From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id BA2571FF13E for ; Wed, 01 Jul 2026 12:31:46 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 5EA93214DC; Wed, 01 Jul 2026 12:31:31 +0200 (CEST) From: Gabriel Goller To: pve-devel@lists.proxmox.com Subject: [RFC network 0/2] sdn: frr: add append-only custom user config Date: Wed, 1 Jul 2026 12:30:43 +0200 Message-ID: <20260701103051.119422-1-g.goller@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1782901843054 X-SPAM-LEVEL: Spam detection results: 0 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: OY57BSQIAEA4LWQ3BVTPQSFB5PO5UOSU X-Message-ID-Hash: OY57BSQIAEA4LWQ3BVTPQSFB5PO5UOSU X-MailFrom: g.goller@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This RFC adds an append-only mechanism for custom FRR configuration via /etc/frr/frr.conf.d/*.conf. Users sometimes need FRR configuration that SDN does not model yet. Editing /etc/frr/frr.conf directly is not useful because it is generated, while frr.conf.local is parsed and merged into the generated config, which can fail for unsupported constructs. The proposed approach copies snippets from /etc/frr/frr.conf.d/*.conf in sorted filename order after the fully generated SDN FRR config, including Rust-generated fabric config, and before the final line vty stanza. The snippets are copied as raw config without parsing or modifying their content. Each appended snippet is wrapped in marker comments in the installed config. Those markers are also checked in the active /etc/frr/frr.conf so that removing the last snippet, or the whole frr.conf.d directory, still triggers an FRR rewrite and cleans up stale appended config. (This is not the case right now with the frr.conf.local file, but we can't change this because that would be breaking.) Before replacing /etc/frr/frr.conf, the full candidate config is validated with vtysh -C -f. On validation failure, the reload fails and shows the error. We need this because previously with the frr.conf.local the merging code provided some sort of syntax-checking and simply didn't merge code that did not match the syntax. Open questions for the RFC: * Is append-only custom config the right user-facing model? Do we want to go all out with the user-editable templates? * Is this possible/should we do this completely in rust? (perl-rs) * Is /etc/frr/frr.conf.d/*.conf the right path and naming scheme? * Is checking installed marker comments the right cleanup trigger? pve-network: Gabriel Goller (2): sdn: frr: add append-only custom frr config tests: cover FRR append config files src/PVE/Network/SDN.pm | 26 +++- src/PVE/Network/SDN/Frr.pm | 115 ++++++++++++++++-- src/test/run_test_zones.pl | 53 ++++++++ .../expected_controller_config | 4 + .../evpn/auto_mode/expected_controller_config | 4 + .../evpn/bgp_ebgp/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../bgp_fabric/expected_controller_config | 4 + .../bgp_loopback/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../evpn/ebgp/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../ebgp_loopback/expected_controller_config | 4 + .../evpn/ebgp_only/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../evpn/exitnode/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../exitnode_snat/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../evpn/ipv4/expected_controller_config | 10 ++ .../zones/evpn/ipv4/frr.conf.d/00-empty.conf | 0 .../zones/evpn/ipv4/frr.conf.d/10-custom.conf | 1 + .../evpn/ipv4ipv6/expected_controller_config | 4 + .../expected_controller_config | 4 + .../evpn/ipv6/expected_controller_config | 4 + .../ipv6underlay/expected_controller_config | 4 + .../evpn/isis/expected_controller_config | 4 + .../isis_loopback/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../multiplezones/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../ospf_fabric/expected_controller_config | 4 + .../evpn/routemap/expected_controller_config | 4 + .../expected_controller_config | 4 + .../expected_controller_config | 4 + .../evpn/rt_import/expected_controller_config | 4 + .../evpn/vxlanport/expected_controller_config | 4 + 51 files changed, 374 insertions(+), 11 deletions(-) create mode 100644 src/test/zones/evpn/ipv4/frr.conf.d/00-empty.conf create mode 100644 src/test/zones/evpn/ipv4/frr.conf.d/10-custom.conf Summary over all repositories: 51 files changed, 374 insertions(+), 11 deletions(-) -- Generated by murpp 0.11.0