superseded: [PATCH manager/network/proxmox{-ebpf,-perl-rs} 00/12] sdn: implement DHCP for all zones using eBPF

[Hannes Laimer <h.laimer@proxmox.com>]

superseded-by:
https://lore.proxmox.com/pve-devel/20260909104144.1110031-1-h.laimer@proxmox.com/T/#t

On 2026-09-04 11:38, Hannes Laimer wrote:
> Adds a second DHCP backend, `ebpf`, next to dnsmasq, selectable per
> zone. It aims to replace dnsmasq eventually, for now it is a second
> implementation, which keeps a migration simple. Every zone type can
> enable DHCP through a dropdown selector, `dnsmasq` stays limited to
> simple zones.
> 
> The responder is a subsystem of `proxmox-ebpf` [1], Perl reaches it
> through new pve-rs bindings (PVE::RS::SDN::Dhcp), so the pve-network
> patches need the pve-rs of this series.
> 
> Currently only supports DHCPv4, but adding v6 is very possible once
> we're happy with the overall design.
> 
> # How
> An eBPF program on the ingress of every guest tap parses DHCP requests,
> looks the client MAC up in a mac -> ip+options map and rewrites the
> request into the reply in place, redirected back out of the tap. The
> exchange never reaches the bridge. Everything else, including MACs
> without a map entry, passes untouched, so attaching is a no-op for
> unmanaged MACs.
> 
> IPAM is the source of the assignments, the map is a per-node copy of
> the records. Every trigger below runs the same full pass, the plugin
> collects all records of the ebpf zones and the guest interfaces on
> their vnets, the responder diffs both against the kernel state, so
> programs, links and records converge from any starting point:
>  - guest start / NIC hotplug / migration: add_dhcp_mapping already
>    fires here, before the interface is plugged, a new tap_plug hook of
>    the dhcp plugins then attaches the program.
>  - mapping create/update/delete through the API: the editing node runs
>    it and pokes the node running the guest to do the same through a
>    new node endpoint (POST /nodes/{node}/sdn/dhcp-mapping), detached
>    from the request. Best effort, an unreachable node catches up on its
>    next apply or the guest's next start.
>  - SDN apply: also refreshes the programs, a rebuild on a schema change
>    is refilled in the same pass, and a zone switching its backend takes
>    effect for running guests too.
>  - boot: nothing is pinned, the first pass after boot loads the
>    programs and fills the map.
> 
> Subnets get a `dhcp-lease-time` property, used by both backends,
> dnsmasq keeps handing out infinite leases without it and the responder
> defaults to ten minutes. The responder identifies itself with the
> subnet gateway, so a subnet without one is not served, and it hands out
> IPv4 resolvers only, a v6 one configured on a v4 subnet is left out of
> the answers.
> 
> Changes made directly on an external IPAM service are not detectable
> and the per-MAC answers are cached, so they are not picked up on apply
> either, exactly like with dnsmasq today.
> 
> The pve-network patches apply on top of the separately posted patch
> pushing ipam API mapping changes to the dhcp backend [2].
> 
> pre-build packages are on sani(`packages/ebpf-dhcp-v1`)
> 
> since the RFC:
>  - every trigger runs the same full pass instead of per-trigger map
>    updates, the responder diffs programs, links and records against
>    the kernel state, so a schema rebuild is refilled by the pass that
>    caused it and a zone switching to ebpf serves its running guests
>  - the guest node is poked through a node endpoint, not all nodes
>  - the tap plug goes through a hook of the dhcp plugin base
>  - the bridge-change paths of guests push their record changes too
