",
> + zone => $zoneid,
> + vnet => $vnetid,
> + });
> + create_subnet({
> + type => "subnet",
> + vnet => $vnetid,
> + subnet => "10.0.0.0/24",
> + gateway => "10.0.0.1",
> + 'dhcp-range' => ["start-address=10.0.0.100,end-address=10.0.0.200"],
> + });
> + create_ip({
> + zone => $zoneid,
> + vnet => $vnetid,
> + mac => $mac,
> + ip => "10.0.0.100",
> + });
> + my $bridged = [];
> + my $unplugged = [];
> + $mocked_sdn_zones_super_plugin->mock(
> + tap_plug => sub {
> + push @$bridged, $_[5];
> + push $test_state->{order}->@*, 'bridge';
> + },
> + );
> + my $mocked_pve_network = Test::MockModule->new('PVE::Network');
> + $mocked_pve_network->mock(
> + tap_plug => sub {
> + push @$bridged, $_[1];
> + push $test_state->{order}->@*, 'bridge';
> + },
> + tap_unplug => sub { push @$unplugged, $_[0]; },
> + veth_delete => sub { push @$unplugged, $_[0]; },
> + );
> + $mocked_pve_inotify->mock(read_file => sub { return { ifaces => {} }; });
> + take_ebpf_calls();
> + take_order();
> +
> + PVE::Network::SDN::Zones::tap_plug('tap999i0', $vnetid, undef, 0, undef, undef,
> + { mac => $mac });
> + eq_or_diff($bridged, [$vnetid], "$test_name: the zone plugin plugs the interface");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'attach', args => ['tap999i0', $vnetid, $ebpf_record->("10.0.0.100")] }],
> + "$test_name: and the dhcp backend attaches it with the MAC's record",
> + );
> + is_deeply(
> + take_order(),
> + ['lock', 'refresh', 'write', 'bridge'],
> + "$test_name: the responder attaches before the interface joins the bridge",
> + );
> +
> + @$bridged = ();
> + PVE::Network::SDN::Zones::tap_plug('tap999i0', 'vmbr0', undef, 0, undef, undef,
> + { mac => $mac });
> + eq_or_diff($bridged, ['vmbr0'], "$test_name: a plain bridge is plugged the classic way");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'detach', args => ['tap999i0', { vnet => undef }] }],
> + "$test_name: and the dhcp backends hear where the interface went",
> + );
> +
> + # a vnet of another backend is a place the ebpf backend hears of as well
> + create_zone({
> + type => "simple",
> + dhcp => "dnsmasq",
> + ipam => "pve",
> + zone => "DNSZONE",
> + });
> + create_vnet({
> + type => "vnet",
> + zone => "DNSZONE",
> + vnet => "dnsvnet",
> + });
> + @$bridged = ();
> + PVE::Network::SDN::Zones::tap_plug(
> + 'tap999i0',
> + 'dnsvnet',
> + undef,
> + 0,
> + undef,
> + undef,
> + { mac => $mac },
> + );
> + eq_or_diff(
> + $bridged,
> + ['dnsvnet'],
> + "$test_name: a vnet of another backend is plugged by its zone",
> + );
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'detach', args => ['tap999i0', { vnet => 'dnsvnet' }] }],
> + "$test_name: and the ebpf backend hears which vnet the interface went to",
> + );
> +
> + # the zone unplug and the veth delete report the interface gone before
> + # the classic ones run
> + PVE::Network::SDN::Zones::tap_unplug('tap999i0');
> + PVE::Network::SDN::Zones::veth_delete('veth999i0');
> + eq_or_diff($unplugged, ['tap999i0', 'veth999i0'], "$test_name: the classic unplugs run");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [
> + { method => 'detach', args => ['tap999i0', undef] },
> + { method => 'detach', args => ['veth999i0', undef] },
> + ],
> + "$test_name: and the dhcp backends hear the interfaces are gone",
> + );
> + $mocked_sdn_zones_super_plugin->unmock('tap_plug');
> + $mocked_pve_inotify->unmock('read_file');
> +}
> +
> +run_test(\&test_zone_tap_plug);
> run_test(\&test_ebpf_backend_edge_cases);
>
> sub test_ebpf_mac_case {
next prev parent reply other threads:[~2026-10-20 13:18 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 7:59 [PATCH container/docs/manager/network/proxmox{-ebpf,-perl-rs}/qemu-server v3 00/17] sdn: implement DHCP for all zones using eBPF Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-ebpf v3 01/17] dhcp: add the per-tap DHCPv4 responder program Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-ebpf v3 02/17] dhcp: add the subsystem that loads the responder and keeps its records Hannes Laimer
2026-10-20 13:09 ` Stefan Hanreich
2026-10-21 7:09 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-perl-rs v3 03/17] pve-rs: sdn: add bindings for the eBPF DHCP responder Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 7:32 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 04/17] sdn: dhcp: replace a stale dnsmasq reservation instead of dropping it Hannes Laimer
2026-10-20 13:15 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 05/17] sdn: dhcp: update reservations when ip mappings change Hannes Laimer
2026-10-20 13:42 ` Stefan Hanreich
2026-10-21 7:21 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 06/17] sdn: ipam: key the MAC cache by lower-case MAC, stop caching misses Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 6:17 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 07/17] sdn: dhcp: make the lease time configurable per subnet Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 08/17] sdn: dhcp: require a backend only if a zone on this node uses it Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 09/17] sdn: dhcp: add an eBPF backend answering on each guest interface Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 6:16 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 10/17] sdn: zones: report interface plugs and unplugs to the DHCP backends Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich [this message]
2026-10-20 7:59 ` [PATCH pve-network v3 11/17] sdn: dhcp: push IP mapping edits to the guest's node Hannes Laimer
2026-10-20 13:09 ` Stefan Hanreich
2026-10-21 6:44 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-network v3 12/17] sdn: zones: allow the ebpf DHCP backend on every zone type Hannes Laimer
2026-10-20 8:00 ` [PATCH qemu-server v3 13/17] network: sdn: keep the DHCP backends current on guest NICs Hannes Laimer
2026-10-20 13:38 ` Stefan Hanreich
2026-10-20 8:00 ` [PATCH pve-container v3 14/17] net: report NIC plugs and removals to the SDN DHCP backends Hannes Laimer
2026-10-20 13:36 ` Stefan Hanreich
2026-10-21 7:29 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-manager v3 15/17] ui: sdn: add zone DHCP backend selector and subnet DHCP options Hannes Laimer
2026-10-20 13:19 ` Stefan Hanreich
2026-10-20 8:00 ` [PATCH pve-manager v3 16/17] sdn: bring up the DHCP backends at boot before the guests start Hannes Laimer
2026-10-20 13:21 ` Stefan Hanreich
2026-10-21 7:17 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-docs v3 17/17] sdn: dhcp: add eBPF backend section Hannes Laimer
2026-10-20 13:11 ` [PATCH container/docs/manager/network/proxmox{-ebpf,-perl-rs}/qemu-server v3 00/17] sdn: implement DHCP for all zones using eBPF Stefan Hanreich
2026-10-21 7:35 ` Hannes Laimer
2026-10-21 8:46 ` superseded: " Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=de23820d-6034-4d21-9162-0cfb67f18d04@proxmox.com \
--to=s.hanreich@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.