4:33 a.m.
I have not had any feedback, but have been using this myself and
it works very nicely for me. I have updated the patch series to
allow vlans to be specified in network/portgroup definitions and
that functionality is working well.
All feedback gratefully received.
Description
-----------
The iproute2 bridge command supports the capability for VLAN filtering
that allows each interface connected to a standard linux bridge to be
configured to use one or more VLANs. For simple setups, this capability
is enough to allow virtual machines or containers to be put onto
separate VLANs without creating multiple bridges and VLANs on the host.
The first patch adds a new function virNetDevBridgeSetupVlans() that
will, given a virNetDevVlan structure, execute the required bridge vlan
commands to configure the given interface accordingly.
The second patch updates the virNetDevBridgeAddPort() function to allow
a virNetDevVlan parameter to be passed, and to call the
virNetDevBridgeSetupVlans() function.
The third patch updates the lxc and tap code to pass the virNetDevLan
parameter from the configuration and to update the XML domain and
network validation to permit the VLAN-related tags for standard
bridges.
The fourth patch updates documentation to match the new capability.
Changes since v1
----------------
- Fix bug in virNetDevSetupVlans where bridge port has no native vlan.
- Update bridge network validation to permit vlan configuration.
- Update documentation to match the functionality.
- Tweak some of the commit descriptions for clarity.
Usage example
-------------
Configure the host with systemd-networkd as follows:
/etc/systemd/network/br0.netdev (br0.network not shown)
[NetDev]
Name=br0
Kind=bridge
MACAddress=xx:xx:xx:xx:xx:xx
[Bridge]
VLANFiltering=on
/etc/systemd/network/eno1.network
[Match]
Name=eno1
[Network]
Bridge=br0
[Link]
MTUBytes=9000
[BridgeVLAN]
VLAN=40
[BridgeVLAN]
VLAN=60
Then add <vlan> tags into the lxc or qemu config:
lxc interface definition:
<interface type='bridge'>
<mac address='xx:xx:xx:xx:xx:xx'/>
<source bridge='br0'/>
<vlan>
<tag id='40'/>
</vlan>
</interface>
qemu interface definition:
<interface type='network'>
<mac address='xx:xx:xx:xx:xx:xx'/>
<source network='br0'/>
<vlan>
<tag id='60'/>
</vlan>
<model type='virtio'/>
<address type='pci' domain='0x0000'
bus='0x01' slot='0x00' function='0x0'/>
</interface>
Then, after starting them, you will see the following
$ sudo bridge vlan
port vlan-id
eno1 1 PVID Egress Untagged
40
60
br0 1 PVID Egress Untagged
vnet0 60 PVID Egress Untagged
vnet1 40 PVID Egress Untagged
Regards,
Leigh Brown (4):
util: Add virNetDevBridgeSetupVlans function
util: Add vlan support to virNetDevBridgeAddPort
Enable vlan support for standard linux bridges
docs: standard linux bridges now support vlans
docs/formatdomain.rst | 37 ++++++++++----------
docs/formatnetwork.rst | 45 ++++++++++++------------
meson.build | 1 +
src/conf/domain_validate.c | 3 +-
src/lxc/lxc_process.c | 3 +-
src/network/bridge_driver.c | 13 ++++---
src/util/virnetdevbridge.c | 68 ++++++++++++++++++++++++++++++++++---
src/util/virnetdevbridge.h | 4 ++-
src/util/virnetdevtap.c | 2 +-
9 files changed, 123 insertions(+), 53 deletions(-)
--
2.39.5
4:33 a.m.
New subject: [RFC v2 PATCH 1/4] util: Add virNetDevBridgeSetupVlans function
In preparation for adding vlan support using iproute2 bridge vlan
functionality, add the virNetDevBridgeSetupVlans function that
configures a bridge interface using the passed virNetDevVlan
struct.
Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk>
---
meson.build | 1 +
src/util/virnetdevbridge.c | 57 ++++++++++++++++++++++++++++++++++++++
2 files changed, 58 insertions(+)
diff --git a/meson.build b/meson.build
index ca1b915737..39c01ebeef 100644
--- a/meson.build
+++ b/meson.build
@@ -857,6 +857,7 @@ optional_programs = [
'ovs-vsctl',
'rmmod',
'tc',
+ 'bridge',
] + optional_test_programs
missing_optional_programs = []
diff --git a/src/util/virnetdevbridge.c b/src/util/virnetdevbridge.c
index 5fd88f3195..353f95b040 100644
--- a/src/util/virnetdevbridge.c
+++ b/src/util/virnetdevbridge.c
@@ -24,6 +24,7 @@
#include "virfile.h"
#include "virlog.h"
#include "virstring.h"
+#include "vircommand.h"
#ifdef WITH_NET_IF_H
# include <net/if.h>
@@ -379,8 +380,64 @@ virNetDevBridgePortSetIsolated(const char *brname G_GNUC_UNUSED,
_("Unable to set bridge port isolated on this
platform"));
return -1;
}
+
#endif
+static int
+virNetDevBridgeSetupVlans(const char *ifname, const virNetDevVlan *virtVlan)
+{
+ g_autoptr(virCommand) cmd = NULL;
+
+ if (!virtVlan || !virtVlan->nTags)
+ return 0;
+
+ // The interface will have been automatically added to vlan 1, so remove it
+ cmd = virCommandNewArgList(BRIDGE, "vlan", "delete",
+ "dev", ifname, "vid",
"1", NULL);
+ if (virCommandRun(cmd, NULL) < 0)
+ return -1;
+
+ // If trunk mode, add the native VLAN then add any others
+ if (virtVlan->trunk) {
+ size_t i;
+
+ if (virtVlan->nativeTag) {
+ virCommandFree(cmd);
+ cmd = virCommandNewArgList(BRIDGE, "vlan", "add",
+ "dev", ifname, "vid", NULL);
+ virCommandAddArgFormat(cmd, "%d", virtVlan->nativeTag);
+ virCommandAddArg(cmd, "pvid");
+ if (virtVlan->nativeMode == VIR_NATIVE_VLAN_MODE_UNTAGGED ||
+ virtVlan->nativeMode == VIR_NATIVE_VLAN_MODE_DEFAULT)
+ virCommandAddArg(cmd, "untagged");
+ if (virCommandRun(cmd, NULL) < 0)
+ return -1;
+ }
+
+ for (i = 0; i < virtVlan->nTags; i++) {
+ if (virtVlan->tag[i] != virtVlan->nativeTag) {
+ virCommandFree(cmd);
+ cmd = virCommandNewArgList(BRIDGE, "vlan", "add",
+ "dev", ifname, "vid",
NULL);
+ virCommandAddArgFormat(cmd, "%d", virtVlan->tag[i]);
+ if (virCommandRun(cmd, NULL) < 0)
+ return -1;
+ }
+ }
+ } else {
+ // In native mode, add the single VLAN as pvid untagged
+ virCommandFree(cmd);
+ cmd = virCommandNewArgList(BRIDGE, "vlan", "add",
+ "dev", ifname, "vid", NULL);
+ virCommandAddArgFormat(cmd, "%d", virtVlan->tag[0]);
+ virCommandAddArgList(cmd, "pvid", "untagged", NULL);
+ if (virCommandRun(cmd, NULL) < 0)
+ return -1;
+ }
+
+ return 0;
+}
+
/**
* virNetDevBridgeCreate:
--
2.39.5
4:33 a.m.
New subject: [RFC v2 PATCH 2/4] util: Add vlan support to virNetDevBridgeAddPort
Add virVlan parameter to the Linux version of the
virNetDevBridgeAddPort function. Update the function to call
virNetDevBridgeSetupVlans to run the appropriate iproute2
bridge vlan commands to set up the required vlan configuration.
