[pve-devel] [PATCH pve-common v2 1/4] tap_plug: add support for bridge port isolation

[pve-devel] [PATCH pve-common v2 1/4] tap_plug: add support for bridge port isolation

[Stefan Hanreich]

From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>

This is allow to block traffic/isolation traffic between all ports
on the bridge with isolation (so between the vms), ans still allow
incoming traffic from uplink.

Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
Changes from v1 to v2:
* rebased
* Improved naming of parameters slightly
* Improve description of parameters
* Add short section to documentation

 src/PVE/Network.pm | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm
index cde7949..269b9cf 100644
--- a/src/PVE/Network.pm
+++ b/src/PVE/Network.pm
@@ -238,6 +238,13 @@ sub disable_ipv6 {
     return;
 }
 
+my $bridge_enable_port_isolation = sub {
+   my ($iface) = @_;
+
+   eval { run_command(['/sbin/bridge', 'link', 'set', 'dev', $iface, 'isolated', 'on']) };
+   die "unable to enable port isolation on interface $iface - $@\n" if $@;
+};
+
 my $bridge_disable_interface_learning = sub {
     my ($iface) = @_;
 
@@ -418,7 +425,7 @@ sub veth_delete {
 }
 
 my $create_firewall_bridge_linux = sub {
-    my ($iface, $bridge, $tag, $trunks, $no_learning) = @_;
+    my ($iface, $bridge, $tag, $trunks, $no_learning, $isolation) = @_;
 
     my ($vmid, $devid) = &$parse_tap_device_name($iface);
     my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
@@ -433,6 +440,7 @@ my $create_firewall_bridge_linux = sub {
 
     &$bridge_add_interface($bridge, $vethfwpeer, $tag, $trunks);
     &$bridge_disable_interface_learning($vethfwpeer) if $no_learning;
+    $bridge_enable_port_isolation->($vethfwpeer) if $isolation;
     &$bridge_add_interface($fwbr, $vethfw);
 
     &$bridge_add_interface($fwbr, $iface);
@@ -492,6 +500,7 @@ sub tap_plug {
 	$opts->{learning} = !($bridge && $bridge->{'bridge-disable-mac-learning'}); # default learning to on
     }
     my $no_learning = !$opts->{learning};
+    my $isolation = $opts->{isolation};
 
     # cleanup old port config from any openvswitch bridge
     eval {
@@ -512,7 +521,7 @@ sub tap_plug {
 	}
 
 	if ($firewall) {
-	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning);
+	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning, $isolation);
 	} else {
 	    &$bridge_add_interface($bridge, $iface, $tag, $trunks);
 	}
@@ -520,6 +529,7 @@ sub tap_plug {
 	    $bridge_disable_interface_learning->($iface);
 	    add_bridge_fdb($iface, $opts->{mac}) if defined($opts->{mac});
 	}
+	$bridge_enable_port_isolation->($iface) if $isolation;
 
     } else {
 	&$cleanup_firewall_bridge($iface); # remove stale devices
-- 
2.39.5


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH pve-manager v2 2/4] sdn: vnet: add isolate-ports option

[Stefan Hanreich]

From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>

We add this as advanced option in the UI and also move vlan-aware
to advanced section.

Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
 [ SH: improve naming and commit msg slightly ]
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 www/manager6/sdn/VnetEdit.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/www/manager6/sdn/VnetEdit.js b/www/manager6/sdn/VnetEdit.js
index 9fb6cd6c7..e5870893e 100644
--- a/www/manager6/sdn/VnetEdit.js
+++ b/www/manager6/sdn/VnetEdit.js
@@ -71,6 +71,18 @@ Ext.define('PVE.sdn.VnetInputPanel', {
 		deleteEmpty: "{!isCreate}",
 	    },
 	},
+    ],
+    advancedItems: [
+	{
+	    xtype: 'proxmoxcheckbox',
+	    name: 'isolate-ports',
+	    uncheckedValue: null,
+	    checked: false,
+	    fieldLabel: gettext('Isolate Ports'),
+	    cbind: {
+		deleteEmpty: "{!isCreate}",
+	    },
+	},
 	{
 	    xtype: 'proxmoxcheckbox',
 	    itemId: 'sdnVnetVlanAwareField',
-- 
2.39.5


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] applied: [PATCH pve-manager v2 2/4] sdn: vnet: add isolate-ports option

