PVE/Network/SDN/VxlanPlugin.pm

   1 package PVE::Network::SDN::VxlanPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Plugin;
   6 use PVE::Tools;
   7 use PVE::INotify;
   8 use PVE::JSONSchema qw(get_standard_option);
   9
  10 use base('PVE::Network::SDN::Plugin');
  11
  12 PVE::JSONSchema::register_format('pve-sdn-vxlanrange', \&pve_verify_sdn_vxlanrange);
  13 sub pve_verify_sdn_vxlanrange {
  14    my ($vxlanstr) = @_;
  15
  16    PVE::Network::SDN::Plugin::parse_tag_number_or_range($vxlanstr, '16777216');
  17
  18    return $vxlanstr;
  19 }
  20
  21 sub type {
  22     return 'vxlan';
  23 }
  24
  25 sub properties {
  26     return {
  27         'vxlan-allowed' => {
  28             type => 'string', format => 'pve-sdn-vxlanrange',
  29             description => "Allowed vlan range",
  30         },
  31         'multicast-address' => {
  32             description => "Multicast address.",
  33             type => 'string',  #fixme: format
  34         },
  35         'unicast-address' => {
  36             description => "Unicast peers address ip list.",
  37             type => 'string',  #fixme: format
  38         },
  39         'vrf' => {
  40             description => "vrf name.",
  41             type => 'string',  #fixme: format
  42         },
  43         'vrf-vxlan' => {
  44             type => 'integer',
  45             description => "l3vni.",
  46         },
  47         'router' => {
  48             type => 'string',
  49             description => "Frr router name",
  50         },
  51         'gateway-nodes' => get_standard_option('pve-node-list'),
  52     };
  53 }
  54
  55 sub options {
  56
  57     return {
  58         'uplink-id' => { optional => 0 },
  59         'multicast-address' => { optional => 1 },
  60         'unicast-address' => { optional => 1 },
  61         'vxlan-allowed' => { optional => 1 },
  62         'vrf' => { optional => 1 },
  63         'vrf-vxlan' => { optional => 1 },
  64         'router' => { optional => 1 },
  65         'gateway-nodes' => { optional => 1 },
  66     };
  67 }
  68
  69 # Plugin implementation
  70 sub generate_sdn_config {
  71     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $uplinks, $config) = @_;
  72
  73     my $tag = $vnet->{tag};
  74     my $alias = $vnet->{alias};
  75     my $ipv4 = $vnet->{ipv4};
  76     my $ipv6 = $vnet->{ipv6};
  77     my $mac = $vnet->{mac};
  78     my $multicastaddress = $plugin_config->{'multicast-address'};
  79     my @unicastaddress = split(',', $plugin_config->{'unicast-address'}) if $plugin_config->{'unicast-address'};
  80
  81     my $uplink = $plugin_config->{'uplink-id'};
  82     my $vxlanallowed = $plugin_config->{'vxlan-allowed'};
  83     my $vrf = $plugin_config->{'vrf'};
  84     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
  85
  86     die "missing vxlan tag" if !$tag;
  87     my $iface = "uplink$uplink";
  88     my $ifaceip = "";
  89
  90     if($uplinks->{$uplink}->{name}) {
  91         $iface = $uplinks->{$uplink}->{name};
  92         $ifaceip = PVE::Network::SDN::Plugin::get_first_local_ipv4_from_interface($iface);
  93     }
  94
  95     my $mtu = 1450;
  96     $mtu = $uplinks->{$uplink}->{mtu} - 50 if $uplinks->{$uplink}->{mtu};
  97     $mtu = $vnet->{mtu} if $vnet->{mtu};
  98
  99     #vxlan interface
 100     my @iface_config = ();
 101     push @iface_config, "vxlan-id $tag";
 102
 103     if($multicastaddress) {
 104         push @iface_config, "vxlan-svcnodeip $multicastaddress";
 105         push @iface_config, "vxlan-physdev $iface";
 106     } elsif (@unicastaddress) {
 107
 108         foreach my $address (@unicastaddress) {
 109             next if $address eq $ifaceip;
 110             push @iface_config, "vxlan_remoteip $address";
 111         }
 112     } else {
 113         push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 114         push @iface_config, "bridge-learning off";
 115         push @iface_config, "bridge-arp-nd-suppress on";
 116     }
 117
 118     push @iface_config, "mtu $mtu" if $mtu;
 119     push(@{$config->{"vxlan$vnetid"}}, @iface_config) if !$config->{"vxlan$vnetid"};
 120
 121     #vnet bridge
 122     @iface_config = ();
 123     push @iface_config, "address $ipv4" if $ipv4;
 124     push @iface_config, "address $ipv6" if $ipv6;
 125     push @iface_config, "hwaddress $mac" if $mac;
 126     push @iface_config, "bridge_ports vxlan$vnetid";
 127     push @iface_config, "bridge_stp off";
 128     push @iface_config, "bridge_fd 0";
 129     push @iface_config, "mtu $mtu" if $mtu;
 130     push @iface_config, "alias $alias" if $alias;
 131     push @iface_config, "ip-forward on" if $ipv4;
 132     push @iface_config, "ip6-forward on" if $ipv6;
 133     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 134     push @iface_config, "vrf $vrf" if $vrf;
 135     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 136
 137     if ($vrf) {
 138         #vrf intreface
 139         @iface_config = ();
 140         push @iface_config, "vrf-table auto";
 141         push(@{$config->{$vrf}}, @iface_config) if !$config->{$vrf};
 142
 143         if ($vrfvxlan) {
 144             #l3vni vxlan interface
 145             my $iface_vxlan = "vxlan$vrf";
 146             @iface_config = ();
 147             push @iface_config, "vxlan-id $vrfvxlan";
 148             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 149             push @iface_config, "bridge-learning off";
 150             push @iface_config, "bridge-arp-nd-suppress on";
 151             push @iface_config, "mtu $mtu" if $mtu;
 152             push(@{$config->{$iface_vxlan}}, @iface_config) if !$config->{$iface_vxlan};
 153
 154             #l3vni bridge
 155             my $brvrf = "br$vrf";
 156             @iface_config = ();
 157             push @iface_config, "bridge-ports $iface_vxlan";
 158             push @iface_config, "bridge_stp off";
 159             push @iface_config, "bridge_fd 0";
 160             push @iface_config, "mtu $mtu" if $mtu;
 161             push @iface_config, "vrf $vrf";
 162             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 163         }
 164     }
 165
 166     return $config;
 167 }
 168
 169 sub generate_frr_config {
 170     my ($class, $plugin_config, $asn, $id, $uplinks, $config) = @_;
 171
 172     my $vrf = $plugin_config->{'vrf'};
 173     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
 174     my $gatewaynodes = $plugin_config->{'gateway-nodes'};
 175
 176     return if !$vrf || !$vrfvxlan;
 177
 178     #vrf
 179     my @router_config = ();
 180     push @router_config, "vni $vrfvxlan";
 181     push(@{$config->{vrf}->{"$vrf"}}, @router_config);
 182
 183     @router_config = ();
 184
 185     my $is_gateway = undef;
 186     my $local_node = PVE::INotify::nodename();
 187
 188     foreach my $gatewaynode (PVE::Tools::split_list($gatewaynodes)) {
 189         $is_gateway = 1 if $gatewaynode eq $local_node;
 190     }
 191
 192     if ($is_gateway) {
 193
 194         @router_config = ();
 195         #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
 196         #frr 7.1 tag is bugged -> works fine with 7.1 stable branch(20190829-02-g6ba76bbc1)
 197         #https://github.com/FRRouting/frr/issues/4905
 198         push @router_config, "import vrf $vrf";
 199         push(@{$config->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @router_config);
 200
 201         @router_config = ();
 202         #redistribute connected to be able to route to local vms on the gateway
