bond: T8023: validate member interface min/max MTU

smoketest/config-tests/bgp-evpn-l2vpn-leaf

@@ -6,13 +6,10 @@ set interfaces ethernet eth0 address '192.0.2.41/27'
 set interfaces ethernet eth0 description 'Out-of-Band Managament Port'
 set interfaces ethernet eth0 vrf 'MGMT'
 set interfaces ethernet eth1 address '172.29.1.1/31'
-set interfaces ethernet eth1 mtu '1600'
 set interfaces ethernet eth2 address '172.29.2.1/31'
-set interfaces ethernet eth2 mtu '1600'
 set interfaces ethernet eth2 offload gro
 set interfaces ethernet eth3 offload gro
 set interfaces loopback lo
-set interfaces vxlan vxlan100 mtu '1500'
 set interfaces vxlan vxlan100 parameters nolearning
 set interfaces vxlan vxlan100 port '8472'
 set interfaces vxlan vxlan100 source-address '172.29.0.1'

smoketest/config-tests/bgp-evpn-l2vpn-spine

@@ -3,12 +3,9 @@ set interfaces ethernet eth0 address '2001:db8::51/64'
 set interfaces ethernet eth0 description 'Out-of-Band Managament Port'
 set interfaces ethernet eth0 vrf 'MGMT'
 set interfaces ethernet eth1 address '172.29.1.0/31'
-set interfaces ethernet eth1 mtu '1600'
 set interfaces ethernet eth2 address '172.29.1.2/31'
-set interfaces ethernet eth2 mtu '1600'
 set interfaces ethernet eth2 offload gro
 set interfaces ethernet eth3 address '172.29.1.4/31'
-set interfaces ethernet eth3 mtu '1600'
 set interfaces ethernet eth3 offload gro
 set interfaces loopback lo
 set protocols bgp address-family ipv4-unicast maximum-paths ibgp '4'

smoketest/config-tests/bgp-evpn-l3vpn-pe-router

@@ -21,13 +21,11 @@ set interfaces ethernet eth0 offload gro
 set interfaces ethernet eth0 vrf 'mgmt'
 set interfaces ethernet eth1 address '172.29.0.2/31'
 set interfaces ethernet eth1 description 'link to pe2'
-set interfaces ethernet eth1 mtu '1600'
 set interfaces ethernet eth1 offload gro
 set interfaces ethernet eth2 disable
 set interfaces ethernet eth2 offload gro
 set interfaces ethernet eth3 address '172.29.0.6/31'
 set interfaces ethernet eth3 description 'link to pe3'
-set interfaces ethernet eth3 mtu '1600'
 set interfaces ethernet eth3 offload gro
 set interfaces ethernet eth4 description 'customer blue'
 set interfaces ethernet eth4 offload gro
@@ -36,17 +34,14 @@ set interfaces ethernet eth5 offload gro
 set interfaces ethernet eth6 description 'customer green'
 set interfaces ethernet eth6 offload gro
 set interfaces loopback lo
-set interfaces vxlan vxlan2000 mtu '1500'
 set interfaces vxlan vxlan2000 parameters nolearning
 set interfaces vxlan vxlan2000 port '4789'
 set interfaces vxlan vxlan2000 source-address '172.29.255.1'
 set interfaces vxlan vxlan2000 vni '2000'
-set interfaces vxlan vxlan3000 mtu '1500'
 set interfaces vxlan vxlan3000 parameters nolearning
 set interfaces vxlan vxlan3000 port '4789'
 set interfaces vxlan vxlan3000 source-address '172.29.255.1'
 set interfaces vxlan vxlan3000 vni '3000'
-set interfaces vxlan vxlan4000 mtu '1500'
 set interfaces vxlan vxlan4000 parameters nolearning
 set interfaces vxlan vxlan4000 port '4789'
 set interfaces vxlan vxlan4000 source-address '172.29.255.1'

smoketest/config-tests/dialup-router-medium-vpn

@@ -23,13 +23,11 @@ set high-availability vrrp group LAN priority '200'
 set high-availability vrrp group LAN vrid '1'
 set high-availability vrrp sync-group failover-group member 'LAN'
 set interfaces ethernet eth0 duplex 'auto'
-set interfaces ethernet eth0 mtu '9000'
 set interfaces ethernet eth0 offload gro
 set interfaces ethernet eth0 speed 'auto'
 set interfaces ethernet eth1 address '192.168.0.250/24'
 set interfaces ethernet eth1 duplex 'auto'
 set interfaces ethernet eth1 ip source-validation 'strict'
-set interfaces ethernet eth1 mtu '9000'
 set interfaces ethernet eth1 offload gro
 set interfaces ethernet eth1 speed 'auto'
 set interfaces loopback lo
@@ -102,7 +100,7 @@ set interfaces openvpn vtun2 tls auth-key 'openvpn_vtun2_auth'
 set interfaces openvpn vtun2 tls ca-certificate 'openvpn_vtun2_1'
 set interfaces pppoe pppoe0 authentication password 'password'
 set interfaces pppoe pppoe0 authentication username 'vyos'
-set interfaces pppoe pppoe0 mtu '1500'
+set interfaces pppoe pppoe0 mtu '1400'
 set interfaces pppoe pppoe0 source-interface 'eth0'
 set interfaces wireguard wg0 address '192.168.10.1/24'
 set interfaces wireguard wg0 ip adjust-mss '1380'

smoketest/configs/bgp-evpn-l2vpn-leaf

@@ -18,18 +18,15 @@ interfaces {
     }
     ethernet eth1 {
         address 172.29.1.1/31
-        mtu 1600
     }
     ethernet eth2 {
         address 172.29.2.1/31
-        mtu 1600
     }
     ethernet eth3 {
     }
     loopback lo {
     }
     vxlan vxlan100 {
-        mtu 1500
         parameters {
             nolearning
         }

smoketest/configs/bgp-evpn-l2vpn-spine

@@ -7,15 +7,12 @@ interfaces {
     }
     ethernet eth1 {
         address 172.29.1.0/31
-        mtu 1600
     }
     ethernet eth2 {
         address 172.29.1.2/31
-        mtu 1600
     }
     ethernet eth3 {
         address 172.29.1.4/31
-        mtu 1600
     }
     loopback lo {
     }

smoketest/configs/bgp-evpn-l3vpn-pe-router

@@ -44,15 +44,13 @@ interfaces {
     ethernet eth1 {
         address 172.29.0.2/31
         description "link to pe2"
-        mtu 1600
     }
     ethernet eth2 {
         disable
     }
     ethernet eth3 {
         address 172.29.0.6/31
         description "link to pe3"
-        mtu 1600
     }
     ethernet eth4 {
         description "customer blue"
@@ -66,7 +64,6 @@ interfaces {
     loopback lo {
     }
     vxlan vxlan2000 {
-        mtu 1500
         parameters {
             nolearning
         }
@@ -75,7 +72,6 @@ interfaces {
         vni 2000
     }
     vxlan vxlan3000 {
-        mtu 1500
         parameters {
             nolearning
         }
@@ -84,7 +80,6 @@ interfaces {
         vni 3000
     }
     vxlan vxlan4000 {
-        mtu 1500
         parameters {
             nolearning
         }

smoketest/configs/dialup-router-medium-vpn

@@ -56,7 +56,6 @@ high-availability {
 interfaces {
     ethernet eth0 {
         duplex auto
-        mtu 9000
         offload-options {
             generic-receive on
             generic-segmentation on
@@ -65,7 +64,7 @@ interfaces {
         }
         pppoe 0 {
             default-route auto
-            mtu 1500
+            mtu 1400
             name-server auto
             password password
             user-id vyos
@@ -80,7 +79,6 @@ interfaces {
         ip {
             source-validation strict
         }
-        mtu 9000
         offload-options {
             generic-receive on
             generic-segmentation on

smoketest/scripts/cli/base_interfaces_test.py

@@ -700,22 +700,25 @@ def test_vif_8021q_mtu_limits(self):
             if not self._test_vlan or not self._test_mtu:
                 self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
-            mtu_1500 = '1500'
-            mtu_9000 = '9000'
+            # Some drivers are limited to an MTU of 1500 byte - e.g. when VyOS
+            # runs on PROXMOX with default bridge settings. We use lower values
+            # for this test which will fit for almost every NIC
+            mtu_1300 = '1300'
+            mtu_1420 = '1420'
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
-                self.cli_set(base + ['mtu', mtu_1500])
+                self.cli_set(base + ['mtu', mtu_1300])
                 for option in self._options.get(interface, []):
                     self.cli_set(base + option.split())
                     if 'source-interface' in option:
                         iface = option.split()[-1]
                         iface_type = Section.section(iface)
-                        self.cli_set(['interfaces', iface_type, iface, 'mtu', mtu_9000])
+                        self.cli_set(['interfaces', iface_type, iface, 'mtu', mtu_1420])
 
                 for vlan in self._vlan_range:
                     base = self._base_path + [interface, 'vif', vlan]
-                    self.cli_set(base + ['mtu', mtu_9000])
+                    self.cli_set(base + ['mtu', mtu_1420])
 
             # check validate() - Interface MTU "9000" too high, parent interface MTU is "1500"!
             with self.assertRaises(ConfigSessionError):
@@ -724,18 +727,18 @@ def test_vif_8021q_mtu_limits(self):
             # Change MTU on base interface to be the same as on the VIF interface
             for interface in self._interfaces:
                 base = self._base_path + [interface]
-                self.cli_set(base + ['mtu', mtu_9000])
+                self.cli_set(base + ['mtu', mtu_1420])
 
             self.cli_commit()
 
             # Verify MTU on base and VIF interfaces
             for interface in self._interfaces:
                 tmp = get_interface_config(interface)
-                self.assertEqual(tmp['mtu'], int(mtu_9000))
+                self.assertEqual(tmp['mtu'], int(mtu_1420))
 
                 for vlan in self._vlan_range:
                     tmp = get_interface_config(f'{interface}.{vlan}')
-                    self.assertEqual(tmp['mtu'], int(mtu_9000))
+                    self.assertEqual(tmp['mtu'], int(mtu_1420))
 
 
         def test_vif_8021q_qos_change(self):

smoketest/scripts/cli/test_interfaces_bonding.py

@@ -334,5 +334,29 @@ def test_bonding_evpn_multihoming(self):
 
             id = int(id) + 1
 
+    def test_bonding_member_mtu(self):
+        # This Smoketest only works on our CI platform where we force the NIC
+        # to virtio and an MTU of only 1500 bytes max
+        if not os.path.exists('/tmp/vyos.smoketests.hint'):
+            self.skipTest('Not running under VyOS CI/CD QEMU environment!')
+
+        for interface in self._interfaces:
+            for option in self._options.get(interface, []):
+                self.cli_set(self._base_path + [interface] + option.split())
+
+            self.cli_set(self._base_path + [interface, 'mtu', '10000'])
+
+        # check validate() - MTU of bond higher then virtio max MTU
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        for interface in self._interfaces:
+            for option in self._options.get(interface, []):
+                self.cli_set(self._base_path + [interface] + option.split())
+
+            self.cli_delete(self._base_path + [interface, 'mtu'])
+
+        self.cli_commit()
+
 if __name__ == '__main__':
     unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())

src/conf_mode/interfaces_bonding.py

@@ -248,6 +248,17 @@ def verify(bond):
                         continue
                     raise ConfigError(error_msg + f'it has a "{option_path.replace(".", " ")}" assigned!')
 
+            if mtu := bond.get('mtu'):
+                mtu = int(mtu)
+                max_mtu = int(EthernetIf(interface).get_max_mtu())
+                min_mtu = int(EthernetIf(interface).get_min_mtu())
+                if mtu > max_mtu:
+                    raise ConfigError('Configured MTU is greater then member '\
+                                      f'interface "{interface}" maximum of {max_mtu}!')
+                if mtu < min_mtu:
+                    raise ConfigError('Configured MTU is less then member '\
+                                      f'interface "{interface}" minimum of {min_mtu}!')
+
     if 'primary' in bond:
         if bond['primary'] not in bond['member']['interface']:
             raise ConfigError(f'Primary interface of bond "{bond_name}" must be a member interface')