[pve-common.git] / src / PVE / Network.pm

package PVE::Network;

use strict;
use warnings;
use PVE::Tools qw(run_command);
use PVE::ProcFSTools;
use PVE::INotify;
use File::Basename;
use IO::Socket::IP;
use POSIX qw(ECONNREFUSED);

# host network related utility functions

our $ipv4_reverse_mask = [
    '0.0.0.0',
    '128.0.0.0',
    '192.0.0.0',
    '224.0.0.0',
    '240.0.0.0',
    '248.0.0.0',
    '252.0.0.0',
    '254.0.0.0',
    '255.0.0.0',
    '255.128.0.0',
    '255.192.0.0',
    '255.224.0.0',
    '255.240.0.0',
    '255.248.0.0',
    '255.252.0.0',
    '255.254.0.0',
    '255.255.0.0',
    '255.255.128.0',
    '255.255.192.0',
    '255.255.224.0',
    '255.255.240.0',
    '255.255.248.0',
    '255.255.252.0',
    '255.255.254.0',
    '255.255.255.0',
    '255.255.255.128',
    '255.255.255.192',
    '255.255.255.224',
    '255.255.255.240',
    '255.255.255.248',
    '255.255.255.252',
    '255.255.255.254',
    '255.255.255.255',
];

our $ipv4_mask_hash_localnet = {
    '255.255.0.0' => 16,
    '255.255.128.0' => 17,
    '255.255.192.0' => 18,
    '255.255.224.0' => 19,
    '255.255.240.0' => 20,
    '255.255.248.0' => 21,
    '255.255.252.0' => 22,
    '255.255.254.0' => 23,
    '255.255.255.0' => 24,
    '255.255.255.128' => 25,
    '255.255.255.192' => 26,
    '255.255.255.224' => 27,
    '255.255.255.240' => 28,
    '255.255.255.248' => 29,
    '255.255.255.252' => 30,
};

sub setup_tc_rate_limit {
    my ($iface, $rate, $burst, $debug) = @_;

    system("/sbin/tc class del dev $iface parent 1: classid 1:1 >/dev/null 2>&1");
    system("/sbin/tc filter del dev $iface parent ffff: protocol all pref 50 u32 >/dev/null 2>&1");
    system("/sbin/tc qdisc del dev $iface ingress >/dev/null 2>&1");
    system("/sbin/tc qdisc del dev $iface root >/dev/null 2>&1");

    return if !$rate;

    # tbf does not work for unknown reason
    #$TC qdisc add dev $DEV root tbf rate $RATE latency 100ms burst $BURST
    # so we use htb instead
    run_command("/sbin/tc qdisc add dev $iface root handle 1: htb default 1");
    run_command("/sbin/tc class add dev $iface parent 1: classid 1:1 " .
		"htb rate ${rate}bps burst ${burst}b");

    run_command("/sbin/tc qdisc add dev $iface handle ffff: ingress");
    run_command("/sbin/tc filter add dev $iface parent ffff: " .
		"protocol all prio 50 u32 match u32 0 0 " .
		"police rate ${rate}bps burst ${burst}b mtu 64kb " .
		"drop flowid :1");

    if ($debug) {
	print "DEBUG tc settings\n";
	system("/sbin/tc qdisc ls dev $iface");
	system("/sbin/tc class ls dev $iface");
	system("/sbin/tc filter ls dev $iface parent ffff:");
    }
}

sub tap_rate_limit {
    my ($iface, $rate) = @_;

    my $debug = 0;
    $rate = int($rate*1024*1024);
    my $burst = 1024*1024;

    setup_tc_rate_limit($iface, $rate, $burst, $debug);
}

my $read_bridge_mtu = sub {
    my ($bridge) = @_;

    my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu");
    die "bridge '$bridge' does not exist\n" if !$mtu;
    # avoid insecure dependency;
    die "unable to parse mtu value" if $mtu !~ /^(\d+)$/;
    $mtu = int($1);

    return $mtu;
};

my $parse_tap_device_name = sub {
    my ($iface, $noerr) = @_;

    my ($vmid, $devid);

    if ($iface =~ m/^tap(\d+)i(\d+)$/) {
	$vmid = $1;
	$devid = $2;
    } elsif ($iface =~ m/^veth(\d+)i(\d+)$/) {
	$vmid = $1;
	$devid = $2;
    } else {
	return undef if $noerr;
	die "can't create firewall bridge for random interface name '$iface'\n";
    }