 203         push @router_config, "redistribute connected";
 204         push(@{$config->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @router_config);
 205
 206         @router_config = ();
 207         #add default originate to announce 0.0.0.0/0 type5 route in evpn
 208         push @router_config, "default-originate ipv4";
 209         push(@{$config->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @router_config);
 210     }
 211
 212     return $config;
 213 }
 214
 215 sub on_delete_hook {
 216     my ($class, $transportid, $sdn_cfg) = @_;
 217
 218     # verify that no vnet are associated to this transport
 219     foreach my $id (keys %{$sdn_cfg->{ids}}) {
 220         my $sdn = $sdn_cfg->{ids}->{$id};
 221         die "transport $transportid is used by vnet $id"
 222             if ($sdn->{type} eq 'vnet' && defined($sdn->{transportzone}) && $sdn->{transportzone} eq $transportid);
 223     }
 224 }
 225
 226 sub on_update_hook {
 227     my ($class, $transportid, $sdn_cfg) = @_;
 228
 229     my $transport = $sdn_cfg->{ids}->{$transportid};
 230
 231     # verify that vxlan-allowed don't conflict with another vxlan-allowed transport
 232
 233     # verify that vxlan-allowed is matching currently vnet tag in this transport
 234     my $vxlanallowed = $transport->{'vxlan-allowed'};
 235     if ($vxlanallowed) {
 236         foreach my $id (keys %{$sdn_cfg->{ids}}) {
 237             my $sdn = $sdn_cfg->{ids}->{$id};
 238             if ($sdn->{type} eq 'vnet' && defined($sdn->{tag})) {
 239                 if(defined($sdn->{transportzone}) && $sdn->{transportzone} eq $transportid) {
 240                     my $tag = $sdn->{tag};
 241                     eval {
 242                         PVE::Network::SDN::Plugin::parse_tag_number_or_range($vxlanallowed, '16777216', $tag);
 243                     };
 244                     if($@) {
 245                         die "vnet $id - vlan $tag is not allowed in transport $transportid";
 246                     }
 247                 }
 248             }
 249         }
 250     }
 251
 252     # verify that router exist
 253     if (defined($sdn_cfg->{ids}->{$transportid}->{router})) {
 254         my $router = $sdn_cfg->{ids}->{$transportid}->{router};
 255         if (!defined($sdn_cfg->{ids}->{$router})) {
 256             die "router $router don't exist";
 257         } else {
 258             die "$router is not a router type" if $sdn_cfg->{ids}->{$router}->{type} ne 'frr';
 259         }
 260
 261         #vrf && vrf-vxlan need to be defined with router
 262         my $vrf = $sdn_cfg->{ids}->{$transportid}->{vrf};
 263         if (!defined($vrf)) {
 264             die "missing vrf option";
 265         } else {
 266             # verify that vrf is not already declared in another transport
 267             foreach my $id (keys %{$sdn_cfg->{ids}}) {
 268                 next if $id eq $transportid;
 269                 die "vrf $vrf is already declared in $id"
 270                         if (defined($sdn_cfg->{ids}->{$id}->{vrf}) && $sdn_cfg->{ids}->{$id}->{vrf} eq $vrf);
 271             }
 272         }
 273
 274         my $vrfvxlan = $sdn_cfg->{ids}->{$transportid}->{'vrf-vxlan'};
 275         if (!defined($vrfvxlan)) {
 276             die "missing vrf-vxlan option";
 277         } else {
 278             # verify that vrf-vxlan is not already declared in another transport
 279             foreach my $id (keys %{$sdn_cfg->{ids}}) {
 280                 next if $id eq $transportid;
 281                 die "vrf-vxlan $vrfvxlan is already declared in $id"
 282                         if (defined($sdn_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $sdn_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 283             }
 284         }
 285     }
 286 }
 287
 288 1;
 289
 290