[Thomas Lamprecht]

Am 12.11.24 um 16:54 schrieb Stefan Hanreich:
> From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>
> 
> We add this as advanced option in the UI and also move vlan-aware
> to advanced section.
> 
> Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
>  [ SH: improve naming and commit msg slightly ]
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  www/manager6/sdn/VnetEdit.js | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
>

applied, thanks!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH pve-network v2 3/4] vnets : add ports isolation

[Stefan Hanreich]

From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>

Add support for bridge ports isolation
https://github.com/torvalds/linux/commit/7d850abd5f4edb1b1ca4b4141a4453305736f564

This allow to drop traffic between all ports having isolation enabled
on the local bridge, but allow traffic with non isolated ports.

Here,we isolate traffic between vms but allow traffic coming from outside.

Main usage is for layer3 routed or natted setup, but some users have requested it
for layer2/bridge network with proxy arp.
So we can enable it at vnet level.

Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
 [ SH: improve option naming and description slightly ]
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 src/PVE/Network/SDN/VnetPlugin.pm   | 5 +++++
 src/PVE/Network/SDN/Zones/Plugin.pm | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/PVE/Network/SDN/VnetPlugin.pm b/src/PVE/Network/SDN/VnetPlugin.pm
index 062904c..f44380a 100644
--- a/src/PVE/Network/SDN/VnetPlugin.pm
+++ b/src/PVE/Network/SDN/VnetPlugin.pm
@@ -72,6 +72,10 @@ sub properties {
             maxLength => 256,
 	    optional => 1,
         },
+	'isolate-ports' => {
+	    type => 'boolean',
+	    description => "If true, sets the isolated property for all members of this VNet",
+	}
     };
 }
 
@@ -81,6 +85,7 @@ sub options {
         tag => { optional => 1},
         alias => { optional => 1 },
         vlanaware => { optional => 1 },
+	'isolate-ports' => { optional => 1 },
     };
 }
 
diff --git a/src/PVE/Network/SDN/Zones/Plugin.pm b/src/PVE/Network/SDN/Zones/Plugin.pm
index 26cc0da..a860168 100644
--- a/src/PVE/Network/SDN/Zones/Plugin.pm
+++ b/src/PVE/Network/SDN/Zones/Plugin.pm
@@ -236,6 +236,7 @@ sub tap_plug {
 
     my $opts = {};
     $opts->{learning} = 0 if $plugin_config->{'bridge-disable-mac-learning'};
+    $opts->{isolation} = 1 if $vnet->{'isolate-ports'};
     PVE::Network::tap_plug($iface, $vnetid, $tag, $firewall, $trunks, $rate, $opts);
 }
 
-- 
2.39.5


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] applied: [PATCH pve-network v2 3/4] vnets : add ports isolation

[Thomas Lamprecht]

Am 12.11.24 um 16:54 schrieb Stefan Hanreich:
> From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>
> 
> Add support for bridge ports isolation
> https://github.com/torvalds/linux/commit/7d850abd5f4edb1b1ca4b4141a4453305736f564
> 
> This allow to drop traffic between all ports having isolation enabled
> on the local bridge, but allow traffic with non isolated ports.
> 
> Here,we isolate traffic between vms but allow traffic coming from outside.
> 
> Main usage is for layer3 routed or natted setup, but some users have requested it
> for layer2/bridge network with proxy arp.
> So we can enable it at vnet level.
> 
> Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
>  [ SH: improve option naming and description slightly ]
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  src/PVE/Network/SDN/VnetPlugin.pm   | 5 +++++
>  src/PVE/Network/SDN/Zones/Plugin.pm | 1 +
>  2 files changed, 6 insertions(+)
> 
>

applied this one a bit ago, before getting the review mail from Stoiko, so
without his trailers, thanks to all involved nonetheless!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH pve-docs v2 4/4] sdn: add documentation for isolated ports option

[Stefan Hanreich]

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 pvesdn.adoc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pvesdn.adoc b/pvesdn.adoc
index 39de80f..b1f2578 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -383,6 +383,11 @@ Tag:: The unique VLAN or VXLAN ID
 VLAN Aware:: Enables vlan-aware option on the interface, enabling configuration
   in the guest.
 