    return ($vmid, $devid);
};

my $compute_fwbr_names = sub {
    my ($vmid, $devid) = @_;

    my $fwbr = "fwbr${vmid}i${devid}";
    # Note: the firewall use 'fwln+' to filter traffic to VMs
    my $vethfw = "fwln${vmid}i${devid}";
    my $vethfwpeer = "fwpr${vmid}p${devid}";
    my $ovsintport = "fwln${vmid}o${devid}";

    return ($fwbr, $vethfw, $vethfwpeer, $ovsintport);
};

my $cond_create_bridge = sub {
    my ($bridge) = @_;

    if (! -d "/sys/class/net/$bridge") {
        system("/sbin/brctl addbr $bridge") == 0 ||
            die "can't add bridge '$bridge'\n";
    }
};

my $bridge_add_interface = sub {
    my ($bridge, $iface, $tag) = @_;

    system("/sbin/brctl addif $bridge $iface") == 0 ||
	die "can't add interface 'iface' to bridge '$bridge'\n";

   my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering");

   if ($vlan_aware) {
	if ($tag) {
	    system("/sbin/bridge vlan add dev $iface vid $tag pvid untagged") == 0 ||
	    die "unable to add vlan $tag to interface $iface\n";
	} else {
	    system("/sbin/bridge vlan add dev $iface vid 2-4094") == 0 ||
	    die "unable to add vlan $tag to interface $iface\n";
	} 
   }
};

my $ovs_bridge_add_port = sub {
    my ($bridge, $iface, $tag, $internal) = @_;

    my $cmd = "/usr/bin/ovs-vsctl add-port $bridge $iface";
    $cmd .= " tag=$tag" if $tag;
    $cmd .= " -- set Interface $iface type=internal" if $internal;
    system($cmd) == 0 ||
	die "can't add ovs port '$iface'\n";
};

my $activate_interface = sub {
    my ($iface) = @_;

    system("/sbin/ip link set $iface up") == 0 ||
	die "can't activate interface '$iface'\n";
};

sub tap_create {
    my ($iface, $bridge) = @_;

    die "unable to get bridge setting\n" if !$bridge;

    my $bridgemtu = &$read_bridge_mtu($bridge);

    eval { 
	PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu");
    };
    die "interface activation failed\n" if $@;
}

sub veth_create {
    my ($veth, $vethpeer, $bridge, $mac) = @_;

    die "unable to get bridge setting\n" if !$bridge;

    my $bridgemtu = &$read_bridge_mtu($bridge);

    # create veth pair
    if (! -d "/sys/class/net/$veth") {
	my $cmd = "/sbin/ip link add name $veth type veth peer name $vethpeer mtu $bridgemtu";
	$cmd .= " addr $mac" if $mac;
	system($cmd) == 0 || die "can't create interface $veth\n";
    }

    # up vethpair
    &$activate_interface($veth);
    &$activate_interface($vethpeer);
}

sub veth_delete {
    my ($veth) = @_;

    if (-d "/sys/class/net/$veth") {
	run_command("/sbin/ip link delete dev $veth", outfunc => sub {}, errfunc => sub {});
    }

}

my $create_firewall_bridge_linux = sub {
    my ($iface, $bridge, $tag) = @_;

    my ($vmid, $devid) = &$parse_tap_device_name($iface);
    my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);

    &$cond_create_bridge($fwbr);
    &$activate_interface($fwbr);

    copy_bridge_config($bridge, $fwbr);
    veth_create($vethfw, $vethfwpeer, $bridge);

    &$bridge_add_interface($fwbr, $vethfw);
    &$bridge_add_interface($bridge, $vethfwpeer, $tag);

    &$bridge_add_interface($fwbr, $iface);
};

my $create_firewall_bridge_ovs = sub {
    my ($iface, $bridge, $tag) = @_;

    my ($vmid, $devid) = &$parse_tap_device_name($iface);
    my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid);

    my $bridgemtu = &$read_bridge_mtu($bridge);

    &$cond_create_bridge($fwbr);
    &$activate_interface($fwbr);

    &$bridge_add_interface($fwbr, $iface);

    &$ovs_bridge_add_port($bridge, $ovsintport, $tag, 1);
    &$activate_interface($ovsintport);

