X-Git-Url: https://git.proxmox.com/?p=pve-common.git;a=blobdiff_plain;f=src%2FPVE%2FNetwork.pm;h=12536c7609e9cc58182e97e8672ccd00e12ade72;hp=ab073505710150a5a24bea052e52070117fe99a6;hb=HEAD;hpb=e43faad9ff27f4d252d5604439c7aab1ff1c6251

diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm
index ab07350..a4f5ba9 100644
--- a/src/PVE/Network.pm
+++ b/src/PVE/Network.pm
@@ -2,23 +2,23 @@ package PVE::Network;
 
 use strict;
 use warnings;
-use PVE::Tools qw(run_command);
-use PVE::ProcFSTools;
+
 use PVE::INotify;
+use PVE::ProcFSTools;
+use PVE::Tools qw(run_command lock_file);
+
 use File::Basename;
 use IO::Socket::IP;
-use POSIX qw(ECONNREFUSED);
-
+use JSON;
 use Net::IP;
-
-use Socket qw(IPPROTO_IP);
-
-use constant IFF_UP => 1;
-use constant IFNAMSIZ => 16;
-use constant SIOCGIFFLAGS => 0x8913;
+use NetAddr::IP qw(:lower);
+use POSIX qw(ECONNREFUSED);
+use Socket qw(NI_NUMERICHOST NI_NUMERICSERV);
 
 # host network related utility functions
 
+our $PHYSICAL_NIC_RE = qr/(?:eth\d+|en[^:.]+|ib[^:.]+)/;
+
 our $ipv4_reverse_mask = [
     '0.0.0.0',
     '128.0.0.0',
@@ -56,6 +56,14 @@ our $ipv4_reverse_mask = [
 ];
 
 our $ipv4_mask_hash_localnet = {
+    '255.0.0.0' => 8,
+    '255.128.0.0' => 9,
+    '255.192.0.0' => 10,
+    '255.224.0.0' => 11,
+    '255.240.0.0' => 12,
+    '255.248.0.0' => 13,
+    '255.252.0.0' => 14,
+    '255.254.0.0' => 15,
     '255.255.0.0' => 16,
     '255.255.128.0' => 17,
     '255.255.192.0' => 18,
@@ -76,7 +84,7 @@ our $ipv4_mask_hash_localnet = {
 };
 
 sub setup_tc_rate_limit {
-    my ($iface, $rate, $burst, $debug) = @_;
+    my ($iface, $rate, $burst) = @_;
 
     # these are allowed / expected to fail, e.g. when there is no previous rate limit to remove
     eval { run_command("/sbin/tc class del dev $iface parent 1: classid 1:1 >/dev/null 2>&1"); };
@@ -94,40 +102,37 @@ sub setup_tc_rate_limit {
 		"htb rate ${rate}bps burst ${burst}b");
 
     run_command("/sbin/tc qdisc add dev $iface handle ffff: ingress");
-    run_command("/sbin/tc filter add dev $iface parent ffff: " .
-		"prio 50 basic " .
-		"police rate ${rate}bps burst ${burst}b mtu 64kb " .
-		"drop flowid :1");
-
-    if ($debug) {
-	print "DEBUG tc settings\n";
-	system("/sbin/tc qdisc ls dev $iface");
-	system("/sbin/tc class ls dev $iface");
-	system("/sbin/tc filter ls dev $iface parent ffff:");
-    }
+    run_command(
+        "/sbin/tc filter add dev $iface parent ffff: prio 50 basic police rate ${rate}bps burst ${burst}b mtu 64kb drop");
+
+    return;
 }
 
 sub tap_rate_limit {
     my ($iface, $rate) = @_;
 
-    my $debug = 0;
     $rate = int($rate*1024*1024) if $rate;
     my $burst = 1024*1024;
 
-    setup_tc_rate_limit($iface, $rate, $burst, $debug);
+    setup_tc_rate_limit($iface, $rate, $burst);
+
+    return;
 }
 