Update callers of this function to pass NULL for now.
Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk>
---
src/lxc/lxc_process.c | 2 +-
src/util/virnetdevbridge.c | 11 +++++++----
src/util/virnetdevbridge.h | 4 +++-
src/util/virnetdevtap.c | 2 +-
4 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
index cd8bcfc282..2a91896328 100644
--- a/src/lxc/lxc_process.c
+++ b/src/lxc/lxc_process.c
@@ -290,7 +290,7 @@ virLXCProcessSetupInterfaceTap(virDomainDef *vm,
vport, virDomainNetGetActualVlan(net)) <
0)
return NULL;
} else {
- if (virNetDevBridgeAddPort(brname, parentVeth) < 0)
+ if (virNetDevBridgeAddPort(brname, parentVeth, NULL) < 0)
return NULL;
if (virDomainNetGetActualPortOptionsIsolated(net) == VIR_TRISTATE_BOOL_YES
&&
diff --git a/src/util/virnetdevbridge.c b/src/util/virnetdevbridge.c
index 353f95b040..7d7440e7ab 100644
--- a/src/util/virnetdevbridge.c
+++ b/src/util/virnetdevbridge.c
@@ -650,7 +650,8 @@ int virNetDevBridgeDelete(const char *brname G_GNUC_UNUSED)
*/
#if defined(WITH_STRUCT_IFREQ) && defined(SIOCBRADDIF)
int virNetDevBridgeAddPort(const char *brname,
- const char *ifname)
+ const char *ifname,
+ const virNetDevVlan *virtVlan)
{
struct ifreq ifr;
VIR_AUTOCLOSE fd = -1;
@@ -670,11 +671,12 @@ int virNetDevBridgeAddPort(const char *brname,
return -1;
}
- return 0;
+ return virNetDevBridgeSetupVlans(ifname, virtVlan);
}
#elif defined(WITH_BSD_BRIDGE_MGMT)
int virNetDevBridgeAddPort(const char *brname,
- const char *ifname)
+ const char *ifname,
+ const virNetDevVlan *virtVlan)
{
struct ifbreq req = { 0 };
@@ -695,7 +697,8 @@ int virNetDevBridgeAddPort(const char *brname,
}
#else
int virNetDevBridgeAddPort(const char *brname,
- const char *ifname)
+ const char *ifname,
+ const virNetDevVlan *virtVlan)
{
virReportSystemError(ENOSYS,
_("Unable to add bridge %1$s port %2$s"), brname,
ifname);
diff --git a/src/util/virnetdevbridge.h b/src/util/virnetdevbridge.h
index db4099bf0b..5f51656abe 100644
--- a/src/util/virnetdevbridge.h
+++ b/src/util/virnetdevbridge.h
@@ -20,6 +20,7 @@
#include "internal.h"
#include "virmacaddr.h"
+#include "virnetdevvlan.h"
int virNetDevBridgeCreate(const char *brname,
const virMacAddr *mac)
@@ -28,7 +29,8 @@ int virNetDevBridgeDelete(const char *brname)
ATTRIBUTE_NONNULL(1) G_GNUC_WARN_UNUSED_RESULT;
int virNetDevBridgeAddPort(const char *brname,
- const char *ifname)
+ const char *ifname,
+ const virNetDevVlan *virtVlan)
ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT;
int virNetDevBridgeRemovePort(const char *brname,
diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c
index 2701ba6dfc..a9573eb8e1 100644
--- a/src/util/virnetdevtap.c
+++ b/src/util/virnetdevtap.c
@@ -483,7 +483,7 @@ virNetDevTapAttachBridge(const char *tapname,
return -1;
}
} else {
- if (virNetDevBridgeAddPort(brname, tapname) < 0)
+ if (virNetDevBridgeAddPort(brname, tapname, NULL) < 0)
return -1;
if (isolatedPort == VIR_TRISTATE_BOOL_YES &&
--
2.39.5
4:33 a.m.