    # set the same mtu for ovs int port
    PVE::Tools::run_command("/sbin/ifconfig $ovsintport mtu $bridgemtu");
    
    &$bridge_add_interface($fwbr, $ovsintport);
};

my $cleanup_firewall_bridge = sub {
    my ($iface) = @_;

    my ($vmid, $devid) = &$parse_tap_device_name($iface, 1);
    return if !defined($vmid);  
    my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid);

    # cleanup old port config from any openvswitch bridge
    if (-d "/sys/class/net/$ovsintport") {
	run_command("/usr/bin/ovs-vsctl del-port $ovsintport", outfunc => sub {}, errfunc => sub {});
    }

    # delete old vethfw interface
    veth_delete($vethfw);

    # cleanup fwbr bridge
    if (-d "/sys/class/net/$fwbr") {
	run_command("/sbin/ip link set dev $fwbr down", outfunc => sub {}, errfunc => sub {});
	run_command("/sbin/brctl delbr $fwbr", outfunc => sub {}, errfunc => sub {});
    }
};

sub tap_plug {
    my ($iface, $bridge, $tag, $firewall) = @_;

    #cleanup old port config from any openvswitch bridge
    eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) };

    if (-d "/sys/class/net/$bridge/bridge") {
	&$cleanup_firewall_bridge($iface); # remove stale devices

	my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering");

	if (!$vlan_aware) {
	    my $newbridge = activate_bridge_vlan($bridge, $tag);
	    copy_bridge_config($bridge, $newbridge) if $bridge ne $newbridge;
	    $bridge = $newbridge;
	    $tag = undef;
	}

	if ($firewall) {
	    &$create_firewall_bridge_linux($iface, $bridge, $tag);
	} else {
	    &$bridge_add_interface($bridge, $iface, $tag);
	}

    } else {
	&$cleanup_firewall_bridge($iface); # remove stale devices

	if ($firewall) {
	    &$create_firewall_bridge_ovs($iface, $bridge, $tag);
	} else {
	    &$ovs_bridge_add_port($bridge, $iface, $tag);
	}
    }
}

sub tap_unplug {
    my ($iface) = @_;

    my $path= "/sys/class/net/$iface/brport/bridge";
    if (-l $path) {
	my $bridge = basename(readlink($path));
	#avoid insecure dependency;
	($bridge) = $bridge =~ /(\S+)/;

	system("/sbin/brctl delif $bridge $iface") == 0 ||
	    die "can't del interface '$iface' from bridge '$bridge'\n";

    }
    
    &$cleanup_firewall_bridge($iface);
}

sub copy_bridge_config {
    my ($br0, $br1) = @_;

    return if $br0 eq $br1;

    my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay', 
		       'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier'];

    foreach my $sysname (@$br_configs) {
	eval {
	    my $v0 = PVE::Tools::file_read_firstline("/sys/class/net/$br0/bridge/$sysname");
	    my $v1 = PVE::Tools::file_read_firstline("/sys/class/net/$br1/bridge/$sysname");
	    if ($v0 ne $v1) {
		 PVE::ProcFSTools::write_proc_entry("/sys/class/net/$br1/bridge/$sysname", $v0);
	    }
	};
	warn $@ if $@;
    }
}

sub activate_bridge_vlan_slave {
    my ($bridgevlan, $iface, $tag) = @_;
    my $ifacevlan = "${iface}.$tag";
	
    # create vlan on $iface is not already exist
    if (! -d "/sys/class/net/$ifacevlan") {
	system("/sbin/ip link add link $iface name ${iface}.${tag} type vlan id $tag") == 0 ||
	    die "can't add vlan tag $tag to interface $iface\n";
    }

    # be sure to have the $ifacevlan up
    &$activate_interface($ifacevlan);

    # test if $vlaniface is already enslaved in another bridge
    my $path= "/sys/class/net/$ifacevlan/brport/bridge";
    if (-l $path) {
        my $tbridge = basename(readlink($path));
	if ($tbridge ne $bridgevlan) {
	    die "interface $ifacevlan already exist in bridge $tbridge\n";
	} else {
            # Port already attached to bridge: do nothing.
            return;
	}
    }

