* [pve-devel] [PATCH pve-network 1/2] sdn: vxlan: make local underlay selection work for IPv6 peers
2026-01-16 11:08 [pve-devel] [PATCH docs/network 0/3] SDN VXLAN IPv6 underlay support Hannes Laimer
@ 2026-01-16 11:08 ` Hannes Laimer
2026-01-16 11:08 ` [pve-devel] [PATCH pve-network 2/2] sdn: vxlan: enforce single address family in peers list Hannes Laimer
2026-01-16 11:08 ` [pve-devel] [PATCH pve-docs 1/1] sdn: vxlan: add short section about underlay address family Hannes Laimer
2 siblings, 0 replies; 4+ messages in thread
From: Hannes Laimer @ 2026-01-16 11:08 UTC (permalink / raw)
To: pve-devel
IPv6 peers couldn't be matched to local underlay addresses, so nodes
would not skip their own peer IP. We need this for VXLAN IPv6 support.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
src/PVE/Network/SDN/Zones/Plugin.pm | 72 +++++++++++++++++--
.../zones/vxlan/ipv6/expected_sdn_interfaces | 15 ++++
src/test/zones/vxlan/ipv6/interfaces | 7 ++
src/test/zones/vxlan/ipv6/sdn_config | 17 +++++
4 files changed, 104 insertions(+), 7 deletions(-)
create mode 100644 src/test/zones/vxlan/ipv6/expected_sdn_interfaces
create mode 100644 src/test/zones/vxlan/ipv6/interfaces
create mode 100644 src/test/zones/vxlan/ipv6/sdn_config
diff --git a/src/PVE/Network/SDN/Zones/Plugin.pm b/src/PVE/Network/SDN/Zones/Plugin.pm
index 826ebdf..bfa96f7 100644
--- a/src/PVE/Network/SDN/Zones/Plugin.pm
+++ b/src/PVE/Network/SDN/Zones/Plugin.pm
@@ -4,6 +4,7 @@ use strict;
use warnings;
use PVE::Tools qw(run_command);
+use Net::IP qw(ip_is_ipv6);
use PVE::IPRoute2;
use PVE::JSONSchema;
use PVE::Cluster;
@@ -278,14 +279,54 @@ sub del_bridge_fdb {
#helper
+sub _normalize_ip {
+ my ($ip) = @_;
+
+ return undef if !defined($ip);
+ $ip =~ s!/.*$!!;
+ return $ip;
+}
+
+sub _get_iface_addresses {
+ my ($iface_cfg) = @_;
+
+ return () if !$iface_cfg;
+
+ my @addrs;
+ for my $key (qw(address address6)) {
+ my $val = $iface_cfg->{$key};
+ next if !defined($val);
+ if (ref($val) eq 'ARRAY') {
+ push @addrs, @$val;
+ } else {
+ push @addrs, $val;
+ }
+ }
+
+ return @addrs;
+}
+
+sub _address_matches_family {
+ my ($address, $family) = @_;
+
+ my $ip = _normalize_ip($address);
+ return 0 if !defined($ip);
+
+ return ip_is_ipv6($ip) ? $family == 6 : $family == 4;
+}
+
sub get_local_route_ip {
my ($targetip) = @_;
my $ip = undef;
my $interface = undef;
+ my @cmd = ('/sbin/ip');
+ push @cmd, '-6' if ip_is_ipv6($targetip);
+ push @cmd, 'route', 'get', $targetip;
+
run_command(
- ['/sbin/ip', 'route', 'get', $targetip],
+ \@cmd,
outfunc => sub {
if ($_[0] =~ m/src ($PVE::Tools::IPRE)/) {
$ip = $1;
@@ -307,16 +348,33 @@ sub find_local_ip_interface_peers {
#if iface is defined, return ip if exist (if not,try to find it on other ifaces)
if ($iface) {
- my $ip = $ifaces->{$iface}->{address};
- return ($ip, $iface) if $ip;
+ my @iface_addrs = _get_iface_addresses($ifaces->{$iface});
+ if (!@{$peers} && @iface_addrs) {
+ my $ip = _normalize_ip($iface_addrs[0]);
+ return ($ip, $iface) if $ip;
+ }
+ foreach my $address (@{$peers}) {
+ my $family = ip_is_ipv6($address) ? 6 : 4;
+ foreach my $iface_addr (@iface_addrs) {
+ next if !_address_matches_family($iface_addr, $family);
+ my $ip = _normalize_ip($iface_addr);
+ return ($ip, $iface) if $ip;
+ }
+ }
}
#is a local ip member of peers list ?
foreach my $address (@{$peers}) {
- while (my $interface = each %$ifaces) {
- my $ip = $ifaces->{$interface}->{address};
- if ($ip && $ip eq $address) {
- return ($ip, $interface);
+ my $family = ip_is_ipv6($address) ? 6 : 4;
+ my $peer_ip = _normalize_ip($address);
+ next if !defined($peer_ip);
+ foreach my $interface (keys %$ifaces) {
+ foreach my $iface_addr (_get_iface_addresses($ifaces->{$interface})) {
+ next if !_address_matches_family($iface_addr, $family);
+ my $ip = _normalize_ip($iface_addr);
+ if ($ip && $ip eq $peer_ip) {
+ return ($ip, $interface);
+ }
}
}
}
diff --git a/src/test/zones/vxlan/ipv6/expected_sdn_interfaces b/src/test/zones/vxlan/ipv6/expected_sdn_interfaces
new file mode 100644
index 0000000..032ab99
--- /dev/null
+++ b/src/test/zones/vxlan/ipv6/expected_sdn_interfaces
@@ -0,0 +1,15 @@
+#version:1
+
+auto myvnet
+iface myvnet
+ bridge_ports vxlan_myvnet
+ bridge_stp off
+ bridge_fd 0
+ mtu 1450
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+ vxlan-id 100
+ vxlan_remoteip 2a08:2200:100:1::11
+ vxlan_remoteip 2a08:2200:100:1::12
+ mtu 1450
diff --git a/src/test/zones/vxlan/ipv6/interfaces b/src/test/zones/vxlan/ipv6/interfaces
new file mode 100644
index 0000000..602179b
--- /dev/null
+++ b/src/test/zones/vxlan/ipv6/interfaces
@@ -0,0 +1,7 @@
+auto vmbr0
+iface vmbr0 inet static
+ address 2a08:2200:100:1::10/64
+ gateway 2a08:2200:100:1::1
+ bridge-ports eth0
+ bridge-stp off
+ bridge-fd 0
diff --git a/src/test/zones/vxlan/ipv6/sdn_config b/src/test/zones/vxlan/ipv6/sdn_config
new file mode 100644
index 0000000..484be23
--- /dev/null
+++ b/src/test/zones/vxlan/ipv6/sdn_config
@@ -0,0 +1,17 @@
+{
+ version => 1,
+ vnets => {
+ ids => {
+ myvnet => { tag => 100, type => "vnet", zone => "myzone" },
+ },
+ },
+ zones => {
+ ids => {
+ myzone => {
+ ipam => "pve",
+ type => "vxlan",
+ peers => "2a08:2200:100:1::10,2a08:2200:100:1::11,2a08:2200:100:1::12",
+ },
+ },
+ },
+}
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 4+ messages in thread* [pve-devel] [PATCH pve-network 2/2] sdn: vxlan: enforce single address family in peers list
2026-01-16 11:08 [pve-devel] [PATCH docs/network 0/3] SDN VXLAN IPv6 underlay support Hannes Laimer
2026-01-16 11:08 ` [pve-devel] [PATCH pve-network 1/2] sdn: vxlan: make local underlay selection work for IPv6 peers Hannes Laimer
@ 2026-01-16 11:08 ` Hannes Laimer
2026-01-16 11:08 ` [pve-devel] [PATCH pve-docs 1/1] sdn: vxlan: add short section about underlay address family Hannes Laimer
2 siblings, 0 replies; 4+ messages in thread
From: Hannes Laimer @ 2026-01-16 11:08 UTC (permalink / raw)
To: pve-devel
We want the underlay to either be IPv4 or IPv6. A dual-stack underlay
adds ambiguity and extra complexity in source selection and validation
without a real use-case.
This includes tests for fabrics, we prefer IPv6 if the fabric offers
both.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 42 +++++++++++++--
.../vxlan/fabric_ipv4/expected_sdn_interfaces | 26 +++++++++
src/test/zones/vxlan/fabric_ipv4/interfaces | 5 ++
src/test/zones/vxlan/fabric_ipv4/sdn_config | 50 +++++++++++++++++
.../vxlan/fabric_ipv6/expected_sdn_interfaces | 32 +++++++++++
src/test/zones/vxlan/fabric_ipv6/interfaces | 5 ++
src/test/zones/vxlan/fabric_ipv6/sdn_config | 54 +++++++++++++++++++
7 files changed, 210 insertions(+), 4 deletions(-)
create mode 100644 src/test/zones/vxlan/fabric_ipv4/expected_sdn_interfaces
create mode 100644 src/test/zones/vxlan/fabric_ipv4/interfaces
create mode 100644 src/test/zones/vxlan/fabric_ipv4/sdn_config
create mode 100644 src/test/zones/vxlan/fabric_ipv6/expected_sdn_interfaces
create mode 100644 src/test/zones/vxlan/fabric_ipv6/interfaces
create mode 100644 src/test/zones/vxlan/fabric_ipv6/sdn_config
diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
index 1db610f..ac006b5 100644
--- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
@@ -4,6 +4,7 @@ use strict;
use warnings;
use PVE::Network::SDN::Zones::Plugin;
use PVE::Tools qw($IPV4RE);
+use Net::IP qw(ip_is_ipv6);
use PVE::INotify;
use PVE::Network::SDN::Controllers::EvpnPlugin;
use PVE::Exception qw(raise raise_param_exc);
@@ -104,15 +105,35 @@ sub generate_sdn_config {
my $current_node = eval { $config->get_node($plugin_config->{fabric}, $local_node) };
die "could not configure VXLAN zone $plugin_config->{id}: $@" if $@;
+ my $all_v6 = 1;
+ my $all_v4 = 1;
+ for my $node (values %$nodes) {
+ $all_v6 = 0 if !$node->{ip6};
+ $all_v4 = 0 if !$node->{ip};
+ }
+
+ # the following checks are not strictly necesarry cause we we shouldn't
+ # even get here if there are nodes on the fabric that don't have an
+ # address on any of the prefixes defined for the fabric
+ my $addr_key;
+ if ($all_v6) {
+ $addr_key = 'ip6';
+ } elsif ($all_v4) {
+ $addr_key = 'ip';
+ } else {
+ die
+ "Fabric $fabric->{id} has no consistent address family for all nodes (need all v6 or all v4)";
+ }
+
die
- "Node $local_node requires an IP in the fabric $fabric->{id} to configure the VXLAN zone $plugin_config->{id}"
- if !$current_node->{ip};
+ "Node $local_node requires a $addr_key address in fabric $fabric->{id} to configure VXLAN zone $plugin_config->{id}"
+ if !$current_node->{$addr_key};
for my $node (values %$nodes) {
- push @peers, $node->{ip} if $node->{ip};
+ push @peers, $node->{$addr_key} if $node->{$addr_key};
}
- $ifaceip = $current_node->{ip};
+ $ifaceip = $current_node->{$addr_key};
} else {
die "neither peers nor fabric configured for VXLAN zone $plugin_config->{id}";
}
@@ -163,6 +184,19 @@ sub on_update_hook {
fabric => "must have exactly one of peers / fabric defined",
});
}
+
+ if ($zone->{peers}) {
+ my @peers = PVE::Tools::split_list($zone->{peers});
+ my $family;
+
+ foreach my $peer (@peers) {
+ my $peer_family = ip_is_ipv6($peer) ? 6 : 4;
+ if (defined($family) && $family != $peer_family) {
+ raise_param_exc({ peers => "must contain only IPv4 or only IPv6 addresses" });
+ }
+ $family = $peer_family;
+ }
+ }
}
sub vnet_update_hook {
diff --git a/src/test/zones/vxlan/fabric_ipv4/expected_sdn_interfaces b/src/test/zones/vxlan/fabric_ipv4/expected_sdn_interfaces
new file mode 100644
index 0000000..3423104
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv4/expected_sdn_interfaces
@@ -0,0 +1,26 @@
+#version:1
+
+auto myvnet
+iface myvnet
+ bridge_ports vxlan_myvnet
+ bridge_stp off
+ bridge_fd 0
+ mtu 1450
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+ vxlan-id 100
+ vxlan_remoteip 172.20.3.2