New subject: [RFC v2 PATCH 3/4] Enable vlan support for standard linux bridges
Adjust domain and network validation to permit standard linux bridges
to allow vlan configuration.
Update calls to virNetDevBridgeAddPort to pass the vlan configuration.
Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk>
---
src/conf/domain_validate.c | 3 ++-
src/lxc/lxc_process.c | 3 ++-
src/network/bridge_driver.c | 13 ++++++++-----
src/util/virnetdevtap.c | 2 +-
4 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 1034bb57f5..c7a79a0277 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -2077,7 +2077,8 @@ virDomainActualNetDefValidate(const virDomainNetDef *net)
(actualType == VIR_DOMAIN_NET_TYPE_DIRECT &&
virDomainNetGetActualDirectMode(net) == VIR_NETDEV_MACVLAN_MODE_PASSTHRU)
||
(actualType == VIR_DOMAIN_NET_TYPE_BRIDGE &&
- vport && vport->virtPortType ==
VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH))) {
+ vport && vport->virtPortType ==
VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH) ||
+ (actualType == VIR_DOMAIN_NET_TYPE_BRIDGE && !vport))) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("interface %1$s - vlan tag not supported for this
connection type"),
macstr);
diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
index 2a91896328..7c8dc703ca 100644
--- a/src/lxc/lxc_process.c
+++ b/src/lxc/lxc_process.c
@@ -290,7 +290,8 @@ virLXCProcessSetupInterfaceTap(virDomainDef *vm,
vport, virDomainNetGetActualVlan(net)) <
0)
return NULL;
} else {
- if (virNetDevBridgeAddPort(brname, parentVeth, NULL) < 0)
+ if (virNetDevBridgeAddPort(brname, parentVeth,
+ virDomainNetGetActualVlan(net)) < 0)
return NULL;
if (virDomainNetGetActualPortOptionsIsolated(net) == VIR_TRISTATE_BOOL_YES
&&
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index e700a614a9..7ce943aabc 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -2997,7 +2997,8 @@ networkValidate(virNetworkDriverState *driver,
/* The only type of networks that currently support transparent
* vlan configuration are those using hostdev sr-iov devices from
- * a pool, and those using an Open vSwitch bridge.
+ * a pool, those using an Open vSwitch bridge, and standard linux
+ * bridges.
*/
vlanAllowed = (def->forward.type == VIR_NETWORK_FORWARD_HOSTDEV ||
@@ -3005,15 +3006,17 @@ networkValidate(virNetworkDriverState *driver,
(def->forward.type == VIR_NETWORK_FORWARD_BRIDGE &&
def->virtPortProfile &&
def->virtPortProfile->virtPortType
- == VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH));
+ == VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH) ||
+ (def->forward.type == VIR_NETWORK_FORWARD_BRIDGE &&
+ !def->virtPortProfile));
vlanUsed = def->vlan.nTags > 0;
for (i = 0; i < def->nPortGroups; i++) {
if (vlanUsed || def->portGroups[i].vlan.nTags > 0) {
/* anyone using this portgroup will get a vlan tag. Verify
- * that they will also be using an openvswitch connection,
- * as that is the only type of network that currently
- * supports a vlan tag.
+ * that they will also be using an openvswitch connection
+ * or a standard linux bridge as they are the only types of
+ * network that currently support a vlan tag.
*/
if (def->portGroups[i].virtPortProfile) {
if (def->forward.type != VIR_NETWORK_FORWARD_BRIDGE ||
diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c
index a9573eb8e1..1dc77f0f5c 100644
--- a/src/util/virnetdevtap.c
+++ b/src/util/virnetdevtap.c
@@ -483,7 +483,7 @@ virNetDevTapAttachBridge(const char *tapname,
return -1;
}
} else {
- if (virNetDevBridgeAddPort(brname, tapname, NULL) < 0)
+ if (virNetDevBridgeAddPort(brname, tapname, virtVlan) < 0)
return -1;
if (isolatedPort == VIR_TRISTATE_BOOL_YES &&
--
2.39.5
4:33 a.m.
