net: Add `link_down` config to allow setting interfaces as disconnected

If this network option is set, the host-side link will be forced down
and the interface won't be connected to the bridge.

Add a `Disconnect` option for network interfaces on LXC containers, much
like it already exists for VMs. This has been requested in #3413 [0] and
seems useful, especially considering we already support the same thing
for VMs.

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=3413

One thing to note is that LXC does not seem to support the notion of
setting an interface down. The `flags` property would suggest that this
possible [1], but AFAICS it does not work. I tried setting the value as
empty and to something else than "up" (since that is really the only
supported option [2][3]), which both had absolutely no effect.

[1] https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html#lbAO
[2] https://github.com/lxc/lxc/blob/08f0e769/src/lxc/confile.c#L453-L467
[3] https://github.com/lxc/lxc/blob/08f0e769/src/lxc/confile.c#L5933-L5952

Thus force the host-side link of the container network down and avoid
adding it to the designated bridge if the new option is set, effectively
disconnecting the container network.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
Tested-by:  Friedrich Weber <f.weber@proxmox.com>
 [ T: paste cover letter as commit message ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 54afd9777c5f0e7b2229463060a3bac82439993d..c4d53e8e0fd72f78717e2ac6298126ea76d90c7f 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -920,6 +920,14 @@ sub vm_stop_cleanup {
 
 sub net_tap_plug : prototype($$) {
     my ($iface, $net) = @_;
+
+    if (defined($net->{link_down})) {
+       PVE::Tools::run_command(['/sbin/ip', 'link', 'set', 'dev', $iface, 'down']);
+       # Don't add disconnected interfaces to the bridge, otherwise e.g. applying any network
+       # change (e.g. `ifreload -a`) could (re-)activate it unintentionally.
+       return;
+    }
+
     my ($bridge, $tag, $firewall, $trunks, $rate, $hwaddr) =
        $net->@{'bridge', 'tag', 'firewall', 'trunks', 'rate', 'hwaddr'};
 
@@ -929,6 +937,8 @@ sub net_tap_plug : prototype($$) {
     } else {
        PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, { mac => $hwaddr });
     }
+
+    PVE::Tools::run_command(['/sbin/ip', 'link', 'set', 'dev', $iface, 'up']);
 }
 
 sub update_net {
@@ -957,7 +967,8 @@ sub update_net {
        } else {
            if (safe_string_ne($oldnet->{bridge}, $newnet->{bridge}) ||
                safe_num_ne($oldnet->{tag}, $newnet->{tag}) ||
-               safe_num_ne($oldnet->{firewall}, $newnet->{firewall})
+               safe_num_ne($oldnet->{firewall}, $newnet->{firewall}) ||
+               safe_boolean_ne($oldnet->{link_down}, $newnet->{link_down})
            ) {
 
                if ($oldnet->{bridge}) {
@@ -972,7 +983,7 @@ sub update_net {
                PVE::LXC::net_tap_plug($veth, $newnet);
 
                # This includes the rate:
-               foreach (qw(bridge tag firewall rate)) {
+               foreach (qw(bridge tag firewall rate link_down)) {
                    $oldnet->{$_} = $newnet->{$_} if $newnet->{$_};
                }
            } elsif (safe_string_ne($oldnet->{rate}, $newnet->{rate})) {
@@ -1015,7 +1026,7 @@ sub hotplug_net {
     PVE::Tools::run_command($cmd);
 
     my $done = { type => 'veth' };
-    foreach (qw(bridge tag firewall hwaddr name)) {
+    foreach (qw(bridge tag firewall hwaddr name link_down)) {
        $done->{$_} = $newnet->{$_} if $newnet->{$_};
     }
     $conf->{$opt} = PVE::LXC::Config->print_lxc_network($done);

diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm
index af25a96e96144ec832e61ff1d3042c15b103dff1..bf424f9f4afa7e34bf33c814854f659bd0b93605 100644 (file)
--- a/src/PVE/LXC/Config.pm
+++ b/src/PVE/LXC/Config.pm
@@ -814,6 +814,12 @@ our $netconf_desc = {
        description => "Apply rate limiting to the interface",
        optional => 1,
     },
+    # TODO: Rename this option and the qemu-server one to `link-down` for PVE 8.0
+    link_down => {
+       type => 'boolean',
+       description => 'Whether this interface should be disconnected (like pulling the plug).',
+       optional => 1,
+    },
 };
 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);