-my $read_bridge_mtu = sub {
+sub read_bridge_mtu {
     my ($bridge) = @_;
 
     my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu");
     die "bridge '$bridge' does not exist\n" if !$mtu;
-    # avoid insecure dependency;
-    die "unable to parse mtu value" if $mtu !~ /^(\d+)$/;
-    $mtu = int($1);
+
+    if ($mtu =~ /^(\d+)$/) { # avoid insecure dependency (untaint)
+	$mtu = int($1);
+    } else {
+	die "unexpeted error: unable to parse mtu value '$mtu' as integer\n";
+    }
 
     return $mtu;
-};
+}
 
 my $parse_tap_device_name = sub {
     my ($iface, $noerr) = @_;
@@ -141,7 +146,7 @@ my $parse_tap_device_name = sub {
 	$vmid = $1;
 	$devid = $2;
     } else {
-	return undef if $noerr;
+	return if $noerr;
 	die "can't create firewall bridge for random interface name '$iface'\n";
     }
 
@@ -160,41 +165,98 @@ my $compute_fwbr_names = sub {
     return ($fwbr, $vethfw, $vethfwpeer, $ovsintport);
 };
 
+sub iface_delete :prototype($) {
+    my ($iface) = @_;
+    run_command(['/sbin/ip', 'link', 'delete', 'dev', $iface], noerr => 1)
+	== 0 or die "failed to delete interface '$iface'\n";
+    return;
+}
+
+sub iface_create :prototype($$@) {
+    my ($iface, $type, @args) = @_;
+    run_command(['/sbin/ip', 'link', 'add', $iface, 'type', $type, @args], noerr => 1)
+	== 0 or die "failed to create interface '$iface'\n";
+    return;
+}
+
+sub iface_set :prototype($@) {
+    my ($iface, @opts) = @_;
+    run_command(['/sbin/ip', 'link', 'set', $iface, @opts], noerr => 1)
+	== 0 or die "failed to set interface options for '$iface' (".join(' ', @opts).")\n";
+    return;
+}
+
+# helper for nicer error messages:
+sub iface_set_master :prototype($$) {
+    my ($iface, $master) = @_;
+    if (defined($master)) {
+	eval { iface_set($iface, 'master', $master) };
+	die "can't enslave '$iface' to '$master'\n" if $@;
+    } else {
+	eval { iface_set($iface, 'nomaster') };
+	die "can't unenslave '$iface'\n" if $@;
+    }
+    return;
+}
+
 my $cond_create_bridge = sub {
     my ($bridge) = @_;
 
     if (! -d "/sys/class/net/$bridge") {
-        system("/sbin/brctl addbr $bridge") == 0 ||
-            die "can't add bridge '$bridge'\n";
+	iface_create($bridge, 'bridge');
+	disable_ipv6($bridge);
     }
 };
 
+sub disable_ipv6 {
+    my ($iface) = @_;
+    my $file = "/proc/sys/net/ipv6/conf/$iface/disable_ipv6";
+    return if !-e $file; # ipv6 might be completely disabled
+    open(my $fh, '>', $file) or die "failed to open $file for writing: $!\n";
+    print {$fh} "1\n" or die "failed to disable link-local ipv6 for $iface\n";
+    close($fh);
+    return;
+}
+
+my $bridge_disable_interface_learning = sub {
+    my ($iface) = @_;
+
+    PVE::ProcFSTools::write_proc_entry("/sys/class/net/$iface/brport/unicast_flood", "0");
+    PVE::ProcFSTools::write_proc_entry("/sys/class/net/$iface/brport/learning", "0");
+
+};
+
 my $bridge_add_interface = sub {
     my ($bridge, $iface, $tag, $trunks) = @_;
 
-    system("/sbin/brctl addif $bridge $iface") == 0 ||
-	die "can't add interface 'iface' to bridge '$bridge'\n";
+    my $bridgemtu = read_bridge_mtu($bridge);
+    eval { run_command(['/sbin/ip', 'link', 'set', $iface, 'mtu', $bridgemtu]) };
+
+    # drop link local address (it can't be used when on a bridge anyway)
+    disable_ipv6($iface);
+    iface_set_master($iface, $bridge);
 
    my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/bridge/vlan_filtering");
 
    if ($vlan_aware) {
-	if ($tag) {
-	    system("/sbin/bridge vlan add dev $iface vid $tag pvid untagged") == 0 ||
-	    die "unable to add vlan $tag to interface $iface\n";
 
-	    warn "Caution: Setting VLAN ID 1 on a VLAN aware bridge may be dangerous\n" if $tag == 1;
-	} else {
-	    system("/sbin/bridge vlan add dev $iface vid 2-4094") == 0 ||
-	    die "unable to add default vlan tags to interface $iface\n" if !$trunks;
-	} 
-
-	if ($trunks) {
-	    my @trunks_array = split /;/, $trunks;
-	    foreach my $trunk (@trunks_array) { 
-		system("/sbin/bridge vlan add dev $iface vid $trunk") == 0 ||
-		die "unable to add vlan $trunk to interface $iface\n";
-	    }
-	}
+        eval { run_command(['/sbin/bridge', 'vlan', 'del', 'dev', $iface, 'vid', '1-4094']) };
+        die "failed to remove default vlan tags of $iface - $@\n" if $@;
+
+        if ($trunks) {
+            my @trunks_array = split /;/, $trunks;
+            foreach my $trunk (@trunks_array) {
+                eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $trunk]) };
+                die "unable to add vlan $trunk to interface $iface - $@\n" if $@;
+            }
+        } elsif (!$tag) {
+            eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', '2-4094']) };
+            die "unable to add default vlan tags to interface $iface - $@\n" if $@;
+        }
+
+        $tag = 1 if !$tag;
+        eval { run_command(['/sbin/bridge', 'vlan', 'add', 'dev', $iface, 'vid', $tag, 'pvid', 'untagged']) };
+        die "unable to add vlan $tag to interface $iface - $@\n" if $@;
    }
 };
 
@@ -203,34 +265,90 @@ my $ovs_bridge_add_port = sub {
 
     $trunks =~ s/;/,/g if $trunks;
 
-    my $cmd = "/usr/bin/ovs-vsctl add-port $bridge $iface";
-    $cmd .= " tag=$tag" if $tag;
-    $cmd .= " trunks=". join(',', $trunks) if $trunks;
-    $cmd .= " vlan_mode=native-untagged" if $tag && $trunks;
+    my $cmd = ['/usr/bin/ovs-vsctl'];
+    # first command
+    push @$cmd, '--', 'add-port', $bridge, $iface;
+    push @$cmd, "tag=$tag" if $tag;
+    push @$cmd, "trunks=". join(',', $trunks) if $trunks;
+    push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks;
+
+    my $bridgemtu = read_bridge_mtu($bridge);
+    push @$cmd, '--', 'set', 'Interface', $iface, "mtu_request=$bridgemtu";
 
-    $cmd .= " -- set Interface $iface type=internal" if $internal;
-    system($cmd) == 0 ||
-	die "can't add ovs port '$iface'\n";
+    if ($internal) {
+	# second command
+	push @$cmd, '--', 'set', 'Interface', $iface, 'type=internal';
+    }
+
+    eval { run_command($cmd) };
+    die "can't add ovs port '$iface' - $@\n" if $@;
+
+    disable_ipv6($iface);
 };
 
 my $activate_interface = sub {
-    my ($iface) = @_;
+    my ($iface, $mtu) = @_;
+
+    my $cmd = ['/sbin/ip', 'link', 'set', $iface, 'up'];
+    push @$cmd, ('mtu', $mtu) if $mtu;
 
-    system("/sbin/ip link set $iface up") == 0 ||
-	die "can't activate interface '$iface'\n";
+    eval { run_command($cmd) };
+    die "can't activate interface '$iface' - $@\n" if $@;
 };
 
+sub add_bridge_fdb {
+    my ($iface, $mac) = @_;
+
+    my $learning = PVE::Tools::file_read_firstline("/sys/class/net/$iface/brport/learning");
+    return if !defined($learning) || $learning == 1;
+
+    my ($vmid, $devid) = &$parse_tap_device_name($iface, 1);
+    return if !defined($vmid);
+
+    run_command(['/sbin/bridge', 'fdb', 'append', $mac, 'dev', $iface, 'master', 'static']);
+
+    my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
+
+    if (-d "/sys/class/net/$vethfwpeer") {
+	run_command(['/sbin/bridge', 'fdb', 'append', $mac, 'dev', $vethfwpeer, 'master', 'static']);
+    }
+
+    return;
+}
+
+sub del_bridge_fdb {
+    my ($iface, $mac) = @_;
+
+    my $learning = PVE::Tools::file_read_firstline("/sys/class/net/$iface/brport/learning");
+    return if !defined($learning) || $learning == 1;
+
+    my ($vmid, $devid) = &$parse_tap_device_name($iface, 1);
+    return if !defined($vmid);
+
+    run_command(['/sbin/bridge', 'fdb', 'del', $mac, 'dev', $iface, 'master', 'static']);
+
+    my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
+
+    if (-d "/sys/class/net/$vethfwpeer") {
+	run_command(['/sbin/bridge', 'fdb', 'del', $mac, 'dev', $vethfwpeer, 'master', 'static']);
+    }
+
+    return;
+}
+
 sub tap_create {
     my ($iface, $bridge) = @_;
 
     die "unable to get bridge setting\n" if !$bridge;
 
-    my $bridgemtu = &$read_bridge_mtu($bridge);
+    my $bridgemtu = read_bridge_mtu($bridge);
 
-    eval { 
-	PVE::Tools::run_command("/sbin/ifconfig $iface 0.0.0.0 promisc up mtu $bridgemtu");
+    eval {
+	disable_ipv6($iface);
+	run_command(['/sbin/ip', 'link', 'set', $iface, 'up', 'promisc', 'on', 'mtu', $bridgemtu]);
     };
     die "interface activation failed\n" if $@;
+    return;
 }
 
 sub veth_create {
@@ -238,74 +356,89 @@ sub veth_create {
 
     die "unable to get bridge setting\n" if !$bridge;
 
-    my $bridgemtu = &$read_bridge_mtu($bridge);
+    my $bridgemtu = read_bridge_mtu($bridge);
 
     # create veth pair
     if (! -d "/sys/class/net/$veth") {
-	my $cmd = "/sbin/ip link add name $veth type veth peer name $vethpeer mtu $bridgemtu";
-	$cmd .= " addr $mac" if $mac;
-	system($cmd) == 0 || die "can't create interface $veth\n";
+	my $cmd = ['/sbin/ip', 'link', 'add'];
+	# veth device + MTU
+	push @$cmd, 'name', $veth;
+	push @$cmd, 'mtu', $bridgemtu;
+	push @$cmd, 'type', 'veth';
+	# peer device + MTU
+	push @$cmd, 'peer', 'name', $vethpeer, 'mtu', $bridgemtu;
+
+	push @$cmd, 'addr', $mac if $mac;
+
+	eval { run_command($cmd) };
+	die "can't create interface $veth - $@\n" if $@;
     }
 
     # up vethpair
-    &$activate_interface($veth);
-    &$activate_interface($vethpeer);
+    disable_ipv6($veth);
+    disable_ipv6($vethpeer);
+    &$activate_interface($veth, $bridgemtu);
+    &$activate_interface($vethpeer, $bridgemtu);
+
+    return;
 }
 
 sub veth_delete {
     my ($veth) = @_;
 
     if (-d "/sys/class/net/$veth") {
-	run_command("/sbin/ip link delete dev $veth", outfunc => sub {}, errfunc => sub {});
+	iface_delete($veth);
     }
-
+    eval { tap_unplug($veth) };
+    return;
 }
 
 my $create_firewall_bridge_linux = sub {
-    my ($iface, $bridge, $tag, $trunks) = @_;
+    my ($iface, $bridge, $tag, $trunks, $no_learning) = @_;
 
     my ($vmid, $devid) = &$parse_tap_device_name($iface);
     my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid);
 
+    my $bridgemtu = read_bridge_mtu($bridge);
+
     &$cond_create_bridge($fwbr);
-    &$activate_interface($fwbr);
+    &$activate_interface($fwbr, $bridgemtu);
 
     copy_bridge_config($bridge, $fwbr);
     veth_create($vethfw, $vethfwpeer, $bridge);
 
-    &$bridge_add_interface($fwbr, $vethfw);
     &$bridge_add_interface($bridge, $vethfwpeer, $tag, $trunks);
+    &$bridge_disable_interface_learning($vethfwpeer) if $no_learning;
+    &$bridge_add_interface($fwbr, $vethfw);
 
     &$bridge_add_interface($fwbr, $iface);
 };
 
 my $create_firewall_bridge_ovs = sub {
-    my ($iface, $bridge, $tag, $trunks) = @_;
+    my ($iface, $bridge, $tag, $trunks, $no_learning) = @_;
 
     my ($vmid, $devid) = &$parse_tap_device_name($iface);
     my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
 
-    my $bridgemtu = &$read_bridge_mtu($bridge);
+    my $bridgemtu = read_bridge_mtu($bridge);
 
     &$cond_create_bridge($fwbr);
-    &$activate_interface($fwbr);
+    &$activate_interface($fwbr, $bridgemtu);
 
     &$bridge_add_interface($fwbr, $iface);
 
     &$ovs_bridge_add_port($bridge, $ovsintport, $tag, 1, $trunks);
-    &$activate_interface($ovsintport);
+    &$activate_interface($ovsintport, $bridgemtu);
 
-    # set the same mtu for ovs int port
-    PVE::Tools::run_command("/sbin/ifconfig $ovsintport mtu $bridgemtu");
-    
     &$bridge_add_interface($fwbr, $ovsintport);
+    &$bridge_disable_interface_learning($ovsintport) if $no_learning;
 };
 
 my $cleanup_firewall_bridge = sub {
     my ($iface) = @_;
 
     my ($vmid, $devid) = &$parse_tap_device_name($iface, 1);
-    return if !defined($vmid);  
+    return if !defined($vmid);
     my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid);
 
     # cleanup old port config from any openvswitch bridge
@@ -318,16 +451,28 @@ my $cleanup_firewall_bridge = sub {
 
     # cleanup fwbr bridge
     if (-d "/sys/class/net/$fwbr") {
-	run_command("/sbin/ip link set dev $fwbr down", outfunc => sub {}, errfunc => sub {});
-	run_command("/sbin/brctl delbr $fwbr", outfunc => sub {}, errfunc => sub {});
+	iface_delete($fwbr);
     }
 };
 
 sub tap_plug {
-    my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_;
+    my ($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts) = @_;
 
-    #cleanup old port config from any openvswitch bridge
-    eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) };
+    $opts = {} if !defined($opts);
+    $opts = { learning => $opts } if !ref($opts); # FIXME: backward compat, drop with PVE 8.0
+
+    if (!defined($opts->{learning})) { # auto-detect
+	$opts = {} if !defined($opts);
+	my $interfaces_config = PVE::INotify::read_file('interfaces');
+	my $bridge = $interfaces_config->{ifaces}->{$bridge};
+	$opts->{learning} = !($bridge && $bridge->{'bridge-disable-mac-learning'}); # default learning to on
+    }
+    my $no_learning = !$opts->{learning};
+
+    # cleanup old port config from any openvswitch bridge
+    eval {
+	run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {});
+    };
 
     if (-d "/sys/class/net/$bridge/bridge") {
 	&$cleanup_firewall_bridge($iface); # remove stale devices
@@ -343,41 +488,47 @@ sub tap_plug {
 	}
 
 	if ($firewall) {
-	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks);
+	    &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning);
 	} else {
 	    &$bridge_add_interface($bridge, $iface, $tag, $trunks);
 	}
+	if ($no_learning) {
+	    $bridge_disable_interface_learning->($iface);
+	    add_bridge_fdb($iface, $opts->{mac}) if defined($opts->{mac});
+	}
 
     } else {
 	&$cleanup_firewall_bridge($iface); # remove stale devices
 
 	if ($firewall) {
-	    &$create_firewall_bridge_ovs($iface, $bridge, $tag, $trunks);
+	    &$create_firewall_bridge_ovs($iface, $bridge, $tag, $trunks, $no_learning);
 	} else {
 	    &$ovs_bridge_add_port($bridge, $iface, $tag, undef, $trunks);
 	}
     }
 
     tap_rate_limit($iface, $rate);
+
+    return;
 }
 
 sub tap_unplug {
     my ($iface) = @_;
 
-    my $path= "/sys/class/net/$iface/brport/bridge";
+    my $path = "/sys/class/net/$iface/brport/bridge";
     if (-l $path) {
 	my $bridge = basename(readlink($path));
 	#avoid insecure dependency;
 	($bridge) = $bridge =~ /(\S+)/;
 