New subject: [RFC v2 PATCH 4/4] docs: standard linux bridges now support vlans
Update domain XML and network XML documentation to describe how
standard linux bridges support the VLAN configuration.
Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk>
---
docs/formatdomain.rst | 37 +++++++++++++++++-----------------
docs/formatnetwork.rst | 45 +++++++++++++++++++++---------------------
2 files changed, 42 insertions(+), 40 deletions(-)
diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index 60bee8bd4f..b5cd319bf0 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -6036,28 +6036,29 @@ VLAN tags to apply to the guest's network traffic
:since:`Since 0.10.0`.
Network connections that support guest-transparent VLAN tagging include
``type='bridge'`` interfaces connected to an Open vSwitch bridge, SRIOV
-Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment)
-and, :since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
-``mode='passthrough'`` (macvtap "passthru" mode). All other
-connection types, including standard linux bridges and libvirt's own virtual
+Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment),
+:since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
+``mode='passthrough'`` (macvtap "passthru" mode) and, :since:`since
11.0.0`
+standard linux bridges. Other connection types, including libvirt's own virtual
networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA) switches
provide their own way (outside of libvirt) to tag guest traffic onto a specific
VLAN. Each tag is given in a separate ``<tag>`` subelement of ``<vlan>``
(for
example: ``<tag id='42'/>``). For VLAN trunking of multiple tags (which is
-supported only on Open vSwitch connections), multiple ``<tag>`` subelements can
-be specified, which implies that the user wants to do VLAN trunking on the
-interface for all the specified tags. In the case that VLAN trunking of a single
-tag is desired, the optional attribute ``trunk='yes'`` can be added to the
-toplevel ``<vlan>`` element to differentiate trunking of a single tag from
-normal tagging.
-
-For network connections using Open vSwitch it is also possible to configure
-'native-tagged' and 'native-untagged' VLAN modes :since:`Since 1.1.0`.
This is
-done with the optional ``nativeMode`` attribute on the ``<tag>`` subelement:
-``nativeMode`` may be set to 'tagged' or 'untagged'. The ``id`` attribute
of the
-``<tag>`` subelement containing ``nativeMode`` sets which VLAN is considered to
-be the "native" VLAN for this interface, and the ``nativeMode`` attribute
-determines whether or not traffic for that VLAN will be tagged.
+supported on Open vSwitch connections and standard linux bridges), multiple
+``<tag>`` subelements can be specified, which implies that the user wants to do
+VLAN trunking on the interface for all the specified tags. In the case that VLAN
+trunking of a single tag is desired, the optional attribute ``trunk='yes'`` can
+be added to the toplevel ``<vlan>`` element to differentiate trunking of a
+single tag from normal tagging.
+
+For network connections using Open vSwitch and standard linux bridges it is also
+possible to configure 'native-tagged' and 'native-untagged' VLAN modes
+:since:`Since 1.1.0`. This is done with the optional ``nativeMode`` attribute on
+the ``<tag>`` subelement: ``nativeMode`` may be set to 'tagged' or
'untagged'.
+The ``id`` attribute of the ``<tag>`` subelement containing ``nativeMode`` sets
+which VLAN is considered to be the "native" VLAN for this interface, and the
+``nativeMode`` attribute determines whether or not traffic for that VLAN will be
+tagged.
Isolating guests' network traffic from each other
diff --git a/docs/formatnetwork.rst b/docs/formatnetwork.rst
index 9b4ecbf31d..053fe6ad56 100644
--- a/docs/formatnetwork.rst
+++ b/docs/formatnetwork.rst
@@ -520,28 +520,29 @@ VLAN tags to apply to the guest's network traffic :since:`Since
0.10.0`.
