add vnet vlan-aware option

Some users would like to be able to defined vlans at
vm level, or allow trunks,  on top of already
tagged vnet. (including vlan on top of vxlan tunnel)

Allow it on all layer2 plugins, and add a warn
for evpn layer3 plugin.

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>

diff --git a/PVE/Network/SDN/VnetPlugin.pm b/PVE/Network/SDN/VnetPlugin.pm
index 179bfa4d239b66e15d3ecd74876676b7a49ace9b..243301370556a412dd73a124d43fc50c4d684bdb 100644 (file)
--- a/PVE/Network/SDN/VnetPlugin.pm
+++ b/PVE/Network/SDN/VnetPlugin.pm
@@ -58,6 +58,10 @@ sub properties {
             type => 'integer',
             description => "vlan or vxlan id",
        },
+       vlanaware => {
+           type => 'boolean',
+           description => 'Allow vm VLANs to pass through this vnet.',
+       },
         alias => {
             type => 'string',
             description => "alias name of the vnet",
@@ -89,6 +93,7 @@ sub options {
         ipv4 => { optional => 1 },
         ipv6 => { optional => 1 },
         mac => { optional => 1 },
+        vlanaware => { optional => 1 },
     };
 }
 

diff --git a/PVE/Network/SDN/Zones.pm b/PVE/Network/SDN/Zones.pm
index 436b103134d47eb0c256e8db44854e567fe39948..b8dc54cd5d8e37e6772d727d2e9f740b2d79a078 100644 (file)
--- a/PVE/Network/SDN/Zones.pm
+++ b/PVE/Network/SDN/Zones.pm
@@ -214,18 +214,6 @@ sub status {
     return($zone_status, $vnet_status);
 }
 
-sub get_bridge_vlan {
-    my ($vnetid) = @_;
-
-    my $vnet = PVE::Network::SDN::Vnets::get_vnet($vnetid);
-
-    return ($vnetid, undef) if !$vnet; # fallback for classic bridge
-
-    my $plugin_config = get_plugin_config($vnet);
-    my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
-    return $plugin->get_bridge_vlan($plugin_config, $vnetid, $vnet->{tag});
-}
-
 sub tap_create {
     my ($iface, $bridge) = @_;
 
@@ -270,7 +258,7 @@ sub tap_plug {
        if $plugin_config->{nodes} && !defined($plugin_config->{nodes}->{$nodename});
 
     my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
-    $plugin->tap_plug($plugin_config, $vnet, $iface, $bridge, $firewall, $rate);
+    $plugin->tap_plug($plugin_config, $vnet, $tag, $iface, $bridge, $firewall, $trunks, $rate);
 }
 
 1;

diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 973e8e054b4d548393a3fe71f59dcf6a2f2fdc82..95fbb64b4c35e115e52c0e27c50e25a19620426f 100644 (file)
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -50,6 +50,7 @@ sub generate_sdn_config {
     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
 
     die "missing vxlan tag" if !$tag;
+    warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
 
     my @peers = split(',', $controller->{'peers'});
     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers);

diff --git a/PVE/Network/SDN/Zones/Plugin.pm b/PVE/Network/SDN/Zones/Plugin.pm
index 9ea7a50d038199726d57859ba0ea220b3a049827..0633b7806670e1d0681bba79217fe52c90ab7a01 100644 (file)
--- a/PVE/Network/SDN/Zones/Plugin.pm
+++ b/PVE/Network/SDN/Zones/Plugin.pm
@@ -205,44 +205,23 @@ sub status {
 }
 
 
-sub get_bridge_vlan {
-    my ($class, $plugin_config, $vnetid, $tag) = @_;
-
-    my $bridge = $vnetid;
-    $tag = undef;
-
-    die "bridge $bridge is missing" if !-d "/sys/class/net/$bridge/";
-
-    return ($bridge, $tag);
-}
-
 sub tap_create {
     my ($class, $plugin_config, $vnet, $iface, $vnetid) = @_;
 
-    my $tag = $vnet->{tag};
-    my ($bridge, undef) = $class->get_bridge_vlan($plugin_config, $vnetid, $tag);
-    die "unable to get bridge setting\n" if !$bridge;
-
-    PVE::Network::tap_create($iface, $bridge);
+    PVE::Network::tap_create($iface, $vnetid);
 }
 
 sub veth_create {
     my ($class, $plugin_config, $vnet, $veth, $vethpeer, $vnetid, $hwaddr) = @_;
 
