[pve-network.git] / PVE / Network / SDN / Zones / EvpnPlugin.pm

package PVE::Network::SDN::Zones::EvpnPlugin;

use strict;
use warnings;
use PVE::Network::SDN::Zones::VxlanPlugin;
use PVE::Exception qw(raise raise_param_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Tools qw($IPV4RE);
use PVE::INotify;
use PVE::Cluster;
use PVE::Tools;
use Net::IP;

use PVE::Network::SDN::Controllers::EvpnPlugin;

use base('PVE::Network::SDN::Zones::VxlanPlugin');

sub type {
    return 'evpn';
}

PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt);
sub pve_verify_sdn_bgp_rt {
    my ($rt) = @_;

    if ($rt =~ m/^(\d+):(\d+)$/) {
	my $asn = $1;
	my $id = $2;

	if ($asn < 0 || $asn > 4294967295) {
	    die "value does not look like a valid bgp route-target\n";
	}
	if ($id < 0 || $id > 4294967295) {
	    die "value does not look like a valid bgp route-target\n";
	}
    } else {
	die "value does not look like a valid bgp route-target\n";
    }
    return $rt;
}

sub properties {
    return {
	'vrf-vxlan' => {
	    type => 'integer',
	    description => "l3vni.",
	},
	'controller' => {
	    type => 'string',
	    description => "Frr router name",
	},
	'mac' => {
	    type => 'string',
	    description => "Anycast logical router mac address",
	    optional => 1, format => 'mac-addr'
	},
	'exitnodes' => get_standard_option('pve-node-list'),
	'exitnodes-local-routing' => {
	    type => 'boolean',
	    description => "Allow exitnodes to connect to evpn guests",
	    optional => 1
	},
	'exitnodes-primary' => get_standard_option('pve-node', {
	    description => "Force traffic to this exitnode first."}),
	'advertise-subnets' => {
	    type => 'boolean',
	    description => "Advertise evpn subnets if you have silent hosts",
	    optional => 1
	},
	'disable-arp-nd-suppression' => {
	    type => 'boolean',
	    description => "Disable ipv4 arp && ipv6 neighbour discovery suppression",
	    optional => 1
	},
	'rt-import' => {
	    type => 'string',
	    description => "Route-Target import",
	    optional => 1, format => 'pve-sdn-bgp-rt-list'
        }
    };
}

sub options {
    return {
	nodes => { optional => 1},
	'vrf-vxlan' => { optional => 0 },
	controller => { optional => 0 },
	exitnodes => { optional => 1 },
	'exitnodes-local-routing' => { optional => 1 },
	'exitnodes-primary' => { optional => 1 },
	'advertise-subnets' => { optional => 1 },
	'disable-arp-nd-suppression' => { optional => 1 },
	'rt-import' => { optional => 1 },
	mtu => { optional => 1 },
	mac => { optional => 1 },
	dns => { optional => 1 },
	reversedns => { optional => 1 },
	dnszone => { optional => 1 },
	ipam => { optional => 1 },
    };
}

# Plugin implementation
sub generate_sdn_config {
    my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;

    my $tag = $vnet->{tag};
    my $alias = $vnet->{alias};
    my $mac = $plugin_config->{'mac'};

    my $vrf_iface = "vrf_$zoneid";
    my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
    my $local_node = PVE::INotify::nodename();

    die "missing vxlan tag" if !$tag;
    die "missing controller" if !$controller;
    warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};

    my @peers = PVE::Tools::split_list($controller->{'peers'});
    my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
    my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
    my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
    my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};


    my $mtu = 1450;
    $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
    $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};

    #vxlan interface
    my $vxlan_iface = "vxlan_$vnetid";
    my @iface_config = ();
    push @iface_config, "vxlan-id $tag";
    push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
    push @iface_config, "bridge-learning off";
    push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};

    push @iface_config, "mtu $mtu" if $mtu;
    push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};

    #vnet bridge
    @iface_config = ();

    my $address = {};
    my $ipv4 = undef;
    my $ipv6 = undef;
    my $enable_forward_v4 = undef;
    my $enable_forward_v6 = undef;
    my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
    foreach my $subnetid (sort keys %{$subnets}) {
	my $subnet = $subnets->{$subnetid};
	my $cidr = $subnet->{cidr};
	my $mask = $subnet->{mask};

	my $gateway = $subnet->{gateway};
	if ($gateway) {
	    push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
	    $address->{$gateway} = 1;
	}

        my $iptables = undef;
        my $checkrouteip = undef;
        my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;

	if ($ipversion == 6) {
	    $ipv6 = 1;
	    $iptables = "ip6tables";
	    $checkrouteip = '2001:4860:4860::8888';
	    $enable_forward_v6 = 1 if $gateway;
	} else {
	    $ipv4 = 1;
	    $iptables = "iptables";
	    $checkrouteip = '8.8.8.8';
	    $enable_forward_v4 = 1 if $gateway;
	}

	if ($subnet->{snat}) {

            #find outgoing interface
            my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
            if ($outip && $outiface && $is_evpn_gateway) {
                #use snat, faster than masquerade
                push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
                push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
                #add conntrack zone once on outgoing interface
                push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
                push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
            }
        }
    }

    push @iface_config, "hwaddress $mac" if $mac;
    push @iface_config, "bridge_ports $vxlan_iface";
    push @iface_config, "bridge_stp off";
    push @iface_config, "bridge_fd 0";
    push @iface_config, "mtu $mtu" if $mtu;
    push @iface_config, "alias $alias" if $alias;
    push @iface_config, "ip-forward on" if $enable_forward_v4;
    push @iface_config, "ip6-forward on" if $enable_forward_v6;
    push @iface_config, "arp-accept on" if $ipv4||$ipv6;
    push @iface_config, "vrf $vrf_iface" if $vrf_iface;
    push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};

    if ($vrf_iface) {
	#vrf interface
	@iface_config = ();
	push @iface_config, "vrf-table auto";
	if(!$is_evpn_gateway) {
	    push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
	} else {
	    push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
	}

	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};

	if ($vrfvxlan) {
	    #l3vni vxlan interface
	    my $iface_vrf_vxlan = "vrfvx_$zoneid";
	    @iface_config = ();
	    push @iface_config, "vxlan-id $vrfvxlan";
	    push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
	    push @iface_config, "bridge-learning off";
	    push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
	    push @iface_config, "mtu $mtu" if $mtu;
	    push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};

	    #l3vni bridge
	    my $brvrf = "vrfbr_$zoneid";
	    @iface_config = ();
	    push @iface_config, "bridge-ports $iface_vrf_vxlan";
	    push @iface_config, "bridge_stp off";
	    push @iface_config, "bridge_fd 0";
	    push @iface_config, "mtu $mtu" if $mtu;
	    push @iface_config, "vrf $vrf_iface";
	    push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
	}

	if ( $is_evpn_gateway && $exitnodes_local_routing ) {
	    #add a veth pair for local cross-vrf routing
	    my $iface_xvrf = "xvrf_$zoneid";
	    my $iface_xvrfp = "xvrfp_$zoneid";

	    @iface_config = ();
	    push @iface_config, "link-type veth";
	    push @iface_config, "address 10.255.255.1/30";
	    push @iface_config, "veth-peer-name $iface_xvrfp";
	    push @iface_config, "mtu ".($mtu+50) if $mtu;
	    push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};

	    @iface_config = ();
	    push @iface_config, "link-type veth";
	    push @iface_config, "address 10.255.255.2/30";
	    push @iface_config, "veth-peer-name $iface_xvrf";
	    push @iface_config, "vrf $vrf_iface";
	    push @iface_config, "mtu ".($mtu+50) if $mtu;
	    push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
	}
    }
    return $config;
}

sub on_update_hook {
    my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;

    # verify that controller exist
    my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
    if (!defined($controller_cfg->{ids}->{$controller})) {
	die "controller $controller don't exist";
    } else {
	die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
    }

    #vrf-vxlan need to be defined

    my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
    # verify that vrf-vxlan is not already declared in another zone
    foreach my $id (keys %{$zone_cfg->{ids}}) {
	next if $id eq $zoneid;
	die "vrf-vxlan $vrfvxlan is already declared in $id"
		if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
    }

    if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
	my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	$zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
    }
}


sub vnet_update_hook {
    my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;

    my $vnet = $vnet_cfg->{ids}->{$vnetid};
    my $tag = $vnet->{tag};

    raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
    raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;

    # verify that tag is not already defined globally (vxlan-id are unique)
    foreach my $id (keys %{$vnet_cfg->{ids}}) {
	next if $id eq $vnetid;
	my $othervnet = $vnet_cfg->{ids}->{$id};
	my $other_tag = $othervnet->{tag};
	my $other_zoneid = $othervnet->{zone};
	my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
	next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
	raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
    }
}


