X-Git-Url: https://git.proxmox.com/?p=pve-common.git;a=blobdiff_plain;f=src%2FPVE%2FNetwork.pm;h=12536c7609e9cc58182e97e8672ccd00e12ade72;hp=f6ad4cde110545f583d4d4de9707f8a03a0ee4cf;hb=HEAD;hpb=29dde5f46b4bb616ed4814903c5d28427e668a4d diff --git a/src/PVE/Network.pm b/src/PVE/Network.pm index f6ad4cd..a4f5ba9 100644 --- a/src/PVE/Network.pm +++ b/src/PVE/Network.pm @@ -9,6 +9,7 @@ use PVE::Tools qw(run_command lock_file); use File::Basename; use IO::Socket::IP; +use JSON; use Net::IP; use NetAddr::IP qw(:lower); use POSIX qw(ECONNREFUSED); @@ -101,10 +102,10 @@ sub setup_tc_rate_limit { "htb rate ${rate}bps burst ${burst}b"); run_command("/sbin/tc qdisc add dev $iface handle ffff: ingress"); - run_command("/sbin/tc filter add dev $iface parent ffff: " . - "prio 50 basic " . - "police rate ${rate}bps burst ${burst}b mtu 64kb " . - "drop"); + run_command( + "/sbin/tc filter add dev $iface parent ffff: prio 50 basic police rate ${rate}bps burst ${burst}b mtu 64kb drop"); + + return; } sub tap_rate_limit { @@ -114,6 +115,8 @@ sub tap_rate_limit { my $burst = 1024*1024; setup_tc_rate_limit($iface, $rate, $burst); + + return; } sub read_bridge_mtu { @@ -121,12 +124,15 @@ sub read_bridge_mtu { my $mtu = PVE::Tools::file_read_firstline("/sys/class/net/$bridge/mtu"); die "bridge '$bridge' does not exist\n" if !$mtu; - # avoid insecure dependency; - die "unable to parse mtu value" if $mtu !~ /^(\d+)$/; - $mtu = int($1); + + if ($mtu =~ /^(\d+)$/) { # avoid insecure dependency (untaint) + $mtu = int($1); + } else { + die "unexpeted error: unable to parse mtu value '$mtu' as integer\n"; + } return $mtu; -}; +} my $parse_tap_device_name = sub { my ($iface, $noerr) = @_; @@ -140,7 +146,7 @@ my $parse_tap_device_name = sub { $vmid = $1; $devid = $2; } else { - return undef if $noerr; + return if $noerr; die "can't create firewall bridge for random interface name '$iface'\n"; } @@ -159,26 +165,29 @@ my $compute_fwbr_names = sub { return ($fwbr, $vethfw, $vethfwpeer, $ovsintport); }; -sub iface_delete($) { +sub iface_delete :prototype($) { my ($iface) = @_; run_command(['/sbin/ip', 'link', 'delete', 'dev', $iface], noerr => 1) == 0 or die "failed to delete interface '$iface'\n"; + return; } -sub iface_create($$@) { +sub iface_create :prototype($$@) { my ($iface, $type, @args) = @_; run_command(['/sbin/ip', 'link', 'add', $iface, 'type', $type, @args], noerr => 1) == 0 or die "failed to create interface '$iface'\n"; + return; } -sub iface_set($@) { +sub iface_set :prototype($@) { my ($iface, @opts) = @_; run_command(['/sbin/ip', 'link', 'set', $iface, @opts], noerr => 1) == 0 or die "failed to set interface options for '$iface' (".join(' ', @opts).")\n"; + return; } # helper for nicer error messages: -sub iface_set_master($$) { +sub iface_set_master :prototype($$) { my ($iface, $master) = @_; if (defined($master)) { eval { iface_set($iface, 'master', $master) }; @@ -187,6 +196,7 @@ sub iface_set_master($$) { eval { iface_set($iface, 'nomaster') }; die "can't unenslave '$iface'\n" if $@; } + return; } my $cond_create_bridge = sub { @@ -200,16 +210,28 @@ my $cond_create_bridge = sub { sub disable_ipv6 { my ($iface) = @_; - return if !