-    my $tag = $vnet->{tag};
-    my ($bridge, undef) = $class->get_bridge_vlan($plugin_config, $vnetid, $tag);
-    die "unable to get bridge setting\n" if !$bridge;
-
-    PVE::Network::veth_create($veth, $vethpeer, $bridge, $hwaddr);
+    PVE::Network::veth_create($veth, $vethpeer, $vnetid, $hwaddr);
 }
 
 sub tap_plug {
-    my ($class, $plugin_config, $vnet, $iface, $vnetid, $firewall, $rate) = @_;
-
-    my $tag = $vnet->{tag};
+    my ($class, $plugin_config, $vnet, $tag, $iface, $vnetid, $firewall, $trunks, $rate) = @_;
 
-    ($vnetid, $tag) = $class->get_bridge_vlan($plugin_config, $vnetid, $tag);
-    my $trunks = undef;
+    my $vlan_aware = PVE::Tools::file_read_firstline("/sys/class/net/$vnetid/bridge/vlan_filtering");
+    die "vm vlans are not allowed on vnet $vnetid" if !$vlan_aware && ($tag || $trunks);
 
     PVE::Network::tap_plug($iface, $vnetid, $tag, $firewall, $trunks, $rate);
 }

diff --git a/PVE/Network/SDN/Zones/QinQPlugin.pm b/PVE/Network/SDN/Zones/QinQPlugin.pm
index 8a8d55b14971fc0f9e753b4a7ca9aad44d612bc8..dcec6b4fc92de84289a000c624543d00d4e80d91 100644 (file)
--- a/PVE/Network/SDN/Zones/QinQPlugin.pm
+++ b/PVE/Network/SDN/Zones/QinQPlugin.pm
@@ -149,6 +149,10 @@ sub generate_sdn_config {
     push @iface_config, "bridge_ports $vnet_bridge_ports";
     push @iface_config, "bridge_stp off";
     push @iface_config, "bridge_fd 0";
+    if($vnet->{vlanaware}) {
+       push @iface_config, "bridge-vlan-aware yes";
+       push @iface_config, "bridge-vids 2-4094";
+    }
     push @iface_config, "mtu $mtu" if $mtu;
     push @iface_config, "alias $alias" if $alias;
     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};

diff --git a/PVE/Network/SDN/Zones/VlanPlugin.pm b/PVE/Network/SDN/Zones/VlanPlugin.pm
index 9d459cd059005a49f7dbb4153d3c0cbda739d866..836445157906878e74fa387f3962c24fb1ddaa96 100644 (file)
--- a/PVE/Network/SDN/Zones/VlanPlugin.pm
+++ b/PVE/Network/SDN/Zones/VlanPlugin.pm
@@ -112,6 +112,10 @@ sub generate_sdn_config {
     push @iface_config, "bridge_ports $vnet_uplink";
     push @iface_config, "bridge_stp off";
     push @iface_config, "bridge_fd 0";
+    if($vnet->{vlanaware}) {
+        push @iface_config, "bridge-vlan-aware yes";
+        push @iface_config, "bridge-vids 2-4094";
+    }
     push @iface_config, "mtu $mtu" if $mtu;
     push @iface_config, "alias $alias" if $alias;
     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};

diff --git a/PVE/Network/SDN/Zones/VxlanPlugin.pm b/PVE/Network/SDN/Zones/VxlanPlugin.pm
index b3ed05f15e3da529e9f998ddac1e992f7017e9b1..bc585c660d016ebb4e668a8d4644051b46ef233e 100644 (file)
--- a/PVE/Network/SDN/Zones/VxlanPlugin.pm
+++ b/PVE/Network/SDN/Zones/VxlanPlugin.pm
@@ -82,6 +82,10 @@ sub generate_sdn_config {
     push @iface_config, "bridge_ports $vxlan_iface";
     push @iface_config, "bridge_stp off";
     push @iface_config, "bridge_fd 0";
+    if($vnet->{vlanaware}) {
+        push @iface_config, "bridge-vlan-aware yes";
+        push @iface_config, "bridge-vids 2-4094";
+    }
     push @iface_config, "mtu $mtu" if $mtu;
     push @iface_config, "alias $alias" if $alias;
     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};