+Isolate Ports:: Sets the isolated flag for all members of this port, except for
+the bridge port. This means that every port can only send traffic to the bridge
+port. In order for this setting to take effect, you need to restart the VMs
+that have interfaces on the VNet.
+
 
 [[pvesdn_config_subnet]]
 Subnets
-- 
2.39.5


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-docs v2 4/4] sdn: add documentation for isolated ports option

[Stoiko Ivanov]

On Tue, 12 Nov 2024 16:54:25 +0100
Stefan Hanreich <s.hanreich@proxmox.com> wrote:

> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  pvesdn.adoc | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/pvesdn.adoc b/pvesdn.adoc
> index 39de80f..b1f2578 100644
> --- a/pvesdn.adoc
> +++ b/pvesdn.adoc
> @@ -383,6 +383,11 @@ Tag:: The unique VLAN or VXLAN ID
>  VLAN Aware:: Enables vlan-aware option on the interface, enabling configuration
>    in the guest.
>  
> +Isolate Ports:: Sets the isolated flag for all members of this port, except for
> +the bridge port. This means that every port can only send traffic to the bridge
> +port. In order for this setting to take effect, you need to restart the VMs
> +that have interfaces on the VNet.
> +
Reading through the VNet docs - I'd rename bridge port to 'interface' and
members to guest ports. - maybe like this:
```
Isolate Ports:: Sets the isolated flag for all guest ports of this interface,
but not for the interface itself. This means that guests cannot send traffic to
each other. In order for this setting to take effect, you need to restart the 
affected guest.
```


>  
>  [[pvesdn_config_subnet]]
>  Subnets



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-docs v2 4/4] sdn: add documentation for isolated ports option

[Hannes Dürr]

I like your changes, but I would adapt the description more to the 
bridge manpage [0].

[0] https://www.man7.org/linux/man-pages/man8/bridge.8.html

On 11/18/24 19:52, Stoiko Ivanov wrote:
> On Tue, 12 Nov 2024 16:54:25 +0100
> Stefan Hanreich <s.hanreich@proxmox.com> wrote:
>
>> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
>> ---
>>   pvesdn.adoc | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/pvesdn.adoc b/pvesdn.adoc
>> index 39de80f..b1f2578 100644
>> --- a/pvesdn.adoc
>> +++ b/pvesdn.adoc
>> @@ -383,6 +383,11 @@ Tag:: The unique VLAN or VXLAN ID
>>   VLAN Aware:: Enables vlan-aware option on the interface, enabling configuration
>>     in the guest.
>>   
>> +Isolate Ports:: Sets the isolated flag for all members of this port, except for
>> +the bridge port. This means that every port can only send traffic to the bridge
>> +port. In order for this setting to take effect, you need to restart the VMs
>> +that have interfaces on the VNet.
>> +
> Reading through the VNet docs - I'd rename bridge port to 'interface' and
> members to guest ports. - maybe like this:
> ```
> Isolate Ports:: Sets the isolated flag for all guest ports of this interface,
> but not for the interface itself. This means that guests cannot send traffic to
> each other. In order for this setting to take effect, you need to restart the
> affected guest.
> ```
This means that guests cannot send traffic to each other -> This means 
guests can only send traffic to non-isolated guests

>
>
>>   
>>   [[pvesdn_config_subnet]]
>>   Subnets
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-docs v2 4/4] sdn: add documentation for isolated ports option

[Stoiko Ivanov]

On Tue, 19 Nov 2024 11:06:12 +0100
Hannes Dürr <h.duerr@proxmox.com> wrote:

> I like your changes, but I would adapt the description more to the 
> bridge manpage [0].
> 
> [0] https://www.man7.org/linux/man-pages/man8/bridge.8.html
> 
> On 11/18/24 19:52, Stoiko Ivanov wrote:
> > On Tue, 12 Nov 2024 16:54:25 +0100
> > Stefan Hanreich <s.hanreich@proxmox.com> wrote:
> >  
> >> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> >> ---
> >>   pvesdn.adoc | 5 +++++
> >>   1 file changed, 5 insertions(+)
> >>
> >> diff --git a/pvesdn.adoc b/pvesdn.adoc
> >> index 39de80f..b1f2578 100644
> >> --- a/pvesdn.adoc
> >> +++ b/pvesdn.adoc
> >> @@ -383,6 +383,11 @@ Tag:: The unique VLAN or VXLAN ID
> >>   VLAN Aware:: Enables vlan-aware option on the interface, enabling configuration
> >>     in the guest.
> >>   
> >> +Isolate Ports:: Sets the isolated flag for all members of this port, except for
> >> +the bridge port. This means that every port can only send traffic to the bridge
> >> +port. In order for this setting to take effect, you need to restart the VMs
> >> +that have interfaces on the VNet.
> >> +  
> > Reading through the VNet docs - I'd rename bridge port to 'interface' and
> > members to guest ports. - maybe like this:
> > ```
> > Isolate Ports:: Sets the isolated flag for all guest ports of this interface,
> > but not for the interface itself. This means that guests cannot send traffic to
> > each other. In order for this setting to take effect, you need to restart the
> > affected guest.
> > ```  
> This means that guests cannot send traffic to each other -> This means 
> guests can only send traffic to non-isolated guests
Thanks for the feedback!
I basically was at the same point staring at the screen for a while...
the setting is per VNet (a.k.a. at least for simple/VLAN zones)
bridge-wide - so short of manually fiddling with the port-settings with
`bridge link set` there currently are no such guests AFAICT.
if we adapt it I'd suggest:
This means guests can only send traffic to non-isolated bridge-ports,
which is the bridge itself.


> 
> >
> >  
> >>   
> >>   [[pvesdn_config_subnet]]
> >>   Subnets  
> >
> >
> > _______________________________________________
> > pve-devel mailing list
> > pve-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> >
> >  



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-docs v2 4/4] sdn: add documentation for isolated ports option

[Hannes Dürr]

On 11/19/24 11:19, Stoiko Ivanov wrote:
> On Tue, 19 Nov 2024 11:06:12 +0100
> Hannes Dürr <h.duerr@proxmox.com> wrote:
>
>> I like your changes, but I would adapt the description more to the
>> bridge manpage [0].
>>
>> [0] https://www.man7.org/linux/man-pages/man8/bridge.8.html
>>
>> On 11/18/24 19:52, Stoiko Ivanov wrote:
>>> On Tue, 12 Nov 2024 16:54:25 +0100
>>> Stefan Hanreich <s.hanreich@proxmox.com> wrote:
>>>   
>>>> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
>>>> ---
>>>>    pvesdn.adoc | 5 +++++
>>>>    1 file changed, 5 insertions(+)
>>>>
>>>> diff --git a/pvesdn.adoc b/pvesdn.adoc
>>>> index 39de80f..b1f2578 100644
>>>> --- a/pvesdn.adoc
>>>> +++ b/pvesdn.adoc
>>>> @@ -383,6 +383,11 @@ Tag:: The unique VLAN or VXLAN ID
>>>>    VLAN Aware:: Enables vlan-aware option on the interface, enabling configuration
>>>>      in the guest.
>>>>    
>>>> +Isolate Ports:: Sets the isolated flag for all members of this port, except for
>>>> +the bridge port. This means that every port can only send traffic to the bridge
>>>> +port. In order for this setting to take effect, you need to restart the VMs
>>>> +that have interfaces on the VNet.
>>>> +
>>> Reading through the VNet docs - I'd rename bridge port to 'interface' and
>>> members to guest ports. - maybe like this:
>>> ```
>>> Isolate Ports:: Sets the isolated flag for all guest ports of this interface,
>>> but not for the interface itself. This means that guests cannot send traffic to
>>> each other. In order for this setting to take effect, you need to restart the
>>> affected guest.
>>> ```
>> This means that guests cannot send traffic to each other -> This means
>> guests can only send traffic to non-isolated guests
> Thanks for the feedback!
> I basically was at the same point staring at the screen for a while...
> the setting is per VNet (a.k.a. at least for simple/VLAN zones)
> bridge-wide - so short of manually fiddling with the port-settings with
> `bridge link set` there currently are no such guests AFAICT.
> if we adapt it I'd suggest:
> This means guests can only send traffic to non-isolated bridge-ports,
> which is the bridge itself.
Sounds fine to me as well.
And yes you are right, after every VM has rebooted there are no such guests.
Nevertheless, I would stay as close as possible to the description of 
the actual documentation, which in my opinion is sufficient with your 
description.
There can always be the case that customers manually switch off the 
isolation for guests.
>
>
>>>   
>>>>    
>>>>    [[pvesdn_config_subnet]]
>>>>    Subnets
>>>
>>> _______________________________________________
>>> pve-devel mailing list
>>> pve-devel@lists.proxmox.com
>>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>>>
>>>   


