]>
Commit | Line | Data |
---|---|---|
f5eabba0 | 1 | package PVE::Network::SDN::Zones::EvpnPlugin; |
63586d2f AD |
2 | |
3 | use strict; | |
4 | use warnings; | |
f5eabba0 | 5 | use PVE::Network::SDN::Zones::VxlanPlugin; |
7fdeb441 | 6 | use PVE::Exception qw(raise raise_param_exc); |
63586d2f AD |
7 | use PVE::Tools qw($IPV4RE); |
8 | use PVE::INotify; | |
5ca07ed9 AD |
9 | use PVE::Cluster; |
10 | use PVE::Tools; | |
11 | ||
4405f2de | 12 | use PVE::Network::SDN::Controllers::EvpnPlugin; |
63586d2f | 13 | |
f5eabba0 | 14 | use base('PVE::Network::SDN::Zones::VxlanPlugin'); |
63586d2f AD |
15 | |
16 | sub type { | |
17 | return 'evpn'; | |
18 | } | |
19 | ||
63586d2f AD |
20 | sub properties { |
21 | return { | |
63586d2f AD |
22 | 'vrf-vxlan' => { |
23 | type => 'integer', | |
24 | description => "l3vni.", | |
25 | }, | |
26 | 'controller' => { | |
27 | type => 'string', | |
28 | description => "Frr router name", | |
29 | }, | |
30 | }; | |
31 | } | |
32 | ||
33 | sub options { | |
34 | ||
35 | return { | |
c2b9c173 | 36 | nodes => { optional => 1}, |
63586d2f AD |
37 | 'vrf-vxlan' => { optional => 0 }, |
38 | 'controller' => { optional => 0 }, | |
823f2e2a | 39 | mtu => { optional => 1 }, |
4ad78442 AD |
40 | dns => { optional => 1 }, |
41 | reversedns => { optional => 1 }, | |
42 | dnszone => { optional => 1 }, | |
63586d2f AD |
43 | }; |
44 | } | |
45 | ||
46 | # Plugin implementation | |
47 | sub generate_sdn_config { | |
7024ec2b | 48 | my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $subnet_cfg, $interfaces_config, $config) = @_; |
63586d2f AD |
49 | |
50 | my $tag = $vnet->{tag}; | |
51 | my $alias = $vnet->{alias}; | |
52 | my $ipv4 = $vnet->{ipv4}; | |
53 | my $ipv6 = $vnet->{ipv6}; | |
54 | my $mac = $vnet->{mac}; | |
55 | ||
1de0abc0 | 56 | my $vrf_iface = "vrf_$zoneid"; |
63586d2f | 57 | my $vrfvxlan = $plugin_config->{'vrf-vxlan'}; |
53b2cc90 | 58 | my $local_node = PVE::INotify::nodename(); |
63586d2f AD |
59 | |
60 | die "missing vxlan tag" if !$tag; | |
912fb443 | 61 | warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware}; |
63586d2f | 62 | |
5a60da84 | 63 | my @peers = PVE::Tools::split_list($controller->{'peers'}); |
1f543c5f | 64 | my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers); |
63586d2f AD |
65 | |
66 | my $mtu = 1450; | |
ba7ac021 | 67 | $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu}; |
0251ed2f | 68 | $mtu = $plugin_config->{mtu} if $plugin_config->{mtu}; |
63586d2f AD |
69 | |
70 | #vxlan interface | |
1de0abc0 | 71 | my $vxlan_iface = "vxlan_$vnetid"; |
63586d2f AD |
72 | my @iface_config = (); |
73 | push @iface_config, "vxlan-id $tag"; | |
63586d2f AD |
74 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; |
75 | push @iface_config, "bridge-learning off"; | |
76 | push @iface_config, "bridge-arp-nd-suppress on"; | |
77 | ||
78 | push @iface_config, "mtu $mtu" if $mtu; | |
1de0abc0 | 79 | push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface}; |
63586d2f AD |
80 | |
81 | #vnet bridge | |
82 | @iface_config = (); | |
7024ec2b | 83 | |
e612faf6 | 84 | my $address = {}; |
5d3e0248 | 85 | my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1); |
e612faf6 AD |
86 | foreach my $subnetid (sort keys %{$subnets}) { |
87 | my $subnet = $subnets->{$subnetid}; | |
88 | my $cidr = $subnetid =~ s/-/\//r; | |
89 | my $gateway = $subnet->{gateway}; | |
90 | if ($gateway) { | |
91 | push @iface_config, "address $gateway" if !defined($address->{$gateway}); | |
92 | $address->{$gateway} = 1; | |
93 | } | |
53b2cc90 AD |
94 | if ($subnet->{snat}) { |
95 | my $gatewaynodes = $controller->{'gateway-nodes'}; | |
96 | my $is_evpn_gateway = ""; | |
97 | foreach my $evpn_gatewaynode (PVE::Tools::split_list($gatewaynodes)) { | |
98 | $is_evpn_gateway = 1 if $evpn_gatewaynode eq $local_node; | |
99 | } | |
100 | #find outgoing interface | |
101 | my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip('8.8.8.8'); | |
102 | if ($outip && $outiface && $is_evpn_gateway) { | |
103 | #use snat, faster than masquerade | |
