[PATCH pve-network v2 16/27] evpn: disable vxlan-learning on create if GBP is enabled

[Hannes Laimer <h.laimer@proxmox.com>]

The kernel recomputes a vxlan interface's reserved_bits on every
changelink. When GBP is enabled, those bits must leave the group
policy id and GBP flag unreserved, otherwise vxlan_rcv classifies
incoming GBP frames as malformed and drops them.

When bridge-learning is off, ifupdown2 syncs vxlan-learning to match
by issuing a separate changelink after create. That changelink omits
vxlan-gbp, so the kernel resets reserved_bits to the default and GBP
frames start getting dropped.

Set vxlan-learning off already at create when GBP is enabled, so the
interface matches the desired state up front and ifupdown2's later
learning sync has nothing to change.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index d8ce733..7f10c8a 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -225,6 +225,10 @@ sub generate_sdn_config {
     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
     push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
     push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
+    # keep vxlan-learning off already at create, matching bridge-learning, otherwise
+    # ifupdown2's later learning sync sends a gbp-less changelink and the kernel resets
+    # reserved_bits to the default, which makes it drop GBP frames
+    push @iface_config, "vxlan-learning off" if $plugin_config->{'vxlan-gbp'};
     push @iface_config, "bridge-learning off";
     push @iface_config, "bridge-arp-nd-suppress on"
         if !$plugin_config->{'disable-arp-nd-suppression'};
@@ -322,6 +326,10 @@ sub generate_sdn_config {
             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
             push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
             push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
+            # keep vxlan-learning off already at create, matching bridge-learning, otherwise
+            # ifupdown2's later learning sync sends a gbp-less changelink and the kernel resets
+            # reserved_bits to the default, which makes it drop GBP frames
+            push @iface_config, "vxlan-learning off" if $plugin_config->{'vxlan-gbp'};
             push @iface_config, "bridge-learning off";
             push @iface_config, "bridge-arp-nd-suppress on"
                 if !$plugin_config->{'disable-arp-nd-suppression'};
-- 
2.47.3