From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 8472093D0B for ; Wed, 22 Feb 2023 13:49:49 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 633DF18220 for ; Wed, 22 Feb 2023 13:49:19 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 22 Feb 2023 13:49:18 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 5916A4811D for ; Wed, 22 Feb 2023 13:49:18 +0100 (CET) From: Christoph Heiss To: pve-devel@lists.proxmox.com Date: Wed, 22 Feb 2023 13:49:02 +0100 Message-Id: <20230222124903.326612-3-c.heiss@proxmox.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230222124903.326612-1-c.heiss@proxmox.com> References: <20230222124903.326612-1-c.heiss@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.098 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH v4 container 2/3] net: Add `link_down` config to allow setting interfaces as disconnected X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2023 12:49:49 -0000 If this network option is set, the host-side link will be forced down and the interface won't be connected to the bridge. Signed-off-by: Christoph Heiss --- Changes v1 -> v2: * Split trailing whitespace fix into separate patch * Rename option to kebap-case * Proper option comparison using `safe_boolean_ne` * Copy option to new network conf like the other options * Remove the veth interface from the bridge when disconnected Changes v2 -> v3: * Rename option to snake_case again * Move option hotplug-handling before LXC attach again Changes v3 -> v4: * Rebase * Shorten and remove some comments as appropriate * Update `link_down` schema comment * Move `link_down` logic to net_tap_plug() A note regarding the last change: The interface is now always set UP if `link_down` is unset. This saves us from passing the old network configuration to net_tap_plug() and should not have any effect as setting an interface UP/DOWN is (hopefully?) idempotent anyway - if it already is UP it does nothing and if it is currently DOWN we want it UP anyway at that point. src/PVE/LXC.pm | 17 ++++++++++++++--- src/PVE/LXC/Config.pm | 6 ++++++ 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm index 54afd97..c4d53e8 100644 --- a/src/PVE/LXC.pm +++ b/src/PVE/LXC.pm @@ -920,6 +920,14 @@ sub vm_stop_cleanup { sub net_tap_plug : prototype($$) { my ($iface, $net) = @_; + + if (defined($net->{link_down})) { + PVE::Tools::run_command(['/sbin/ip', 'link', 'set', 'dev', $iface, 'down']); + # Don't add disconnected interfaces to the bridge, otherwise e.g. applying any network + # change (e.g. `ifreload -a`) could (re-)activate it unintentionally. + return; + } + my ($bridge, $tag, $firewall, $trunks, $rate, $hwaddr) = $net->@{'bridge', 'tag', 'firewall', 'trunks', 'rate', 'hwaddr'}; @@ -929,6 +937,8 @@ sub net_tap_plug : prototype($$) { } else { PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, { mac => $hwaddr }); } + + PVE::Tools::run_command(['/sbin/ip', 'link', 'set', 'dev', $iface, 'up']); } sub update_net { @@ -957,7 +967,8 @@ sub update_net { } else { if (safe_string_ne($oldnet->{bridge}, $newnet->{bridge}) || safe_num_ne($oldnet->{tag}, $newnet->{tag}) || - safe_num_ne($oldnet->{firewall}, $newnet->{firewall}) + safe_num_ne($oldnet->{firewall}, $newnet->{firewall}) || + safe_boolean_ne($oldnet->{link_down}, $newnet->{link_down}) ) { if ($oldnet->{bridge}) { @@ -972,7 +983,7 @@ sub update_net { PVE::LXC::net_tap_plug($veth, $newnet); # This includes the rate: - foreach (qw(bridge tag firewall rate)) { + foreach (qw(bridge tag firewall rate link_down)) { $oldnet->{$_} = $newnet->{$_} if $newnet->{$_}; } } elsif (safe_string_ne($oldnet->{rate}, $newnet->{rate})) { @@ -1015,7 +1026,7 @@ sub hotplug_net { PVE::Tools::run_command($cmd); my $done = { type => 'veth' }; - foreach (qw(bridge tag firewall hwaddr name)) { + foreach (qw(bridge tag firewall hwaddr name link_down)) { $done->{$_} = $newnet->{$_} if $newnet->{$_}; } $conf->{$opt} = PVE::LXC::Config->print_lxc_network($done); diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm index af25a96..bf424f9 100644 --- a/src/PVE/LXC/Config.pm +++ b/src/PVE/LXC/Config.pm @@ -814,6 +814,12 @@ our $netconf_desc = { description => "Apply rate limiting to the interface", optional => 1, }, + # TODO: Rename this option and the qemu-server one to `link-down` for PVE 8.0 + link_down => { + type => 'boolean', + description => 'Whether this interface should be disconnected (like pulling the plug).', + optional => 1, + }, }; PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc); -- 2.39.1