| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Add a new cluster-wide lock for SDN that prevents any changes to the
configuration if the generated lock-token is not provided. It works
by generating and storing a token in sdn/.lock which gets checked by
lock_sdn_config on every invocation. If the lock file exists, then the
lock token has to be supplied in order to make changes to the SDN
configuration.
Lock using the domain lock (`PVE::Cluster::cfs_lock_domain`) and "sdn"
string.
This is mainly a preparation for PDM, where PDM can take the lock and
prevent concurrent modifications to the SDN configuration from other
sources, even across multiple API calls.
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Link: https://lore.proxmox.com/20250729092933.90118-2-g.goller@proxmox.com
[TL: fix tests failing build as unprivileged users by mocking the
cfs_domain_lock method]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
With FRR being recommended it will be pulled in by default if a user
did not manually configured apt to not do that.
This should provide a better UX for SDN on older systems that get
upgraded, for new installations we set up FRR already anyway.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Fixes: 98f4d75 ("split into implementation and API endpoint packages")
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
We call perlmod rust functions directly from pve-network.
Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
Link: https://lore.proxmox.com/20250716130837.585796-37-g.goller@proxmox.com
|
|
The is_ovs helper has been moved to pve-common. Update all call sites
to use the new helper in pve-common to determine whether something is
a linux or OVS bridge.
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Reviewed-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
FG: add version bumps
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Ship this systemd unit template in the actual /usr directory, not in
the symlinked ("aliased") /lib one.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Currently pve-network has a (versioned) build-dep of pve-firewall, which has
a (versioned) runtime dependency of a newer version of libpve-network-perl,
which is not available because it has not been built. It turns out that
pve-firewall is only needed in testing, so let's only pull it in if
we don't use the "nocheck" build profile so that we can actually build
pve-network from source.
perl is a build-essential so no need to add it in build-deps.
Fixes: cbc70c81b9a2647a20903b27cabb14c1d6dc6d76
Signed-off-by: Jing Luo <jing@jing.rocks>
Link: https://lore.proxmox.com/mailman.599.1732342430.391.pve-devel@lists.proxmox.com
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Currently, we do not verify the TLS certificate for API requests
external IPAM and DNS integration. This could allow man-in-the-middle
attacks, albeit most IPAM infrastructure is on controlled and isolated
LANs, so it's not something that should frequently happen; and
technically our IPAM integration is still marked as tech-preview,
which had its reasons.
Enforce verification, and allow users to pass a cert SHA256
fingerprint to ensure a certificates validity if it's not trusted by
the system trust store, as it's, e.g., the case for self-signed certs.
The code was adapted from the one in pve-apiclient, which we cannot
reuse directly as it is only implemented for requests against PVE
nodes, not as a generic HTTP client request helper.
Add the new dependency `libio-socket-ssl-perl` required to get the
verify callback for the TLS certificate used for cert-fingerprint
checking.
Signed-off-by: Hannes Duerr <h.duerr@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
[TL: return valid for non-leaf certs and rewrite commit message]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
failing a package-install does not help repairing the situation - so
inform the user about the issue instead of erroring out. The copy
could fail if a node is not quorate, so writes in /etc/pve are a bit
more likely to fail
adapts the change introduced in
d0628df ("debian: migrate legacy mac/ipam cache/state files")
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
We opted for a simple copy of the legacy file to the new location,
since any other migration path would be too strenuous. The worst-case
scenario of failures with this approach is losing IPAM / MAC entries
that are created during the update window in the legacy files by nodes
that are not yet updated to the new version. Those can be fixed by a
simple start / stop of the affected VMs, triggering a rewrite of the
IPAM database.
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
[ TL: output message if files get moved and add todo-comment ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
We mount the per-vnet firewall API endpoints here now, as we split api
and implementation we can avoid a cyclic dependency.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
To ensure 'sdn/mac-cache.json' is available as observed file.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
This is not yet marked as released as the bump was mostly done to
allow testing with correct version for the package split's
break/replaces.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
To better handle the case where firewall requires to parse the SDN
config and this package here would like to mount some vnet specific
firewall endpoints, without a split we got a cyclic dependency here,
and those are painful, especially on bootstrapping.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
to ensure 'sdn/pve-ipam-state.json' is in the list of observed files
for version tracking and direct IPC get-config availability through
pmxcfs.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
For mocking RPCEnvironment in sbuild.
Signed-off-by: Stefan Lendl <s.lendl@proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
|
|
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
|
|
avoid pulling FRR in on upgrade if we'd hard-depend on
libpve-network-perl for all those systems that kept the default
install-recommends enabled as FRR is a bit involved and might announce
stuff and break some network environments if not correctly configured.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
The plugin creates a dnsmasq@<zone> service that spawns a dnsmasq
instance that handles dhcp for that zone.
The configuration files for a dnsmasq instance lie within
/etc/dnsmasq.d/<zone>
The plugin generates the following configuration files:
* 00-default.conf
Contains the default global configuration for dnsmasq. Disables DNS,
enables some specific options for Windows, does some
security-related configuration and makes dnsmasq bind only to the
interfaces it is responsible for
* 10-<subnet>.conf
Contains the default settings for a subnet. Sets dhcp options for
DNS and gateway.
* 10-<subnet>.ranges.conf
Contains the configuration of DHCP ranges for a subnet.
* ethers
Contains the MAC address to IP mappings for a zone.
Every subnet gets assigned a tag in the dnsmasq configuration that is
equal to the subnet_id. This can be used to override / set additional
configuration options on a per-subnet basis.
Additionally it creates the file /etc/default/dnsmasq.<zone> that
provides default options for the dnsmasq service.
Leases are stored in /var/lib/misc/dnsmasq.<zone>.
Co-Authored-By: Alexandre Derumier <aderumier@odiso.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
|
