X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=src%2FPVE%2FNetwork.pm;h=366d24236d52f2d3a7be06832942b7baaa23acb2;hb=123c310474b12a21e85d6d12d255faf3a7d4155b;hp=5f40353ccd6e01ef170c1626c10503ed0294c650;hpb=f27d5e6b7a2a322e9e708ec7c93cca4df94a3a43;p=pve-common.git diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm index 5f40353..366d242 100644 --- a/src/PVE/Network.pm +++ b/src/PVE/Network.pm @@ -82,7 +82,7 @@ our $ipv4_mask_hash_localnet = { }; sub setup_tc_rate_limit { - my ($iface, $rate, $burst, $debug) = @_; + my ($iface, $rate, $burst) = @_; # these are allowed / expected to fail, e.g. when there is no previous rate limit to remove eval { run_command("/sbin/tc class del dev $iface parent 1: classid 1:1 >/dev/null 2>&1"); }; @@ -104,26 +104,18 @@ sub setup_tc_rate_limit { "prio 50 basic " . "police rate ${rate}bps burst ${burst}b mtu 64kb " . "drop"); - - if ($debug) { - print "DEBUG tc settings\n"; - system("/sbin/tc qdisc ls dev $iface"); - system("/sbin/tc class ls dev $iface"); - system("/sbin/tc filter ls dev $iface parent ffff:"); - } } sub tap_rate_limit { my ($iface, $rate) = @_; - my $debug = 0; $rate = int($rate*1024*1024) if $rate; my $burst = 1024*1024; - setup_tc_rate_limit($iface, $rate, $burst, $debug); + setup_tc_rate_limit($iface, $rate, $burst); } -my $read_bridge_mtu = sub { +sub read_bridge_mtu { my ($bridge) = @_; my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu"); @@ -224,25 +216,24 @@ my $bridge_add_interface = sub { my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering"); if ($vlan_aware) { - if ($tag) { - system({'/sbin/bridge'} 'bridge', 'vlan', 'del', 'dev', $iface, 'vid', '1-4094') == 0 - or die "failed to remove default vlan tags of $iface\n"; - system({'/sbin/bridge'} 'bridge', 'vlan', 'add', 'dev', $iface, 'vid', $tag, 'pvid', 'untagged') == 0 - or die "unable to add vlan $tag to interface $iface\n"; - - warn "Caution: Setting VLAN ID 1 on a VLAN aware bridge may be dangerous\n" if $tag == 1; - } else { - system("/sbin/bridge vlan add dev $iface vid 2-4094") == 0 || - die "unable to add default vlan tags to interface $iface\n" if !$trunks; - } - if ($trunks) { - my @trunks_array = split /;/, $trunks; - foreach my $trunk (@trunks_array) { - system("/sbin/bridge vlan add dev $iface vid $trunk") == 0 || - die "unable to add vlan $trunk to interface $iface\n"; - } - } + eval { run_command(['/sbin/bridge', 'vlan', 'del', 'dev', $iface, 'vid', '1-4094']) }; + die "failed to remove default vlan tags of $iface - $@\n" if $@; + + if ($trunks) { + my @trunks_array = split /;/, $trunks; + foreach my $trunk (@trunks_array) { + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $trunk]) }; + die "unable to add vlan $trunk to interface $iface - $@\n" if $@; + } + } elsif (!$tag) { + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', '2-4094']) }; + die "unable to add default vlan tags to interface $iface - $@\n" if $@; + } + + $tag = 1 if !$tag; + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $tag, 'pvid', 'untagged']) }; + die "unable to add vlan $tag to interface $iface - $@\n" if $@; } }; @@ -251,22 +242,29 @@ my $ovs_bridge_add_port = sub { $trunks =~ s/;/,/g if $trunks; - my $cmd = "/usr/bin/ovs-vsctl add-port $bridge $iface"; - $cmd .= " tag=$tag" if $tag; - $cmd .= " trunks=". join(',', $trunks) if $trunks; - $cmd .= " vlan_mode=native-untagged" if $tag && $trunks; + my $cmd = ['/usr/bin/ovs-vsctl']; + # first command + push @$cmd, '--', 'add-port', $bridge, $iface; + push @$cmd, "tag=$tag" if $tag; + push @$cmd, "trunks=". join(',', $trunks) if $trunks; + push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks; + + if ($internal) { + # second command + push @$cmd, '--', 'set', 'Interface', $iface, 'type=internal'; + } + + eval { run_command($cmd) }; + die "can't add ovs port '$iface' - $@\n" if $@; - $cmd .= " -- set Interface $iface type=internal" if $internal; - system($cmd) == 0 || - die "can't add ovs port '$iface'\n"; disable_ipv6($iface); }; my $activate_interface = sub { my ($iface) = @_; - system("/sbin/ip link set $iface up") == 0 || - die "can't activate interface '$iface'\n"; + eval { run_command(['/sbin/ip', 'link', 'set', $iface, 'up']) }; + die "can't activate interface '$iface' - $@\n" if $@; }; sub tap_create { @@ -274,7 +272,7 @@ sub tap_create { die "unable to get bridge setting\n" if !$bridge; - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); eval { disable_ipv6($iface); @@ -288,13 +286,22 @@ sub veth_create { die "unable to get bridge setting\n" if !$bridge; - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); # create veth pair if (! -d "/sys/class/net/$veth") { - my $cmd = "/sbin/ip link add name $veth mtu $bridgemtu type veth peer name $vethpeer mtu $bridgemtu"; - $cmd .= " addr $mac" if $mac; - system($cmd) == 0 || die "can't create interface $veth\n"; + my $cmd = ['/sbin/ip', 'link', 'add']; + # veth device + MTU + push @$cmd, 'name', $veth; + push @$cmd, 'mtu', $bridgemtu; + push @$cmd, 'type', 'veth'; + # peer device + MTU + push @$cmd, 'peer', 'name', $vethpeer, 'mtu', $bridgemtu; + + push @$cmd, 'addr', $mac if $mac; + + eval { run_command($cmd) }; + die "can't create interface $veth - $@\n" if $@; } # up vethpair @@ -337,7 +344,7 @@ my $create_firewall_bridge_ovs = sub { my ($vmid, $devid) = &$parse_tap_device_name($iface); my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid); - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); &$cond_create_bridge($fwbr); &$activate_interface($fwbr); @@ -455,8 +462,14 @@ sub activate_bridge_vlan_slave { # create vlan on $iface is not already exist if (! -d "/sys/class/net/$ifacevlan") { - system("/sbin/ip link add link $iface name $ifacevlan type vlan id $tag") == 0 || - die "can't add vlan tag $tag to interface $iface\n"; + eval { + my $cmd = ['/sbin/ip', 'link', 'add']; + push @$cmd, 'link', $iface; + push @$cmd, 'name', $ifacevlan; + push @$cmd, 'type', 'vlan', 'id', $tag; + run_command($cmd); + }; + die "can't add vlan tag $tag to interface $iface - $@\n" if $@; # remove ipv6 link-local address before activation disable_ipv6($ifacevlan); @@ -579,21 +592,24 @@ sub is_ip_in_cidr { my $ip_obj = Net::IP->new($ip, $version); return undef if !$ip_obj; - return $cidr_obj->overlaps($ip_obj) == $Net::IP::IP_B_IN_A_OVERLAP; + my $overlap = $cidr_obj->overlaps($ip_obj); + + return $overlap == $Net::IP::IP_B_IN_A_OVERLAP || $overlap == $Net::IP::IP_IDENTICAL; } sub get_local_ip_from_cidr { my ($cidr) = @_; - my $IPs = []; + my $IPs = {}; + my $i = 1; run_command(['/sbin/ip', 'address', 'show', 'to', $cidr, 'up'], outfunc => sub { if ($_[0] =~ m!^\s*inet(?:6)?\s+($PVE::Tools::IPRE)(?:/\d+|\s+peer\s+)!) { - push @$IPs, $1; + $IPs->{$1} = $i++ if !exists($IPs->{$1}); } }); - return $IPs; + return [ sort { $IPs->{$a} <=> $IPs->{$b} } keys %{$IPs} ]; } sub addr_to_ip { @@ -607,19 +623,22 @@ sub addr_to_ip { sub get_ip_from_hostname { my ($hostname, $noerr) = @_; - my ($family, $ip); - - eval { - my @res = PVE::Tools::getaddrinfo_all($hostname); - $family = $res[0]->{family}; - $ip = addr_to_ip($res[0]->{addr}) - }; + my @res = eval { PVE::Tools::getaddrinfo_all($hostname) }; if ($@) { die "hostname lookup '$hostname' failed - $@" if !$noerr; return undef; } - if ($ip =~ m/^127\.|^::1$/) { + my ($ip, $family); + for my $ai (@res) { + $family = $ai->{family}; + my $tmpip = addr_to_ip($ai->{addr}); + if ($tmpip !~ m/^127\.|^::1$/) { + $ip = $tmpip; + last; + } + } + if (!defined($ip) ) { die "hostname lookup '$hostname' failed - got local IP address '$ip'\n" if !$noerr; return undef; }