From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: Re: [PATCH pve-network v3 10/17] sdn: zones: report interface plugs and unplugs to the DHCP backends
Date: Tue, 20 Oct 2026 15:17:57 +0200 [thread overview]
Message-ID: <de23820d-6034-4d21-9162-0cfb67f18d04@proxmox.com> (raw)
In-Reply-To: <20261020080005.470757-11-h.laimer@proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
On 10/20/26 10:01 AM, Hannes Laimer wrote:
> The ebpf DHCP backend answers on each guest interface rather than on
> the bridge, so the zone layer now reports every plug to the DHCP
> backends. The plug takes the guest's MAC along, since the address to
> hand out is recorded per MAC. A plug onto a plain bridge is reported
> too, since a running guest's interface can move there from a vnet.
> A failing backend only warns and the plug goes ahead.
>
> The zone layer also gains an unplug and a veth removal, which report
> the interface to the backends as gone.
>
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
> src/PVE/Network/SDN/Zones.pm | 29 ++++++-
> src/test/run_test_vnets_blackbox.pl | 129 ++++++++++++++++++++++++++++
> 2 files changed, 154 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/Network/SDN/Zones.pm b/src/PVE/Network/SDN/Zones.pm
> index 4229feda..10fc0731 100644
> --- a/src/PVE/Network/SDN/Zones.pm
> +++ b/src/PVE/Network/SDN/Zones.pm
> @@ -326,16 +326,18 @@ sub veth_create {
> }
>
> sub tap_plug {
> - my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_;
> + my ($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts) = @_;
>
> my $vnet = PVE::Network::SDN::Vnets::get_vnet($bridge, 1);
> if (!$vnet) { # fallback for classic bridge
> my $interfaces_config = PVE::INotify::read_file('interfaces');
> - my $opts = {};
> - $opts->{learning} = 0
> + my $bridge_opts = {};
> + $bridge_opts->{learning} = 0
> if $interfaces_config->{ifaces}->{$bridge}
> && $interfaces_config->{ifaces}->{$bridge}->{'bridge-disable-mac-learning'};
> - PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts);
> + # the dhcp backends hear of an interface moving onto a plain bridge as well
> + PVE::Network::SDN::Dhcp::tap_plug($bridge, $iface, $opts->{mac});
> + PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $bridge_opts);
> return;
> }
>
> @@ -346,9 +348,28 @@ sub tap_plug {
> if $plugin_config->{nodes} && !defined($plugin_config->{nodes}->{$nodename});
>
> my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
> +
> + # the dhcp backends act before the interface joins the bridge, so no request slips past
> + # them. Dhcp.pm comes in through Vnets.pm, since a use of it here would create a load-order
> + # cycle
> + PVE::Network::SDN::Dhcp::tap_plug($bridge, $iface, $opts->{mac});
> $plugin->tap_plug($plugin_config, $vnet, $tag, $iface, $bridge, $firewall, $trunks, $rate);
> }
>
> +sub tap_unplug {
> + my ($iface) = @_;
> +
> + PVE::Network::SDN::Dhcp::tap_unplug($iface);
> + PVE::Network::tap_unplug($iface);
> +}
> +
> +sub veth_delete {
> + my ($veth) = @_;
> +
> + PVE::Network::SDN::Dhcp::tap_unplug($veth);
> + PVE::Network::veth_delete($veth);
> +}
> +
> sub add_bridge_fdb {
> my ($iface, $macaddr, $bridge) = @_;
>
> diff --git a/src/test/run_test_vnets_blackbox.pl b/src/test/run_test_vnets_blackbox.pl
> index db6fc472..783d0d47 100755
> --- a/src/test/run_test_vnets_blackbox.pl
> +++ b/src/test/run_test_vnets_blackbox.pl
> @@ -1844,6 +1844,135 @@ sub test_ebpf_backend_edge_cases {
> }
>
> run_test(\&test_ebpf_backend);
> +
> +sub test_zone_tap_plug {
> + my $test_name = (split(/::/, (caller(0))[3]))[-1];
> + my $zoneid = "TESTZONE";
> + my $vnetid = "testvnet";
