Re: [PATCH pve-container v3 14/17] net: report NIC plugs and removals to the SDN DHCP backends

[Hannes Laimer <h.laimer@proxmox.com>]

On 2026-10-20 15:37, Stefan Hanreich wrote:
> Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
> 
> On 10/20/26 10:02 AM, Hannes Laimer wrote:
>> An SDN DHCP backend answers a guest NIC with the address IPAM holds
>> for its MAC. A NIC joining its bridge now hands its MAC to the SDN
>> plug, so the backend of its vnet can answer its first request.
>> Deleting a veth also reports it as gone to the backends, since their
>> state for an interface can outlive it.
>>
>> On a running container, a bridge change now pushes the DHCP mapping
>> for the new vnet, as adding a NIC or changing its MAC already does.
>>
>> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
>> ---
>>  src/PVE/LXC.pm            | 13 +++++++++++--
>>  src/PVE/LXC/Config.pm     |  3 ++-
>>  src/lxc-pve-poststop-hook |  6 +++---
>>  3 files changed, 16 insertions(+), 6 deletions(-)
>>
>> diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
>> index 1f11490..c3cf9e7 100644
>> --- a/src/PVE/LXC.pm
>> +++ b/src/PVE/LXC.pm
>> @@ -1111,7 +1111,13 @@ sub net_tap_plug : prototype($$) {
>>      my $create_firewall_bridges = $net->{firewall} && PVE::Firewall::Helpers::needs_fwbr($bridge);
>>  
>>      PVE::Network::SDN::Zones::tap_plug(
>> -        $iface, $bridge, $tag, $create_firewall_bridges, $trunks, $rate,
>> +        $iface,
>> +        $bridge,
>> +        $tag,
>> +        $create_firewall_bridges,
>> +        $trunks,
>> +        $rate,
>> +        { mac => $hwaddr },
> 
> nit: I understand that this function already has quite a few arguments, but introducing a new
> $opts and then setting the MAC there seems somewhat awkward as well? A matter of taste though, I
> suppose..
> 

yeah, `PVE::Network::tap_plug` underneath does the same for the 7th arg,
that's the only reason it is like this

>>      );
>>      PVE::Network::SDN::Zones::add_bridge_fdb($iface, $hwaddr, $bridge);
>>  
>> @@ -1137,7 +1143,7 @@ sub update_net {
>>              || safe_string_ne($oldnet->{name}, $newnet->{name})
>>          ) {
>>  
>> -            PVE::Network::veth_delete($veth);
>> +            PVE::Network::SDN::Zones::veth_delete($veth);
>>  
>>              if (safe_string_ne($oldnet->{hwaddr}, $newnet->{hwaddr})) {
>>                  eval {
>> @@ -1192,6 +1198,9 @@ sub update_net {
>>                      PVE::Network::SDN::Vnets::add_next_free_cidr(
>>                          $newnet->{bridge}, $conf->{hostname}, $newnet->{hwaddr}, $vmid, undef, 1,
>>                      );
>> +                    PVE::Network::SDN::Vnets::add_dhcp_mapping(
>> +                        $newnet->{bridge}, $newnet->{hwaddr}, $vmid, $conf->{hostname},
>> +                    );
>>                  }
>>                  eval { PVE::LXC::net_tap_plug($veth, $newnet) };
>>                  if (my $err = $@) {
>> diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm
>> index 9823d00..b522413 100644
>> --- a/src/PVE/LXC/Config.pm
>> +++ b/src/PVE/LXC/Config.pm
>> @@ -12,6 +12,7 @@ use PVE::GuestHelpers;
>>  use PVE::INotify;
>>  use PVE::JSONSchema qw(get_standard_option);
>>  use PVE::Network::SDN::Vnets;
>> +use PVE::Network::SDN::Zones;
>>  use PVE::RESTEnvironment;
>>  use PVE::Tools;
>>  
>> @@ -1696,7 +1697,7 @@ sub vmconfig_hotplug_pending {
>>                  my $net = parse_lxc_network($conf->{$opt});
>>                  PVE::LXC::kill_dhclients($vmid, $net->{name}) if $net->{'host-managed'};
>>  
>> -                PVE::Network::veth_delete("veth${vmid}i$netid");
>> +                PVE::Network::SDN::Zones::veth_delete("veth${vmid}i$netid");
>>                  print "delete ips from $opt\n";
>>                  eval {
>>                      PVE::Network::SDN::Vnets::del_ips_from_mac(
>> diff --git a/src/lxc-pve-poststop-hook b/src/lxc-pve-poststop-hook
>> index c8bbb79..c5d1059 100755
>> --- a/src/lxc-pve-poststop-hook
>> +++ b/src/lxc-pve-poststop-hook
>> @@ -11,7 +11,7 @@ use PVE::GuestHelpers;
>>  use PVE::LXC::Config;
>>  use PVE::LXC::Tools;
>>  use PVE::LXC;
>> -use PVE::Network;
>> +use PVE::Network::SDN::Zones;
>>  use PVE::RESTEnvironment;
>>  use PVE::Storage;
>>  use PVE::Tools;
>> @@ -49,8 +49,8 @@ PVE::LXC::Tools::lxc_hook(
>>              my $ind = $1;
>>              my $net = PVE::LXC::Config->parse_lxc_network($conf->{$k});
>>              next if $net->{type} ne 'veth';
>> -            # veth_delete tests with '-d /sys/class/net/$name' before running the command
>> -            PVE::Network::veth_delete("veth${vmid}i$ind");
>> +            # reports the unplug and deletes the veth only where it still exists
>> +            PVE::Network::SDN::Zones::veth_delete("veth${vmid}i$ind");
>>          }
>>  
>>          my $config_updated = 0;
> 
> 
> 
> 
>