[PATCH pve-network 10/16] evpn: disable vxlan-learning on create if GBP is enabled

[Hannes Laimer <h.laimer@proxmox.com>]

The kernel recomputes a vxlan interface's reserved_bits on every
changelink. When GBP is enabled, those bits must leave the group
policy id and GBP flag unreserved, otherwise vxlan_rcv classifies
incoming GBP frames as malformed and drops them.

When bridge-learning is off, ifupdown2 syncs vxlan-learning to match
by issuing a separate changelink after create. That changelink omits
vxlan-gbp, so the kernel resets reserved_bits to the default and GBP
frames start getting dropped.

Set vxlan-learning off already at create when GBP is enabled, so the
interface matches the desired state up front and ifupdown2's later
learning sync has nothing to change. This avoids the gbp-less
changelink that would reset reserved_bits.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index d8ce733..7f10c8a 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -225,6 +225,10 @@ sub generate_sdn_config {
     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
     push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
     push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
+    # keep vxlan-learning off already at create, matching bridge-learning, otherwise
+    # ifupdown2's later learning sync sends a gbp-less changelink and the kernel resets
+    # reserved_bits to the default, which makes it drop GBP frames
+    push @iface_config, "vxlan-learning off" if $plugin_config->{'vxlan-gbp'};
     push @iface_config, "bridge-learning off";
     push @iface_config, "bridge-arp-nd-suppress on"
         if !$plugin_config->{'disable-arp-nd-suppression'};
@@ -322,6 +326,10 @@ sub generate_sdn_config {
             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
             push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
             push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
+            # keep vxlan-learning off already at create, matching bridge-learning, otherwise
+            # ifupdown2's later learning sync sends a gbp-less changelink and the kernel resets
+            # reserved_bits to the default, which makes it drop GBP frames
+            push @iface_config, "vxlan-learning off" if $plugin_config->{'vxlan-gbp'};
             push @iface_config, "bridge-learning off";
             push @iface_config, "bridge-arp-nd-suppress on"
                 if !$plugin_config->{'disable-arp-nd-suppression'};
-- 
2.47.3