X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=src%2FPVE%2FNetwork.pm;h=e44648bb56e48bae40386039200f4e66f9949e7f;hb=d7cafe5124fbfd96a9fa5a01f5a1904c9ccc4850;hp=0a984ad32f9e51bc0ab145c073253991edb5dcf1;hpb=899f8c4aa54c59f01c7fa3c516a465b438edc172;p=pve-common.git diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm index 0a984ad..e44648b 100644 --- a/src/PVE/Network.pm +++ b/src/PVE/Network.pm @@ -2,23 +2,23 @@ package PVE::Network; use strict; use warnings; -use PVE::Tools qw(run_command); -use PVE::ProcFSTools; + use PVE::INotify; +use PVE::ProcFSTools; +use PVE::Tools qw(run_command lock_file); + use File::Basename; use IO::Socket::IP; -use POSIX qw(ECONNREFUSED); - +use JSON; use Net::IP; - -use Socket qw(IPPROTO_IP); - -use constant IFF_UP => 1; -use constant IFNAMSIZ => 16; -use constant SIOCGIFFLAGS => 0x8913; +use NetAddr::IP qw(:lower); +use POSIX qw(ECONNREFUSED); +use Socket qw(NI_NUMERICHOST NI_NUMERICSERV); # host network related utility functions +our $PHYSICAL_NIC_RE = qr/(?:eth\d+|en[^:.]+|ib[^:.]+)/; + our $ipv4_reverse_mask = [ '0.0.0.0', '128.0.0.0', @@ -56,6 +56,14 @@ our $ipv4_reverse_mask = [ ]; our $ipv4_mask_hash_localnet = { + '255.0.0.0' => 8, + '255.128.0.0' => 9, + '255.192.0.0' => 10, + '255.224.0.0' => 11, + '255.240.0.0' => 12, + '255.248.0.0' => 13, + '255.252.0.0' => 14, + '255.254.0.0' => 15, '255.255.0.0' => 16, '255.255.128.0' => 17, '255.255.192.0' => 18, @@ -71,10 +79,12 @@ our $ipv4_mask_hash_localnet = { '255.255.255.240' => 28, '255.255.255.248' => 29, '255.255.255.252' => 30, + '255.255.255.254' => 31, + '255.255.255.255' => 32, }; sub setup_tc_rate_limit { - my ($iface, $rate, $burst, $debug) = @_; + my ($iface, $rate, $burst) = @_; # these are allowed / expected to fail, e.g. when there is no previous rate limit to remove eval { run_command("/sbin/tc class del dev $iface parent 1: classid 1:1 >/dev/null 2>&1"); }; @@ -95,27 +105,19 @@ sub setup_tc_rate_limit { run_command("/sbin/tc filter add dev $iface parent ffff: " . "prio 50 basic " . "police rate ${rate}bps burst ${burst}b mtu 64kb " . - "drop flowid :1"); - - if ($debug) { - print "DEBUG tc settings\n"; - system("/sbin/tc qdisc ls dev $iface"); - system("/sbin/tc class ls dev $iface"); - system("/sbin/tc filter ls dev $iface parent ffff:"); - } + "drop"); } sub tap_rate_limit { my ($iface, $rate) = @_; - my $debug = 0; $rate = int($rate*1024*1024) if $rate; my $burst = 1024*1024; - setup_tc_rate_limit($iface, $rate, $burst, $debug); + setup_tc_rate_limit($iface, $rate, $burst); } -my $read_bridge_mtu = sub { +sub read_bridge_mtu { my ($bridge) = @_; my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu"); @@ -158,39 +160,82 @@ my $compute_fwbr_names = sub { return ($fwbr, $vethfw, $vethfwpeer, $ovsintport); }; +sub iface_delete($) { + my ($iface) = @_; + run_command(['/sbin/ip', 'link', 'delete', 'dev', $iface], noerr => 1) + == 0 or die "failed to delete interface '$iface'\n"; +} + +sub iface_create($$@) { + my ($iface, $type, @args) = @_; + run_command(['/sbin/ip', 'link', 'add', $iface, 'type', $type, @args], noerr => 1) + == 0 or die "failed to create interface '$iface'\n"; +} + +sub iface_set($@) { + my ($iface, @opts) = @_; + run_command(['/sbin/ip', 'link', 'set', $iface, @opts], noerr => 1) + == 0 or die "failed to set interface options for '$iface' (".join(' ', @opts).")\n"; +} + +# helper for nicer error messages: +sub iface_set_master($$) { + my ($iface, $master) = @_; + if (defined($master)) { + eval { iface_set($iface, 'master', $master) }; + die "can't enslave '$iface' to '$master'\n" if $@; + } else { + eval { iface_set($iface, 'nomaster') }; + die "can't unenslave '$iface'\n" if $@; + } +} + my $cond_create_bridge = sub { my ($bridge) = @_; if (! -d "/sys/class/net/$bridge") { - system("/sbin/brctl addbr $bridge") == 0 || - die "can't add bridge '$bridge'\n"; + iface_create($bridge, 'bridge'); + disable_ipv6($bridge); } }; +sub disable_ipv6 { + my ($iface) = @_; + return if !-d '/proc/sys/net/ipv6'; # ipv6 might be completely disabled + my $file = "/proc/sys/net/ipv6/conf/$iface/disable_ipv6"; + open(my $fh, '>', $file) or die "failed to open $file for writing: $!\n"; + print {$fh} "1\n" or die "failed to disable link-local ipv6 for $iface\n"; + close($fh); +} + my $bridge_add_interface = sub { my ($bridge, $iface, $tag, $trunks) = @_; - system("/sbin/brctl addif $bridge $iface") == 0 || - die "can't add interface 'iface' to bridge '$bridge'\n"; + # drop link local address (it can't be used when on a bridge anyway) + disable_ipv6($iface); + iface_set_master($iface, $bridge); my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering"); if ($vlan_aware) { - if ($tag) { - system("/sbin/bridge vlan add dev $iface vid $tag pvid untagged") == 0 || - die "unable to add vlan $tag to interface $iface\n"; - } else { - system("/sbin/bridge vlan add dev $iface vid 2-4094") == 0 || - die "unable to add default vlan tags to interface $iface\n" if !$trunks; - } - - if ($trunks) { - my @trunks_array = split /;/, $trunks; - foreach my $trunk (@trunks_array) { - system("/sbin/bridge vlan add dev $iface vid $trunk") == 0 || - die "unable to add vlan $trunk to interface $iface\n"; - } - } + + eval { run_command(['/sbin/bridge', 'vlan', 'del', 'dev', $iface, 'vid', '1-4094']) }; + die "failed to remove default vlan tags of $iface - $@\n" if $@; + + if ($trunks) { + my @trunks_array = split /;/, $trunks; + foreach my $trunk (@trunks_array) { + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $trunk]) }; + die "unable to add vlan $trunk to interface $iface - $@\n" if $@; + } + } elsif (!$tag) { + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', '2-4094']) }; + die "unable to add default vlan tags to interface $iface - $@\n" if $@; + } + + $tag = 1 if !$tag; + eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $tag, 'pvid', 'untagged']) }; + die "unable to add vlan $tag to interface $iface - $@\n" if $@; } }; @@ -199,21 +244,29 @@ my $ovs_bridge_add_port = sub { $trunks =~ s/;/,/g if $trunks; - my $cmd = "/usr/bin/ovs-vsctl add-port $bridge $iface"; - $cmd .= " tag=$tag" if $tag; - $cmd .= " trunks=". join(',', $trunks) if $trunks; - $cmd .= " vlan_mode=native-untagged" if $tag && $trunks; + my $cmd = ['/usr/bin/ovs-vsctl']; + # first command + push @$cmd, '--', 'add-port', $bridge, $iface; + push @$cmd, "tag=$tag" if $tag; + push @$cmd, "trunks=". join(',', $trunks) if $trunks; + push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks; + + if ($internal) { + # second command + push @$cmd, '--', 'set', 'Interface', $iface, 'type=internal'; + } + + eval { run_command($cmd) }; + die "can't add ovs port '$iface' - $@\n" if $@; - $cmd .= " -- set Interface $iface type=internal" if $internal; - system($cmd) == 0 || - die "can't add ovs port '$iface'\n"; + disable_ipv6($iface); }; my $activate_interface = sub { my ($iface) = @_; - system("/sbin/ip link set $iface up") == 0 || - die "can't activate interface '$iface'\n"; + eval { run_command(['/sbin/ip', 'link', 'set', $iface, 'up']) }; + die "can't activate interface '$iface' - $@\n" if $@; }; sub tap_create { @@ -221,10 +274,11 @@ sub tap_create { die "unable to get bridge setting\n" if !$bridge; - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); - eval { - PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu"); + eval { + disable_ipv6($iface); + PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $iface, 'up', 'promisc', 'on', 'mtu', $bridgemtu]); }; die "interface activation failed\n" if $@; } @@ -234,16 +288,27 @@ sub veth_create { die "unable to get bridge setting\n" if !$bridge; - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); # create veth pair if (! -d "/sys/class/net/$veth") { - my $cmd = "/sbin/ip link add name $veth type veth peer name $vethpeer mtu $bridgemtu"; - $cmd .= " addr $mac" if $mac; - system($cmd) == 0 || die "can't create interface $veth\n"; + my $cmd = ['/sbin/ip', 'link', 'add']; + # veth device + MTU + push @$cmd, 'name', $veth; + push @$cmd, 'mtu', $bridgemtu; + push @$cmd, 'type', 'veth'; + # peer device + MTU + push @$cmd, 'peer', 'name', $vethpeer, 'mtu', $bridgemtu; + + push @$cmd, 'addr', $mac if $mac; + + eval { run_command($cmd) }; + die "can't create interface $veth - $@\n" if $@; } # up vethpair + disable_ipv6($veth); + disable_ipv6($vethpeer); &$activate_interface($veth); &$activate_interface($vethpeer); } @@ -252,9 +317,9 @@ sub veth_delete { my ($veth) = @_; if (-d "/sys/class/net/$veth") { - run_command("/sbin/ip link delete dev $veth", outfunc => sub {}, errfunc => sub {}); + iface_delete($veth); } - + eval { tap_unplug($veth) }; } my $create_firewall_bridge_linux = sub { @@ -281,7 +346,7 @@ my $create_firewall_bridge_ovs = sub { my ($vmid, $devid) = &$parse_tap_device_name($iface); my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid); - my $bridgemtu = &$read_bridge_mtu($bridge); + my $bridgemtu = read_bridge_mtu($bridge); &$cond_create_bridge($fwbr); &$activate_interface($fwbr); @@ -292,8 +357,8 @@ my $create_firewall_bridge_ovs = sub { &$activate_interface($ovsintport); # set the same mtu for ovs int port - PVE::Tools::run_command("/sbin/ifconfig $ovsintport mtu $bridgemtu"); - + PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $ovsintport, 'mtu', $bridgemtu]); + &$bridge_add_interface($fwbr, $ovsintport); }; @@ -301,7 +366,7 @@ my $cleanup_firewall_bridge = sub { my ($iface) = @_; my ($vmid, $devid) = &$parse_tap_device_name($iface, 1); - return if !defined($vmid); + return if !defined($vmid); my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid); # cleanup old port config from any openvswitch bridge @@ -314,8 +379,7 @@ my $cleanup_firewall_bridge = sub { # cleanup fwbr bridge if (-d "/sys/class/net/$fwbr") { - run_command("/sbin/ip link set dev $fwbr down", outfunc => sub {}, errfunc => sub {}); - run_command("/sbin/brctl delbr $fwbr", outfunc => sub {}, errfunc => sub {}); + iface_delete($fwbr); } }; @@ -366,11 +430,9 @@ sub tap_unplug { #avoid insecure dependency; ($bridge) = $bridge =~ /(\S+)/; - system("/sbin/brctl delif $bridge $iface") == 0 || - die "can't del interface '$iface' from bridge '$bridge'\n"; - + iface_set_master($iface, undef); } - + &$cleanup_firewall_bridge($iface); #cleanup old port config from any openvswitch bridge eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) }; @@ -381,7 +443,7 @@ sub copy_bridge_config { return if $br0 eq $br1; - my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay', + my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay', 'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier']; foreach my $sysname (@$br_configs) { @@ -399,11 +461,20 @@ sub copy_bridge_config { sub activate_bridge_vlan_slave { my ($bridgevlan, $iface, $tag) = @_; my $ifacevlan = "${iface}.$tag"; - + # create vlan on $iface is not already exist if (! -d "/sys/class/net/$ifacevlan") { - system("/sbin/ip link add link $iface name ${iface}.${tag} type vlan id $tag") == 0 || - die "can't add vlan tag $tag to interface $iface\n"; + eval { + my $cmd = ['/sbin/ip', 'link', 'add']; + push @$cmd, 'link', $iface; + push @$cmd, 'name', $ifacevlan; + push @$cmd, 'type', 'vlan', 'id', $tag; + run_command($cmd); + }; + die "can't add vlan tag $tag to interface $iface - $@\n" if $@; + + # remove ipv6 link-local address before activation + disable_ipv6($ifacevlan); } # be sure to have the $ifacevlan up @@ -446,23 +517,24 @@ sub activate_bridge_vlan { die "no physical interface on bridge '$bridge'\n" if scalar(@ifaces) == 0; - # add bridgevlan if it doesn't already exist - if (! -d "/sys/class/net/$bridgevlan") { - system("/sbin/brctl addbr $bridgevlan") == 0 || - die "can't add bridge $bridgevlan\n"; - } + lock_network(sub { + # add bridgevlan if it doesn't already exist + if (! -d "/sys/class/net/$bridgevlan") { + iface_create($bridgevlan, 'bridge'); + } - # for each physical interface (eth or bridge) bind them to bridge vlan - foreach my $iface (@ifaces) { - activate_bridge_vlan_slave($bridgevlan, $iface, $tag); - } + # for each physical interface (eth or bridge) bind them to bridge vlan + foreach my $iface (@ifaces) { + activate_bridge_vlan_slave($bridgevlan, $iface, $tag); + } - #fixme: set other bridge flags + #fixme: set other bridge flags - # be sure to have the bridge up - system("/sbin/ip link set $bridgevlan up") == 0 || - die "can't up bridge $bridgevlan\n"; - + # remove ipv6 link-local address before activation + disable_ipv6($bridgevlan); + # be sure to have the bridge up + &$activate_interface($bridgevlan); + }); return $bridgevlan; } @@ -522,39 +594,121 @@ sub is_ip_in_cidr { my $ip_obj = Net::IP->new($ip, $version); return undef if !$ip_obj; - return $cidr_obj->overlaps($ip_obj) == $Net::IP::IP_B_IN_A_OVERLAP; + my $overlap = $cidr_obj->overlaps($ip_obj); + + return if !defined($overlap); + + return $overlap == $Net::IP::IP_B_IN_A_OVERLAP || $overlap == $Net::IP::IP_IDENTICAL; +} + +# get all currently configured addresses that have a global scope, i.e., are reachable from the +# outside of the host and thus are neither loopback nor link-local ones +# returns an array ref of: { addr => "IP", cidr => "IP/PREFIXLEN", family => "inet|inet6" } +sub get_reachable_networks { + my $raw = ''; + run_command([qw(ip -j addr show up scope global)], outfunc => sub { $raw .= shift }); + my $addrs = decode_json($raw); + + # sort by family (IPv4/IPv6) and then by addr, just for some stability + my $addrs_sorter = sub { + my ($a, $b) = @_; + my $family = $a->{family} cmp $b->{family}; + return $family if $family != 0; + return $a->{local} cmp $b->{local}; + }; + + my $res = []; + for my $addr ($addrs->@*) { + next if !exists $addr->{addr_info}; + next if grep { $_ eq 'LOOPBACK' } $addr->{flags}->@*; + for my $info (sort $addrs_sorter grep { $_ && $_->{local}} $addr->{addr_info}->@*) { + push $res->@*, { + addr => $info->{local}, + cidr => "$info->{local}/$info->{prefixlen}", + family => $info->{family}, + }; + } + } + + return $res; +} + +sub get_local_ip_from_cidr { + my ($cidr) = @_; + + my $IPs = {}; + my $i = 1; + run_command(['/sbin/ip', 'address', 'show', 'to', $cidr, 'up'], outfunc => sub { + if ($_[0] =~ m!^\s*inet(?:6)?\s+($PVE::Tools::IPRE)(?:/\d+|\s+peer\s+)!) { + $IPs->{$1} = $i++ if !exists($IPs->{$1}); + } + }); + + return [ sort { $IPs->{$a} <=> $IPs->{$b} } keys %{$IPs} ]; +} + +sub addr_to_ip { + my ($addr) = @_; + my ($err, $host, $port) = Socket::getnameinfo($addr, NI_NUMERICHOST | NI_NUMERICSERV); + die "failed to get numerical host address: $err\n" if $err; + return ($host, $port) if wantarray; + return $host; } -# struct ifreq { // FOR SIOCGIFFLAGS: -# char ifrn_name[IFNAMSIZ] -# short ifru_flags -# }; -my $STRUCT_IFREQ_SIOCGIFFLAGS = 'Z' . IFNAMSIZ . 's1'; -sub get_active_interfaces { - # Use the interface name list from /proc/net/dev - open my $fh, '<', '/proc/net/dev' - or die "failed to open /proc/net/dev: $!\n"; - # And filter by IFF_UP flag fetched via a PF_INET6 socket ioctl: - my $sock; - socket($sock, PF_INET6, SOCK_DGRAM, &IPPROTO_IP) - or socket($sock, PF_INET, SOCK_DGRAM, &IPPROTO_IP) - or return []; - - my $ifaces = []; - while(defined(my $line = <$fh>)) { - next if $line !~ /^\s*([^:\s]+):/; - my $ifname = $1; - my $ifreq = pack($STRUCT_IFREQ_SIOCGIFFLAGS, $ifname, 0); - if (!defined(ioctl($sock, SIOCGIFFLAGS, $ifreq))) { - warn "failed to get interface flags for: $ifname\n"; - next; +sub get_ip_from_hostname { + my ($hostname, $noerr) = @_; + + my @res = eval { PVE::Tools::getaddrinfo_all($hostname) }; + if ($@) { + die "hostname lookup '$hostname' failed - $@" if !$noerr; + return undef; + } + + for my $ai (@res) { + my $ip = addr_to_ip($ai->{addr}); + if ($ip !~ m/^127\.|^::1$/) { + return wantarray ? ($ip, $ai->{family}) : $ip; } - my ($name, $flags) = unpack($STRUCT_IFREQ_SIOCGIFFLAGS, $ifreq); - push @$ifaces, $ifname if ($flags & IFF_UP); } - close $fh; - close $sock; - return $ifaces; + # NOTE: we only get here if no WAN/LAN IP was found, so this is now the error path! + die "address lookup for '$hostname' did not find any IP address\n" if !$noerr; + return undef; +} + +sub lock_network { + my ($code, @param) = @_; + my $res = lock_file('/var/lock/pve-network.lck', 10, $code, @param); + die $@ if $@; + return $res; +} + +# the canonical form of the given IP, i.e. dotted quad for IPv4 and RFC 5952 for IPv6 +sub canonical_ip { + my ($ip) = @_; + + my $ip_obj = NetAddr::IP->new($ip) or die "invalid IP string '$ip'\n"; + + return $ip_obj->canon(); +} + +# List of unique, canonical IPs in the provided list. +# Keeps the original order, filtering later duplicates. +sub unique_ips { + my ($ips) = @_; + + my $res = []; + my $seen = {}; + + for my $ip (@{$ips}) { + $ip = canonical_ip($ip); + + next if $seen->{$ip}; + + $seen->{$ip} = 1; + push @{$res}, $ip; + } + + return $res; } 1;