[PATCH pve-network v3 12/17] sdn: zones: allow the ebpf DHCP backend on every zone type

[Hannes Laimer <h.laimer@proxmox.com>]

The ebpf backend answers each guest on the guest's own tap or veth
device, so the zone type makes no difference to it. dnsmasq stays
limited to simple zones, since every node runs its own instance on
the vnet bridge and only a simple zone's bridge is cut off from the
other nodes. Choosing it elsewhere fails on create and on update.

Every zone type now reports the MTU its guests should use. The ebpf
backend hands it out, and until now only simple zones could answer.
A VXLAN or EVPN zone without an MTU setting takes it from the
interface that reaches its peers.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/API2/Network/SDN/Zones.pm         |   8 +-
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm   |  32 +++++++
 src/PVE/Network/SDN/Zones/FaucetPlugin.pm |   1 +
 src/PVE/Network/SDN/Zones/QinQPlugin.pm   |   7 ++
 src/PVE/Network/SDN/Zones/SimplePlugin.pm |   2 +-
 src/PVE/Network/SDN/Zones/VlanPlugin.pm   |   7 ++
 src/PVE/Network/SDN/Zones/VxlanPlugin.pm  |  25 +++++
 src/test/run_test_vnets_blackbox.pl       | 111 +++++++++++++++++++++-
 8 files changed, 188 insertions(+), 5 deletions(-)

diff --git a/src/PVE/API2/Network/SDN/Zones.pm b/src/PVE/API2/Network/SDN/Zones.pm
index 0e907260..181d2872 100644
--- a/src/PVE/API2/Network/SDN/Zones.pm
+++ b/src/PVE/API2/Network/SDN/Zones.pm
@@ -93,7 +93,7 @@ my $ZONE_PROPERTIES = {
         type => 'string',
         enum => PVE::Network::SDN::Dhcp->plugin_types(),
         optional => 1,
-        description => 'Name of DHCP server backend for this zone.',
+        description => 'DHCP backend serving the zone. dnsmasq works on simple zones only.',
     },
     'rt-import' => {
         type => 'string',
@@ -448,6 +448,9 @@ __PACKAGE__->register_method({
                 raise_param_exc({ ipam => "$ipam not existing" })
                     if $ipam && !$ipam_cfg->{ids}->{$ipam};
 
+                raise_param_exc({ dhcp => "the dnsmasq backend only supports simple zones" })
+                    if ($opts->{dhcp} // '') eq 'dnsmasq' && $plugin->type() ne 'simple';
+
                 $zone_cfg->{ids}->{$id} = $opts;
                 $plugin->on_update_hook($id, $zone_cfg, $controller_cfg);
 
@@ -544,6 +547,9 @@ __PACKAGE__->register_method({
                 raise_param_exc({ ipam => "$ipam not existing" })
                     if $ipam && !$ipam_cfg->{ids}->{$ipam};
 
+                raise_param_exc({ dhcp => "the dnsmasq backend only supports simple zones" })
+                    if ($scfg->{dhcp} // '') eq 'dnsmasq' && $plugin->type() ne 'simple';
+
                 $plugin->on_update_hook($id, $zone_cfg, $controller_cfg);
 
                 PVE::Network::SDN::Zones::write_config($zone_cfg);
diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 0e79707c..60fe788f 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -125,10 +125,42 @@ sub options {
         reversedns => { optional => 1 },
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
+        dhcp => { optional => 1 },
     };
 }
 