>  - the records are collected under the macdb lock
>  - a v6 resolver on a v4 subnet is left out instead of failing the
>    pass, a subnet without a gateway is skipped with a warning
>  - dnsmasq honours dhcp-lease-time as well
>  - the mapping push endpoint checks the vnet belongs to the zone
> 
> 
> [1] https://lore.proxmox.com/pve-devel/20260904090458.990888-1-h.laimer@proxmox.com/T/#t 
> [2] https://lore.proxmox.com/pve-devel/20260902125357.757029-1-h.laimer@proxmox.com/T/#u
> 
> 
> proxmox-ebpf:
> 
> Hannes Laimer (2):
>   dhcp: add per-tap responder BPF program
>   dhcp: add responder subsystem
> 
>  Cargo.toml              |   5 +
>  debian/control          |   6 +-
>  src/dhcp/bpf/dhcp.bpf.c | 324 +++++++++++++++++++
>  src/dhcp/bpf/types.h    |  25 ++
>  src/dhcp/mod.rs         | 247 +++++++++++++++
>  src/dhcp/types.rs       |  53 ++++
>  src/lib.rs              |   3 +
>  tests/dhcp.rs           | 668 ++++++++++++++++++++++++++++++++++++++++
>  8 files changed, 1330 insertions(+), 1 deletion(-)
>  create mode 100644 src/dhcp/bpf/dhcp.bpf.c
>  create mode 100644 src/dhcp/bpf/types.h
>  create mode 100644 src/dhcp/mod.rs
>  create mode 100644 src/dhcp/types.rs
>  create mode 100644 tests/dhcp.rs
> 
> 
> proxmox-perl-rs:
> 
> Hannes Laimer (1):
>   pve-rs: sdn: add dhcp responder bindings
> 
>  pve-rs/Cargo.toml               |  2 +
>  pve-rs/Makefile                 |  1 +
>  pve-rs/debian/control           |  2 +
>  pve-rs/src/bindings/sdn/dhcp.rs | 81 +++++++++++++++++++++++++++++++++
>  pve-rs/src/bindings/sdn/mod.rs  |  1 +
>  5 files changed, 87 insertions(+)
>  create mode 100644 pve-rs/src/bindings/sdn/dhcp.rs
> 
> 
> pve-network:
> 
> Hannes Laimer (8):
>   sdn: ipam: do not cache negative per-MAC answers, lock the write
>   sdn: subnets: add dhcp-lease-time property
>   sdn: dhcp: only assert a backend's availability for zones using it
>   sdn: dhcp: add ebpf plugin
>   sdn: zones: attach the dhcp responder on tap plug
>   sdn: dhcp: apply mapping edits on the node serving the guest
>   sdn: zones: offer dhcp on all zone types, keep dnsmasq simple-only
>   tests: cover the ebpf dhcp backend and ipam API mapping pushes
> 
>  src/PVE/API2/Network/SDN/Ips.pm           |   3 +
>  src/PVE/API2/Network/SDN/Nodes/Status.pm  |  42 +++-
>  src/PVE/API2/Network/SDN/Zones.pm         |   8 +-
>  src/PVE/Network/SDN/Dhcp.pm               |  87 +++++++-
>  src/PVE/Network/SDN/Dhcp/Dnsmasq.pm       |   3 +-
>  src/PVE/Network/SDN/Dhcp/Ebpf.pm          | 187 ++++++++++++++++++
>  src/PVE/Network/SDN/Dhcp/Makefile         |   2 +-
>  src/PVE/Network/SDN/Dhcp/Plugin.pm        |   6 +
>  src/PVE/Network/SDN/Ipams.pm              |  24 ++-
>  src/PVE/Network/SDN/SubnetPlugin.pm       |   9 +
>  src/PVE/Network/SDN/Zones.pm              |   3 +
>  src/PVE/Network/SDN/Zones/EvpnPlugin.pm   |   1 +
>  src/PVE/Network/SDN/Zones/FaucetPlugin.pm |   1 +
>  src/PVE/Network/SDN/Zones/QinQPlugin.pm   |   7 +
>  src/PVE/Network/SDN/Zones/VlanPlugin.pm   |   7 +
>  src/PVE/Network/SDN/Zones/VxlanPlugin.pm  |   9 +
>  src/test/run_test_vnets_blackbox.pl       | 231 ++++++++++++++++++++++
>  17 files changed, 619 insertions(+), 11 deletions(-)
>  create mode 100644 src/PVE/Network/SDN/Dhcp/Ebpf.pm
> 
> 
> pve-manager:
> 
> Hannes Laimer (1):
>   ui: sdn: dhcp backend selector on all zones, expose dhcp options
> 
>  www/manager6/sdn/SubnetEdit.js       | 24 ++++++++++++++++++++++++
>  www/manager6/sdn/zones/Base.js       | 17 +++++++++++++++++
>  www/manager6/sdn/zones/SimpleEdit.js | 11 -----------
>  3 files changed, 41 insertions(+), 11 deletions(-)
> 
> 
> Summary over all repositories:
>   33 files changed, 2077 insertions(+), 23 deletions(-)
>