From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id F38D51FF09C for ; Mon, 02 Nov 2026 16:19:08 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 47ADB21A1C; Mon, 02 Nov 2026 16:18:55 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network v5 04/15] sdn: zones: take the VXLAN and EVPN MTU from the underlay interface Date: Mon, 2 Nov 2026 16:18:31 +0100 Message-ID: <20261102151842.1605234-5-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261102151842.1605234-1-h.laimer@proxmox.com> References: <20261102151842.1605234-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793632729544 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.652 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_MAILER 2 Automated Mailer Tag Left in Email RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: Y6YPDLRP3BFEEK5C74SV47K4JA5WZKTN X-Message-ID-Hash: Y6YPDLRP3BFEEK5C74SV47K4JA5WZKTN X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The MTU of a VXLAN or EVPN zone without its own setting is the MTU of the interface that reaches its peers, minus the 50 bytes of VXLAN encapsulation. The lookup read that interface one level too high in the parsed network configuration and never found it. So the vnets always got the default of 1450. A zone whose underlay interface has an MTU set gets that MTU minus the encapsulation at its next apply, such as 8950 on a 9000 byte underlay. Signed-off-by: Hannes Laimer --- Notes: v5: * new src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 8 ++-- src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 18 +++++--- .../underlay_mtu/expected_controller_config | 44 +++++++++++++++++++ .../evpn/underlay_mtu/expected_sdn_interfaces | 42 ++++++++++++++++++ src/test/zones/evpn/underlay_mtu/interfaces | 8 ++++ src/test/zones/evpn/underlay_mtu/sdn_config | 26 +++++++++++ .../underlay_mtu/expected_sdn_interfaces | 15 +++++++ src/test/zones/vxlan/underlay_mtu/interfaces | 8 ++++ src/test/zones/vxlan/underlay_mtu/sdn_config | 11 +++++ 9 files changed, 170 insertions(+), 10 deletions(-) create mode 100644 src/test/zones/evpn/underlay_mtu/expected_controller_config create mode 100644 src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces create mode 100644 src/test/zones/evpn/underlay_mtu/interfaces create mode 100644 src/test/zones/evpn/underlay_mtu/sdn_config create mode 100644 src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces create mode 100644 src/test/zones/vxlan/underlay_mtu/interfaces create mode 100644 src/test/zones/vxlan/underlay_mtu/sdn_config diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm index 0e79707c3746..99ad13d5a1d3 100644 --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm @@ -212,11 +212,9 @@ sub generate_sdn_config { my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node}; my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'}; - my $mtu = 1450; - if ($iface) { - $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu}; - } - $mtu = $plugin_config->{mtu} if $plugin_config->{mtu}; + my $mtu = PVE::Network::SDN::Zones::VxlanPlugin::vxlan_mtu( + $plugin_config, $iface, $interfaces_config, + ); #vxlan interface my $vxlan_iface = "vxlan_$vnetid"; diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm index 1d6d5886b107..823ad19858ac 100644 --- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm +++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm @@ -47,6 +47,18 @@ sub properties { }; } +# the vnet bridge takes the underlay interface's MTU minus the vxlan +# encapsulation where the peers name a local interface, the default +# otherwise. An explicit zone MTU wins +sub vxlan_mtu { + my ($plugin_config, $iface, $interfaces_config) = @_; + + return $plugin_config->{mtu} if $plugin_config->{mtu}; + return $interfaces_config->{ifaces}->{$iface}->{mtu} - 50 + if $iface && $interfaces_config->{ifaces}->{$iface}->{mtu}; + return 1450; +} + sub options { return { nodes => { optional => 1 }, @@ -117,11 +129,7 @@ sub generate_sdn_config { die "neither peers nor fabric configured for VXLAN zone $plugin_config->{id}"; } - my $mtu = 1450; - if ($iface) { - $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu}; - } - $mtu = $plugin_config->{mtu} if $plugin_config->{mtu}; + my $mtu = vxlan_mtu($plugin_config, $iface, $interfaces_config); #vxlan interface my @iface_config = (); diff --git a/src/test/zones/evpn/underlay_mtu/expected_controller_config b/src/test/zones/evpn/underlay_mtu/expected_controller_config new file mode 100644 index 000000000000..0c6cc0939d15 --- /dev/null +++ b/src/test/zones/evpn/underlay_mtu/expected_controller_config @@ -0,0 +1,44 @@ +frr version 10.6.1 +frr defaults datacenter +hostname localhost +log syslog informational +service integrated-vtysh-config +! +vrf vrf_myzone + vni 1000 +exit-vrf +! +router bgp 65000 + bgp router-id 192.168.0.1 + no bgp hard-administrative-reset + no bgp default ipv4-unicast + coalesce-time 1000 + no bgp graceful-restart notification + neighbor VTEP peer-group + neighbor VTEP remote-as 65000 + neighbor VTEP bfd + neighbor 192.168.0.2 peer-group VTEP + neighbor 192.168.0.3 peer-group VTEP + ! + address-family l2vpn evpn + neighbor VTEP activate + neighbor VTEP route-map MAP_VTEP_IN in + neighbor VTEP route-map MAP_VTEP_OUT out + advertise-all-vni + exit-address-family +exit +! +router bgp 65000 vrf vrf_myzone + bgp router-id 192.168.0.1 + no bgp hard-administrative-reset + no bgp graceful-restart notification +exit +! +route-map MAP_VTEP_IN permit 1 +exit +! +route-map MAP_VTEP_OUT permit 1 +exit +! +line vty +! diff --git a/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces b/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces new file mode 100644 index 000000000000..66d6c3d40a08 --- /dev/null +++ b/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces @@ -0,0 +1,42 @@ +#version:1 + +auto myvnet +iface myvnet + address 10.0.0.1/24 + hwaddress A2:1D:CB:1A:C0:8B + bridge_ports vxlan_myvnet + bridge_stp off + bridge_fd 0 + mtu 8950 + ip-forward on + arp-accept on + vrf vrf_myzone + +auto vrf_myzone +iface vrf_myzone + vrf-table auto + post-up ip route add vrf vrf_myzone unreachable default metric 4278198272 + +auto vrfbr_myzone +iface vrfbr_myzone + bridge-ports vrfvx_myzone + bridge_stp off + bridge_fd 0 + mtu 8950 + vrf vrf_myzone + +auto vrfvx_myzone +iface vrfvx_myzone + vxlan-id 1000 + vxlan-local-tunnelip 192.168.0.1 + bridge-learning off + bridge-arp-nd-suppress on + mtu 8950 + +auto vxlan_myvnet +iface vxlan_myvnet + vxlan-id 100 + vxlan-local-tunnelip 192.168.0.1 + bridge-learning off + bridge-arp-nd-suppress on + mtu 8950 diff --git a/src/test/zones/evpn/underlay_mtu/interfaces b/src/test/zones/evpn/underlay_mtu/interfaces new file mode 100644 index 000000000000..c32f92e1a7fc --- /dev/null +++ b/src/test/zones/evpn/underlay_mtu/interfaces @@ -0,0 +1,8 @@ +auto vmbr0 +iface vmbr0 inet static + address 192.168.0.1/24 + gateway 192.168.0.254 + mtu 9000 + bridge-ports eth0 + bridge-stp off + bridge-fd 0 diff --git a/src/test/zones/evpn/underlay_mtu/sdn_config b/src/test/zones/evpn/underlay_mtu/sdn_config new file mode 100644 index 000000000000..dd73b5cdc140 --- /dev/null +++ b/src/test/zones/evpn/underlay_mtu/sdn_config @@ -0,0 +1,26 @@ +{ + version => 1, + vnets => { + ids => { + myvnet => { tag => "100", type => "vnet", zone => "myzone" }, + }, + }, + + zones => { + ids => { myzone => { ipam => "pve", type => "evpn", controller => "evpnctl", 'vrf-vxlan' => 1000, 'mac' => 'A2:1D:CB:1A:C0:8B' } }, + }, + controllers => { + ids => { evpnctl => { type => "evpn", 'peers' => '192.168.0.1,192.168.0.2,192.168.0.3', asn => "65000" } }, + }, + + subnets => { + ids => { 'myzone-10.0.0.0-24' => { + 'type' => 'subnet', + 'vnet' => 'myvnet', + 'gateway' => '10.0.0.1', + } + } + } +} + + diff --git a/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces b/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces new file mode 100644 index 000000000000..263e86d11085 --- /dev/null +++ b/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces @@ -0,0 +1,15 @@ +#version:1 + +auto myvnet +iface myvnet + bridge_ports vxlan_myvnet + bridge_stp off + bridge_fd 0 + mtu 8950 + +auto vxlan_myvnet +iface vxlan_myvnet + vxlan-id 100 + vxlan_remoteip 192.168.0.2 + vxlan_remoteip 192.168.0.3 + mtu 8950 diff --git a/src/test/zones/vxlan/underlay_mtu/interfaces b/src/test/zones/vxlan/underlay_mtu/interfaces new file mode 100644 index 000000000000..c32f92e1a7fc --- /dev/null +++ b/src/test/zones/vxlan/underlay_mtu/interfaces @@ -0,0 +1,8 @@ +auto vmbr0 +iface vmbr0 inet static + address 192.168.0.1/24 + gateway 192.168.0.254 + mtu 9000 + bridge-ports eth0 + bridge-stp off + bridge-fd 0 diff --git a/src/test/zones/vxlan/underlay_mtu/sdn_config b/src/test/zones/vxlan/underlay_mtu/sdn_config new file mode 100644 index 000000000000..f929304206c9 --- /dev/null +++ b/src/test/zones/vxlan/underlay_mtu/sdn_config @@ -0,0 +1,11 @@ +{ + version => 1, + vnets => { + ids => { + myvnet => { tag => 100, type => "vnet", zone => "myzone" }, + }, + }, + zones => { + ids => { myzone => { ipam => "pve", type => "vxlan", peers => "192.168.0.1,192.168.0.2,192.168.0.3" } }, + }, +} -- 2.47.3