Network connections that support guest-transparent VLAN tagging include
``type='bridge'`` interfaces connected to an Open vSwitch bridge, SRIOV
-Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment)
-and, :since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
-``mode='passthrough'`` (macvtap "passthru" mode). All other
-connection types, including standard linux bridges and libvirt's own virtual
-networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA) switches
-provide their own way (outside of libvirt) to tag guest traffic onto a specific
-VLAN. Each tag is given in a separate ``<tag>`` subelement of ``<vlan>``
(for
-example: ``<tag id='42'/>``). For VLAN trunking of multiple tags (which is
-supported only on Open vSwitch connections), multiple ``<tag>`` subelements can
-be specified, which implies that the user wants to do VLAN trunking on the
-interface for all the specified tags. In the case that VLAN trunking of a single
-tag is desired, the optional attribute ``trunk='yes'`` can be added to the
-toplevel ``<vlan>`` element to differentiate trunking of a single tag from
-normal tagging.
-
-For network connections using Open vSwitch it is also possible to configure
-'native-tagged' and 'native-untagged' VLAN modes :since:`Since 1.1.0`.
This is
-done with the optional ``nativeMode`` attribute on the ``<tag>`` subelement:
-``nativeMode`` may be set to 'tagged' or 'untagged'. The ``id`` attribute
of the
-``<tag>`` subelement containing ``nativeMode`` sets which VLAN is considered to
-be the "native" VLAN for this interface, and the ``nativeMode`` attribute
-determines whether or not traffic for that VLAN will be tagged.
+Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment),
+:since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
+``mode='passthrough'`` (macvtap "passthru" mode) and, :since:`since
11.0.0`,
+standard linux bridges. All other connection types, including libvirt's own
+virtual networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA)
+switches provide their own way (outside of libvirt) to tag guest traffic onto a
+specific VLAN. Each tag is given in a separate ``<tag>`` subelement of
+``<vlan>`` (for example: ``<tag id='42'/>``). For VLAN trunking of
multiple
+tags (which is supported on Open vSwitch connections and standard linux
+bridges), multiple ``<tag>`` subelements can be specified, which implies that
+the user wants to do VLAN trunking on the interface for all the specified tags.
+In the case that VLAN trunking of a single tag is desired, the optional
+attribute ``trunk='yes'`` can be added to the toplevel ``<vlan>`` element
to
+differentiate trunking of a single tag from normal tagging.
+
+For network connections using Open vSwitch :since:`since 1.1.10` and standard
+linux bridges :since:`since 11.0.0` it is also possible to configure
+'native-tagged' and 'native-untagged' VLAN modes. This is done with the
optional
+``nativeMode`` attribute on the ``<tag>`` subelement: ``nativeMode`` may be set
+to 'tagged' or 'untagged'. The ``id`` attribute of the ``<tag>``
subelement
+containing ``nativeMode`` sets which VLAN is considered to be the "native"
VLAN
+for this interface, and the ``nativeMode`` attribute determines whether or not
+traffic for that VLAN will be tagged.
``<vlan>`` elements can also be specified in a ``<portgroup>`` element, as
well
as directly in a domain's ``<interface>`` element. In the case that a vlan tag
--
2.39.5
1:05 a.m.
On 12/20/24 5:33 AM, Leigh Brown wrote:
I have not had any feedback, but have been using this myself and
it works very nicely for me. I have updated the patch series to
allow vlans to be specified in network/portgroup definitions and
that functionality is working well.
All feedback gratefully received.
Sorry, I meant to go through your patches last week but haven't had the
time yet.
Before I get to that, I have 2 general comments:
1) I'm *really* happy to see that someone has taken this on. It's
something I've wanted to do (or have done) for several years (ever since
I heard that the Linux host bridge added vlan support, which was many
years ago!), but I don't use VLANs myself, and haven't had any concrete
demand for it, so I'd pretty much forgotten about it.
