deps: moving skiplock breaks qemu-server << 4.0-109

[pve-common.git] / src / PVE / Network.pm

diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm
index 405f14ba17afa44e0823f5e9469c60c075e4a1e9..69051b9de048e5a6023902b9898af9cd5ab655b5 100644 (file)
--- a/src/PVE/Network.pm
+++ b/src/PVE/Network.pm
@@ -2,7 +2,7 @@ package PVE::Network;
 
 use strict;
 use warnings;
-use PVE::Tools qw(run_command);
+use PVE::Tools qw(run_command lock_file);
 use PVE::ProcFSTools;
 use PVE::INotify;
 use File::Basename;
@@ -171,9 +171,20 @@ my $cond_create_bridge = sub {
     }
 };
 
+sub disable_ipv6 {
+    my ($iface) = @_;
+    return if !-d '/proc/sys/net/ipv6'; # ipv6 might be completely disabled
+    my $file = "/proc/sys/net/ipv6/conf/$iface/disable_ipv6";
+    open(my $fh, '>', $file) or die "failed to open $file for writing: $!\n";
+    print {$fh} "1\n" or die "failed to disable link-local ipv6 for $iface\n";
+    close($fh);
+}
+
 my $bridge_add_interface = sub {
     my ($bridge, $iface, $tag, $trunks) = @_;
 
+    # drop link local address (it can't be used when on a bridge anyway)
+    disable_ipv6($iface);
     system("/sbin/brctl addif $bridge $iface") == 0 ||
        die "can't add interface 'iface' to bridge '$bridge'\n";
 
@@ -215,6 +226,7 @@ my $ovs_bridge_add_port = sub {
     $cmd .= " -- set Interface $iface type=internal" if $internal;
     system($cmd) == 0 ||
        die "can't add ovs port '$iface'\n";
+    disable_ipv6($iface);
 };
 
 my $activate_interface = sub {
@@ -232,7 +244,8 @@ sub tap_create {
     my $bridgemtu = &$read_bridge_mtu($bridge);
 
     eval { 
-       PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu");
+       disable_ipv6($iface);
+       PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $iface, 'up', 'promisc', 'on', 'mtu', $bridgemtu]);
     };
     die "interface activation failed\n" if $@;
 }
@@ -252,6 +265,8 @@ sub veth_create {
     }
 
     # up vethpair
+    disable_ipv6($veth);
+    disable_ipv6($vethpeer);
     &$activate_interface($veth);
     &$activate_interface($vethpeer);
 }
@@ -262,7 +277,7 @@ sub veth_delete {
     if (-d "/sys/class/net/$veth") {
        run_command("/sbin/ip link delete dev $veth", outfunc => sub {}, errfunc => sub {});
     }
-
+    eval { tap_unplug($veth) };
 }
 
 my $create_firewall_bridge_linux = sub {
@@ -272,6 +287,7 @@ my $create_firewall_bridge_linux = sub {
     my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
 
     &$cond_create_bridge($fwbr);
+    disable_ipv6($fwbr);
     &$activate_interface($fwbr);
 
     copy_bridge_config($bridge, $fwbr);
@@ -292,6 +308,7 @@ my $create_firewall_bridge_ovs = sub {
     my $bridgemtu = &$read_bridge_mtu($bridge);
 
     &$cond_create_bridge($fwbr);
+    disable_ipv6($fwbr);
     &$activate_interface($fwbr);
 
     &$bridge_add_interface($fwbr, $iface);
@@ -300,7 +317,7 @@ my $create_firewall_bridge_ovs = sub {
     &$activate_interface($ovsintport);
 
     # set the same mtu for ovs int port
-    PVE::Tools::run_command("/sbin/ifconfig $ovsintport mtu $bridgemtu");
+    PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $ovsintport, 'mtu', $bridgemtu]);
     
     &$bridge_add_interface($fwbr, $ovsintport);
 };
@@ -410,10 +427,13 @@ sub activate_bridge_vlan_slave {
        
     # create vlan on $iface is not already exist
     if (! -d "/sys/class/net/$ifacevlan") {
-       system("/sbin/ip link add link $iface name ${iface}.${tag} type vlan id $tag") == 0 ||
+       system("/sbin/ip link add link $iface name $ifacevlan type vlan id $tag") == 0 ||
            die "can't add vlan tag $tag to interface $iface\n";
     }
 
+    # remove ipv6 link-local address before activation
+    disable_ipv6($ifacevlan);
+
     # be sure to have the $ifacevlan up
     &$activate_interface($ifacevlan);
 
@@ -454,23 +474,25 @@ sub activate_bridge_vlan {
 
     die "no physical interface on bridge '$bridge'\n" if scalar(@ifaces) == 0;
 
-    # add bridgevlan if it doesn't already exist
-    if (! -d "/sys/class/net/$bridgevlan") {
-        system("/sbin/brctl addbr $bridgevlan") == 0 ||
-            die "can't add bridge $bridgevlan\n";
-    }
+    lock_network(sub {
+       # add bridgevlan if it doesn't already exist
+       if (! -d "/sys/class/net/$bridgevlan") {
+           system("/sbin/brctl addbr $bridgevlan") == 0 ||
+               die "can't add bridge $bridgevlan\n";
+       }
 
-    # for each physical interface (eth or bridge) bind them to bridge vlan
-    foreach my $iface (@ifaces) {
-        activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
-    }
+       # for each physical interface (eth or bridge) bind them to bridge vlan
+       foreach my $iface (@ifaces) {
+           activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
+       }
 
-    #fixme: set other bridge flags
+       #fixme: set other bridge flags
 
-    # be sure to have the bridge up
-    system("/sbin/ip link set $bridgevlan up") == 0 ||
-        die "can't up bridge $bridgevlan\n";
-   
+       # remove ipv6 link-local address before activation
+       disable_ipv6($bridgevlan);
+       # be sure to have the bridge up
+       &$activate_interface($bridgevlan);
+    });
     return $bridgevlan;
 }
 
@@ -533,4 +555,32 @@ sub is_ip_in_cidr {
     return $cidr_obj->overlaps($ip_obj) == $Net::IP::IP_B_IN_A_OVERLAP;
 }
 
+
+sub get_local_ip_from_cidr {
+    my ($cidr) = @_;
+
+    my $cmd = ['/sbin/ip', 'address', 'show', 'to', $cidr, 'up'];
+
+    my $IPs = [];
+
+    my $code = sub {
+       my $line = shift;
+
+       if ($line =~ m!^\s*inet(?:6)?\s+($PVE::Tools::IPRE)/\d+!) {
+           push @$IPs, $1;
+       }
+    };
+
+    PVE::Tools::run_command($cmd, outfunc => $code);
+
+    return $IPs;
+}
+
+sub lock_network {
+    my ($code, @param) = @_;
+    my $res = lock_file('/var/lock/pve-network.lck', 10, $code, @param);
+    die $@ if $@;
+    return $res;
+}
+
 1;