    # add $ifacevlan to the bridge
    &$bridge_add_interface($bridgevlan, $ifacevlan);
}

sub activate_bridge_vlan {
    my ($bridge, $tag_param) = @_;

    die "bridge '$bridge' is not active\n" if ! -d "/sys/class/net/$bridge";

    return $bridge if !defined($tag_param); # no vlan, simply return

    my $tag = int($tag_param);

    die "got strange vlan tag '$tag_param'\n" if $tag < 1 || $tag > 4094;

    my $bridgevlan = "${bridge}v$tag";

    my @ifaces = ();
    my $dir = "/sys/class/net/$bridge/brif";
    PVE::Tools::dir_glob_foreach($dir, '((eth|bond)\d+)', sub {
        push @ifaces, $_[0];
    });

    die "no physical interface on bridge '$bridge'\n" if scalar(@ifaces) == 0;

    # add bridgevlan if it doesn't already exist
    if (! -d "/sys/class/net/$bridgevlan") {
        system("/sbin/brctl addbr $bridgevlan") == 0 ||
            die "can't add bridge $bridgevlan\n";
    }

    # for each physical interface (eth or bridge) bind them to bridge vlan
    foreach my $iface (@ifaces) {
        activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
    }

    #fixme: set other bridge flags

    # be sure to have the bridge up
    system("/sbin/ip link set $bridgevlan up") == 0 ||
        die "can't up bridge $bridgevlan\n";
   
    return $bridgevlan;
}

sub tcp_ping {
    my ($host, $port, $timeout) = @_;

    my $refused = 1;

    $timeout = 3 if !$timeout; # sane default
    if (!$port) {
	# Net::Ping defaults to the echo port
	$port = 7;
    } else {
	# Net::Ping's port_number() implies service_check(1)
	$refused = 0;
    }

    my ($sock, $result);
    eval {
	$result = PVE::Tools::run_with_timeout($timeout, sub {
	    $sock = IO::Socket::IP->new(PeerHost => $host, PeerPort => $port, Type => SOCK_STREAM);
	    $result = $refused if $! == ECONNREFUSED;
	});
    };
    if ($sock) {
	$sock->close();
	$result = 1;
    }
    return $result;
}