 # Plugin implementation
+# the underlay interface is the one the controller's peers name, found the
+# way the bridge generation finds it
+sub get_mtu {
+    my ($class, $plugin_config) = @_;
+
+    return $plugin_config->{mtu} if $plugin_config->{mtu};
+
+    my $iface;
+    my $controller_cfg = PVE::Network::SDN::running_config()->{controllers};
+    my $controller = $controller_cfg->{ids}->{ $plugin_config->{controller} // '' };
+    if ($controller && $controller->{peers}) {
+        my @peers = PVE::Tools::split_list($controller->{peers});
+        my $local_node = PVE::INotify::nodename();
+        my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller(
+            $local_node, $controller_cfg,
+        );
+        my $isisrouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_isis_controller(
+            $local_node, $controller_cfg,
+        );
+        my $loopback = $bgprouter->{loopback} // $isisrouter->{loopback};
+        (undef, $iface) = eval {
+            PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
+        };
+    }
+    return PVE::Network::SDN::Zones::VxlanPlugin::vxlan_mtu(
+        $plugin_config,
+        $iface,
+        PVE::INotify::read_file('interfaces'),
+    );
+}
+
 sub generate_sdn_config {
     my (
         $class,
diff --git a/src/PVE/Network/SDN/Zones/FaucetPlugin.pm b/src/PVE/Network/SDN/Zones/FaucetPlugin.pm
index 5f069aea..4e3f5eff 100644
--- a/src/PVE/Network/SDN/Zones/FaucetPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/FaucetPlugin.pm
@@ -30,6 +30,7 @@ sub options {
         reversedns => { optional => 1 },
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
+        dhcp => { optional => 1 },
     };
 }
 
diff --git a/src/PVE/Network/SDN/Zones/QinQPlugin.pm b/src/PVE/Network/SDN/Zones/QinQPlugin.pm
index 642420e9..85d9ce98 100644
--- a/src/PVE/Network/SDN/Zones/QinQPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/QinQPlugin.pm
@@ -36,6 +36,12 @@ sub properties {
     };
 }
 
+sub get_mtu {
+    my ($class, $plugin_config) = @_;
+
+    return $plugin_config->{mtu};
+}
+
 sub options {
     return {
         nodes => { optional => 1 },
@@ -48,6 +54,7 @@ sub options {
         reversedns => { optional => 1 },
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
+        dhcp => { optional => 1 },
     };
 }
 
diff --git a/src/PVE/Network/SDN/Zones/SimplePlugin.pm b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
index 347eee9a..655f7e41 100644
--- a/src/PVE/Network/SDN/Zones/SimplePlugin.pm
+++ b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
@@ -31,7 +31,7 @@ sub properties {
             description => "dns domain zone  ex: mydomain.com",
         },
         dhcp => {
-            description => 'Type of the DHCP backend for this zone',
+            description => 'DHCP backend serving the zone. dnsmasq works on simple zones only.',
             type => 'string',
             enum => PVE::Network::SDN::Dhcp->plugin_types(),
         },
diff --git a/src/PVE/Network/SDN/Zones/VlanPlugin.pm b/src/PVE/Network/SDN/Zones/VlanPlugin.pm
index 271b3fab..a5d0fb0d 100644
--- a/src/PVE/Network/SDN/Zones/VlanPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/VlanPlugin.pm
@@ -36,6 +36,12 @@ sub properties {
     };
 }
 
+sub get_mtu {
+    my ($class, $plugin_config) = @_;
+
+    return $plugin_config->{mtu};
+}
+
 sub options {
 
     return {
@@ -47,6 +53,7 @@ sub options {
         reversedns => { optional => 1 },
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
+        dhcp => { optional => 1 },
     };
 }
 
diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
index a4082615..0dab5d95 100644
--- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
@@ -47,6 +47,30 @@ sub properties {
     };
 }
 