> + my $mac = "da:65:8f:18:9b:6f";
> +
> + # the zone plug hands the MAC on to the dhcp backends, and a plug onto a
> + # plain bridge tells them where the interface went
> + create_zone({
> + type => "simple",
> + dhcp => "ebpf",
> + ipam => "pve",
> + zone => $zoneid,
> + });
> + create_vnet({
> + type => "vnet",
> + zone => $zoneid,
> + vnet => $vnetid,
> + });
> + create_subnet({
> + type => "subnet",
> + vnet => $vnetid,
> + subnet => "10.0.0.0/24",
> + gateway => "10.0.0.1",
> + 'dhcp-range' => ["start-address=10.0.0.100,end-address=10.0.0.200"],
> + });
> + create_ip({
> + zone => $zoneid,
> + vnet => $vnetid,
> + mac => $mac,
> + ip => "10.0.0.100",
> + });
> + my $bridged = [];
> + my $unplugged = [];
> + $mocked_sdn_zones_super_plugin->mock(
> + tap_plug => sub {
> + push @$bridged, $_[5];
> + push $test_state->{order}->@*, 'bridge';
> + },
> + );
> + my $mocked_pve_network = Test::MockModule->new('PVE::Network');
> + $mocked_pve_network->mock(
> + tap_plug => sub {
> + push @$bridged, $_[1];
> + push $test_state->{order}->@*, 'bridge';
> + },
> + tap_unplug => sub { push @$unplugged, $_[0]; },
> + veth_delete => sub { push @$unplugged, $_[0]; },
> + );
> + $mocked_pve_inotify->mock(read_file => sub { return { ifaces => {} }; });
> + take_ebpf_calls();
> + take_order();
> +
> + PVE::Network::SDN::Zones::tap_plug('tap999i0', $vnetid, undef, 0, undef, undef,
> + { mac => $mac });
> + eq_or_diff($bridged, [$vnetid], "$test_name: the zone plugin plugs the interface");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'attach', args => ['tap999i0', $vnetid, $ebpf_record->("10.0.0.100")] }],
> + "$test_name: and the dhcp backend attaches it with the MAC's record",
> + );
> + is_deeply(
> + take_order(),
> + ['lock', 'refresh', 'write', 'bridge'],
> + "$test_name: the responder attaches before the interface joins the bridge",
> + );
> +
> + @$bridged = ();
> + PVE::Network::SDN::Zones::tap_plug('tap999i0', 'vmbr0', undef, 0, undef, undef,
> + { mac => $mac });
> + eq_or_diff($bridged, ['vmbr0'], "$test_name: a plain bridge is plugged the classic way");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'detach', args => ['tap999i0', { vnet => undef }] }],
> + "$test_name: and the dhcp backends hear where the interface went",
> + );
> +
> + # a vnet of another backend is a place the ebpf backend hears of as well
> + create_zone({
> + type => "simple",
> + dhcp => "dnsmasq",
> + ipam => "pve",
> + zone => "DNSZONE",
> + });
> + create_vnet({
> + type => "vnet",
> + zone => "DNSZONE",
> + vnet => "dnsvnet",
> + });
> + @$bridged = ();
> + PVE::Network::SDN::Zones::tap_plug(
> + 'tap999i0',
> + 'dnsvnet',
> + undef,
> + 0,
> + undef,
> + undef,
> + { mac => $mac },
> + );
> + eq_or_diff(
> + $bridged,
> + ['dnsvnet'],
> + "$test_name: a vnet of another backend is plugged by its zone",
> + );
> + eq_or_diff(
> + take_ebpf_calls(),
> + [{ method => 'detach', args => ['tap999i0', { vnet => 'dnsvnet' }] }],
> + "$test_name: and the ebpf backend hears which vnet the interface went to",
> + );
> +
> + # the zone unplug and the veth delete report the interface gone before
> + # the classic ones run
> + PVE::Network::SDN::Zones::tap_unplug('tap999i0');
> + PVE::Network::SDN::Zones::veth_delete('veth999i0');
> + eq_or_diff($unplugged, ['tap999i0', 'veth999i0'], "$test_name: the classic unplugs run");
> + eq_or_diff(
> + take_ebpf_calls(),
> + [
> + { method => 'detach', args => ['tap999i0', undef] },
> + { method => 'detach', args => ['veth999i0', undef] },
> + ],
> + "$test_name: and the dhcp backends hear the interfaces are gone",
> + );
> + $mocked_sdn_zones_super_plugin->unmock('tap_plug');