-	system("/sbin/brctl delif $bridge $iface") == 0 ||
-	    die "can't del interface '$iface' from bridge '$bridge'\n";
-
+	iface_set_master($iface, undef);
     }
-    
+
     &$cleanup_firewall_bridge($iface);
     #cleanup old port config from any openvswitch bridge
-    eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) };
+    eval { run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) };
+
+    return;
 }
 
 sub copy_bridge_config {
@@ -385,8 +536,10 @@ sub copy_bridge_config {
 
     return if $br0 eq $br1;
 
-    my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay', 
-		       'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier'];
+    my $br_configs = [
+	'ageing_time', 'stp_state', 'priority', 'forward_delay',
+	'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier',
+    ];
 
     foreach my $sysname (@$br_configs) {
 	eval {
@@ -398,16 +551,26 @@ sub copy_bridge_config {
 	};
 	warn $@ if $@;
     }
+    return;
 }
 
 sub activate_bridge_vlan_slave {
     my ($bridgevlan, $iface, $tag) = @_;
     my $ifacevlan = "${iface}.$tag";
-	
+
     # create vlan on $iface is not already exist
     if (! -d "/sys/class/net/$ifacevlan") {
-	system("/sbin/ip link add link $iface name ${iface}.${tag} type vlan id $tag") == 0 ||
-	    die "can't add vlan tag $tag to interface $iface\n";
+	eval {
+	    my $cmd = ['/sbin/ip', 'link', 'add'];
+	    push @$cmd, 'link', $iface;
+	    push @$cmd, 'name', $ifacevlan;
+	    push @$cmd, 'type', 'vlan', 'id', $tag;
+	    run_command($cmd);
+	};
+	die "can't add vlan tag $tag to interface $iface - $@\n" if $@;
+
+	# remove ipv6 link-local address before activation
+	disable_ipv6($ifacevlan);
     }
 
     # be sure to have the $ifacevlan up
@@ -427,6 +590,7 @@ sub activate_bridge_vlan_slave {
 
     # add $ifacevlan to the bridge
     &$bridge_add_interface($bridgevlan, $ifacevlan);
+    return;
 }
 
 sub activate_bridge_vlan {
@@ -450,23 +614,27 @@ sub activate_bridge_vlan {
 
     die "no physical interface on bridge '$bridge'\n" if scalar(@ifaces) == 0;
 
-    # add bridgevlan if it doesn't already exist
-    if (! -d "/sys/class/net/$bridgevlan") {
-        system("/sbin/brctl addbr $bridgevlan") == 0 ||
-            die "can't add bridge $bridgevlan\n";
-    }
+    lock_network(sub {
+	# add bridgevlan if it doesn't already exist
+	if (! -d "/sys/class/net/$bridgevlan") {
+	    iface_create($bridgevlan, 'bridge');
+	}
 
-    # for each physical interface (eth or bridge) bind them to bridge vlan
-    foreach my $iface (@ifaces) {
-        activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
-    }
+	my $bridgemtu = read_bridge_mtu($bridge);
+	eval { run_command(['/sbin/ip', 'link', 'set', $bridgevlan, 'mtu', $bridgemtu]) };
+
+	# for each physical interface (eth or bridge) bind them to bridge vlan
+	foreach my $iface (@ifaces) {
+	    activate_bridge_vlan_slave($bridgevlan, $iface, $tag);
+	}
 
-    #fixme: set other bridge flags
+	#fixme: set other bridge flags
 
-    # be sure to have the bridge up
-    system("/sbin/ip link set $bridgevlan up") == 0 ||
-        die "can't up bridge $bridgevlan\n";
-   
+	# remove ipv6 link-local address before activation
+	disable_ipv6($bridgevlan);
+	# be sure to have the bridge up
+	&$activate_interface($bridgevlan);
+    });
     return $bridgevlan;
 }
 
@@ -501,8 +669,7 @@ sub tcp_ping {
 sub IP_from_cidr {
     my ($cidr, $version) = @_;
 
-    return if $cidr !~ m!^(\S+?)/(\S+)$!;
-    my ($ip, $prefix) = ($1, $2);
+    my ($ip, $prefix) = $cidr =~ m!^(\S+?)/(\S+)$! or return;
 
     my $ipobj = Net::IP->new($ip, $version);
     return if !$ipobj;
@@ -521,44 +688,172 @@ sub is_ip_in_cidr {
     my ($ip, $cidr, $version) = @_;
 
     my $cidr_obj = IP_from_cidr($cidr, $version);
-    return undef if !$cidr_obj;
+    return if !$cidr_obj;
 
     my $ip_obj = Net::IP->new($ip, $version);
-    return undef if !$ip_obj;
+    return if !$ip_obj;
+
+    my $overlap = $cidr_obj->overlaps($ip_obj);
+    return if !defined($overlap);
+
+    return $overlap == $Net::IP::IP_B_IN_A_OVERLAP || $overlap == $Net::IP::IP_IDENTICAL;
+}
+
+# get all currently configured addresses that have a global scope, i.e., are reachable from the
+# outside of the host and thus are neither loopback nor link-local ones
+# returns an array ref of: { addr => "IP", cidr => "IP/PREFIXLEN", family => "inet|inet6" }
+sub get_reachable_networks {
+    my $raw = '';
+    run_command([qw(ip -j addr show up scope global)], outfunc => sub { $raw .= shift });
+    my $decoded = decode_json($raw);
+
+    my $addrs = []; # filter/transform first so that we can sort correctly more easily below
+    for my $e ($decoded->@*) {
+	next if !$e->{addr_info} || grep { $_ eq 'LOOPBACK' } $e->{flags}->@*;
+	push $addrs->@*, grep { scalar(keys $_->%*) } $e->{addr_info}->@*
+    }
+    my $res = [];
+    for my $info (sort { $a->{family} cmp $b->{family} || $a->{local} cmp $b->{local} } $addrs->@*) {
+	push $res->@*, {
+	    addr => $info->{local},
+	    cidr => "$info->{local}/$info->{prefixlen}",
+	    family => $info->{family},
+	};
+    }
+
+    return $res;
+}
+
+# get one or all local IPs that are not loopback ones, able to pick up the following ones (in order)
+# - the hostname primary resolves too, follows gai.conf (admin controlled) and will be prioritised
+# - all configured in the interfaces configuration
+# - all currently networks known to the kernel in the current (root) namespace
+# returns a single address if no parameter is passed, and all found, grouped by type, if `all => 1`
+# is passed.
+sub get_local_ip {
+    my (%param) = @_;
+
+    my $nodename = PVE::INotify::nodename();
+    my $resolved_host = eval { get_ip_from_hostname($nodename) };
+
+    return $resolved_host if defined($resolved_host) && !$param{all};
+
+    my $all = { v4 => {}, v6 => {} }; # hash to avoid duplicates and group by type
+
+    my $interaces_cfg = PVE::INotify::read_file('interfaces', 1) || {};
+    for my $if (values $interaces_cfg->{data}->{ifaces}->%*) {
+	next if $if->{type} eq 'loopback' || (!defined($if->{address}) && !defined($if->{address6}));
+	my ($v4, $v6) = ($if->{address}, $if->{address6});
 
-    return $cidr_obj->overlaps($ip_obj) == $Net::IP::IP_B_IN_A_OVERLAP;
+	return ($v4 // $v6) if !$param{all}; # prefer v4, admin can override $resolved_host via hosts/gai.conf
+
+	$all->{v4}->{$v4} = 1 if defined($v4);
+	$all->{v6}->{$v6} = 1 if defined($v6);
+    }
+
+    my $live = eval { get_reachable_networks() } // [];
+    for my $info ($live->@*) {
+	my $addr = $info->{addr};
+
+	return $addr if !$param{all};
+
+	if ($info->{family} eq 'inet') {
+	    $all->{v4}->{$addr} = 1;
+	} else {
+	    $all->{v6}->{$addr} = 1;
+	}
+    }
+
+    return if !$param{all}; # getting here means no early return above triggered -> no IPs
+
+    my $res = []; # order gai.conf controlled first, then group v4 and v6, simply lexically sorted
+    if ($resolved_host) {
+	push $res->@*, $resolved_host;
+	delete $all->{v4}->{$resolved_host};
+	delete $all->{v6}->{$resolved_host};
+    }
+    push $res->@*, sort { $a cmp $b } keys $all->{v4}->%*;
+    push $res->@*, sort { $a cmp $b } keys $all->{v6}->%*;
+
+    return $res;
 }
 
-# struct ifreq { // FOR SIOCGIFFLAGS:
-#   char ifrn_name[IFNAMSIZ]
-#   short ifru_flags
-# };
-my $STRUCT_IFREQ_SIOCGIFFLAGS = 'Z' . IFNAMSIZ . 's1';
-sub get_active_interfaces {
-    # Use the interface name list from /proc/net/dev
-    open my $fh, '<', '/proc/net/dev'
-	or die "failed to open /proc/net/dev: $!\n";
-    # And filter by IFF_UP flag fetched via a PF_INET6 socket ioctl:
-    my $sock;
-    socket($sock, PF_INET6, SOCK_DGRAM, &IPPROTO_IP)
-    or socket($sock, PF_INET, SOCK_DGRAM, &IPPROTO_IP)
-    or return [];
-
-    my $ifaces = [];
-    while(defined(my $line = <$fh>)) {
-	next if $line !~ /^\s*([^:\s]+):/;
-	my $ifname = $1;
-	my $ifreq = pack($STRUCT_IFREQ_SIOCGIFFLAGS, $ifname, 0);
-	if (!defined(ioctl($sock, SIOCGIFFLAGS, $ifreq))) {
-	    warn "failed to get interface flags for: $ifname\n";
-	    next;
+sub get_local_ip_from_cidr {
+    my ($cidr) = @_;
+
+    my $IPs = {};
+    my $i = 1;
+    run_command(['/sbin/ip', 'address', 'show', 'to', $cidr, 'up'], outfunc => sub {
+	if ($_[0] =~ m!^\s*inet(?:6)?\s+($PVE::Tools::IPRE)(?:/\d+|\s+peer\s+)!) {
+	    $IPs->{$1} = $i++ if !exists($IPs->{$1});
 	}
-	my ($name, $flags) = unpack($STRUCT_IFREQ_SIOCGIFFLAGS, $ifreq);
-	push @$ifaces, $ifname if ($flags & IFF_UP);
+    });
+
+    return [ sort { $IPs->{$a} <=> $IPs->{$b} } keys %{$IPs} ];
+}
+
+sub addr_to_ip {
+    my ($addr) = @_;
+    my ($err, $host, $port) = Socket::getnameinfo($addr, NI_NUMERICHOST | NI_NUMERICSERV);
+    die "failed to get numerical host address: $err\n" if $err;
+    return ($host, $port) if wantarray;
+    return $host;
+}
+
+sub get_ip_from_hostname {
+    my ($hostname, $noerr) = @_;
+
+    my @res = eval { PVE::Tools::getaddrinfo_all($hostname) };
+    if ($@) {
+	die "hostname lookup '$hostname' failed - $@" if !$noerr;
+	return;
+    }
+
+    for my $ai (@res) {
+	my $ip = addr_to_ip($ai->{addr});
+	if ($ip !~ m/^127\.|^::1$/) {
+	    return wantarray ? ($ip, $ai->{family}) : $ip;
+	}
+    }
+    # NOTE: we only get here if no WAN/LAN IP was found, so this is now the error path!
+    die "address lookup for '$hostname' did not find any IP address\n" if !$noerr;
+    return;
+}
+
+sub lock_network {
+    my ($code, @param) = @_;
+    my $res = lock_file('/var/lock/pve-network.lck', 10, $code, @param);
+    die $@ if $@;
+    return $res;
+}
+
+# the canonical form of the given IP, i.e. dotted quad for IPv4 and RFC 5952 for IPv6
+sub canonical_ip {
+    my ($ip) = @_;
+
+    my $ip_obj = NetAddr::IP->new($ip) or die "invalid IP string '$ip'\n";
+
+    return $ip_obj->canon();
+}
+
+# List of unique, canonical IPs in the provided list.
+# Keeps the original order, filtering later duplicates.
+sub unique_ips {
+    my ($ips) = @_;
+
+    my $res = [];
+    my $seen = {};
+
+    for my $ip (@{$ips}) {
+	$ip = canonical_ip($ip);
+
+	next if $seen->{$ip};
+
+	$seen->{$ip} = 1;
+	push @{$res}, $ip;
     }
-    close $fh;
-    close $sock;
-    return $ifaces;
+
+    return $res;
 }
 
 1;