From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 15EB8BBA72 for ; Tue, 19 Dec 2023 09:32:26 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id F3B2D33C00 for ; Tue, 19 Dec 2023 09:32:25 +0100 (CET) Received: from bastionodiso.odiso.net (bastionodiso.odiso.net [185.151.191.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Tue, 19 Dec 2023 09:32:24 +0100 (CET) Received: from kvmformation3.odiso.net (formationkvm3.odiso.net [10.3.94.12]) by bastionodiso.odiso.net (Postfix) with ESMTP id 30A417F88; Tue, 19 Dec 2023 09:32:17 +0100 (CET) Received: by kvmformation3.odiso.net (Postfix, from userid 0) id 2F75EDE5F3; Tue, 19 Dec 2023 09:32:17 +0100 (CET) From: Alexandre Derumier To: pve-devel@lists.proxmox.com Date: Tue, 19 Dec 2023 09:32:16 +0100 Message-Id: <20231219083216.2551645-8-aderumier@odiso.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231219083216.2551645-1-aderumier@odiso.com> References: <20231219083216.2551645-1-aderumier@odiso.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.031 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy HEADER_FROM_DIFFERENT_DOMAINS 0.25 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH pve-network 7/7] zones: vxlan: add dhcp support X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2023 08:32:26 -0000 add gateway ip to vnet and force /32 for ipv4 to avoid arp problem, and disable forwarding by security Signed-off-by: Alexandre Derumier --- src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 32 +++++++++++++++++++ .../zones/vxlan/dhcp/expected_sdn_interfaces | 19 +++++++++++ src/test/zones/vxlan/dhcp/interfaces | 7 ++++ src/test/zones/vxlan/dhcp/sdn_config | 25 +++++++++++++++ .../vxlan/nodhcp/expected_sdn_interfaces | 15 +++++++++ src/test/zones/vxlan/nodhcp/interfaces | 7 ++++ src/test/zones/vxlan/nodhcp/sdn_config | 25 +++++++++++++++ 7 files changed, 130 insertions(+) create mode 100644 src/test/zones/vxlan/dhcp/expected_sdn_interfaces create mode 100644 src/test/zones/vxlan/dhcp/interfaces create mode 100644 src/test/zones/vxlan/dhcp/sdn_config create mode 100644 src/test/zones/vxlan/nodhcp/expected_sdn_interfaces create mode 100644 src/test/zones/vxlan/nodhcp/interfaces create mode 100644 src/test/zones/vxlan/nodhcp/sdn_config diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm index 9a77bb9..7aa3c26 100644 --- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm +++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm @@ -48,6 +48,7 @@ sub options { reversedns => { optional => 1 }, dnszone => { optional => 1 }, ipam => { optional => 1 }, + dhcp => { optional => 1 }, }; } @@ -59,6 +60,7 @@ sub generate_sdn_config { my $alias = $vnet->{alias}; my $multicastaddress = $plugin_config->{'multicast-address'}; my $vxlanport = $plugin_config->{'vxlan-port'}; + my $dhcp = $plugin_config->{'dhcp'}; my @peers; @peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'}; my $vxlan_iface = "vxlan_$vnetid"; @@ -87,6 +89,34 @@ sub generate_sdn_config { #vnet bridge @iface_config = (); + + my $disable_forward_v4 = undef; + my $disable_forward_v6 = undef; + + if ($dhcp) { + my $address = {}; + my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1); + + foreach my $subnetid (sort keys %{$subnets}) { + my $subnet = $subnets->{$subnetid}; + my $gateway = $subnet->{gateway}; + + if ($gateway) { + + my $mask = $subnet->{mask}; + if (Net::IP::ip_is_ipv6($gateway)) { + $disable_forward_v6 = 1; + } else { + $mask = '32'; + $disable_forward_v4 = 1; + } + + push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway}); + $address->{$gateway} = 1; + } + } + } + push @iface_config, "bridge_ports $vxlan_iface"; push @iface_config, "bridge_stp off"; push @iface_config, "bridge_fd 0"; @@ -96,6 +126,8 @@ sub generate_sdn_config { } push @iface_config, "mtu $mtu" if $mtu; push @iface_config, "alias $alias" if $alias; + push @iface_config, "ip-forward off" if $disable_forward_v4; + push @iface_config, "ip6-forward off" if $disable_forward_v6; push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid}; return $config; diff --git a/src/test/zones/vxlan/dhcp/expected_sdn_interfaces b/src/test/zones/vxlan/dhcp/expected_sdn_interfaces new file mode 100644 index 0000000..d99efc2 --- /dev/null +++ b/src/test/zones/vxlan/dhcp/expected_sdn_interfaces @@ -0,0 +1,19 @@ +#version:1 + +auto myvnet +iface myvnet + address 192.168.0.1/32 + address 2a08:2142:302:3::1/64 + bridge_ports vxlan_myvnet + bridge_stp off + bridge_fd 0 + mtu 1450 + ip-forward off + ip6-forward off + +auto vxlan_myvnet +iface vxlan_myvnet + vxlan-id 100 + vxlan_remoteip 192.168.0.2 + vxlan_remoteip 192.168.0.3 + mtu 1450 diff --git a/src/test/zones/vxlan/dhcp/interfaces b/src/test/zones/vxlan/dhcp/interfaces new file mode 100644 index 0000000..66bb826 --- /dev/null +++ b/src/test/zones/vxlan/dhcp/interfaces @@ -0,0 +1,7 @@ +auto vmbr0 +iface vmbr0 inet static + address 192.168.0.1/24 + gateway 192.168.0.254 + bridge-ports eth0 + bridge-stp off + bridge-fd 0 diff --git a/src/test/zones/vxlan/dhcp/sdn_config b/src/test/zones/vxlan/dhcp/sdn_config new file mode 100644 index 0000000..3056165 --- /dev/null +++ b/src/test/zones/vxlan/dhcp/sdn_config @@ -0,0 +1,25 @@ +{ + version => 1, + vnets => { + ids => { + myvnet => { tag => 100, type => "vnet", zone => "myzone" }, + }, + }, + zones => { + ids => { myzone => { ipam => "pve", type => "vxlan", peers => "192.168.0.1,192.168.0.2,192.168.0.3", dhcp => "dnsmasq" } }, + }, + subnets => { + ids => { + 'myzone-192.168.0.0-24' => { + 'type' => 'subnet', + 'vnet' => 'myvnet', + 'gateway' => '192.168.0.1', + }, + 'myzone-2a08:2142:302:3::-64' => { + 'type' => 'subnet', + 'vnet' => 'myvnet', + 'gateway' => '2a08:2142:302:3::1', + } + } + } +} diff --git a/src/test/zones/vxlan/nodhcp/expected_sdn_interfaces b/src/test/zones/vxlan/nodhcp/expected_sdn_interfaces new file mode 100644 index 0000000..7b73c3e --- /dev/null +++ b/src/test/zones/vxlan/nodhcp/expected_sdn_interfaces @@ -0,0 +1,15 @@ +#version:1 + +auto myvnet +iface myvnet + bridge_ports vxlan_myvnet + bridge_stp off + bridge_fd 0 + mtu 1450 + +auto vxlan_myvnet +iface vxlan_myvnet + vxlan-id 100 + vxlan_remoteip 192.168.0.2 + vxlan_remoteip 192.168.0.3 + mtu 1450 diff --git a/src/test/zones/vxlan/nodhcp/interfaces b/src/test/zones/vxlan/nodhcp/interfaces new file mode 100644 index 0000000..66bb826 --- /dev/null +++ b/src/test/zones/vxlan/nodhcp/interfaces @@ -0,0 +1,7 @@ +auto vmbr0 +iface vmbr0 inet static + address 192.168.0.1/24 + gateway 192.168.0.254 + bridge-ports eth0 + bridge-stp off + bridge-fd 0 diff --git a/src/test/zones/vxlan/nodhcp/sdn_config b/src/test/zones/vxlan/nodhcp/sdn_config new file mode 100644 index 0000000..338290d --- /dev/null +++ b/src/test/zones/vxlan/nodhcp/sdn_config @@ -0,0 +1,25 @@ +{ + version => 1, + vnets => { + ids => { + myvnet => { tag => 100, type => "vnet", zone => "myzone" }, + }, + }, + zones => { + ids => { myzone => { ipam => "pve", type => "vxlan", peers => "192.168.0.1,192.168.0.2,192.168.0.3" } }, + }, + subnets => { + ids => { + 'myzone-192.168.0.0-24' => { + 'type' => 'subnet', + 'vnet' => 'myvnet', + 'gateway' => '192.168.0.1', + }, + 'myzone-2a08:2142:302:3::-64' => { + 'type' => 'subnet', + 'vnet' => 'myvnet', + 'gateway' => '2a08:2142:302:3::1', + } + } + } +} -- 2.39.2