+# the vnet bridge takes the underlay interface's MTU minus the vxlan
+# encapsulation where the peers name a local interface, the default
+# otherwise. An explicit zone MTU wins
+sub vxlan_mtu {
+    my ($plugin_config, $iface, $interfaces_config) = @_;
+
+    return $plugin_config->{mtu} if $plugin_config->{mtu};
+    return $interfaces_config->{ifaces}->{$iface}->{mtu} - 50
+        if $iface && $interfaces_config->{ifaces}->{$iface}->{mtu};
+    return 1450;
+}
+
+sub get_mtu {
+    my ($class, $plugin_config) = @_;
+
+    my $iface;
+    if ($plugin_config->{peers}) {
+        my @peers = PVE::Tools::split_list($plugin_config->{peers});
+        (undef, $iface) =
+            eval { PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers) };
+    }
+    return vxlan_mtu($plugin_config, $iface, PVE::INotify::read_file('interfaces'));
+}
+
 sub options {
     return {
         nodes => { optional => 1 },
@@ -58,6 +82,7 @@ sub options {
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
         fabric => { optional => 1 },
+        dhcp => { optional => 1 },
     };
 }
 
diff --git a/src/test/run_test_vnets_blackbox.pl b/src/test/run_test_vnets_blackbox.pl
index 9a4dbb9c..816f8382 100755
--- a/src/test/run_test_vnets_blackbox.pl
+++ b/src/test/run_test_vnets_blackbox.pl
@@ -1488,6 +1488,55 @@ sub test_ipam_cache_case {
 
 run_test(\&test_ipam_cache_case);
 
+sub test_zone_dhcp_backends {
+    my $test_name = (split(/::/, (caller(0))[3]))[-1];
+    my $zoneid = "TESTZONE";
+
+    # dnsmasq answers on the vnet bridge, so it only fits zones confined to
+    # one node. The ebpf backend answers on the guest's tap and fits any
+    my $zone = {
+        type => "vlan",
+        bridge => "vmbr0",
+        ipam => "pve",
+        zone => $zoneid,
+    };
+    eval { PVE::API2::Network::SDN::Zones->create({ %$zone, dhcp => "dnsmasq" }); };
+    like(
+        $@,
+        qr/dnsmasq backend only supports simple zones/,
+        "$test_name: dnsmasq is refused on a vlan zone",
+    );
+
+    create_zone({ %$zone, dhcp => "ebpf" });
+    is(get_zone($zoneid)->{dhcp}, "ebpf", "$test_name: ebpf is accepted on a vlan zone");
+
+    eval { update_zone($zoneid, { dhcp => "dnsmasq" }); };
+    like(
+        $@,
+        qr/dnsmasq backend only supports simple zones/,
+        "$test_name: switching a vlan zone to dnsmasq is refused",
+    );
+
+    # every other zone type offers the backend as well
+    $test_state->{controller_config} = {
+        ids => { ctrl => { type => 'evpn', asn => 65000, peers => '10.0.0.1' } },
+    };
+    my $params = {
+        qinq => { bridge => 'vmbr0', tag => 100 },
+        vxlan => { peers => '10.0.0.1' },
+        evpn => { controller => 'ctrl', 'vrf-vxlan' => 1000 },
+        faucet => { 'dp-id' => 1, controller => 'ctrl' },
+    };
+    for my $type (sort keys %$params) {
+        my $id = uc($type) . "Z";
+        my $zone = { type => $type, ipam => "pve", zone => $id, %{ $params->{$type} } };
+        create_zone({ %$zone, dhcp => "ebpf" });
+        is(get_zone($id)->{dhcp}, "ebpf", "$test_name: ebpf is accepted on a $type zone");
+    }
+}
+
+run_test(\&test_zone_dhcp_backends);
+
 sub test_dnsmasq_dual_stack_and_sweep {
     my $test_name = (split(/::/, (caller(0))[3]))[-1];
     my $zoneid = "TESTZONE";
@@ -1584,7 +1633,7 @@ sub test_dnsmasq_dual_stack_and_sweep {
     is(
         PVE::Tools::file_get_contents($TMP_ETHERS_FILE),
         "$mac,10.0.0.100,[8888::ab]\n$other,10.0.0.102,[8888::AB]\n",
-        "$test_name: a line of another MAC spelled by the old code is kept",
+        "$test_name: a line of another MAC in its earlier spelling is kept",
     );
     is(
         scalar(grep { $_ eq 'reload' } $test_state->{dnsmasq_calls}->@*),
@@ -1818,6 +1867,8 @@ sub test_ebpf_backend {
     );
 }
 
+run_test(\&test_ebpf_backend);
+
 sub test_ebpf_backend_edge_cases {
     my $test_name = (split(/::/, (caller(0))[3]))[-1];
     my $zoneid = "TESTZONE";
@@ -1933,7 +1984,7 @@ sub test_ebpf_backend_edge_cases {
     );
 }
 
-run_test(\&test_ebpf_backend);
+run_test(\&test_ebpf_backend_edge_cases);
 
 sub test_zone_tap_plug {
     my $test_name = (split(/::/, (caller(0))[3]))[-1];
@@ -2063,7 +2114,6 @@ sub test_zone_tap_plug {
 }
 
 run_test(\&test_zone_tap_plug);
-run_test(\&test_ebpf_backend_edge_cases);
 
 sub test_ebpf_mac_case {
     my $test_name = (split(/::/, (caller(0))[3]))[-1];
@@ -2252,6 +2302,61 @@ sub test_ebpf_zone_mtu {
 
 run_test(\&test_ebpf_zone_mtu);
 
+sub test_ebpf_vxlan_mtu {
+    my $test_name = (split(/::/, (caller(0))[3]))[-1];
+    my $zoneid = "VXZONE";
+    my $vnetid = "vxvnet";
+    my $mac = "da:65:8f:18:9b:6f";
+
+    # a vxlan zone without an MTU of its own answers with the one its bridge
+    # takes from the underlay, the encapsulation overhead taken off
+    my $mocked_zone_plugin = Test::MockModule->new('PVE::Network::SDN::Zones::Plugin');
+    $mocked_zone_plugin->mock(
+        find_local_ip_interface_peers => sub { return ('10.10.10.1', 'eno1'); });
+    $mocked_pve_inotify->mock(
+        read_file => sub { return { ifaces => { eno1 => { mtu => 1400 } } }; });
+    create_zone({
+        type => "vxlan",
+        peers => "10.10.10.2",
+        dhcp => "ebpf",
+        ipam => "pve",
+        zone => $zoneid,
+    });
+    create_vnet({
+        type => "vnet",
+        zone => $zoneid,
+        vnet => $vnetid,
+        tag => 100,
+    });
+    create_subnet({
+        type => "subnet",
+        vnet => $vnetid,
+        subnet => "10.0.0.0/24",
+        gateway => "10.0.0.1",
+    });
+    $test_state->{vmlist} = { ids => { 999 => { type => 'qemu', node => 'localnode' } } };
+    $test_state->{guest_nets} = { 999 => { net0 => "virtio=$mac,bridge=$vnetid" } };
+    $test_state->{macdb} = { macs => { $mac => { ip4 => '10.0.0.100' } } };
+
+    take_ebpf_calls();
+    PVE::Network::SDN::Dhcp::regenerate_config();
+    is(
+        take_ebpf_calls()->[0]->{args}->[0]->[0]->{record}->{mtu},
+        1350,
+        "$test_name: the underlay's MTU minus the encapsulation is handed out",
+    );
+    update_zone($zoneid, { mtu => 1500 });
+    PVE::Network::SDN::Dhcp::regenerate_config();
+    is(
+        take_ebpf_calls()->[0]->{args}->[0]->[0]->{record}->{mtu},
+        1500,
+        "$test_name: an explicit zone MTU wins",
+    );
+    $mocked_pve_inotify->unmock('read_file');
+}
+
+run_test(\&test_ebpf_vxlan_mtu);
+
 sub test_ebpf_overlapping_subnets {
     my $test_name = (split(/::/, (caller(0))[3]))[-1];
     my $zoneid = "TESTZONE";
-- 
2.47.3