1;
Commit	Line	Data
b9436cda DM	1	package PVE::Network;
	2
	3	use strict;
c36f332e	4	use warnings;
74d1b045	5	use PVE::Tools qw(run_command);
b9436cda DM	6	use PVE::ProcFSTools;
	7	use PVE::INotify;
	8	use File::Basename;
b6bff92e WB	9	use IO::Socket::IP;
b6bff92e WB	10	use POSIX qw(ECONNREFUSED);
b9436cda DM	11
	12	# host network related utility functions
	13
61aa94e4 WB	14	our $ipv4_reverse_mask = [
	15	'0.0.0.0',
	16	'128.0.0.0',
	17	'192.0.0.0',
	18	'224.0.0.0',
	19	'240.0.0.0',
	20	'248.0.0.0',
	21	'252.0.0.0',
	22	'254.0.0.0',
	23	'255.0.0.0',
	24	'255.128.0.0',
	25	'255.192.0.0',
	26	'255.224.0.0',
	27	'255.240.0.0',
	28	'255.248.0.0',
	29	'255.252.0.0',
	30	'255.254.0.0',
	31	'255.255.0.0',
	32	'255.255.128.0',
	33	'255.255.192.0',
	34	'255.255.224.0',
	35	'255.255.240.0',
	36	'255.255.248.0',
	37	'255.255.252.0',
	38	'255.255.254.0',
	39	'255.255.255.0',
	40	'255.255.255.128',
	41	'255.255.255.192',
	42	'255.255.255.224',
	43	'255.255.255.240',
	44	'255.255.255.248',
	45	'255.255.255.252',
	46	'255.255.255.254',
	47	'255.255.255.255',
	48	];
	49
	50	our $ipv4_mask_hash_localnet = {
	51	'255.255.0.0' => 16,
	52	'255.255.128.0' => 17,
	53	'255.255.192.0' => 18,
	54	'255.255.224.0' => 19,
	55	'255.255.240.0' => 20,
	56	'255.255.248.0' => 21,
	57	'255.255.252.0' => 22,
	58	'255.255.254.0' => 23,
	59	'255.255.255.0' => 24,
	60	'255.255.255.128' => 25,
	61	'255.255.255.192' => 26,
	62	'255.255.255.224' => 27,
	63	'255.255.255.240' => 28,
	64	'255.255.255.248' => 29,
	65	'255.255.255.252' => 30,
	66	};
	67
74d1b045 DM	68	sub setup_tc_rate_limit {
	69	my ($iface, $rate, $burst, $debug) = @_;
	70
957753df	71	system("/sbin/tc class del dev $iface parent 1: classid 1:1 >/dev/null 2>&1");
5d35df41	72	system("/sbin/tc filter del dev $iface parent ffff: protocol all pref 50 u32 >/dev/null 2>&1");
edde1d46	73	system("/sbin/tc qdisc del dev $iface ingress >/dev/null 2>&1");
74d1b045 DM	74	system("/sbin/tc qdisc del dev $iface root >/dev/null 2>&1");
74d1b045 DM	75
d6f2623b	76	return if !$rate;
957753df	77
74d1b045 DM	78	# tbf does not work for unknown reason
	79	#$TC qdisc add dev $DEV root tbf rate $RATE latency 100ms burst $BURST
	80	# so we use htb instead
	81	run_command("/sbin/tc qdisc add dev $iface root handle 1: htb default 1");
	82	run_command("/sbin/tc class add dev $iface parent 1: classid 1:1 " .
	83	"htb rate ${rate}bps burst ${burst}b");
	84
5d35df41 W	85	run_command("/sbin/tc qdisc add dev $iface handle ffff: ingress");
	86	run_command("/sbin/tc filter add dev $iface parent ffff: " .
	87	"protocol all prio 50 u32 match u32 0 0 " .
	88	"police rate ${rate}bps burst ${burst}b mtu 64kb " .
	89	"drop flowid :1");
	90
74d1b045 DM	91	if ($debug) {
	92	print "DEBUG tc settings\n";
	93	system("/sbin/tc qdisc ls dev $iface");
	94	system("/sbin/tc class ls dev $iface");
	95	system("/sbin/tc filter ls dev $iface parent ffff:");
	96	}
	97	}
	98
ec9ada18 AD	99	sub tap_rate_limit {
	100	my ($iface, $rate) = @_;
	101
	102	my $debug = 0;
	103	$rate = int($rate10241024);
	104	my $burst = 1024*1024;
	105
	106	setup_tc_rate_limit($iface, $rate, $burst, $debug);
	107	}
74d1b045	108
605bb891 DM	109	my $read_bridge_mtu = sub {
	110	my ($bridge) = @_;
	111
	112	my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu");
	113	die "bridge '$bridge' does not exist\n" if !$mtu;
	114	# avoid insecure dependency;
	115	die "unable to parse mtu value" if $mtu !~ /^(\d+)$/;
	116	$mtu = int($1);
	117
	118	return $mtu;
	119	};
	120
32cb7d27	121	my $parse_tap_device_name = sub {
6c80e6d6	122	my ($iface, $noerr) = @_;
605bb891 DM	123
	124	my ($vmid, $devid);
	125
	126	if ($iface =~ m/^tap(\d+)i(\d+)$/) {
	127	$vmid = $1;
	128	$devid = $2;
32cb7d27	129	} elsif ($iface =~ m/^veth(\d+)i(\d+)$/) {
605bb891 DM	130	$vmid = $1;
	131	$devid = $2;
	132	} else {
6c80e6d6 DM	133	return undef if $noerr;
6c80e6d6 DM	134	die "can't create firewall bridge for random interface name '$iface'\n";
605bb891 DM	135	}
	136
	137	return ($vmid, $devid);
	138	};
	139
70ab4434	140	my $compute_fwbr_names = sub {
605bb891 DM	141	my ($vmid, $devid) = @_;
	142
	143	my $fwbr = "fwbr${vmid}i${devid}";
f193aa74	144	# Note: the firewall use 'fwln+' to filter traffic to VMs
7d78a966 AD	145	my $vethfw = "fwln${vmid}i${devid}";
	146	my $vethfwpeer = "fwpr${vmid}p${devid}";
	147	my $ovsintport = "fwln${vmid}o${devid}";
605bb891	148
70ab4434	149	return ($fwbr, $vethfw, $vethfwpeer, $ovsintport);
605bb891 DM	150	};
	151
	152	my $cond_create_bridge = sub {
	153	my ($bridge) = @_;
	154
	155	if (! -d "/sys/class/net/$bridge") {
	156	system("/sbin/brctl addbr $bridge") == 0 \|\|
	157	die "can't add bridge '$bridge'\n";
	158	}
	159	};
	160
	161	my $bridge_add_interface = sub {
4d25f4aa	162	my ($bridge, $iface, $tag) = @_;
605bb891 DM	163
	164	system("/sbin/brctl addif $bridge $iface") == 0 \|\|
	165	die "can't add interface 'iface' to bridge '$bridge'\n";
4d25f4aa AD	166
	167	my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering");
	168
	169	if ($vlan_aware) {
	170	if ($tag) {
	171	system("/sbin/bridge vlan add dev $iface vid $tag pvid untagged") == 0 \|\|
	172	die "unable to add vlan $tag to interface $iface\n";
	173	} else {
	174	system("/sbin/bridge vlan add dev $iface vid 2-4094") == 0 \|\|
	175	die "unable to add vlan $tag to interface $iface\n";
	176	}
	177	}
605bb891 DM	178	};
605bb891 DM	179
70ab4434 DM	180	my $ovs_bridge_add_port = sub {
	181	my ($bridge, $iface, $tag, $internal) = @_;
	182
	183	my $cmd = "/usr/bin/ovs-vsctl add-port $bridge $iface";
	184	$cmd .= " tag=$tag" if $tag;
	185	$cmd .= " -- set Interface $iface type=internal" if $internal;
	186	system($cmd) == 0 \|\|
	187	die "can't add ovs port '$iface'\n";
	188	};
	189
605bb891 DM	190	my $activate_interface = sub {
	191	my ($iface) = @_;
	192
	193	system("/sbin/ip link set $iface up") == 0 \|\|
	194	die "can't activate interface '$iface'\n";
	195	};
	196
3aa99c70 AD	197	sub tap_create {
	198	my ($iface, $bridge) = @_;
	199
	200	die "unable to get bridge setting\n" if !$bridge;
	201
605bb891	202	my $bridgemtu = &$read_bridge_mtu($bridge);
3aa99c70	203
098795e0 DM	204	eval {
	205	PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu");
	206	};
	207	die "interface activation failed\n" if $@;
3aa99c70 AD	208	}
3aa99c70 AD	209
35efc4eb AD	210	sub veth_create {
	211	my ($veth, $vethpeer, $bridge, $mac) = @_;
	212
	213	die "unable to get bridge setting\n" if !$bridge;
	214
	215	my $bridgemtu = &$read_bridge_mtu($bridge);
	216
	217	# create veth pair
	218	if (! -d "/sys/class/net/$veth") {
	219	my $cmd = "/sbin/ip link add name $veth type veth peer name $vethpeer mtu $bridgemtu";
	220	$cmd .= " addr $mac" if $mac;
	221	system($cmd) == 0 \|\| die "can't create interface $veth\n";
	222	}
	223
	224	# up vethpair
	225	&$activate_interface($veth);
	226	&$activate_interface($vethpeer);
	227	}
	228
f3f0bc3a AD	229	sub veth_delete {
	230	my ($veth) = @_;
	231
	232	if (-d "/sys/class/net/$veth") {
	233	run_command("/sbin/ip link delete dev $veth", outfunc => sub {}, errfunc => sub {});
	234	}
	235
	236	}
35efc4eb	237
605bb891	238	my $create_firewall_bridge_linux = sub {
4d25f4aa	239	my ($iface, $bridge, $tag) = @_;
605bb891	240
32cb7d27	241	my ($vmid, $devid) = &$parse_tap_device_name($iface);
70ab4434	242	my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
605bb891	243
605bb891 DM	244	&$cond_create_bridge($fwbr);
	245	&$activate_interface($fwbr);
	246
	247	copy_bridge_config($bridge, $fwbr);
35efc4eb	248	veth_create($vethfw, $vethfwpeer, $bridge);
605bb891	249
7d78a966	250	&$bridge_add_interface($fwbr, $vethfw);
4d25f4aa	251	&$bridge_add_interface($bridge, $vethfwpeer, $tag);
605bb891	252
4d25f4aa	253	&$bridge_add_interface($fwbr, $iface);
605bb891 DM	254	};
605bb891 DM	255
70ab4434 DM	256	my $create_firewall_bridge_ovs = sub {
	257	my ($iface, $bridge, $tag) = @_;
	258
32cb7d27	259	my ($vmid, $devid) = &$parse_tap_device_name($iface);
70ab4434 DM	260	my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
	261
	262	my $bridgemtu = &$read_bridge_mtu($bridge);
	263
	264	&$cond_create_bridge($fwbr);
	265	&$activate_interface($fwbr);
	266
	267	&$bridge_add_interface($fwbr, $iface);
	268
	269	&$ovs_bridge_add_port($bridge, $ovsintport, $tag, 1);
ac3a04b8	270	&$activate_interface($ovsintport);
70ab4434 DM	271
	272	# set the same mtu for ovs int port
	273	PVE::Tools::run_command("/sbin/ifconfig $ovsintport mtu $bridgemtu");
	274
	275	&$bridge_add_interface($fwbr, $ovsintport);
	276	};
	277
	278	my $cleanup_firewall_bridge = sub {
605bb891 DM	279	my ($iface) = @_;
605bb891 DM	280
32cb7d27	281	my ($vmid, $devid) = &$parse_tap_device_name($iface, 1);
6c80e6d6	282	return if !defined($vmid);
70ab4434 DM	283	my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
	284
	285	# cleanup old port config from any openvswitch bridge
	286	if (-d "/sys/class/net/$ovsintport") {
	287	run_command("/usr/bin/ovs-vsctl del-port $ovsintport", outfunc => sub {}, errfunc => sub {});
	288	}
605bb891 DM	289
605bb891 DM	290	# delete old vethfw interface
f3f0bc3a	291	veth_delete($vethfw);
605bb891 DM	292
	293	# cleanup fwbr bridge
	294	if (-d "/sys/class/net/$fwbr") {
	295	run_command("/sbin/ip link set dev $fwbr down", outfunc => sub {}, errfunc => sub {});
	296	run_command("/sbin/brctl delbr $fwbr", outfunc => sub {}, errfunc => sub {});
	297	}
	298	};
	299
f0c190ee	300	sub tap_plug {
605bb891	301	my ($iface, $bridge, $tag, $firewall) = @_;
f0c190ee	302
4cbabd40 AD	303	#cleanup old port config from any openvswitch bridge
	304	eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) };
	305
098795e0	306	if (-d "/sys/class/net/$bridge/bridge") {
70ab4434	307	&$cleanup_firewall_bridge($iface); # remove stale devices
605bb891	308
4d25f4aa	309	my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering");
098795e0	310
4d25f4aa AD	311	if (!$vlan_aware) {
	312	my $newbridge = activate_bridge_vlan($bridge, $tag);
	313	copy_bridge_config($bridge, $newbridge) if $bridge ne $newbridge;
ff042056	314	$bridge = $newbridge;
4d25f4aa AD	315	$tag = undef;
	316	}
	317
	318	if ($firewall) {
	319	&$create_firewall_bridge_linux($iface, $bridge, $tag);
	320	} else {
	321	&$bridge_add_interface($bridge, $iface, $tag);
	322	}
605bb891	323
098795e0	324	} else {
70ab4434 DM	325	&$cleanup_firewall_bridge($iface); # remove stale devices
	326
	327	if ($firewall) {
	328	&$create_firewall_bridge_ovs($iface, $bridge, $tag);
	329	} else {
	330	&$ovs_bridge_add_port($bridge, $iface, $tag);
	331	}
4cbabd40	332	}
f0c190ee AD	333	}
f0c190ee AD	334
a84b65c0	335	sub tap_unplug {
2db1cc0d	336	my ($iface) = @_;
a84b65c0	337
2db1cc0d DM	338	my $path= "/sys/class/net/$iface/brport/bridge";
	339	if (-l $path) {
	340	my $bridge = basename(readlink($path));
	341	#avoid insecure dependency;
	342	($bridge) = $bridge =~ /(\S+)/;
4cbabd40	343
098795e0	344	system("/sbin/brctl delif $bridge $iface") == 0 \|\|
2db1cc0d	345	die "can't del interface '$iface' from bridge '$bridge'\n";
605bb891	346
4cbabd40	347	}
70ab4434 DM	348
70ab4434 DM	349	&$cleanup_firewall_bridge($iface);
a84b65c0 AD	350	}
a84b65c0 AD	351
b9436cda DM	352	sub copy_bridge_config {
	353	my ($br0, $br1) = @_;
	354
	355	return if $br0 eq $br1;
	356
	357	my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay',
