[pve-network.git] / PVE / Network / SDN / Controllers / EvpnPlugin.pm

package PVE::Network::SDN::Controllers::EvpnPlugin;

use strict;
use warnings;

use PVE::INotify;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Tools qw(run_command file_set_contents file_get_contents);

use PVE::Network::SDN::Controllers::Plugin;
use PVE::Network::SDN::Zones::Plugin;
use Net::IP;

use base('PVE::Network::SDN::Controllers::Plugin');

sub type {
    return 'evpn';
}

sub properties {
    return {
	asn => {
	    type => 'integer',
	    description => "autonomous system number",
	    minimum => 0,
	    maximum => 4294967296
	},
	peers => {
	    description => "peers address list.",
	    type => 'string', format => 'ip-list'
	},
    };
}

sub options {
    return {
	'asn' => { optional => 0 },
	'peers' => { optional => 0 },
    };
}

# Plugin implementation
sub generate_controller_config {
    my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;

    my @peers;
    @peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};

    my $local_node = PVE::INotify::nodename();

    my $asn = $plugin_config->{asn};
    my $ebgp = undef;
    my $loopback = undef;
    my $autortas = undef;
    my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
    if($bgprouter) {
	$ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	$autortas = $plugin_config->{'asn'} if $ebgp;
    }

    return if !$asn;

    my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};

    my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);

    my $remoteas = $ebgp ? "external" : $asn;

    #global options
    my @controller_config = (
	"bgp router-id $ifaceip",
	"no bgp default ipv4-unicast",
	"coalesce-time 1000",
    );

    push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;

    @controller_config = ();
    
    #VTEP neighbors
    push @controller_config, "neighbor VTEP peer-group";
    push @controller_config, "neighbor VTEP remote-as $remoteas";
    push @controller_config, "neighbor VTEP bfd";

    if($ebgp && $loopback) {
	push @controller_config, "neighbor VTEP ebgp-multihop 10";
	push @controller_config, "neighbor VTEP update-source $loopback";
    }

    # VTEP peers
    foreach my $address (@peers) {
	next if $address eq $ifaceip;
	push @controller_config, "neighbor $address peer-group VTEP";
    }

    push(@{$bgp->{""}}, @controller_config);

    # address-family l2vpn
    @controller_config = ();
    push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
    push @controller_config, "neighbor VTEP activate";
    push @controller_config, "advertise-all-vni";
    push @controller_config, "autort as $autortas" if $autortas;
    push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);

    push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []);

    return $config;
}

sub generate_controller_zone_config {
    my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;

    my $local_node = PVE::INotify::nodename();

    my $vrf = "vrf_$id";
    my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
    my $exitnodes = $plugin_config->{'exitnodes'};
    my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
    my $advertisesubnets = $plugin_config->{'advertise-subnets'};
    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
    my $rt_import = [PVE::Tools::split_list($plugin_config->{'rt-import'})] if $plugin_config->{'rt-import'};

    my $asn = $controller->{asn};
    my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
    my $ebgp = undef;
    my $loopback = undef;
    my $autortas = undef;
    my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
    if($bgprouter) {
        $ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	$autortas = $controller->{'asn'} if $ebgp;
    }

    return if !$vrf || !$vrfvxlan || !$asn;

    my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);

    # vrf
    my @controller_config = ();
    push @controller_config, "vni $vrfvxlan";
    push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);

    #main vrf router
    @controller_config = ();
    push @controller_config, "bgp router-id $ifaceip";
#    push @controller_config, "!";
    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);

    if ($autortas) {
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
    }

    my $is_gateway = $exitnodes->{$local_node};

    if ($is_gateway) {

        if($exitnodes_primary && $exitnodes_primary ne $local_node) {
	    my $routemap_config = ();
	    push @{$routemap_config}, "match evpn vni $vrfvxlan";
	    push @{$routemap_config}, "match evpn route-type prefix";
	    push @{$routemap_config}, "set metric 200";
	    unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config);
        }

	if (!$exitnodes_local_routing) {
	    @controller_config = ();
	    #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
	    push @controller_config, "import vrf $vrf";
	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);

	    @controller_config = ();
	    #redistribute connected to be able to route to local vms on the gateway
	    push @controller_config, "redistribute connected";
	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	}

	@controller_config = ();
	#add default originate to announce 0.0.0.0/0 type5 route in evpn
	push @controller_config, "default-originate ipv4";
	push @controller_config, "default-originate ipv6";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    } elsif ($advertisesubnets) {

	@controller_config = ();
	#redistribute connected networks
	push @controller_config, "redistribute connected";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);

	@controller_config = ();
	#advertise connected networks type5 route in evpn
	push @controller_config, "advertise ipv4 unicast";
	push @controller_config, "advertise ipv6 unicast";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    }

    if($rt_import) {
	@controller_config = ();
	foreach my $rt (sort @{$rt_import}) {
	    push @controller_config, "route-target import $rt";
	}
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    }

    return $config;
}

sub generate_controller_vnet_config {
    my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;

    my $exitnodes = $zone->{'exitnodes'};
    my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};

    return if !$exitnodes_local_routing;

    my $local_node = PVE::INotify::nodename();
    my $is_gateway = $exitnodes->{$local_node};
    
    return if !$is_gateway;

    my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
    my @controller_config = ();
    foreach my $subnetid (sort keys %{$subnets}) {
        my $subnet = $subnets->{$subnetid};
	my $cidr = $subnet->{cidr};
	push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
    }
    push(@{$config->{frr}->{''}}, @controller_config);
}

sub on_delete_hook {
    my ($class, $controllerid, $zone_cfg) = @_;

    # verify that zone is associated to this controller
    foreach my $id (keys %{$zone_cfg->{ids}}) {
	my $zone = $zone_cfg->{ids}->{$id};
	die "controller $controllerid is used by $id"
	    if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
    }
}

sub on_update_hook {
    my ($class, $controllerid, $controller_cfg) = @_;

    # we can only have 1 evpn controller / 1 asn by server

    my $controllernb = 0;
    foreach my $id (keys %{$controller_cfg->{ids}}) {
	next if $id eq $controllerid;
	my $controller = $controller_cfg->{ids}->{$id};
	next if $controller->{type} ne "evpn";
	$controllernb++;
	die "only 1 global evpn controller can be defined" if $controllernb > 1;
    }
}

sub find_bgp_controller {
    my ($nodename, $controller_cfg) = @_;

    my $controller = undef;
    foreach my $id  (keys %{$controller_cfg->{ids}}) {
        $controller = $controller_cfg->{ids}->{$id};
        next if $controller->{type} ne 'bgp';
        next if $controller->{node} ne $nodename;
	last;
    }

    return $controller;
}


sub sort_frr_config {
    my $order = {};
    $order->{''} = 0;
    $order->{'vrf'} = 1;
    $order->{'ipv4 unicast'} = 1;
    $order->{'ipv6 unicast'} = 2;
    $order->{'l2vpn evpn'} = 3;

    my $a_val = 100;
    my $b_val = 100;

    $a_val = $order->{$a} if defined($order->{$a});
    $b_val = $order->{$b} if defined($order->{$b});

    if ($a =~ /bgp (\d+)$/) {
	$a_val = 2;
    }

    if ($b =~ /bgp (\d+)$/) {
	$b_val = 2;
    }

    return $a_val <=> $b_val;
}

sub generate_frr_recurse{
   my ($final_config, $content, $parentkey, $level) = @_;

   my $keylist = {};
   $keylist->{vrf} = 1;
   $keylist->{'address-family'} = 1;
   $keylist->{router} = 1;

   my $exitkeylist = {};
   $exitkeylist->{vrf} = 1;
   $exitkeylist->{'address-family'} = 1;

   # FIXME: make this generic
   my $paddinglevel = undef;
   if ($level == 1 || $level == 2) {
	$paddinglevel = $level - 1;
   } elsif ($level == 3 || $level ==  4) {
	$paddinglevel = $level - 2;
   }

   my $padding = "";
   $padding = ' ' x ($paddinglevel) if $paddinglevel;

   if (ref $content eq  'HASH') {
	foreach my $key (sort sort_frr_config keys %$content) {
	    if ($parentkey && defined($keylist->{$parentkey})) {
		push @{$final_config}, $padding."!";
		push @{$final_config}, $padding."$parentkey $key";
	    } elsif ($key ne '' && !defined($keylist->{$key})) {
		push @{$final_config}, $padding."$key";
	    }

	    my $option = $content->{$key};
	    generate_frr_recurse($final_config, $option, $key, $level+1);

	    push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
	}
    }

    if (ref $content eq 'ARRAY') {
	push @{$final_config}, map { $padding . "$_" } @$content;
    }
}

sub generate_frr_routemap {
   my ($final_config, $routemaps) = @_;

   foreach my $id (sort keys %$routemaps) {

	my $routemap = $routemaps->{$id};
	my $order = 0;
	foreach my $seq (@$routemap) {
		$order++;
		my @config = ();
		push @config, "!";
		push @config, "route-map $id permit $order";
		push @config, map { " $_" } @$seq;
		push @{$final_config}, @config;
	}
   }
}
sub generate_controller_rawconfig {
    my ($class, $plugin_config, $config) = @_;

    my $nodename = PVE::INotify::nodename();

    my $final_config = [];
    push @{$final_config}, "log syslog informational";
    push @{$final_config}, "ip forwarding";
    push @{$final_config}, "ipv6 forwarding";
    push @{$final_config}, "frr defaults datacenter";
    push @{$final_config}, "service integrated-vtysh-config";
    push @{$final_config}, "hostname $nodename";
    push @{$final_config}, "!";

    if (-e "/etc/frr/frr.conf.local") {
	generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
	generate_frr_routemap($final_config, $config->{frr_routemap});
	push @{$final_config}, "!";

	my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
	chomp ($local_conf);
	push @{$final_config}, $local_conf;
    } else {
	generate_frr_recurse($final_config, $config->{frr}, undef, 0);
	generate_frr_routemap($final_config, $config->{frr_routemap});
    }

    push @{$final_config}, "!";
    push @{$final_config}, "line vty";
    push @{$final_config}, "!";

    my $rawconfig = join("\n", @{$final_config});

    return if !$rawconfig;
    return $rawconfig;
}

sub write_controller_config {
    my ($class, $plugin_config, $config) = @_;

    my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
    return if !$rawconfig;
    return if !-d "/etc/frr";

    file_set_contents("/etc/frr/frr.conf", $rawconfig);
}

sub reload_controller {
    my ($class) = @_;

    my $conf_file = "/etc/frr/frr.conf";
    my $bin_path = "/usr/lib/frr/frr-reload.py";

    if (!-e $bin_path) {
	warn "missing $bin_path. Please install frr-pythontools package";
	return;
    }

    my $err = sub {
	my $line = shift;
	if ($line =~ /ERROR:/) {
	    warn "$line \n";
	}
    };

    if (-e $conf_file && -e $bin_path) {
	run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
    }
}

1;
Commit	Line	Data
fa253735	1	package PVE::Network::SDN::Controllers::EvpnPlugin;
32602a38 AD	2
	3	use strict;
	4	use warnings;
cdf2c819	5
074d270b AD	6	use PVE::INotify;
074d270b AD	7	use PVE::JSONSchema qw(get_standard_option);
cdf2c819 TL	8	use PVE::Tools qw(run_command file_set_contents file_get_contents);
	9
	10	use PVE::Network::SDN::Controllers::Plugin;
1f543c5f	11	use PVE::Network::SDN::Zones::Plugin;
f23633dc	12	use Net::IP;
cdf2c819	13
f5eabba0	14	use base('PVE::Network::SDN::Controllers::Plugin');
32602a38 AD	15
32602a38 AD	16	sub type {
fa253735	17	return 'evpn';
8fb1ee7f AD	18	}
8fb1ee7f AD	19
32602a38 AD	20	sub properties {
32602a38 AD	21	return {
92526f0e TL	22	asn => {
	23	type => 'integer',
	24	description => "autonomous system number",
9e6b99fd AD	25	minimum => 0,
9e6b99fd AD	26	maximum => 4294967296
92526f0e TL	27	},
	28	peers => {
	29	description => "peers address list.",
	30	type => 'string', format => 'ip-list'
	31	},
32602a38 AD	32	};
	33	}
	34
	35	sub options {
32602a38	36	return {
92526f0e TL	37	'asn' => { optional => 0 },
92526f0e TL	38	'peers' => { optional => 0 },
32602a38 AD	39	};
	40	}
	41
	42	# Plugin implementation
8fb1ee7f	43	sub generate_controller_config {
f23633dc	44	my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;
32602a38	45
3caa7687 FG	46	my @peers;
3caa7687 FG	47	@peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};
32602a38	48
f23633dc AD	49	my $local_node = PVE::INotify::nodename();
f23633dc AD	50
074d270b	51	my $asn = $plugin_config->{asn};
f23633dc AD	52	my $ebgp = undef;
	53	my $loopback = undef;
	54	my $autortas = undef;
	55	my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
	56	if($bgprouter) {
	57	$ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
	58	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	59	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	60	$autortas = $plugin_config->{'asn'} if $ebgp;
	61	}
074d270b AD	62
074d270b AD	63	return if !$asn;
32602a38	64
92526f0e TL	65	my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};
92526f0e TL	66
f23633dc	67	my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
32602a38	68
f23633dc	69	my $remoteas = $ebgp ? "external" : $asn;
17854295	70
f23633dc	71	#global options
92526f0e TL	72	my @controller_config = (
	73	"bgp router-id $ifaceip",
	74	"no bgp default ipv4-unicast",
	75	"coalesce-time 1000",
	76	);
32602a38	77
f23633dc AD	78	push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;
	79
	80	@controller_config = ();
	81
	82	#VTEP neighbors
	83	push @controller_config, "neighbor VTEP peer-group";
	84	push @controller_config, "neighbor VTEP remote-as $remoteas";
	85	push @controller_config, "neighbor VTEP bfd";
	86
	87	if($ebgp && $loopback) {
	88	push @controller_config, "neighbor VTEP ebgp-multihop 10";
	89	push @controller_config, "neighbor VTEP update-source $loopback";
	90	}
	91
	92	# VTEP peers
32602a38 AD	93	foreach my $address (@peers) {
32602a38 AD	94	next if $address eq $ifaceip;
f23633dc	95	push @controller_config, "neighbor $address peer-group VTEP";
7d35eaf5	96	}
074d270b	97
92526f0e	98	push(@{$bgp->{""}}, @controller_config);
074d270b	99
f23633dc	100	# address-family l2vpn
56cdcac9	101	@controller_config = ();
847f5144	102	push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
f23633dc	103	push @controller_config, "neighbor VTEP activate";
56cdcac9	104	push @controller_config, "advertise-all-vni";
f23633dc	105	push @controller_config, "autort as $autortas" if $autortas;
92526f0e	106	push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
32602a38	107
847f5144 AD	108	push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []);
847f5144 AD	109
32602a38 AD	110	return $config;
	111	}
	112
56cdcac9	113	sub generate_controller_zone_config {
f23633dc AD	114	my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;
	115
	116	my $local_node = PVE::INotify::nodename();
0589eb09	117
1de0abc0	118	my $vrf = "vrf_$id";
0589eb09	119	my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
f23633dc	120	my $exitnodes = $plugin_config->{'exitnodes'};
847f5144	121	my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
92d8effb	122	my $advertisesubnets = $plugin_config->{'advertise-subnets'};
3d135423	123	my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
96794fd6	124	my $rt_import = [PVE::Tools::split_list($plugin_config->{'rt-import'})] if $plugin_config->{'rt-import'};
f23633dc	125
56cdcac9	126	my $asn = $controller->{asn};
f34a898e	127	my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
f23633dc AD	128	my $ebgp = undef;
	129	my $loopback = undef;
	130	my $autortas = undef;
	131	my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
	132	if($bgprouter) {
	133	$ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
	134	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	135	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	136	$autortas = $controller->{'asn'} if $ebgp;
	137	}
0589eb09 AD	138
	139	return if !$vrf \|\| !$vrfvxlan \|\| !$asn;
	140
f34a898e AD	141	my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
f34a898e AD	142
92526f0e	143	# vrf
56cdcac9 AD	144	my @controller_config = ();
	145	push @controller_config, "vni $vrfvxlan";
	146	push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);
0589eb09	147
f23633dc AD	148	#main vrf router
f23633dc AD	149	@controller_config = ();
f34a898e	150	push @controller_config, "bgp router-id $ifaceip";
f23633dc AD	151	# push @controller_config, "!";
f23633dc AD	152	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);
659c27c2	153
f23633dc AD	154	if ($autortas) {
	155	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
	156	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
	157	}
0589eb09	158
b634e577 AD	159	my $is_gateway = $exitnodes->{$local_node};
b634e577 AD	160
0589eb09 AD	161	if ($is_gateway) {
0589eb09 AD	162
847f5144 AD	163	if($exitnodes_primary && $exitnodes_primary ne $local_node) {
	164	my $routemap_config = ();
	165	push @{$routemap_config}, "match evpn vni $vrfvxlan";
	166	push @{$routemap_config}, "match evpn route-type prefix";
	167	push @{$routemap_config}, "set metric 200";
	168	unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config);
	169	}
	170
3d135423 AD	171	if (!$exitnodes_local_routing) {
	172	@controller_config = ();
	173	#import /32 routes of evpn network from vrf1 to default vrf (for packet return)
	174	push @controller_config, "import vrf $vrf";
	175	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	176	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
0589eb09	177
3d135423 AD	178	@controller_config = ();
	179	#redistribute connected to be able to route to local vms on the gateway
	180	push @controller_config, "redistribute connected";
	181	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	182	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	183	}
0589eb09	184
56cdcac9	185	@controller_config = ();
0589eb09	186	#add default originate to announce 0.0.0.0/0 type5 route in evpn
56cdcac9 AD	187	push @controller_config, "default-originate ipv4";
	188	push @controller_config, "default-originate ipv6";
	189	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
92d8effb AD	190	} elsif ($advertisesubnets) {
	191
	192	@controller_config = ();
	193	#redistribute connected networks
	194	push @controller_config, "redistribute connected";
	195	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	196	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	197
	198	@controller_config = ();
	199	#advertise connected networks type5 route in evpn
	200	push @controller_config, "advertise ipv4 unicast";
	201	push @controller_config, "advertise ipv6 unicast";
	202	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
0589eb09 AD	203	}
0589eb09 AD	204
96794fd6 AD	205	if($rt_import) {
	206	@controller_config = ();
	207	foreach my $rt (sort @{$rt_import}) {
	208	push @controller_config, "route-target import $rt";
	209	}
	210	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
	211	}
	212
0589eb09 AD	213	return $config;
	214	}
	215
3d135423 AD	216	sub generate_controller_vnet_config {
	217	my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
	218
	219	my $exitnodes = $zone->{'exitnodes'};
	220	my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};
	221
	222	return if !$exitnodes_local_routing;
	223
	224	my $local_node = PVE::INotify::nodename();
	225	my $is_gateway = $exitnodes->{$local_node};
	226
	227	return if !$is_gateway;
	228
	229	my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
	230	my @controller_config = ();
	231	foreach my $subnetid (sort keys %{$subnets}) {
	232	my $subnet = $subnets->{$subnetid};
	233	my $cidr = $subnet->{cidr};
	234	push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
	235	}
	236	push(@{$config->{frr}->{''}}, @controller_config);
	237	}
	238
32602a38	239	sub on_delete_hook {
56cdcac9	240	my ($class, $controllerid, $zone_cfg) = @_;
32602a38	241
56cdcac9 AD	242	# verify that zone is associated to this controller
56cdcac9 AD	243	foreach my $id (keys %{$zone_cfg->{ids}}) {
92526f0e TL	244	my $zone = $zone_cfg->{ids}->{$id};
	245	die "controller $controllerid is used by $id"
	246	if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
5bda8607	247	}
32602a38 AD	248	}
	249
	250	sub on_update_hook {
56cdcac9	251	my ($class, $controllerid, $controller_cfg) = @_;
5bda8607	252
c7bb4ac5 AD	253	# we can only have 1 evpn controller / 1 asn by server
c7bb4ac5 AD	254
f23633dc	255	my $controllernb = 0;
56cdcac9 AD	256	foreach my $id (keys %{$controller_cfg->{ids}}) {
56cdcac9 AD	257	next if $id eq $controllerid;
92526f0e	258	my $controller = $controller_cfg->{ids}->{$id};
f23633dc AD	259	next if $controller->{type} ne "evpn";
	260	$controllernb++;
	261	die "only 1 global evpn controller can be defined" if $controllernb > 1;
	262	}
	263	}
	264
	265	sub find_bgp_controller {
	266	my ($nodename, $controller_cfg) = @_;
	267
	268	my $controller = undef;
	269	foreach my $id (keys %{$controller_cfg->{ids}}) {
	270	$controller = $controller_cfg->{ids}->{$id};
	271	next if $controller->{type} ne 'bgp';
	272	next if $controller->{node} ne $nodename;
	273	last;
5bda8607	274	}
f23633dc AD	275
f23633dc AD	276	return $controller;
32602a38 AD	277	}
32602a38 AD	278
f23633dc	279
8fb1ee7f AD	280	sub sort_frr_config {
	281	my $order = {};
	282	$order->{''} = 0;
	283	$order->{'vrf'} = 1;
	284	$order->{'ipv4 unicast'} = 1;
	285	$order->{'ipv6 unicast'} = 2;
	286	$order->{'l2vpn evpn'} = 3;
	287
	288	my $a_val = 100;
	289	my $b_val = 100;
	290
	291	$a_val = $order->{$a} if defined($order->{$a});
	292	$b_val = $order->{$b} if defined($order->{$b});
	293
92526f0e	294	if ($a =~ /bgp (\d+)$/) {
8fb1ee7f AD	295	$a_val = 2;
	296	}
	297
92526f0e	298	if ($b =~ /bgp (\d+)$/) {
8fb1ee7f AD	299	$b_val = 2;
	300	}
	301
	302	return $a_val <=> $b_val;
	303	}
	304
	305	sub generate_frr_recurse{
	306	my ($final_config, $content, $parentkey, $level) = @_;
	307
	308	my $keylist = {};
	309	$keylist->{vrf} = 1;
	310	$keylist->{'address-family'} = 1;
	311	$keylist->{router} = 1;
	312
	313	my $exitkeylist = {};
	314	$exitkeylist->{vrf} = 1;
	315	$exitkeylist->{'address-family'} = 1;
	316
92526f0e	317	# FIXME: make this generic
8fb1ee7f	318	my $paddinglevel = undef;
92526f0e TL	319	if ($level == 1 \|\| $level == 2) {
92526f0e TL	320	$paddinglevel = $level - 1;
8fb1ee7f	321	} elsif ($level == 3 \|\| $level == 4) {
92526f0e	322	$paddinglevel = $level - 2;
8fb1ee7f AD	323	}
	324
	325	my $padding = "";
	326	$padding = ' ' x ($paddinglevel) if $paddinglevel;
	327
92526f0e	328	if (ref $content eq 'HASH') {
8fb1ee7f AD	329	foreach my $key (sort sort_frr_config keys %$content) {
8fb1ee7f AD	330	if ($parentkey && defined($keylist->{$parentkey})) {
92526f0e TL	331	push @{$final_config}, $padding."!";
	332	push @{$final_config}, $padding."$parentkey $key";
	333	} elsif ($key ne '' && !defined($keylist->{$key})) {
	334	push @{$final_config}, $padding."$key";
8fb1ee7f AD	335	}
	336
	337	my $option = $content->{$key};
	338	generate_frr_recurse($final_config, $option, $key, $level+1);
	339
	340	push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
	341	}
	342	}
32602a38	343
8fb1ee7f	344	if (ref $content eq 'ARRAY') {
92526f0e	345	push @{$final_config}, map { $padding . "$_" } @$content;
8fb1ee7f AD	346	}
	347	}
	348
847f5144 AD	349	sub generate_frr_routemap {
	350	my ($final_config, $routemaps) = @_;
	351
	352	foreach my $id (sort keys %$routemaps) {
	353
	354	my $routemap = $routemaps->{$id};
	355	my $order = 0;
	356	foreach my $seq (@$routemap) {
	357	$order++;
	358	my @config = ();
	359	push @config, "!";
	360	push @config, "route-map $id permit $order";
	361	push @config, map { " $_" } @$seq;
	362	push @{$final_config}, @config;
	363	}
	364	}
	365	}
9cef13e9	366	sub generate_controller_rawconfig {
8fb1ee7f AD	367	my ($class, $plugin_config, $config) = @_;
8fb1ee7f AD	368
659c27c2 AD	369	my $nodename = PVE::INotify::nodename();
659c27c2 AD	370
8fb1ee7f AD	371	my $final_config = [];
8fb1ee7f AD	372	push @{$final_config}, "log syslog informational";
659c27c2 AD	373	push @{$final_config}, "ip forwarding";
659c27c2 AD	374	push @{$final_config}, "ipv6 forwarding";
67a0f815	375	push @{$final_config}, "frr defaults datacenter";
659c27c2 AD	376	push @{$final_config}, "service integrated-vtysh-config";
659c27c2 AD	377	push @{$final_config}, "hostname $nodename";
8fb1ee7f AD	378	push @{$final_config}, "!";
8fb1ee7f AD	379
0d1ab7dc	380	if (-e "/etc/frr/frr.conf.local") {
0d1ab7dc	381	generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
847f5144	382	generate_frr_routemap($final_config, $config->{frr_routemap});
0d1ab7dc AD	383	push @{$final_config}, "!";
0d1ab7dc AD	384
cdf2c819 TL	385	my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
	386	chomp ($local_conf);
	387	push @{$final_config}, $local_conf;
0d1ab7dc AD	388	} else {
0d1ab7dc AD	389	generate_frr_recurse($final_config, $config->{frr}, undef, 0);
847f5144	390	generate_frr_routemap($final_config, $config->{frr_routemap});
0d1ab7dc	391	}
8fb1ee7f AD	392
	393	push @{$final_config}, "!";
	394	push @{$final_config}, "line vty";
	395	push @{$final_config}, "!";
	396
	397	my $rawconfig = join("\n", @{$final_config});
	398
9cef13e9 AD	399	return if !$rawconfig;
	400	return $rawconfig;
	401	}
	402
	403	sub write_controller_config {
	404	my ($class, $plugin_config, $config) = @_;
	405
	406	my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
8fb1ee7f AD	407	return if !$rawconfig;
	408	return if !-d "/etc/frr";
	409
cdf2c819	410	file_set_contents("/etc/frr/frr.conf", $rawconfig);
8fb1ee7f AD	411	}
8fb1ee7f AD	412
fa609bdd AD	413	sub reload_controller {
	414	my ($class) = @_;
	415
	416	my $conf_file = "/etc/frr/frr.conf";
659c27c2 AD	417	my $bin_path = "/usr/lib/frr/frr-reload.py";
	418
	419	if (!-e $bin_path) {
	420	warn "missing $bin_path. Please install frr-pythontools package";
	421	return;
	422	}
fa609bdd AD	423
	424	my $err = sub {
	425	my $line = shift;
659c27c2 AD	426	if ($line =~ /ERROR:/) {
659c27c2 AD	427	warn "$line \n";
fa609bdd AD	428	}
	429	};
	430
	431	if (-e $conf_file && -e $bin_path) {
cdf2c819	432	run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
fa609bdd AD	433	}
	434	}
	435
8fb1ee7f	436	1;
32602a38	437
0589eb09	438