2) Rather than having virNetDevBridgeSetupVlans() exec the "bridge"
utility, it would be much preferred if we could use netlink requests
instead. A couple examples of using netlink to set something on an
interface:
* src/util/virnetdevbridge.c:virNetDevBridgeFDBAddDel()
* src/util/virnetdevip.c:virNetDevIPRouteAdd()
but there are several others.
I'll try to look at the rest of it on Monday.
Description
-----------
The iproute2 bridge command supports the capability for VLAN filtering
that allows each interface connected to a standard linux bridge to be
configured to use one or more VLANs. For simple setups, this capability
is enough to allow virtual machines or containers to be put onto
separate VLANs without creating multiple bridges and VLANs on the host.
The first patch adds a new function virNetDevBridgeSetupVlans() that
will, given a virNetDevVlan structure, execute the required bridge vlan
commands to configure the given interface accordingly.
The second patch updates the virNetDevBridgeAddPort() function to allow
a virNetDevVlan parameter to be passed, and to call the
virNetDevBridgeSetupVlans() function.
The third patch updates the lxc and tap code to pass the virNetDevLan
parameter from the configuration and to update the XML domain and
network validation to permit the VLAN-related tags for standard
bridges.
The fourth patch updates documentation to match the new capability.
Changes since v1
----------------
- Fix bug in virNetDevSetupVlans where bridge port has no native vlan.
- Update bridge network validation to permit vlan configuration.
- Update documentation to match the functionality.
- Tweak some of the commit descriptions for clarity.
Usage example
-------------
Configure the host with systemd-networkd as follows:
/etc/systemd/network/br0.netdev (br0.network not shown)
[NetDev]
Name=br0
Kind=bridge
MACAddress=xx:xx:xx:xx:xx:xx
[Bridge]
VLANFiltering=on
/etc/systemd/network/eno1.network
[Match]
Name=eno1
[Network]
Bridge=br0
[Link]
MTUBytes=9000
[BridgeVLAN]
VLAN=40
[BridgeVLAN]
VLAN=60
Then add <vlan> tags into the lxc or qemu config:
lxc interface definition:
<interface type='bridge'>
<mac address='xx:xx:xx:xx:xx:xx'/>
<source bridge='br0'/>
<vlan>
<tag id='40'/>
</vlan>
</interface>
qemu interface definition:
<interface type='network'>
<mac address='xx:xx:xx:xx:xx:xx'/>
<source network='br0'/>
<vlan>
<tag id='60'/>
</vlan>
<model type='virtio'/>
<address type='pci' domain='0x0000'
bus='0x01' slot='0x00' function='0x0'/>
</interface>
Then, after starting them, you will see the following
$ sudo bridge vlan
port vlan-id
eno1 1 PVID Egress Untagged
40
60
br0 1 PVID Egress Untagged
vnet0 60 PVID Egress Untagged
vnet1 40 PVID Egress Untagged
Regards,
Leigh Brown (4):
util: Add virNetDevBridgeSetupVlans function
util: Add vlan support to virNetDevBridgeAddPort
Enable vlan support for standard linux bridges
docs: standard linux bridges now support vlans
docs/formatdomain.rst | 37 ++++++++++----------
docs/formatnetwork.rst | 45 ++++++++++++------------
meson.build | 1 +
src/conf/domain_validate.c | 3 +-
src/lxc/lxc_process.c | 3 +-
src/network/bridge_driver.c | 13 ++++---
src/util/virnetdevbridge.c | 68 ++++++++++++++++++++++++++++++++++---
src/util/virnetdevbridge.h | 4 ++-
src/util/virnetdevtap.c | 2 +-
9 files changed, 123 insertions(+), 53 deletions(-)
5
days inactive
7
days old
5 comments
2 participants
participants (2)
-
Laine Stump -
Leigh Brown