ba4af65b	358	'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier'];
b9436cda DM	359
	360	foreach my $sysname (@$br_configs) {
	361	eval {
	362	my $v0 = PVE::Tools::file_read_firstline("/sys/class/net/$br0/bridge/$sysname");
	363	my $v1 = PVE::Tools::file_read_firstline("/sys/class/net/$br1/bridge/$sysname");
	364	if ($v0 ne $v1) {
aec04803	365	PVE::ProcFSTools::write_proc_entry("/sys/class/net/$br1/bridge/$sysname", $v0);
b9436cda DM	366	}
	367	};
	368	warn $@ if $@;
	369	}
	370	}
	371
70d89745 PRG	372	sub activate_bridge_vlan_slave {
70d89745 PRG	373	my ($bridgevlan, $iface, $tag) = @_;
b9436cda	374	my $ifacevlan = "${iface}.$tag";
70d89745	375
b9436cda DM	376	# create vlan on $iface is not already exist
b9436cda DM	377	if (! -d "/sys/class/net/$ifacevlan") {
6fc54cb2	378	system("/sbin/ip link add link $iface name ${iface}.${tag} type vlan id $tag") == 0 \|\|
02c9a6b4	379	die "can't add vlan tag $tag to interface $iface\n";
b9436cda DM	380	}
	381
	382	# be sure to have the $ifacevlan up
605bb891	383	&$activate_interface($ifacevlan);
b9436cda DM	384
	385	# test if $vlaniface is already enslaved in another bridge
	386	my $path= "/sys/class/net/$ifacevlan/brport/bridge";
	387	if (-l $path) {
	388	my $tbridge = basename(readlink($path));
70d89745	389	if ($tbridge ne $bridgevlan) {
b9436cda	390	die "interface $ifacevlan already exist in bridge $tbridge\n";
eee4b32a PRG	391	} else {
	392	# Port already attached to bridge: do nothing.
	393	return;
b9436cda DM	394	}
	395	}
	396
70d89745	397	# add $ifacevlan to the bridge
605bb891	398	&$bridge_add_interface($bridgevlan, $ifacevlan);
70d89745 PRG	399	}
	400
	401	sub activate_bridge_vlan {
	402	my ($bridge, $tag_param) = @_;
	403
	404	die "bridge '$bridge' is not active\n" if ! -d "/sys/class/net/$bridge";
	405
	406	return $bridge if !defined($tag_param); # no vlan, simply return
	407
	408	my $tag = int($tag_param);
	409
	410	die "got strange vlan tag '$tag_param'\n" if $tag < 1 \|\| $tag > 4094;
	411
	412	my $bridgevlan = "${bridge}v$tag";
	413
c9030d97 PRG	414	my @ifaces = ();
	415	my $dir = "/sys/class/net/$bridge/brif";
	416	PVE::Tools::dir_glob_foreach($dir, '((eth\|bond)\d+)', sub {
5ffa7628	417	push @ifaces, $_[0];
c9030d97 PRG	418	});
c9030d97 PRG	419
5ffa7628	420	die "no physical interface on bridge '$bridge'\n" if scalar(@ifaces) == 0;
c9030d97	421
b9436cda DM	422	# add bridgevlan if it doesn't already exist
b9436cda DM	423	if (! -d "/sys/class/net/$bridgevlan") {
9e14b1b7	424	system("/sbin/brctl addbr $bridgevlan") == 0 \|\|
b9436cda DM	425	die "can't add bridge $bridgevlan\n";
	426	}
	427
70d89745	428	# for each physical interface (eth or bridge) bind them to bridge vlan
c9030d97 PRG	429	foreach my $iface (@ifaces) {
	430	activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
	431	}
70d89745	432
b9436cda DM	433	#fixme: set other bridge flags
	434
	435	# be sure to have the bridge up
	436	system("/sbin/ip link set $bridgevlan up") == 0 \|\|
	437	die "can't up bridge $bridgevlan\n";
70d89745	438
b9436cda DM	439	return $bridgevlan;
	440	}
	441
b6bff92e WB	442	sub tcp_ping {
	443	my ($host, $port, $timeout) = @_;
	444
	445	my $refused = 1;
	446
	447	$timeout = 3 if !$timeout; # sane default
	448	if (!$port) {
	449	# Net::Ping defaults to the echo port
	450	$port = 7;
	451	} else {
	452	# Net::Ping's port_number() implies service_check(1)
	453	$refused = 0;
	454	}
	455
	456	my ($sock, $result);
	457	eval {
	458	$result = PVE::Tools::run_with_timeout($timeout, sub {
	459	$sock = IO::Socket::IP->new(PeerHost => $host, PeerPort => $port, Type => SOCK_STREAM);
	460	$result = $refused if $! == ECONNREFUSED;
	461	});
	462	};
	463	if ($sock) {
	464	$sock->close();
	465	$result = 1;
	466	}
	467	return $result;
	468	}
	469
b9436cda	470	1;