> + $mocked_pve_inotify->unmock('read_file');
> +}
> +
> +run_test(\&test_zone_tap_plug);
> run_test(\&test_ebpf_backend_edge_cases);
>
> sub test_ebpf_mac_case {
next prev parent reply other threads:[~2026-10-20 13:18 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 7:59 [PATCH container/docs/manager/network/proxmox{-ebpf,-perl-rs}/qemu-server v3 00/17] sdn: implement DHCP for all zones using eBPF Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-ebpf v3 01/17] dhcp: add the per-tap DHCPv4 responder program Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-ebpf v3 02/17] dhcp: add the subsystem that loads the responder and keeps its records Hannes Laimer
2026-10-20 13:09 ` Stefan Hanreich
2026-10-21 7:09 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH proxmox-perl-rs v3 03/17] pve-rs: sdn: add bindings for the eBPF DHCP responder Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 7:32 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 04/17] sdn: dhcp: replace a stale dnsmasq reservation instead of dropping it Hannes Laimer
2026-10-20 13:15 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 05/17] sdn: dhcp: update reservations when ip mappings change Hannes Laimer
2026-10-20 13:42 ` Stefan Hanreich
2026-10-21 7:21 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 06/17] sdn: ipam: key the MAC cache by lower-case MAC, stop caching misses Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 6:17 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 07/17] sdn: dhcp: make the lease time configurable per subnet Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 08/17] sdn: dhcp: require a backend only if a zone on this node uses it Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich
2026-10-20 7:59 ` [PATCH pve-network v3 09/17] sdn: dhcp: add an eBPF backend answering on each guest interface Hannes Laimer
2026-10-20 13:10 ` Stefan Hanreich
2026-10-21 6:16 ` Hannes Laimer
2026-10-20 7:59 ` [PATCH pve-network v3 10/17] sdn: zones: report interface plugs and unplugs to the DHCP backends Hannes Laimer
2026-10-20 13:17 ` Stefan Hanreich [this message]
2026-10-20 7:59 ` [PATCH pve-network v3 11/17] sdn: dhcp: push IP mapping edits to the guest's node Hannes Laimer
2026-10-20 13:09 ` Stefan Hanreich
2026-10-21 6:44 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-network v3 12/17] sdn: zones: allow the ebpf DHCP backend on every zone type Hannes Laimer
2026-10-20 8:00 ` [PATCH qemu-server v3 13/17] network: sdn: keep the DHCP backends current on guest NICs Hannes Laimer
2026-10-20 13:38 ` Stefan Hanreich
2026-10-20 8:00 ` [PATCH pve-container v3 14/17] net: report NIC plugs and removals to the SDN DHCP backends Hannes Laimer
2026-10-20 13:36 ` Stefan Hanreich
2026-10-21 7:29 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-manager v3 15/17] ui: sdn: add zone DHCP backend selector and subnet DHCP options Hannes Laimer
2026-10-20 13:19 ` Stefan Hanreich
2026-10-20 8:00 ` [PATCH pve-manager v3 16/17] sdn: bring up the DHCP backends at boot before the guests start Hannes Laimer
2026-10-20 13:21 ` Stefan Hanreich
2026-10-21 7:17 ` Hannes Laimer
2026-10-20 8:00 ` [PATCH pve-docs v3 17/17] sdn: dhcp: add eBPF backend section Hannes Laimer
2026-10-20 13:11 ` [PATCH container/docs/manager/network/proxmox{-ebpf,-perl-rs}/qemu-server v3 00/17] sdn: implement DHCP for all zones using eBPF Stefan Hanreich
2026-10-21 7:35 ` Hannes Laimer
2026-10-21 8:46 ` superseded: " Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=de23820d-6034-4d21-9162-0cfb67f18d04@proxmox.com \
--to=s.hanreich@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox