1 package PVE
::Network
::SDN
::Zones
::EvpnPlugin
;
5 use PVE
::Network
::SDN
::Zones
::VxlanPlugin
;
6 use PVE
::Exception
qw(raise raise_param_exc);
7 use PVE
::JSONSchema
qw(get_standard_option);
8 use PVE
::Tools
qw($IPV4RE);
13 use PVE
::Network
::SDN
::Controllers
::EvpnPlugin
;
15 use base
('PVE::Network::SDN::Zones::VxlanPlugin');
25 description
=> "l3vni.",
29 description
=> "Frr router name",
33 description
=> "Anycast logical router mac address",
34 optional
=> 1, format
=> 'mac-addr'
36 'exitnodes' => get_standard_option
('pve-node-list'),
43 nodes
=> { optional
=> 1},
44 'vrf-vxlan' => { optional
=> 0 },
45 controller
=> { optional
=> 0 },
46 exitnodes
=> { optional
=> 1 },
47 mtu
=> { optional
=> 1 },
48 mac
=> { optional
=> 1 },
49 dns
=> { optional
=> 1 },
50 reversedns
=> { optional
=> 1 },
51 dnszone
=> { optional
=> 1 },
52 ipam
=> { optional
=> 0 },
56 # Plugin implementation
57 sub generate_sdn_config
{
58 my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
60 my $tag = $vnet->{tag
};
61 my $alias = $vnet->{alias
};
62 my $ipv4 = $vnet->{ipv4
};
63 my $ipv6 = $vnet->{ipv6
};
64 my $mac = $plugin_config->{'mac'};
66 my $vrf_iface = "vrf_$zoneid";
67 my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
68 my $local_node = PVE
::INotify
::nodename
();
70 die "missing vxlan tag" if !$tag;
71 die "missing controller" if !$controller;
72 warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware
};
74 my @peers = PVE
::Tools
::split_list
($controller->{'peers'});
75 my $bgprouter = PVE
::Network
::SDN
::Controllers
::EvpnPlugin
::find_bgp_controller
($local_node, $controller_cfg);
76 my $loopback = $bgprouter->{loopback
} if $bgprouter->{loopback
};
77 my ($ifaceip, $iface) = PVE
::Network
::SDN
::Zones
::Plugin
::find_local_ip_interface_peers
(\
@peers, $loopback);
80 $mtu = $interfaces_config->{$iface}->{mtu
} - 50 if $interfaces_config->{$iface}->{mtu
};
81 $mtu = $plugin_config->{mtu
} if $plugin_config->{mtu
};
84 my $vxlan_iface = "vxlan_$vnetid";
85 my @iface_config = ();
86 push @iface_config, "vxlan-id $tag";
87 push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
88 push @iface_config, "bridge-learning off";
89 push @iface_config, "bridge-arp-nd-suppress on";
91 push @iface_config, "mtu $mtu" if $mtu;
92 push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
98 my $subnets = PVE
::Network
::SDN
::Vnets
::get_subnets
($vnetid, 1);
99 foreach my $subnetid (sort keys %{$subnets}) {
100 my $subnet = $subnets->{$subnetid};
101 my $cidr = $subnet->{cidr
};
102 my $mask = $subnet->{mask
};
104 my $gateway = $subnet->{gateway
};
106 push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
107 $address->{$gateway} = 1;
110 if ($subnet->{snat
}) {
112 my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
114 #find outgoing interface
115 my ($outip, $outiface) = PVE
::Network
::SDN
::Zones
::Plugin
::get_local_route_ip
('8.8.8.8');
116 if ($outip && $outiface && $is_evpn_gateway) {
117 #use snat, faster than masquerade
118 push @iface_config, "post-up iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
119 push @iface_config, "post-down iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
120 #add conntrack zone once on outgoing interface
121 push @iface_config, "post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
122 push @iface_config, "post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
127 push @iface_config, "hwaddress $mac" if $mac;
128 push @iface_config, "bridge_ports $vxlan_iface";
129 push @iface_config, "bridge_stp off";
130 push @iface_config, "bridge_fd 0";
131 push @iface_config, "mtu $mtu" if $mtu;
132 push @iface_config, "alias $alias" if $alias;
133 push @iface_config, "ip-forward on" if $ipv4;
134 push @iface_config, "ip6-forward on" if $ipv6;
135 push @iface_config, "arp-accept on" if $ipv4||$ipv6;
136 push @iface_config, "vrf $vrf_iface" if $vrf_iface;
137 push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
142 push @iface_config, "vrf-table auto";
143 push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
144 push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
147 #l3vni vxlan interface
148 my $iface_vrf_vxlan = "vrfvx_$zoneid";
150 push @iface_config, "vxlan-id $vrfvxlan";
151 push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
152 push @iface_config, "bridge-learning off";
153 push @iface_config, "bridge-arp-nd-suppress on";
154 push @iface_config, "mtu $mtu" if $mtu;
155 push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
158 my $brvrf = "vrfbr_$zoneid";
160 push @iface_config, "bridge-ports $iface_vrf_vxlan";
161 push @iface_config, "bridge_stp off";
162 push @iface_config, "bridge_fd 0";
163 push @iface_config, "mtu $mtu" if $mtu;
164 push @iface_config, "vrf $vrf_iface";
165 push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
173 my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
175 # verify that controller exist
176 my $controller = $zone_cfg->{ids
}->{$zoneid}->{controller
};
177 if (!defined($controller_cfg->{ids
}->{$controller})) {
178 die "controller $controller don't exist";
180 die "$controller is not a evpn controller type" if $controller_cfg->{ids
}->{$controller}->{type
} ne 'evpn';
183 #vrf-vxlan need to be defined
185 my $vrfvxlan = $zone_cfg->{ids
}->{$zoneid}->{'vrf-vxlan'};
186 # verify that vrf-vxlan is not already declared in another zone
187 foreach my $id (keys %{$zone_cfg->{ids
}}) {
188 next if $id eq $zoneid;
189 die "vrf-vxlan $vrfvxlan is already declared in $id"
190 if (defined($zone_cfg->{ids
}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids
}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
193 if (!defined($zone_cfg->{ids
}->{$zoneid}->{'mac'})) {
194 my $dc = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
195 $zone_cfg->{ids
}->{$zoneid}->{'mac'} = PVE
::Tools
::random_ether_addr
($dc->{mac_prefix
});
200 sub vnet_update_hook
{
201 my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
203 my $vnet = $vnet_cfg->{ids
}->{$vnetid};
204 my $tag = $vnet->{tag
};
206 raise_param_exc
({ tag
=> "missing vxlan tag"}) if !defined($tag);
207 raise_param_exc
({ tag
=> "vxlan tag max value is 16777216"}) if $tag > 16777216;
209 # verify that tag is not already defined globally (vxlan-id are unique)
210 foreach my $id (keys %{$vnet_cfg->{ids
}}) {
211 next if $id eq $vnetid;
212 my $othervnet = $vnet_cfg->{ids
}->{$id};
213 my $other_tag = $othervnet->{tag
};
214 my $other_zoneid = $othervnet->{zone
};
215 my $other_zone = $zone_cfg->{ids
}->{$other_zoneid};
216 next if $other_zone->{type
} ne 'vxlan' && $other_zone->{type
} ne 'evpn';
217 raise_param_exc
({ tag
=> "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;