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] applied: [PATCH pve-common v2 1/4] tap_plug: add support for bridge port isolation

[Thomas Lamprecht]

Am 12.11.24 um 16:54 schrieb Stefan Hanreich:
> From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>
> 
> This is allow to block traffic/isolation traffic between all ports
> on the bridge with isolation (so between the vms), ans still allow
> incoming traffic from uplink.
> 
> Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
> Changes from v1 to v2:
> * rebased
> * Improved naming of parameters slightly
> * Improve description of parameters
> * Add short section to documentation
> 
>  src/PVE/Network.pm | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
>

applied this one for now, thanks!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-common v2 1/4] tap_plug: add support for bridge port isolation

[Stoiko Ivanov]

saw this when looking through our git repos and thought I'll give it a
spin (as afaict only the manager and docs-patches are not applied yet)

It works, and does what it says it does.

small suggestions for the docs-patch will be sent as reply to the
docs-patch directly.
w/ or w/o the doc-suggestions:
Reviewed-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Tested-by: Stoiko Ivanov <s.ivanov@proxmox.com>

On Tue, 12 Nov 2024 16:54:22 +0100
Stefan Hanreich <s.hanreich@proxmox.com> wrote:

> From: Alexandre Derumier via pve-devel <pve-devel@lists.proxmox.com>
> 
> This is allow to block traffic/isolation traffic between all ports
> on the bridge with isolation (so between the vms), ans still allow
> incoming traffic from uplink.
> 
> Signed-off-by: Alexandre Derumier <alexandre.derumier@groupe-cyllene.com>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
> Changes from v1 to v2:
> * rebased
> * Improved naming of parameters slightly
> * Improve description of parameters
> * Add short section to documentation
> 
>  src/PVE/Network.pm | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm
> index cde7949..269b9cf 100644
> --- a/src/PVE/Network.pm
> +++ b/src/PVE/Network.pm
> @@ -238,6 +238,13 @@ sub disable_ipv6 {
>      return;
>  }
>  
> +my $bridge_enable_port_isolation = sub {
> +   my ($iface) = @_;
> +
> +   eval { run_command(['/sbin/bridge', 'link', 'set', 'dev', $iface, 'isolated', 'on']) };
> +   die "unable to enable port isolation on interface $iface - $@\n" if $@;
> +};
> +
>  my $bridge_disable_interface_learning = sub {
>      my ($iface) = @_;
>  
> @@ -418,7 +425,7 @@ sub veth_delete {
>  }
>  
>  my $create_firewall_bridge_linux = sub {
> -    my ($iface, $bridge, $tag, $trunks, $no_learning) = @_;
> +    my ($iface, $bridge, $tag, $trunks, $no_learning, $isolation) = @_;
>  
>      my ($vmid, $devid) = &$parse_tap_device_name($iface);
>      my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
> @@ -433,6 +440,7 @@ my $create_firewall_bridge_linux = sub {
>  
>      &$bridge_add_interface($bridge, $vethfwpeer, $tag, $trunks);
>      &$bridge_disable_interface_learning($vethfwpeer) if $no_learning;
> +    $bridge_enable_port_isolation->($vethfwpeer) if $isolation;
>      &$bridge_add_interface($fwbr, $vethfw);
>  
>      &$bridge_add_interface($fwbr, $iface);
> @@ -492,6 +500,7 @@ sub tap_plug {
>  	$opts->{learning} = !($bridge && $bridge->{'bridge-disable-mac-learning'}); # default learning to on
>      }
>      my $no_learning = !$opts->{learning};
> +    my $isolation = $opts->{isolation};
>  
>      # cleanup old port config from any openvswitch bridge
>      eval {
> @@ -512,7 +521,7 @@ sub tap_plug {
>  	}
>  
>  	if ($firewall) {
> -	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning);
> +	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning, $isolation);
>  	} else {
>  	    &$bridge_add_interface($bridge, $iface, $tag, $trunks);
>  	}
> @@ -520,6 +529,7 @@ sub tap_plug {
>  	    $bridge_disable_interface_learning->($iface);
>  	    add_bridge_fdb($iface, $opts->{mac}) if defined($opts->{mac});
>  	}
> +	$bridge_enable_port_isolation->($iface) if $isolation;
>  
>      } else {
>  	&$cleanup_firewall_bridge($iface); # remove stale devices



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel