From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id DC7D81FF0BC for ; Thu, 29 Oct 2026 16:42:56 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id CA4D82167D; Thu, 29 Oct 2026 16:42:25 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network v5 6/9] sdn: evpn: accept untracked IPv6 neighbor advertisements Date: Thu, 29 Oct 2026 16:41:45 +0100 Message-ID: <20261029154148.2882594-7-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261029154148.2882594-1-h.laimer@proxmox.com> References: <20261029154148.2882594-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793288521672 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.367 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: LVB4W5Y6PCW75X376XRC23JBSJ7QXA54 X-Message-ID-Hash: LVB4W5Y6PCW75X376XRC23JBSJ7QXA54 X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Every node of an EVPN zone has the same gateway address and MAC on a vnet bridge. An exit node without a neighbor entry for a guest's IPv6 address floods a solicitation to the other nodes. The guest answers to the shared gateway, so the node it runs on gets the advertisement. That node never sent the solicitation, and with no entry for the address its kernel ignores the advertisement by default. The exit node is left without an entry and drops traffic from outside the zone to the guest. Set accept_untracked_na to 2 on vnet bridges with an IPv6 subnet [1]. The kernel then adds an entry from such an advertisement if its source is in the subnet of an address on the bridge. From there EVPN carries the entry to the exit node. [1] https://docs.kernel.org/networking/ip-sysctl.html#proc-sys-net-ipv6-variables Signed-off-by: Hannes Laimer --- Notes: v3: - add the missing accept_untracked_na line to the exitnode_local_routing_ipv6 fixture src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 5 +++++ .../evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces | 1 + src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces | 1 + .../zones/evpn/exitnodenullroute/expected_sdn_interfaces | 1 + src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces | 1 + .../zones/evpn/ipv4ipv6nogateway/expected_sdn_interfaces | 1 + src/test/zones/evpn/ipv6/expected_sdn_interfaces | 1 + src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces | 1 + 8 files changed, 12 insertions(+) diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm index c1d5536e09c0..96f549577b3b 100644 --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm @@ -309,6 +309,11 @@ sub generate_sdn_config { push @iface_config, "ip-forward on" if $enable_forward_v4; push @iface_config, "ip6-forward on" if $enable_forward_v6; push @iface_config, "arp-accept on" if $ipv4 || $ipv6; + + if ($ipv6) { + push @iface_config, + "post-up echo 2 > /proc/sys/net/ipv6/conf/$vnetid/accept_untracked_na || true"; + } push @iface_config, "vrf $vrf_iface" if $vrf_iface; push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid}; diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces index b46d4e7b6ea0..9b268f21857f 100644 --- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces +++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces @@ -9,6 +9,7 @@ iface myvnet mtu 1450 ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces index 0d7d17412f0b..3e9b8adca124 100644 --- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces +++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces @@ -28,6 +28,7 @@ iface myvnet2 mtu 1450 ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet2/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces index 4bf5ccf96f91..81a3b39ed129 100644 --- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces +++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces @@ -15,6 +15,7 @@ iface myvnet ip-forward on ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto myvnet2 diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces index 7a5d741b067c..7b1727bbf278 100644 --- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces +++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces @@ -12,6 +12,7 @@ iface myvnet ip-forward on ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone diff --git a/src/test/zones/evpn/ipv4ipv6nogateway/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6nogateway/expected_sdn_interfaces index 378fa77fa368..4d904be3fd5b 100644 --- a/src/test/zones/evpn/ipv4ipv6nogateway/expected_sdn_interfaces +++ b/src/test/zones/evpn/ipv4ipv6nogateway/expected_sdn_interfaces @@ -8,6 +8,7 @@ iface myvnet bridge_fd 0 mtu 1450 arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces index b2bdbfefd810..f77612293fbf 100644 --- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces +++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces @@ -10,6 +10,7 @@ iface myvnet mtu 1450 ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces index 3b91f75eb3dd..ab5988fae818 100644 --- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces +++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces @@ -10,6 +10,7 @@ iface myvnet mtu 1450 ip6-forward on arp-accept on + post-up echo 2 > /proc/sys/net/ipv6/conf/myvnet/accept_untracked_na || true vrf vrf_myzone auto vrf_myzone -- 2.47.3