[pve-network.git] / PVE / Network / SDN / Controllers / EvpnPlugin.pm

package PVE::Network::SDN::Controllers::EvpnPlugin;

use strict;
use warnings;

use PVE::INotify;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Tools qw(run_command file_set_contents file_get_contents);

use PVE::Network::SDN::Controllers::Plugin;
use PVE::Network::SDN::Zones::Plugin;
use Net::IP;

use base('PVE::Network::SDN::Controllers::Plugin');

sub type {
    return 'evpn';
}

sub properties {
    return {
	asn => {
	    type => 'integer',
	    description => "autonomous system number",
	    minimum => 0,
	    maximum => 4294967296
	},
	peers => {
	    description => "peers address list.",
	    type => 'string', format => 'ip-list'
	},
    };
}

sub options {
    return {
	'asn' => { optional => 0 },
	'peers' => { optional => 0 },
    };
}

# Plugin implementation
sub generate_controller_config {
    my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;

    my @peers;
    @peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};

    my $local_node = PVE::INotify::nodename();

    my $asn = $plugin_config->{asn};
    my $ebgp = undef;
    my $loopback = undef;
    my $autortas = undef;
    my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
    if($bgprouter) {
	$ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	$autortas = $plugin_config->{'asn'} if $ebgp;
    }

    return if !$asn;

    my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};

    my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);

    my $remoteas = $ebgp ? "external" : $asn;

    #global options
    my @controller_config = (
	"bgp router-id $ifaceip",
	"no bgp default ipv4-unicast",
	"coalesce-time 1000",
    );

    push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;

    @controller_config = ();
    
    #VTEP neighbors
    push @controller_config, "neighbor VTEP peer-group";
    push @controller_config, "neighbor VTEP remote-as $remoteas";
    push @controller_config, "neighbor VTEP bfd";

    if($ebgp && $loopback) {
	push @controller_config, "neighbor VTEP ebgp-multihop 10";
	push @controller_config, "neighbor VTEP update-source $loopback";
    }

    # VTEP peers
    foreach my $address (@peers) {
	next if $address eq $ifaceip;
	push @controller_config, "neighbor $address peer-group VTEP";
    }

    push(@{$bgp->{""}}, @controller_config);

    # address-family l2vpn
    @controller_config = ();
    push @controller_config, "neighbor VTEP route-map MAP_VTEP_IN in";
    push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
    push @controller_config, "neighbor VTEP activate";
    push @controller_config, "advertise-all-vni";
    push @controller_config, "autort as $autortas" if $autortas;
    push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);

    my $routemap = { rule => undef, action => "permit" };
    push(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap );
    push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap );

    return $config;
}

sub generate_controller_zone_config {
    my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;

    my $local_node = PVE::INotify::nodename();

    my $vrf = "vrf_$id";
    my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
    my $exitnodes = $plugin_config->{'exitnodes'};
    my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
    my $advertisesubnets = $plugin_config->{'advertise-subnets'};
    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
    my $rt_import = [PVE::Tools::split_list($plugin_config->{'rt-import'})] if $plugin_config->{'rt-import'};

    my $asn = $controller->{asn};
    my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
    my $ebgp = undef;
    my $loopback = undef;
    my $autortas = undef;
    my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
    if($bgprouter) {
        $ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	$autortas = $controller->{'asn'} if $ebgp;
    }

    return if !$vrf || !$vrfvxlan || !$asn;

    my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);

    # vrf
    my @controller_config = ();
    push @controller_config, "vni $vrfvxlan";
    push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);

    #main vrf router
    @controller_config = ();
    push @controller_config, "bgp router-id $ifaceip";
#    push @controller_config, "!";
    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);

    if ($autortas) {
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
    }

    my $is_gateway = $exitnodes->{$local_node};

    if ($is_gateway) {

	if(!$exitnodes_primary || $exitnodes_primary eq $local_node) {
	    #filter default type5 route coming from other exit nodes on primary node or both nodes if no primary is defined.
	    my $routemap_config = ();
	    push @{$routemap_config}, "match evpn route-type prefix";
	    my $routemap = { rule => $routemap_config, action => "deny" };
	    unshift(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap);
	} elsif ($exitnodes_primary ne $local_node) {
	    my $routemap_config = ();
	    push @{$routemap_config}, "match evpn vni $vrfvxlan";
	    push @{$routemap_config}, "match evpn route-type prefix";
	    push @{$routemap_config}, "set metric 200";
	    my $routemap = { rule => $routemap_config, action => "permit" };
	    unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap);
        }


	if (!$exitnodes_local_routing) {
	    @controller_config = ();
	    #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
	    push @controller_config, "import vrf $vrf";
	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);

	    @controller_config = ();
	    #redistribute connected to be able to route to local vms on the gateway
	    push @controller_config, "redistribute connected";
	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	}

	@controller_config = ();
	#add default originate to announce 0.0.0.0/0 type5 route in evpn
	push @controller_config, "default-originate ipv4";
	push @controller_config, "default-originate ipv6";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    } elsif ($advertisesubnets) {

	@controller_config = ();
	#redistribute connected networks
	push @controller_config, "redistribute connected";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);

	@controller_config = ();
	#advertise connected networks type5 route in evpn
	push @controller_config, "advertise ipv4 unicast";
	push @controller_config, "advertise ipv6 unicast";
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    }

    if($rt_import) {
	@controller_config = ();
	foreach my $rt (sort @{$rt_import}) {
	    push @controller_config, "route-target import $rt";
	}
	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
    }

    return $config;
}

sub generate_controller_vnet_config {
    my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;

    my $exitnodes = $zone->{'exitnodes'};
    my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};

    return if !$exitnodes_local_routing;

    my $local_node = PVE::INotify::nodename();
    my $is_gateway = $exitnodes->{$local_node};
    
    return if !$is_gateway;

    my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
    my @controller_config = ();
    foreach my $subnetid (sort keys %{$subnets}) {
        my $subnet = $subnets->{$subnetid};
	my $cidr = $subnet->{cidr};
	push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
    }
    push(@{$config->{frr}->{''}}, @controller_config);
}

sub on_delete_hook {
    my ($class, $controllerid, $zone_cfg) = @_;

    # verify that zone is associated to this controller
    foreach my $id (keys %{$zone_cfg->{ids}}) {
	my $zone = $zone_cfg->{ids}->{$id};
	die "controller $controllerid is used by $id"
	    if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
    }
}

sub on_update_hook {
    my ($class, $controllerid, $controller_cfg) = @_;

    # we can only have 1 evpn controller / 1 asn by server

    my $controllernb = 0;
    foreach my $id (keys %{$controller_cfg->{ids}}) {
	next if $id eq $controllerid;
	my $controller = $controller_cfg->{ids}->{$id};
	next if $controller->{type} ne "evpn";
	$controllernb++;
	die "only 1 global evpn controller can be defined" if $controllernb > 1;
    }
}

sub find_bgp_controller {
    my ($nodename, $controller_cfg) = @_;

    my $controller = undef;
    foreach my $id  (keys %{$controller_cfg->{ids}}) {
        $controller = $controller_cfg->{ids}->{$id};
        next if $controller->{type} ne 'bgp';
        next if $controller->{node} ne $nodename;
	last;
    }

    return $controller;
}


sub sort_frr_config {
    my $order = {};
    $order->{''} = 0;
    $order->{'vrf'} = 1;
    $order->{'ipv4 unicast'} = 1;
    $order->{'ipv6 unicast'} = 2;
    $order->{'l2vpn evpn'} = 3;

    my $a_val = 100;
    my $b_val = 100;

    $a_val = $order->{$a} if defined($order->{$a});
    $b_val = $order->{$b} if defined($order->{$b});

    if ($a =~ /bgp (\d+)$/) {
	$a_val = 2;
    }

    if ($b =~ /bgp (\d+)$/) {
	$b_val = 2;
    }

    return $a_val <=> $b_val;
}

sub generate_frr_recurse{
   my ($final_config, $content, $parentkey, $level) = @_;

   my $keylist = {};
   $keylist->{vrf} = 1;
   $keylist->{'address-family'} = 1;
   $keylist->{router} = 1;

   my $exitkeylist = {};
   $exitkeylist->{vrf} = 1;
   $exitkeylist->{'address-family'} = 1;

   # FIXME: make this generic
   my $paddinglevel = undef;
   if ($level == 1 || $level == 2) {
	$paddinglevel = $level - 1;
   } elsif ($level == 3 || $level ==  4) {
	$paddinglevel = $level - 2;
   }

   my $padding = "";
   $padding = ' ' x ($paddinglevel) if $paddinglevel;

   if (ref $content eq  'HASH') {
	foreach my $key (sort sort_frr_config keys %$content) {
	    if ($parentkey && defined($keylist->{$parentkey})) {
		push @{$final_config}, $padding."!";
		push @{$final_config}, $padding."$parentkey $key";
	    } elsif ($key ne '' && !defined($keylist->{$key})) {
		push @{$final_config}, $padding."$key";
	    }

	    my $option = $content->{$key};
	    generate_frr_recurse($final_config, $option, $key, $level+1);

	    push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
	}
    }

    if (ref $content eq 'ARRAY') {
	push @{$final_config}, map { $padding . "$_" } @$content;
    }
}

sub generate_frr_routemap {
   my ($final_config, $routemaps) = @_;

   foreach my $id (sort keys %$routemaps) {

	my $routemap = $routemaps->{$id};
	my $order = 0;
	foreach my $seq (@$routemap) {
		$order++;
		next if !defined($seq->{action});
		my @config = ();
		push @config, "!";
		push @config, "route-map $id $seq->{action} $order";
		my $rule = $seq->{rule};
		push @config, map { " $_" } @$rule;
		push @{$final_config}, @config;
	}
   }
}
sub generate_controller_rawconfig {
    my ($class, $plugin_config, $config) = @_;

    my $nodename = PVE::INotify::nodename();

    my $final_config = [];
    push @{$final_config}, "frr version 8.2.2";
    push @{$final_config}, "frr defaults datacenter";
    push @{$final_config}, "hostname $nodename";
    push @{$final_config}, "log syslog informational";
    push @{$final_config}, "service integrated-vtysh-config";
    push @{$final_config}, "!";

    if (-e "/etc/frr/frr.conf.local") {
	generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
	generate_frr_routemap($final_config, $config->{frr_routemap});
	push @{$final_config}, "!";

	my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
	chomp ($local_conf);
	push @{$final_config}, $local_conf;
    } else {
	generate_frr_recurse($final_config, $config->{frr}, undef, 0);
	generate_frr_routemap($final_config, $config->{frr_routemap});
    }

    push @{$final_config}, "!";
    push @{$final_config}, "line vty";
    push @{$final_config}, "!";

    my $rawconfig = join("\n", @{$final_config});

    return if !$rawconfig;
    return $rawconfig;
}

sub write_controller_config {
    my ($class, $plugin_config, $config) = @_;

    my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
    return if !$rawconfig;
    return if !-d "/etc/frr";

    file_set_contents("/etc/frr/frr.conf", $rawconfig);
}

sub reload_controller {
    my ($class) = @_;

    my $conf_file = "/etc/frr/frr.conf";
    my $bin_path = "/usr/lib/frr/frr-reload.py";

    if (!-e $bin_path) {
	warn "missing $bin_path. Please install frr-pythontools package";
	return;
    }

    my $err = sub {
	my $line = shift;
	if ($line =~ /ERROR:/) {
	    warn "$line \n";
	}
    };

    if (-e $conf_file && -e $bin_path) {
	eval {
	    run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
	};
	if ($@) {
	    warn "frr reload command fail. Restarting frr.";
	    eval { run_command(['systemctl', 'restart', 'frr']); };
	}
    }
}

1;
Commit	Line	Data
fa253735	1	package PVE::Network::SDN::Controllers::EvpnPlugin;
32602a38 AD	2
	3	use strict;
	4	use warnings;
cdf2c819	5
074d270b AD	6	use PVE::INotify;
074d270b AD	7	use PVE::JSONSchema qw(get_standard_option);
cdf2c819 TL	8	use PVE::Tools qw(run_command file_set_contents file_get_contents);
	9
	10	use PVE::Network::SDN::Controllers::Plugin;
1f543c5f	11	use PVE::Network::SDN::Zones::Plugin;
f23633dc	12	use Net::IP;
cdf2c819	13
f5eabba0	14	use base('PVE::Network::SDN::Controllers::Plugin');
32602a38 AD	15
32602a38 AD	16	sub type {
fa253735	17	return 'evpn';
8fb1ee7f AD	18	}
8fb1ee7f AD	19
32602a38 AD	20	sub properties {
32602a38 AD	21	return {
92526f0e TL	22	asn => {
	23	type => 'integer',
	24	description => "autonomous system number",
9e6b99fd AD	25	minimum => 0,
9e6b99fd AD	26	maximum => 4294967296
92526f0e TL	27	},
	28	peers => {
	29	description => "peers address list.",
	30	type => 'string', format => 'ip-list'
	31	},
32602a38 AD	32	};
	33	}
	34
	35	sub options {
32602a38	36	return {
92526f0e TL	37	'asn' => { optional => 0 },
92526f0e TL	38	'peers' => { optional => 0 },
32602a38 AD	39	};
	40	}
	41
	42	# Plugin implementation
8fb1ee7f	43	sub generate_controller_config {
f23633dc	44	my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;
32602a38	45
3caa7687 FG	46	my @peers;
3caa7687 FG	47	@peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};
32602a38	48
f23633dc AD	49	my $local_node = PVE::INotify::nodename();
f23633dc AD	50
074d270b	51	my $asn = $plugin_config->{asn};
f23633dc AD	52	my $ebgp = undef;
	53	my $loopback = undef;
	54	my $autortas = undef;
	55	my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
	56	if($bgprouter) {
	57	$ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
	58	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	59	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	60	$autortas = $plugin_config->{'asn'} if $ebgp;
	61	}
074d270b AD	62
074d270b AD	63	return if !$asn;
32602a38	64
92526f0e TL	65	my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};
92526f0e TL	66
f23633dc	67	my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
32602a38	68
f23633dc	69	my $remoteas = $ebgp ? "external" : $asn;
17854295	70
f23633dc	71	#global options
92526f0e TL	72	my @controller_config = (
	73	"bgp router-id $ifaceip",
	74	"no bgp default ipv4-unicast",
	75	"coalesce-time 1000",
	76	);
32602a38	77
f23633dc AD	78	push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;
	79
	80	@controller_config = ();
	81
	82	#VTEP neighbors
	83	push @controller_config, "neighbor VTEP peer-group";
	84	push @controller_config, "neighbor VTEP remote-as $remoteas";
	85	push @controller_config, "neighbor VTEP bfd";
	86
	87	if($ebgp && $loopback) {
	88	push @controller_config, "neighbor VTEP ebgp-multihop 10";
	89	push @controller_config, "neighbor VTEP update-source $loopback";
	90	}
	91
	92	# VTEP peers
32602a38 AD	93	foreach my $address (@peers) {
32602a38 AD	94	next if $address eq $ifaceip;
f23633dc	95	push @controller_config, "neighbor $address peer-group VTEP";
7d35eaf5	96	}
074d270b	97
92526f0e	98	push(@{$bgp->{""}}, @controller_config);
074d270b	99
f23633dc	100	# address-family l2vpn
56cdcac9	101	@controller_config = ();
916488cc	102	push @controller_config, "neighbor VTEP route-map MAP_VTEP_IN in";
847f5144	103	push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
f23633dc	104	push @controller_config, "neighbor VTEP activate";
56cdcac9	105	push @controller_config, "advertise-all-vni";
f23633dc	106	push @controller_config, "autort as $autortas" if $autortas;
92526f0e	107	push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
32602a38	108
916488cc AD	109	my $routemap = { rule => undef, action => "permit" };
	110	push(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap );
	111	push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap );
847f5144	112
32602a38 AD	113	return $config;
	114	}
	115
56cdcac9	116	sub generate_controller_zone_config {
f23633dc AD	117	my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;
	118
	119	my $local_node = PVE::INotify::nodename();
0589eb09	120
1de0abc0	121	my $vrf = "vrf_$id";
0589eb09	122	my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
f23633dc	123	my $exitnodes = $plugin_config->{'exitnodes'};
847f5144	124	my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
92d8effb	125	my $advertisesubnets = $plugin_config->{'advertise-subnets'};
3d135423	126	my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
96794fd6	127	my $rt_import = [PVE::Tools::split_list($plugin_config->{'rt-import'})] if $plugin_config->{'rt-import'};
f23633dc	128
56cdcac9	129	my $asn = $controller->{asn};
f34a898e	130	my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
f23633dc AD	131	my $ebgp = undef;
	132	my $loopback = undef;
	133	my $autortas = undef;
	134	my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
	135	if($bgprouter) {
	136	$ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
	137	$loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
	138	$asn = $bgprouter->{asn} if $bgprouter->{asn};
	139	$autortas = $controller->{'asn'} if $ebgp;
	140	}
0589eb09 AD	141
	142	return if !$vrf \|\| !$vrfvxlan \|\| !$asn;
	143
f34a898e AD	144	my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
f34a898e AD	145
92526f0e	146	# vrf
56cdcac9 AD	147	my @controller_config = ();
	148	push @controller_config, "vni $vrfvxlan";
	149	push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);
0589eb09	150
f23633dc AD	151	#main vrf router
f23633dc AD	152	@controller_config = ();
f34a898e	153	push @controller_config, "bgp router-id $ifaceip";
f23633dc AD	154	# push @controller_config, "!";
f23633dc AD	155	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);
659c27c2	156
f23633dc AD	157	if ($autortas) {
	158	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
	159	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
	160	}
0589eb09	161
b634e577 AD	162	my $is_gateway = $exitnodes->{$local_node};
b634e577 AD	163
0589eb09 AD	164	if ($is_gateway) {
0589eb09 AD	165
916488cc AD	166	if(!$exitnodes_primary \|\| $exitnodes_primary eq $local_node) {
	167	#filter default type5 route coming from other exit nodes on primary node or both nodes if no primary is defined.
	168	my $routemap_config = ();
	169	push @{$routemap_config}, "match evpn route-type prefix";
	170	my $routemap = { rule => $routemap_config, action => "deny" };
	171	unshift(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap);
	172	} elsif ($exitnodes_primary ne $local_node) {
847f5144 AD	173	my $routemap_config = ();
	174	push @{$routemap_config}, "match evpn vni $vrfvxlan";
	175	push @{$routemap_config}, "match evpn route-type prefix";
	176	push @{$routemap_config}, "set metric 200";
916488cc AD	177	my $routemap = { rule => $routemap_config, action => "permit" };
916488cc AD	178	unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap);
847f5144 AD	179	}
847f5144 AD	180
916488cc	181
3d135423 AD	182	if (!$exitnodes_local_routing) {
	183	@controller_config = ();
	184	#import /32 routes of evpn network from vrf1 to default vrf (for packet return)
	185	push @controller_config, "import vrf $vrf";
	186	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	187	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
0589eb09	188
3d135423 AD	189	@controller_config = ();
	190	#redistribute connected to be able to route to local vms on the gateway
	191	push @controller_config, "redistribute connected";
	192	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	193	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	194	}
0589eb09	195
56cdcac9	196	@controller_config = ();
0589eb09	197	#add default originate to announce 0.0.0.0/0 type5 route in evpn
56cdcac9 AD	198	push @controller_config, "default-originate ipv4";
	199	push @controller_config, "default-originate ipv6";
	200	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
92d8effb AD	201	} elsif ($advertisesubnets) {
	202
	203	@controller_config = ();
	204	#redistribute connected networks
	205	push @controller_config, "redistribute connected";
	206	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
	207	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
	208
	209	@controller_config = ();
	210	#advertise connected networks type5 route in evpn
	211	push @controller_config, "advertise ipv4 unicast";
	212	push @controller_config, "advertise ipv6 unicast";
	213	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
0589eb09 AD	214	}
0589eb09 AD	215
96794fd6 AD	216	if($rt_import) {
	217	@controller_config = ();
	218	foreach my $rt (sort @{$rt_import}) {
	219	push @controller_config, "route-target import $rt";
	220	}
	221	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
	222	}
	223
0589eb09 AD	224	return $config;
	225	}
	226
3d135423 AD	227	sub generate_controller_vnet_config {
	228	my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
	229
	230	my $exitnodes = $zone->{'exitnodes'};
	231	my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};
	232
	233	return if !$exitnodes_local_routing;
	234
	235	my $local_node = PVE::INotify::nodename();
	236	my $is_gateway = $exitnodes->{$local_node};
	237
	238	return if !$is_gateway;
	239
	240	my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
	241	my @controller_config = ();
	242	foreach my $subnetid (sort keys %{$subnets}) {
	243	my $subnet = $subnets->{$subnetid};
	244	my $cidr = $subnet->{cidr};
	245	push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
	246	}
	247	push(@{$config->{frr}->{''}}, @controller_config);
	248	}
	249
32602a38	250	sub on_delete_hook {
56cdcac9	251	my ($class, $controllerid, $zone_cfg) = @_;
32602a38	252
56cdcac9 AD	253	# verify that zone is associated to this controller
56cdcac9 AD	254	foreach my $id (keys %{$zone_cfg->{ids}}) {
92526f0e TL	255	my $zone = $zone_cfg->{ids}->{$id};
	256	die "controller $controllerid is used by $id"
	257	if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
5bda8607	258	}
32602a38 AD	259	}
	260
	261	sub on_update_hook {
56cdcac9	262	my ($class, $controllerid, $controller_cfg) = @_;
5bda8607	263
c7bb4ac5 AD	264	# we can only have 1 evpn controller / 1 asn by server
c7bb4ac5 AD	265
f23633dc	266	my $controllernb = 0;
56cdcac9 AD	267	foreach my $id (keys %{$controller_cfg->{ids}}) {
56cdcac9 AD	268	next if $id eq $controllerid;
92526f0e	269	my $controller = $controller_cfg->{ids}->{$id};
f23633dc AD	270	next if $controller->{type} ne "evpn";
	271	$controllernb++;
	272	die "only 1 global evpn controller can be defined" if $controllernb > 1;
	273	}
	274	}
	275
	276	sub find_bgp_controller {
	277	my ($nodename, $controller_cfg) = @_;
	278
	279	my $controller = undef;
	280	foreach my $id (keys %{$controller_cfg->{ids}}) {
	281	$controller = $controller_cfg->{ids}->{$id};
	282	next if $controller->{type} ne 'bgp';
	283	next if $controller->{node} ne $nodename;
	284	last;
5bda8607	285	}
f23633dc AD	286
f23633dc AD	287	return $controller;
32602a38 AD	288	}
32602a38 AD	289
f23633dc	290
8fb1ee7f AD	291	sub sort_frr_config {
	292	my $order = {};
	293	$order->{''} = 0;
	294	$order->{'vrf'} = 1;
	295	$order->{'ipv4 unicast'} = 1;
	296	$order->{'ipv6 unicast'} = 2;
	297	$order->{'l2vpn evpn'} = 3;
	298
	299	my $a_val = 100;
	300	my $b_val = 100;
	301
	302	$a_val = $order->{$a} if defined($order->{$a});
	303	$b_val = $order->{$b} if defined($order->{$b});
	304
92526f0e	305	if ($a =~ /bgp (\d+)$/) {
8fb1ee7f AD	306	$a_val = 2;
	307	}
	308
92526f0e	309	if ($b =~ /bgp (\d+)$/) {
8fb1ee7f AD	310	$b_val = 2;
	311	}
	312
	313	return $a_val <=> $b_val;
	314	}
	315
	316	sub generate_frr_recurse{
	317	my ($final_config, $content, $parentkey, $level) = @_;
	318
	319	my $keylist = {};
	320	$keylist->{vrf} = 1;
	321	$keylist->{'address-family'} = 1;
	322	$keylist->{router} = 1;
	323
	324	my $exitkeylist = {};
	325	$exitkeylist->{vrf} = 1;
	326	$exitkeylist->{'address-family'} = 1;
	327
92526f0e	328	# FIXME: make this generic
8fb1ee7f	329	my $paddinglevel = undef;
92526f0e TL	330	if ($level == 1 \|\| $level == 2) {
92526f0e TL	331	$paddinglevel = $level - 1;
8fb1ee7f	332	} elsif ($level == 3 \|\| $level == 4) {
92526f0e	333	$paddinglevel = $level - 2;
8fb1ee7f AD	334	}
	335
	336	my $padding = "";
	337	$padding = ' ' x ($paddinglevel) if $paddinglevel;
	338
92526f0e	339	if (ref $content eq 'HASH') {
8fb1ee7f AD	340	foreach my $key (sort sort_frr_config keys %$content) {
8fb1ee7f AD	341	if ($parentkey && defined($keylist->{$parentkey})) {
92526f0e TL	342	push @{$final_config}, $padding."!";
	343	push @{$final_config}, $padding."$parentkey $key";
	344	} elsif ($key ne '' && !defined($keylist->{$key})) {
	345	push @{$final_config}, $padding."$key";
8fb1ee7f AD	346	}
	347
	348	my $option = $content->{$key};
	349	generate_frr_recurse($final_config, $option, $key, $level+1);
	350
	351	push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
	352	}
	353	}
32602a38	354
8fb1ee7f	355	if (ref $content eq 'ARRAY') {
92526f0e	356	push @{$final_config}, map { $padding . "$_" } @$content;
8fb1ee7f AD	357	}
	358	}
	359
847f5144 AD	360	sub generate_frr_routemap {
	361	my ($final_config, $routemaps) = @_;
	362
	363	foreach my $id (sort keys %$routemaps) {
	364
	365	my $routemap = $routemaps->{$id};
	366	my $order = 0;
	367	foreach my $seq (@$routemap) {
	368	$order++;
916488cc	369	next if !defined($seq->{action});
847f5144 AD	370	my @config = ();
847f5144 AD	371	push @config, "!";
916488cc AD	372	push @config, "route-map $id $seq->{action} $order";
	373	my $rule = $seq->{rule};
	374	push @config, map { " $_" } @$rule;
847f5144 AD	375	push @{$final_config}, @config;
	376	}
	377	}
	378	}
9cef13e9	379	sub generate_controller_rawconfig {
8fb1ee7f AD	380	my ($class, $plugin_config, $config) = @_;
8fb1ee7f AD	381
659c27c2 AD	382	my $nodename = PVE::INotify::nodename();
659c27c2 AD	383
8fb1ee7f	384	my $final_config = [];
4bd3d7bf	385	push @{$final_config}, "frr version 8.2.2";
67a0f815	386	push @{$final_config}, "frr defaults datacenter";
659c27c2	387	push @{$final_config}, "hostname $nodename";
9c7dded6 AD	388	push @{$final_config}, "log syslog informational";
9c7dded6 AD	389	push @{$final_config}, "service integrated-vtysh-config";
8fb1ee7f AD	390	push @{$final_config}, "!";
8fb1ee7f AD	391
0d1ab7dc	392	if (-e "/etc/frr/frr.conf.local") {
0d1ab7dc	393	generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
847f5144	394	generate_frr_routemap($final_config, $config->{frr_routemap});
0d1ab7dc AD	395	push @{$final_config}, "!";
0d1ab7dc AD	396
cdf2c819 TL	397	my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
	398	chomp ($local_conf);
	399	push @{$final_config}, $local_conf;
0d1ab7dc AD	400	} else {
0d1ab7dc AD	401	generate_frr_recurse($final_config, $config->{frr}, undef, 0);
847f5144	402	generate_frr_routemap($final_config, $config->{frr_routemap});
0d1ab7dc	403	}
8fb1ee7f AD	404
	405	push @{$final_config}, "!";
	406	push @{$final_config}, "line vty";
	407	push @{$final_config}, "!";
	408
	409	my $rawconfig = join("\n", @{$final_config});
	410
9cef13e9 AD	411	return if !$rawconfig;
	412	return $rawconfig;
	413	}
	414
	415	sub write_controller_config {
	416	my ($class, $plugin_config, $config) = @_;
	417
	418	my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
8fb1ee7f AD	419	return if !$rawconfig;
	420	return if !-d "/etc/frr";
	421
cdf2c819	422	file_set_contents("/etc/frr/frr.conf", $rawconfig);
8fb1ee7f AD	423	}
8fb1ee7f AD	424
fa609bdd AD	425	sub reload_controller {
	426	my ($class) = @_;
	427
	428	my $conf_file = "/etc/frr/frr.conf";
659c27c2 AD	429	my $bin_path = "/usr/lib/frr/frr-reload.py";
	430
	431	if (!-e $bin_path) {
	432	warn "missing $bin_path. Please install frr-pythontools package";
	433	return;
	434	}
fa609bdd AD	435
	436	my $err = sub {
	437	my $line = shift;
659c27c2 AD	438	if ($line =~ /ERROR:/) {
659c27c2 AD	439	warn "$line \n";
fa609bdd AD	440	}
	441	};
	442
	443	if (-e $conf_file && -e $bin_path) {
9c24bcc5 AD	444	eval {
	445	run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
	446	};
	447	if ($@) {
	448	warn "frr reload command fail. Restarting frr.";
	449	eval { run_command(['systemctl', 'restart', 'frr']); };
	450	}
fa609bdd AD	451	}
	452	}
	453
8fb1ee7f	454	1;
32602a38	455
0589eb09	456