104 | push @iface_config, "post-up iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; | |
105 | push @iface_config, "post-down iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; | |
106 | #add conntrack zone once on outgoing interface | |
107 | push @iface_config, "post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1"; | |
108 | push @iface_config, "post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1"; | |
109 | } | |
110 | } | |
7024ec2b AD |
111 | } |
112 | ||
63586d2f | 113 | push @iface_config, "hwaddress $mac" if $mac; |
1de0abc0 | 114 | push @iface_config, "bridge_ports $vxlan_iface"; |
63586d2f AD |
115 | push @iface_config, "bridge_stp off"; |
116 | push @iface_config, "bridge_fd 0"; | |
117 | push @iface_config, "mtu $mtu" if $mtu; | |
118 | push @iface_config, "alias $alias" if $alias; | |
119 | push @iface_config, "ip-forward on" if $ipv4; | |
120 | push @iface_config, "ip6-forward on" if $ipv6; | |
121 | push @iface_config, "arp-accept on" if $ipv4||$ipv6; | |
1de0abc0 | 122 | push @iface_config, "vrf $vrf_iface" if $vrf_iface; |
63586d2f AD |
123 | push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid}; |
124 | ||
1de0abc0 | 125 | if ($vrf_iface) { |
63586d2f AD |
126 | #vrf interface |
127 | @iface_config = (); | |
128 | push @iface_config, "vrf-table auto"; | |
1de0abc0 | 129 | push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface}; |
63586d2f AD |
130 | |
131 | if ($vrfvxlan) { | |
132 | #l3vni vxlan interface | |
1de0abc0 | 133 | my $iface_vrf_vxlan = "vrfvx_$zoneid"; |
63586d2f AD |
134 | @iface_config = (); |
135 | push @iface_config, "vxlan-id $vrfvxlan"; | |
136 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; | |
137 | push @iface_config, "bridge-learning off"; | |
138 | push @iface_config, "bridge-arp-nd-suppress on"; | |
139 | push @iface_config, "mtu $mtu" if $mtu; | |
1de0abc0 | 140 | push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan}; |
63586d2f AD |
141 | |
142 | #l3vni bridge | |
1de0abc0 | 143 | my $brvrf = "vrfbr_$zoneid"; |
63586d2f | 144 | @iface_config = (); |
1de0abc0 | 145 | push @iface_config, "bridge-ports $iface_vrf_vxlan"; |
63586d2f AD |
146 | push @iface_config, "bridge_stp off"; |
147 | push @iface_config, "bridge_fd 0"; | |
148 | push @iface_config, "mtu $mtu" if $mtu; | |
1de0abc0 | 149 | push @iface_config, "vrf $vrf_iface"; |
63586d2f AD |
150 | push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf}; |
151 | } | |
152 | } | |
153 | ||
154 | return $config; | |
155 | } | |
156 | ||
157 | sub on_update_hook { | |
a2b32a94 AD |
158 | my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_; |
159 | ||
160 | # verify that controller exist | |
161 | my $controller = $zone_cfg->{ids}->{$zoneid}->{controller}; | |
162 | if (!defined($controller_cfg->{ids}->{$controller})) { | |
163 | die "controller $controller don't exist"; | |
164 | } else { | |
165 | die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn'; | |
166 | } | |
63586d2f | 167 | |
7cb9714d | 168 | #vrf-vxlan need to be defined |
a2b32a94 AD |
169 | |
170 | my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'}; | |
171 | # verify that vrf-vxlan is not already declared in another zone | |
172 | foreach my $id (keys %{$zone_cfg->{ids}}) { | |
173 | next if $id eq $zoneid; | |
174 | die "vrf-vxlan $vrfvxlan is already declared in $id" | |
175 | if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan); | |
63586d2f | 176 | } |
5ca07ed9 | 177 | |
63586d2f AD |
178 | } |
179 | ||
1d44ce70 | 180 | |
5ca07ed9 AD |
181 | sub vnet_update_hook { |
182 | my ($class, $vnet) = @_; | |
183 | ||
184 | raise_param_exc({ tag => "missing vxlan tag"}) if !defined($vnet->{tag}); | |
185 | raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $vnet->{tag} > 16777216; | |
186 | ||
187 | if (!defined($vnet->{mac})) { | |
188 | my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg'); | |
189 | $vnet->{mac} = PVE::Tools::random_ether_addr($dc->{mac_prefix}); | |
190 | } | |
1d44ce70 AD |
191 | } |
192 | ||
5ca07ed9 | 193 | |
63586d2f AD |
194 | 1; |
195 | ||
196 |