superseded-by:
https://lore.proxmox.com/pve-devel/[email protected]/T/#t
On 2026-09-04 11:38, Hannes Laimer wrote:
> Adds a second DHCP backend, `ebpf`, next to dnsmasq, selectable per
> zone. It aims to replace dnsmasq eventually, for now it is a second
> implementation, which keeps a migration simple. Every zone type can
> enable DHCP through a dropdown selector, `dnsmasq` stays limited to
> simple zones.
>
> The responder is a subsystem of `proxmox-ebpf` [1], Perl reaches it
> through new pve-rs bindings (PVE::RS::SDN::Dhcp), so the pve-network
> patches need the pve-rs of this series.
>
> Currently only supports DHCPv4, but adding v6 is very possible once
> we're happy with the overall design.
>
> # How
> An eBPF program on the ingress of every guest tap parses DHCP requests,
> looks the client MAC up in a mac -> ip+options map and rewrites the
> request into the reply in place, redirected back out of the tap. The
> exchange never reaches the bridge. Everything else, including MACs
> without a map entry, passes untouched, so attaching is a no-op for
> unmanaged MACs.
>
> IPAM is the source of the assignments, the map is a per-node copy of
> the records. Every trigger below runs the same full pass, the plugin
> collects all records of the ebpf zones and the guest interfaces on
> their vnets, the responder diffs both against the kernel state, so
> programs, links and records converge from any starting point:
> - guest start / NIC hotplug / migration: add_dhcp_mapping already
> fires here, before the interface is plugged, a new tap_plug hook of
> the dhcp plugins then attaches the program.
> - mapping create/update/delete through the API: the editing node runs
> it and pokes the node running the guest to do the same through a
> new node endpoint (POST /nodes/{node}/sdn/dhcp-mapping), detached
> from the request. Best effort, an unreachable node catches up on its
> next apply or the guest's next start.
> - SDN apply: also refreshes the programs, a rebuild on a schema change
> is refilled in the same pass, and a zone switching its backend takes
> effect for running guests too.
> - boot: nothing is pinned, the first pass after boot loads the
> programs and fills the map.
>
> Subnets get a `dhcp-lease-time` property, used by both backends,
> dnsmasq keeps handing out infinite leases without it and the responder
> defaults to ten minutes. The responder identifies itself with the
> subnet gateway, so a subnet without one is not served, and it hands out
> IPv4 resolvers only, a v6 one configured on a v4 subnet is left out of
> the answers.
>
> Changes made directly on an external IPAM service are not detectable
> and the per-MAC answers are cached, so they are not picked up on apply
> either, exactly like with dnsmasq today.
>
> The pve-network patches apply on top of the separately posted patch
> pushing ipam API mapping changes to the dhcp backend [2].
>
> pre-build packages are on sani(`packages/ebpf-dhcp-v1`)
>
> since the RFC:
> - every trigger runs the same full pass instead of per-trigger map
> updates, the responder diffs programs, links and records against
> the kernel state, so a schema rebuild is refilled by the pass that
> caused it and a zone switching to ebpf serves its running guests
> - the guest node is poked through a node endpoint, not all nodes
> - the tap plug goes through a hook of the dhcp plugin base
> - the bridge-change paths of guests push their record changes too
> - the records are collected under the macdb lock
> - a v6 resolver on a v4 subnet is left out instead of failing the
> pass, a subnet without a gateway is skipped with a warning
> - dnsmasq honours dhcp-lease-time as well
> - the mapping push endpoint checks the vnet belongs to the zone
>
>
> [1]
> https://lore.proxmox.com/pve-devel/[email protected]/T/#t
>
> [2]
> https://lore.proxmox.com/pve-devel/[email protected]/T/#u
>
>
> proxmox-ebpf:
>
> Hannes Laimer (2):
> dhcp: add per-tap responder BPF program
> dhcp: add responder subsystem
>
> Cargo.toml | 5 +
> debian/control | 6 +-
> src/dhcp/bpf/dhcp.bpf.c | 324 +++++++++++++++++++
> src/dhcp/bpf/types.h | 25 ++
> src/dhcp/mod.rs | 247 +++++++++++++++
> src/dhcp/types.rs | 53 ++++
> src/lib.rs | 3 +
> tests/dhcp.rs | 668 ++++++++++++++++++++++++++++++++++++++++
> 8 files changed, 1330 insertions(+), 1 deletion(-)
> create mode 100644 src/dhcp/bpf/dhcp.bpf.c
> create mode 100644 src/dhcp/bpf/types.h
> create mode 100644 src/dhcp/mod.rs
> create mode 100644 src/dhcp/types.rs
> create mode 100644 tests/dhcp.rs
>
>
> proxmox-perl-rs:
>
> Hannes Laimer (1):
> pve-rs: sdn: add dhcp responder bindings
>
> pve-rs/Cargo.toml | 2 +
> pve-rs/Makefile | 1 +
> pve-rs/debian/control | 2 +
> pve-rs/src/bindings/sdn/dhcp.rs | 81 +++++++++++++++++++++++++++++++++
> pve-rs/src/bindings/sdn/mod.rs | 1 +
> 5 files changed, 87 insertions(+)
> create mode 100644 pve-rs/src/bindings/sdn/dhcp.rs
>
>
> pve-network:
>
> Hannes Laimer (8):
> sdn: ipam: do not cache negative per-MAC answers, lock the write
> sdn: subnets: add dhcp-lease-time property
> sdn: dhcp: only assert a backend's availability for zones using it
> sdn: dhcp: add ebpf plugin
> sdn: zones: attach the dhcp responder on tap plug
> sdn: dhcp: apply mapping edits on the node serving the guest
> sdn: zones: offer dhcp on all zone types, keep dnsmasq simple-only
> tests: cover the ebpf dhcp backend and ipam API mapping pushes
>
> src/PVE/API2/Network/SDN/Ips.pm | 3 +
> src/PVE/API2/Network/SDN/Nodes/Status.pm | 42 +++-
> src/PVE/API2/Network/SDN/Zones.pm | 8 +-
> src/PVE/Network/SDN/Dhcp.pm | 87 +++++++-
> src/PVE/Network/SDN/Dhcp/Dnsmasq.pm | 3 +-
> src/PVE/Network/SDN/Dhcp/Ebpf.pm | 187 ++++++++++++++++++
> src/PVE/Network/SDN/Dhcp/Makefile | 2 +-
> src/PVE/Network/SDN/Dhcp/Plugin.pm | 6 +
> src/PVE/Network/SDN/Ipams.pm | 24 ++-
> src/PVE/Network/SDN/SubnetPlugin.pm | 9 +
> src/PVE/Network/SDN/Zones.pm | 3 +
> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
> src/PVE/Network/SDN/Zones/FaucetPlugin.pm | 1 +
> src/PVE/Network/SDN/Zones/QinQPlugin.pm | 7 +
> src/PVE/Network/SDN/Zones/VlanPlugin.pm | 7 +
> src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 9 +
> src/test/run_test_vnets_blackbox.pl | 231 ++++++++++++++++++++++
> 17 files changed, 619 insertions(+), 11 deletions(-)
> create mode 100644 src/PVE/Network/SDN/Dhcp/Ebpf.pm
>
>
> pve-manager:
>
> Hannes Laimer (1):
> ui: sdn: dhcp backend selector on all zones, expose dhcp options
>
> www/manager6/sdn/SubnetEdit.js | 24 ++++++++++++++++++++++++
> www/manager6/sdn/zones/Base.js | 17 +++++++++++++++++
> www/manager6/sdn/zones/SimpleEdit.js | 11 -----------
> 3 files changed, 41 insertions(+), 11 deletions(-)
>
>
> Summary over all repositories:
> 33 files changed, 2077 insertions(+), 23 deletions(-)
>