+ vxlan_remoteip 172.20.3.3
+ mtu 1450
+
+auto dummy_test
+iface dummy_test inet static
+ address 172.20.3.1/32
+ link-type dummy
+ ip-forward 1
+
+auto ens18
+iface ens18 inet static
+ address 172.20.3.1/32
+ ip-forward 1
diff --git a/src/test/zones/vxlan/fabric_ipv4/interfaces b/src/test/zones/vxlan/fabric_ipv4/interfaces
new file mode 100644
index 0000000..68b6a88
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv4/interfaces
@@ -0,0 +1,5 @@
+auto vmbr0
+iface vmbr0 inet manual
+ bridge-ports eth0
+ bridge-stp off
+ bridge-fd 0
diff --git a/src/test/zones/vxlan/fabric_ipv4/sdn_config b/src/test/zones/vxlan/fabric_ipv4/sdn_config
new file mode 100644
index 0000000..eaaf3a9
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv4/sdn_config
@@ -0,0 +1,50 @@
+{
+ version => 1,
+ vnets => {
+ ids => {
+ myvnet => { tag => 100, type => "vnet", zone => "myzone" },
+ },
+ },
+ zones => {
+ ids => {
+ myzone => {
+ ipam => "pve",
+ type => "vxlan",
+ fabric => "test",
+ },
+ },
+ },
+ fabrics => {
+ ids => {
+ test => {
+ type => 'openfabric_fabric',
+ id => 'test',
+ ip_prefix => '172.20.3.0/24',
+ },
+ test_localhost => {
+ id => 'test_localhost',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.1',
+ },
+ test_node2 => {
+ id => 'test_node2',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.2',
+ },
+ test_node3 => {
+ id => 'test_node3',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.3',
+ },
+ },
+ },
+}
diff --git a/src/test/zones/vxlan/fabric_ipv6/expected_sdn_interfaces b/src/test/zones/vxlan/fabric_ipv6/expected_sdn_interfaces
new file mode 100644
index 0000000..7351fc9
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv6/expected_sdn_interfaces
@@ -0,0 +1,32 @@
+#version:1
+
+auto myvnet
+iface myvnet
+ bridge_ports vxlan_myvnet
+ bridge_stp off
+ bridge_fd 0
+ mtu 1450
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+ vxlan-id 100
+ vxlan_remoteip fd00::2
+ vxlan_remoteip fd00::3
+ mtu 1450
+
+auto dummy_test
+iface dummy_test inet static
+ address 172.20.3.1/32
+ link-type dummy
+ ip-forward 1
+
+auto dummy_test
+iface dummy_test inet6 static
+ address fd00::1/128
+ link-type dummy
+ ip-forward 1
+
+auto ens18
+iface ens18 inet static
+ address 172.20.3.1/32
+ ip-forward 1
diff --git a/src/test/zones/vxlan/fabric_ipv6/interfaces b/src/test/zones/vxlan/fabric_ipv6/interfaces
new file mode 100644
index 0000000..68b6a88
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv6/interfaces
@@ -0,0 +1,5 @@
+auto vmbr0
+iface vmbr0 inet manual
+ bridge-ports eth0
+ bridge-stp off
+ bridge-fd 0
diff --git a/src/test/zones/vxlan/fabric_ipv6/sdn_config b/src/test/zones/vxlan/fabric_ipv6/sdn_config
new file mode 100644
index 0000000..f463a88
--- /dev/null
+++ b/src/test/zones/vxlan/fabric_ipv6/sdn_config
@@ -0,0 +1,54 @@
+{
+ version => 1,
+ vnets => {
+ ids => {
+ myvnet => { tag => 100, type => "vnet", zone => "myzone" },
+ },
+ },
+ zones => {
+ ids => {
+ myzone => {
+ ipam => "pve",
+ type => "vxlan",
+ fabric => "test",
+ },
+ },
+ },
+ fabrics => {
+ ids => {
+ test => {
+ type => 'openfabric_fabric',
+ id => 'test',
+ ip_prefix => '172.20.3.0/24',
+ ip6_prefix => 'fd00::/64',
+ },
+ test_localhost => {
+ id => 'test_localhost',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.1',
+ ip6 => 'fd00::1',
+ },
+ test_node2 => {
+ id => 'test_node2',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.2',
+ ip6 => 'fd00::2',
+ },
+ test_node3 => {
+ id => 'test_node3',
+ type => 'openfabric_node',
+ interfaces => [
+ 'name=ens18',
+ ],
+ ip => '172.20.3.3',
+ ip6 => 'fd00::3',
+ },
+ },
+ },
+}
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 4+ messages in thread