1;
Commit	Line	Data
f5eabba0	1	package PVE::Network::SDN::Zones::EvpnPlugin;
63586d2f AD	2
	3	use strict;
	4	use warnings;
f5eabba0	5	use PVE::Network::SDN::Zones::VxlanPlugin;
7fdeb441	6	use PVE::Exception qw(raise raise_param_exc);
f23633dc	7	use PVE::JSONSchema qw(get_standard_option);
63586d2f AD	8	use PVE::Tools qw($IPV4RE);
63586d2f AD	9	use PVE::INotify;
5ca07ed9 AD	10	use PVE::Cluster;
5ca07ed9 AD	11	use PVE::Tools;
645d5f4e	12	use Net::IP;
5ca07ed9	13
4405f2de	14	use PVE::Network::SDN::Controllers::EvpnPlugin;
63586d2f	15
f5eabba0	16	use base('PVE::Network::SDN::Zones::VxlanPlugin');
63586d2f AD	17
	18	sub type {
	19	return 'evpn';
	20	}
	21
96794fd6 AD	22	PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt);
	23	sub pve_verify_sdn_bgp_rt {
	24	my ($rt) = @_;
	25
	26	if ($rt =~ m/^(\d+):(\d+)$/) {
	27	my $asn = $1;
	28	my $id = $2;
	29
	30	if ($asn < 0 \|\| $asn > 4294967295) {
	31	die "value does not look like a valid bgp route-target\n";
	32	}
	33	if ($id < 0 \|\| $id > 4294967295) {
	34	die "value does not look like a valid bgp route-target\n";
	35	}
	36	} else {
	37	die "value does not look like a valid bgp route-target\n";
	38	}
	39	return $rt;
	40	}
	41
63586d2f AD	42	sub properties {
63586d2f AD	43	return {
63586d2f AD	44	'vrf-vxlan' => {
	45	type => 'integer',
	46	description => "l3vni.",
	47	},
	48	'controller' => {
	49	type => 'string',
	50	description => "Frr router name",
	51	},
65cb893e TL	52	'mac' => {
	53	type => 'string',
	54	description => "Anycast logical router mac address",
	55	optional => 1, format => 'mac-addr'
	56	},
f23633dc	57	'exitnodes' => get_standard_option('pve-node-list'),
3d135423 AD	58	'exitnodes-local-routing' => {
	59	type => 'boolean',
	60	description => "Allow exitnodes to connect to evpn guests",
	61	optional => 1
	62	},
847f5144 AD	63	'exitnodes-primary' => get_standard_option('pve-node', {
847f5144 AD	64	description => "Force traffic to this exitnode first."}),
92d8effb AD	65	'advertise-subnets' => {
	66	type => 'boolean',
	67	description => "Advertise evpn subnets if you have silent hosts",
	68	optional => 1
b1a5c31e AD	69	},
	70	'disable-arp-nd-suppression' => {
	71	type => 'boolean',
	72	description => "Disable ipv4 arp && ipv6 neighbour discovery suppression",
	73	optional => 1
96794fd6 AD	74	},
	75	'rt-import' => {
	76	type => 'string',
	77	description => "Route-Target import",
	78	optional => 1, format => 'pve-sdn-bgp-rt-list'
	79	}
63586d2f AD	80	};
	81	}
	82
	83	sub options {
63586d2f	84	return {
65cb893e TL	85	nodes => { optional => 1},
	86	'vrf-vxlan' => { optional => 0 },
	87	controller => { optional => 0 },
f23633dc	88	exitnodes => { optional => 1 },
3d135423	89	'exitnodes-local-routing' => { optional => 1 },
847f5144	90	'exitnodes-primary' => { optional => 1 },
92d8effb	91	'advertise-subnets' => { optional => 1 },
b1a5c31e	92	'disable-arp-nd-suppression' => { optional => 1 },
96794fd6	93	'rt-import' => { optional => 1 },
823f2e2a	94	mtu => { optional => 1 },
8313a2c0	95	mac => { optional => 1 },
4ad78442 AD	96	dns => { optional => 1 },
	97	reversedns => { optional => 1 },
	98	dnszone => { optional => 1 },
57a335c4	99	ipam => { optional => 1 },
63586d2f AD	100	};
	101	}
	102
	103	# Plugin implementation
	104	sub generate_sdn_config {
efffa0ff	105	my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
63586d2f AD	106
	107	my $tag = $vnet->{tag};
	108	my $alias = $vnet->{alias};
8313a2c0	109	my $mac = $plugin_config->{'mac'};
63586d2f	110
1de0abc0	111	my $vrf_iface = "vrf_$zoneid";
63586d2f	112	my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
53b2cc90	113	my $local_node = PVE::INotify::nodename();
63586d2f AD	114
63586d2f AD	115	die "missing vxlan tag" if !$tag;
f23633dc	116	die "missing controller" if !$controller;
912fb443	117	warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
63586d2f	118
5a60da84	119	my @peers = PVE::Tools::split_list($controller->{'peers'});
efffa0ff AD	120	my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
efffa0ff AD	121	my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
f23633dc	122	my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
110b881d	123	my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
3d135423 AD	124	my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
3d135423 AD	125
63586d2f AD	126
63586d2f AD	127	my $mtu = 1450;
ba7ac021	128	$mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
0251ed2f	129	$mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
63586d2f AD	130
63586d2f AD	131	#vxlan interface
1de0abc0	132	my $vxlan_iface = "vxlan_$vnetid";
63586d2f AD	133	my @iface_config = ();
63586d2f AD	134	push @iface_config, "vxlan-id $tag";
63586d2f AD	135	push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
63586d2f AD	136	push @iface_config, "bridge-learning off";
b1a5c31e	137	push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
63586d2f AD	138
63586d2f AD	139	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	140	push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
63586d2f AD	141
	142	#vnet bridge
	143	@iface_config = ();
7024ec2b	144
e612faf6	145	my $address = {};
645d5f4e AD	146	my $ipv4 = undef;
645d5f4e AD	147	my $ipv6 = undef;
bdec7089 AD	148	my $enable_forward_v4 = undef;
bdec7089 AD	149	my $enable_forward_v6 = undef;
5d3e0248	150	my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
e612faf6 AD	151	foreach my $subnetid (sort keys %{$subnets}) {
e612faf6 AD	152	my $subnet = $subnets->{$subnetid};
e8736dac	153	my $cidr = $subnet->{cidr};
9f4f6c2e	154	my $mask = $subnet->{mask};
e8736dac	155
e612faf6 AD	156	my $gateway = $subnet->{gateway};
e612faf6 AD	157	if ($gateway) {
9f4f6c2e	158	push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
e612faf6 AD	159	$address->{$gateway} = 1;
e612faf6 AD	160	}
b634e577	161
645d5f4e AD	162	my $iptables = undef;
	163	my $checkrouteip = undef;
	164	my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;
	165
	166	if ($ipversion == 6) {
	167	$ipv6 = 1;
	168	$iptables = "ip6tables";
	169	$checkrouteip = '2001:4860:4860::8888';
bdec7089	170	$enable_forward_v6 = 1 if $gateway;
645d5f4e AD	171	} else {
	172	$ipv4 = 1;
	173	$iptables = "iptables";
	174	$checkrouteip = '8.8.8.8';
bdec7089	175	$enable_forward_v4 = 1 if $gateway;
645d5f4e AD	176	}
645d5f4e AD	177
53b2cc90	178	if ($subnet->{snat}) {
b634e577	179
53b2cc90	180	#find outgoing interface
645d5f4e	181	my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
53b2cc90 AD	182	if ($outip && $outiface && $is_evpn_gateway) {
53b2cc90 AD	183	#use snat, faster than masquerade
645d5f4e AD	184	push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
645d5f4e AD	185	push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
53b2cc90	186	#add conntrack zone once on outgoing interface
645d5f4e AD	187	push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
645d5f4e AD	188	push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
53b2cc90 AD	189	}
53b2cc90 AD	190	}
7024ec2b AD	191	}
7024ec2b AD	192
63586d2f	193	push @iface_config, "hwaddress $mac" if $mac;
1de0abc0	194	push @iface_config, "bridge_ports $vxlan_iface";
63586d2f AD	195	push @iface_config, "bridge_stp off";
	196	push @iface_config, "bridge_fd 0";
	197	push @iface_config, "mtu $mtu" if $mtu;
	198	push @iface_config, "alias $alias" if $alias;
bdec7089 AD	199	push @iface_config, "ip-forward on" if $enable_forward_v4;
bdec7089 AD	200	push @iface_config, "ip6-forward on" if $enable_forward_v6;
63586d2f	201	push @iface_config, "arp-accept on" if $ipv4\|\|$ipv6;
1de0abc0	202	push @iface_config, "vrf $vrf_iface" if $vrf_iface;
63586d2f AD	203	push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
63586d2f AD	204
1de0abc0	205	if ($vrf_iface) {
63586d2f AD	206	#vrf interface
	207	@iface_config = ();
	208	push @iface_config, "vrf-table auto";
110b881d AD	209	if(!$is_evpn_gateway) {
	210	push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
	211	} else {
	212	push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
	213	}
	214
1de0abc0	215	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
63586d2f AD	216
	217	if ($vrfvxlan) {
	218	#l3vni vxlan interface
1de0abc0	219	my $iface_vrf_vxlan = "vrfvx_$zoneid";
63586d2f AD	220	@iface_config = ();
	221	push @iface_config, "vxlan-id $vrfvxlan";
	222	push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
	223	push @iface_config, "bridge-learning off";
b1a5c31e	224	push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
63586d2f	225	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	226	push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
63586d2f AD	227
63586d2f AD	228	#l3vni bridge
1de0abc0	229	my $brvrf = "vrfbr_$zoneid";
63586d2f	230	@iface_config = ();
1de0abc0	231	push @iface_config, "bridge-ports $iface_vrf_vxlan";
63586d2f AD	232	push @iface_config, "bridge_stp off";
	233	push @iface_config, "bridge_fd 0";
	234	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	235	push @iface_config, "vrf $vrf_iface";
63586d2f AD	236	push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
63586d2f AD	237	}
63586d2f	238
3d135423 AD	239	if ( $is_evpn_gateway && $exitnodes_local_routing ) {
	240	#add a veth pair for local cross-vrf routing
	241	my $iface_xvrf = "xvrf_$zoneid";
	242	my $iface_xvrfp = "xvrfp_$zoneid";
	243
	244	@iface_config = ();
	245	push @iface_config, "link-type veth";
	246	push @iface_config, "address 10.255.255.1/30";
	247	push @iface_config, "veth-peer-name $iface_xvrfp";
	248	push @iface_config, "mtu ".($mtu+50) if $mtu;
	249	push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};
	250
	251	@iface_config = ();
	252	push @iface_config, "link-type veth";
	253	push @iface_config, "address 10.255.255.2/30";
	254	push @iface_config, "veth-peer-name $iface_xvrf";
	255	push @iface_config, "vrf $vrf_iface";
	256	push @iface_config, "mtu ".($mtu+50) if $mtu;
	257	push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
	258	}
	259	}
63586d2f AD	260	return $config;
	261	}
	262
	263	sub on_update_hook {
a2b32a94 AD	264	my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
	265
	266	# verify that controller exist
	267	my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
	268	if (!defined($controller_cfg->{ids}->{$controller})) {
	269	die "controller $controller don't exist";
	270	} else {
	271	die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
	272	}
63586d2f	273
7cb9714d	274	#vrf-vxlan need to be defined
a2b32a94 AD	275
	276	my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
	277	# verify that vrf-vxlan is not already declared in another zone
	278	foreach my $id (keys %{$zone_cfg->{ids}}) {
	279	next if $id eq $zoneid;
	280	die "vrf-vxlan $vrfvxlan is already declared in $id"
	281	if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
63586d2f	282	}
5ca07ed9	283
8313a2c0 AD	284	if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
	285	my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	286	$zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
	287	}
63586d2f AD	288	}
63586d2f AD	289
1d44ce70	290
5ca07ed9	291	sub vnet_update_hook {
88d9562b	292	my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
5ca07ed9	293
88d9562b AD	294	my $vnet = $vnet_cfg->{ids}->{$vnetid};
	295	my $tag = $vnet->{tag};
	296
	297	raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
	298	raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
	299
	300	# verify that tag is not already defined globally (vxlan-id are unique)
	301	foreach my $id (keys %{$vnet_cfg->{ids}}) {
	302	next if $id eq $vnetid;
	303	my $othervnet = $vnet_cfg->{ids}->{$id};
	304	my $other_tag = $othervnet->{tag};
	305	my $other_zoneid = $othervnet->{zone};
	306	my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
	307	next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
	308	raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
	309	}
1d44ce70 AD	310	}
1d44ce70 AD	311
5ca07ed9	312
63586d2f AD	313	1;
	314
	315