Re: [RFC manager/network/proxmox{-ebpf,-perl-rs} 00/12] sdn: implement DHCP for all zones using eBPF

[Hannes Laimer <h.laimer@proxmox.com>]

On 2026-09-02 14:48, Hannes Laimer wrote:
> Adds a second DHCP backend, `ebpf`, next to dnsmasq, selectable per
> zone. It aims to replace dnsmasq eventually, for now it is a second
> implementation, which keeps a migration simple. Every zone type can
> enable DHCP through a dropdown selector, `dnsmasq` stays limited to
> simple zones.
> 
> The responder is a subsystem of `proxmox-ebpf` [1], Perl reaches it
> through new pve-rs bindings (PVE::RS::SDN::Dhcp), so the pve-network
> patches need the pve-rs of this series.
> 
> Currently only supports DHCPv4, but adding v6 is very possible once we're happy
> with the overall design.
> 
> # How
> An eBPF program on the ingress of every guest tap parses DHCP requests,
> looks the client MAC up in a mac -> ip+options map and rewrites the
> request into the reply in place, redirected back out of the tap. The
> exchange never reaches the bridge. Everything else, including MACs
> without a map entry, passes untouched, so attaching is a no-op for
> unmanaged MACs.
> 
> IPAM is the source of the assignments, the map is a per-node copy of
> the records, kept current by:
>  - guest start / NIC hotplug / migration: add_dhcp_mapping already
>    fires here and pushes the MAC's record before the interface is
>    plugged, tap_plug then attaches the program.
>  - mapping create/update/delete through the API: the editing node
>    updates its own map and pokes the node running the guest to do the
>    same, detached from the request. Best effort, an unreachable node
>    catches up on its next apply or the guest's next start.
>  - SDN apply: refreshes the programs, drops the link pins of departed
>    guests and rebuilds the map from the current records.
>  - boot: maps start empty, every guest start seeds its own record.
> 
> Changes made directly on an external IPAM service are not detectable
> and the per-MAC answers are cached, so they are not picked up on apply
> either, exactly like with dnsmasq today.
> 
> The pve-network part applies on top of the separately posted patch
> pushing ipam API mapping changes to the dhcp backend. Its first
> patches are preparatory, no negative per-MAC cache entries and a
> locked cache write, a lease time property on subnets, and asserting a
> backend's availability only for zones using it.

oops, did not send that yet, it's [2]

> 
> [1] https://lore.proxmox.com/pve-devel/8d63974f-0a73-480b-9407-c6bdc2d576d7@proxmox.com

[2]
https://lore.proxmox.com/pve-devel/20260902125357.757029-1-h.laimer@proxmox.com/T/#u

> 
> 
> proxmox-ebpf:
> 
> Hannes Laimer (2):
>   dhcp: add per-tap responder BPF program
>   dhcp: add responder subsystem
> 
>  Cargo.toml              |   5 +
>  debian/control          |   6 +-
>  src/dhcp/bpf/dhcp.bpf.c | 324 +++++++++++++++++++
>  src/dhcp/bpf/types.h    |  25 ++
>  src/dhcp/mod.rs         | 288 +++++++++++++++++
>  src/dhcp/types.rs       |  53 ++++
>  src/lib.rs              |   3 +
>  src/subsystem.rs        |  35 +++
>  tests/dhcp.rs           | 668 ++++++++++++++++++++++++++++++++++++++++
>  9 files changed, 1406 insertions(+), 1 deletion(-)
>  create mode 100644 src/dhcp/bpf/dhcp.bpf.c
>  create mode 100644 src/dhcp/bpf/types.h
>  create mode 100644 src/dhcp/mod.rs
>  create mode 100644 src/dhcp/types.rs
>  create mode 100644 tests/dhcp.rs
> 
> 
> proxmox-perl-rs:
> 
> Hannes Laimer (1):
>   pve-rs: sdn: add dhcp responder bindings
> 
>  pve-rs/Cargo.toml               |  2 +
>  pve-rs/Makefile                 |  1 +
>  pve-rs/debian/control           |  2 +
>  pve-rs/src/bindings/sdn/dhcp.rs | 91 +++++++++++++++++++++++++++++++++
>  pve-rs/src/bindings/sdn/mod.rs  |  1 +
>  5 files changed, 97 insertions(+)
>  create mode 100644 pve-rs/src/bindings/sdn/dhcp.rs
> 
> 
> pve-network:
> 
> Hannes Laimer (8):
>   sdn: ipam: do not cache negative per-MAC answers, lock the write
>   sdn: subnets: add dhcp-lease-time property
>   sdn: dhcp: only assert a backend's availability for zones using it
>   sdn: dhcp: add ebpf plugin
>   sdn: zones: attach the dhcp responder on tap plug
>   sdn: dhcp: apply mapping edits on the node serving the guest
>   sdn: zones: offer dhcp on all zone types, keep dnsmasq simple-only
>   tests: cover the ebpf dhcp backend and ipam API mapping pushes
> 
>  src/PVE/API2/Network/SDN/Ips.pm           |   5 +-
>  src/PVE/API2/Network/SDN/Nodes/Status.pm  |  37 ++++-
>  src/PVE/API2/Network/SDN/Zones.pm         |   8 +-
>  src/PVE/Network/SDN/Dhcp.pm               |  87 ++++++++++-
>  src/PVE/Network/SDN/Dhcp/Ebpf.pm          | 173 ++++++++++++++++++++++
>  src/PVE/Network/SDN/Dhcp/Makefile         |   2 +-
>  src/PVE/Network/SDN/Ipams.pm              |  20 ++-
>  src/PVE/Network/SDN/SubnetPlugin.pm       |   7 +
>  src/PVE/Network/SDN/Zones.pm              |   4 +
>  src/PVE/Network/SDN/Zones/EvpnPlugin.pm   |   1 +
>  src/PVE/Network/SDN/Zones/FaucetPlugin.pm |   1 +
>  src/PVE/Network/SDN/Zones/QinQPlugin.pm   |   7 +
>  src/PVE/Network/SDN/Zones/VlanPlugin.pm   |   7 +
>  src/PVE/Network/SDN/Zones/VxlanPlugin.pm  |   9 ++
>  src/test/run_test_vnets_blackbox.pl       | 147 ++++++++++++++++++
>  15 files changed, 502 insertions(+), 13 deletions(-)
>  create mode 100644 src/PVE/Network/SDN/Dhcp/Ebpf.pm
> 
> 
> pve-manager:
> 
> Hannes Laimer (1):
>   ui: sdn: dhcp backend selector on all zones, expose dhcp options
> 
>  www/manager6/sdn/SubnetEdit.js       | 24 ++++++++++++++++++++++++
>  www/manager6/sdn/zones/Base.js       | 17 +++++++++++++++++
>  www/manager6/sdn/zones/SimpleEdit.js | 11 -----------
>  3 files changed, 41 insertions(+), 11 deletions(-)
> 
> 
> Summary over all repositories:
>   32 files changed, 2046 insertions(+), 25 deletions(-)
>