-d '/proc/sys/net/ipv6'; # ipv6 might be completely disabled my $file = "/proc/sys/net/ipv6/conf/$iface/disable_ipv6"; + return if !-e $file; # ipv6 might be completely disabled open(my $fh, '>', $file) or die "failed to open $file for writing: $!\n"; print {$fh} "1\n" or die "failed to disable link-local ipv6 for $iface\n"; close($fh); + return; } +my $bridge_disable_interface_learning = sub { + my ($iface) = @_; + + PVE::ProcFSTools::write_proc_entry("/sys/class/net/$iface/brport/unicast_flood", "0"); + PVE::ProcFSTools::write_proc_entry("/sys/class/net/$iface/brport/learning", "0"); + +}; + my $bridge_add_interface = sub { my ($bridge, $iface, $tag, $trunks) = @_; + my $bridgemtu = read_bridge_mtu($bridge); + eval { run_command(['/sbin/ip', 'link', 'set', $iface, 'mtu', $bridgemtu]) }; + # drop link local address (it can't be used when on a bridge anyway) disable_ipv6($iface); iface_set_master($iface, $bridge); @@ -250,6 +272,9 @@ my $ovs_bridge_add_port = sub { push @$cmd, "trunks=". join(',', $trunks) if $trunks; push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks; + my $bridgemtu = read_bridge_mtu($bridge); + push @$cmd, '--', 'set', 'Interface', $iface, "mtu_request=$bridgemtu"; + if ($internal) { # second command push @$cmd, '--', 'set', 'Interface', $iface, 'type=internal'; @@ -262,12 +287,55 @@ my $ovs_bridge_add_port = sub { }; my $activate_interface = sub { - my ($iface) = @_; + my ($iface, $mtu) = @_; - eval { run_command(['/sbin/ip', 'link', 'set', $iface, 'up']) }; + my $cmd = ['/sbin/ip', 'link', 'set', $iface, 'up']; + push @$cmd, ('mtu', $mtu) if $mtu; + + eval { run_command($cmd) }; die "can't activate interface '$iface' - $@\n" if $@; }; +sub add_bridge_fdb { + my ($iface, $mac) = @_; + + my $learning = PVE::Tools::file_read_firstline("/sys/class/net/$iface/brport/learning"); + return if !defined($learning) || $learning == 1; + + my ($vmid, $devid) = &$parse_tap_device_name($iface, 1); + return if !defined($vmid); + + run_command(['/sbin/bridge', 'fdb', 'append', $mac, 'dev', $iface, 'master', 'static']); + + my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid); + + if (-d "/sys/class/net/$vethfwpeer") { + run_command(['/sbin/bridge', 'fdb', 'append', $mac, 'dev', $vethfwpeer, 'master', 'static']); + } + + return; +} + +sub del_bridge_fdb { + my ($iface, $mac) = @_; + + my $learning = PVE::Tools::file_read_firstline("/sys/class/net/$iface/brport/learning"); + return if !defined($learning) || $learning == 1; + + my ($vmid, $devid) = &$parse_tap_device_name($iface, 1); + return if !defined($vmid); + + run_command(['/sbin/bridge', 'fdb', 'del', $mac, 'dev', $iface, 'master', 'static']); + + my ($fwbr, $vethfw, $vethfwpeer, $ovsintport) = &$compute_fwbr_names($vmid, $devid); + + if (-d "/sys/class/net/$vethfwpeer") { + run_command(['/sbin/bridge', 'fdb', 'del', $mac, 'dev', $vethfwpeer, 'master', 'static']); + } + + return; +} + sub tap_create { my ($iface, $bridge) = @_; @@ -277,9 +345,10 @@ sub tap_create { eval { disable_ipv6($iface); - PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $iface, 'up', 'promisc', 'on', 'mtu', $bridgemtu]); + run_command(['/sbin/ip', 'link', 'set', $iface, 'up', 'promisc', 'on', 'mtu', $bridgemtu]); }; die "interface activation failed\n" if $@; + return; } sub veth_create { @@ -308,8 +377,10 @@ sub veth_create { # up vethpair disable_ipv6($veth); disable_ipv6($vethpeer); - &$activate_interface($veth); - &$activate_interface($vethpeer); + &$activate_interface($veth, $bridgemtu); + &$activate_interface($vethpeer, $bridgemtu); + + return; } sub veth_delete { @@ -319,28 +390,32 @@ sub veth_delete { iface_delete($veth); } eval { tap_unplug($veth) }; + return; } my $create_firewall_bridge_linux = sub { - my ($iface, $bridge, $tag, $trunks) = @_; + my ($iface, $bridge, $tag, $trunks, $no_learning) = @_; my ($vmid, $devid) = &$parse_tap_device_name($iface); my ($fwbr, $vethfw, $vethfwpeer) = &$compute_fwbr_names($vmid, $devid); + my $bridgemtu = read_bridge_mtu($bridge); + &$cond_create_bridge($fwbr); - &$activate_interface($fwbr); + &$activate_interface($fwbr, $bridgemtu); copy_bridge_config($bridge, $fwbr); veth_create($vethfw, $vethfwpeer, $bridge); - &$bridge_add_interface($fwbr, $vethfw); &$bridge_add_interface($bridge, $vethfwpeer, $tag, $trunks); + &$bridge_disable_interface_learning($vethfwpeer) if $no_learning; + &$bridge_add_interface($fwbr, $vethfw); &$bridge_add_interface($fwbr, $iface); }; my $create_firewall_bridge_ovs = sub { - my ($iface, $bridge, $tag, $trunks) = @_; + my ($iface, $bridge, $tag, $trunks, $no_learning) = @_; my ($vmid, $devid) = &$parse_tap_device_name($iface); my ($fwbr, undef, undef, $ovsintport) = &$compute_fwbr_names($vmid, $devid); @@ -348,17 +423,15 @@ my $create_firewall_bridge_ovs = sub { my $bridgemtu = read_bridge_mtu($bridge); &$cond_create_bridge($fwbr); - &$activate_interface($fwbr); + &$activate_interface($fwbr, $bridgemtu); &$bridge_add_interface($fwbr, $iface); &$ovs_bridge_add_port($bridge, $ovsintport, $tag, 1, $trunks); - &$activate_interface($ovsintport); - - # set the same mtu for ovs int port - PVE::Tools::run_command(['/sbin/ip', 'link', 'set', $ovsintport, 'mtu', $bridgemtu]); + &$activate_interface($ovsintport, $bridgemtu); &$bridge_add_interface($fwbr, $ovsintport); + &$bridge_disable_interface_learning($ovsintport) if $no_learning; }; my $cleanup_firewall_bridge = sub { @@ -383,10 +456,23 @@ my $cleanup_firewall_bridge = sub { }; sub tap_plug { - my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_; + my ($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts) = @_; - #cleanup old port config from any openvswitch bridge - eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) }; + $opts = {} if !defined($opts); + $opts = { learning => $opts } if !ref($opts); # FIXME: backward compat, drop with PVE 8.0 + + if (!defined($opts->{learning})) { # auto-detect + $opts = {} if !defined($opts); + my $interfaces_config = PVE::INotify::read_file('interfaces'); + my $bridge = $interfaces_config->{ifaces}->{$bridge}; + $opts->{learning} = !($bridge && $bridge->{'bridge-disable-mac-learning'}); # default learning to on + } + my $no_learning = !$opts->{learning}; + + # cleanup old port config from any openvswitch bridge + eval { + run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}); + }; if (-d "/sys/class/net/$bridge/bridge") { &$cleanup_firewall_bridge($iface); # remove stale devices @@ -402,28 +488,34 @@ sub tap_plug { } if ($firewall) { - &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks); + &$create_firewall_bridge_linux($iface, $bridge, $tag, $trunks, $no_learning); } else { &$bridge_add_interface($bridge, $iface, $tag, $trunks); } + if ($no_learning) { + $bridge_disable_interface_learning->($iface); + add_bridge_fdb($iface, $opts->{mac}) if defined($opts->{mac}); + } } else { &$cleanup_firewall_bridge($iface); # remove stale devices if ($firewall) { - &$create_firewall_bridge_ovs($iface, $bridge, $tag, $trunks); + &$create_firewall_bridge_ovs($iface, $bridge, $tag, $trunks, $no_learning); } else { &$ovs_bridge_add_port($bridge, $iface, $tag, undef, $trunks); } } tap_rate_limit($iface, $rate); + + return; } sub tap_unplug { my ($iface) = @_; - my $path= "/sys/class/net/$iface/brport/bridge"; + my $path = "/sys/class/net/$iface/brport/bridge"; if (-l $path) { my $bridge = basename(readlink($path)); #avoid insecure dependency; @@ -434,7 +526,9 @@ sub tap_unplug { &$cleanup_firewall_bridge($iface); #cleanup old port config from any openvswitch bridge - eval {run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) }; + eval { run_command("/usr/bin/ovs-vsctl del-port $iface", outfunc => sub {}, errfunc => sub {}) }; + + return; } sub copy_bridge_config { @@ -442,8 +536,10 @@ sub copy_bridge_config { return if $br0 eq $br1; - my $br_configs = [ 'ageing_time', 'stp_state', 'priority', 'forward_delay', - 'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier']; + my $br_configs = [ + 'ageing_time', 'stp_state', 'priority', 'forward_delay', + 'hello_time', 'max_age', 'multicast_snooping', 'multicast_querier', + ]; foreach my $sysname (@$br_configs) { eval { @@ -455,6 +551,7 @@ sub copy_bridge_config { }; warn $@ if $@; } + return; } sub activate_bridge_vlan_slave { @@ -493,6 +590,7 @@ sub activate_bridge_vlan_slave { # add $ifacevlan to the bridge &$bridge_add_interface($bridgevlan, $ifacevlan); + return; } sub activate_bridge_vlan { @@ -522,6 +620,9 @@ sub activate_bridge_vlan { iface_create($bridgevlan, 'bridge'); } + my $bridgemtu = read_bridge_mtu($bridge); + eval { run_command(['/sbin/ip', 'link', 'set', $bridgevlan, 'mtu', $bridgemtu]) }; + # for each physical interface (eth or bridge) bind them to bridge vlan foreach my $iface (@ifaces) { activate_bridge_vlan_slave($bridgevlan, $iface, $tag); @@ -568,8 +669,7 @@ sub tcp_ping { sub IP_from_cidr { my ($cidr, $version) = @_; - return if $cidr !~ m!^(\S+?)/(\S+)$!; - my ($ip, $prefix) = ($1, $2); + my ($ip, $prefix) = $cidr =~ m!^(\S+?)/(\S+)$! or return; my $ipobj = Net::IP->new($ip, $version); return if !$ipobj; @@ -588,18 +688,95 @@ sub is_ip_in_cidr { my ($ip, $cidr, $version) = @_; my $cidr_obj = IP_from_cidr($cidr, $version); - return undef if !$cidr_obj; + return if !$cidr_obj; my $ip_obj = Net::IP->new($ip, $version); - return undef if !$ip_obj; + return if !$ip_obj; my $overlap = $cidr_obj->overlaps($ip_obj); - return if !defined($overlap); return $overlap == $Net::IP::IP_B_IN_A_OVERLAP || $overlap == $Net::IP::IP_IDENTICAL; } +# get all currently configured addresses that have a global scope, i.e., are reachable from the +# outside of the host and thus are neither loopback nor link-local ones +# returns an array ref of: { addr => "IP", cidr => "IP/PREFIXLEN", family => "inet|inet6" } +sub get_reachable_networks { + my $raw = ''; + run_command([qw(ip -j addr show up scope global)], outfunc => sub { $raw .= shift }); + my $decoded = decode_json($raw); + + my $addrs = []; # filter/transform first so that we can sort correctly more easily below + for my $e ($decoded->@*) { + next if !$e->{addr_info} || grep { $_ eq 'LOOPBACK' } $e->{flags}->@*; + push $addrs->@*, grep { scalar(keys $_->%*) } $e->{addr_info}->@* + } + my $res = []; + for my $info (sort { $a->{family} cmp $b->{family} || $a->{local} cmp $b->{local} } $addrs->@*) { + push $res->@*, { + addr => $info->{local}, + cidr => "$info->{local}/$info->{prefixlen}", + family => $info->{family}, + }; + } + + return $res; +} + +# get one or all local IPs that are not loopback ones, able to pick up the following ones (in order) +# - the hostname primary resolves too, follows gai.conf (admin controlled) and will be prioritised +# - all configured in the interfaces configuration +# - all currently networks known to the kernel in the current (root) namespace +# returns a single address if no parameter is passed, and all found, grouped by type, if `all => 1` +# is passed. +sub get_local_ip { + my (%param) = @_; + + my $nodename = PVE::INotify::nodename(); + my $resolved_host = eval { get_ip_from_hostname($nodename) }; + + return $resolved_host if defined($resolved_host) && !$param{all}; + + my $all = { v4 => {}, v6 => {} }; # hash to avoid duplicates and group by type + + my $interaces_cfg = PVE::INotify::read_file('interfaces', 1) || {}; + for my $if (values $interaces_cfg->{data}->{ifaces}->%*) { + next if $if->{type} eq 'loopback' || (!defined($if->{address}) && !defined($if->{address6})); + my ($v4, $v6) = ($if->{address}, $if->{address6}); + + return ($v4 // $v6) if !$param{all}; # prefer v4, admin can override $resolved_host via hosts/gai.conf + + $all->{v4}->{$v4} = 1 if defined($v4); + $all->{v6}->{$v6} = 1 if defined($v6); + } + + my $live = eval { get_reachable_networks() } // []; + for my $info ($live->@*) { + my $addr = $info->{addr}; + + return $addr if !$param{all}; + + if ($info->{family} eq 'inet') { + $all->{v4}->{$addr} = 1; + } else { + $all->{v6}->{$addr} = 1; + } + } + + return if !$param{all}; # getting here means no early return above triggered -> no IPs + + my $res = []; # order gai.conf controlled first, then group v4 and v6, simply lexically sorted + if ($resolved_host) { + push $res->@*, $resolved_host; + delete $all->{v4}->{$resolved_host}; + delete $all->{v6}->{$resolved_host}; + } + push $res->@*, sort { $a cmp $b } keys $all->{v4}->%*; + push $res->@*, sort { $a cmp $b } keys $all->{v6}->%*; + + return $res; +} sub get_local_ip_from_cidr { my ($cidr) = @_; @@ -629,7 +806,7 @@ sub get_ip_from_hostname { my @res = eval { PVE::Tools::getaddrinfo_all($hostname) }; if ($@) { die "hostname lookup '$hostname' failed - $@" if !$noerr; - return undef; + return; } for my $ai (@res) { @@ -640,7 +817,7 @@ sub get_ip_from_hostname { } # NOTE: we only get here if no WAN/LAN IP was found, so this is now the error path! die "address lookup for '$hostname' did not find any IP address\n" if !$noerr; - return undef; + return; } sub lock_network {