]>
Commit | Line | Data |
---|---|---|
f5eabba0 | 1 | package PVE::Network::SDN::Zones::EvpnPlugin; |
63586d2f AD |
2 | |
3 | use strict; | |
4 | use warnings; | |
f5eabba0 | 5 | use PVE::Network::SDN::Zones::VxlanPlugin; |
7fdeb441 | 6 | use PVE::Exception qw(raise raise_param_exc); |
f23633dc | 7 | use PVE::JSONSchema qw(get_standard_option); |
63586d2f AD |
8 | use PVE::Tools qw($IPV4RE); |
9 | use PVE::INotify; | |
5ca07ed9 AD |
10 | use PVE::Cluster; |
11 | use PVE::Tools; | |
645d5f4e | 12 | use Net::IP; |
5ca07ed9 | 13 | |
4405f2de | 14 | use PVE::Network::SDN::Controllers::EvpnPlugin; |
63586d2f | 15 | |
f5eabba0 | 16 | use base('PVE::Network::SDN::Zones::VxlanPlugin'); |
63586d2f AD |
17 | |
18 | sub type { | |
19 | return 'evpn'; | |
20 | } | |
21 | ||
63586d2f AD |
22 | sub properties { |
23 | return { | |
63586d2f AD |
24 | 'vrf-vxlan' => { |
25 | type => 'integer', | |
26 | description => "l3vni.", | |
27 | }, | |
28 | 'controller' => { | |
29 | type => 'string', | |
30 | description => "Frr router name", | |
31 | }, | |
65cb893e TL |
32 | 'mac' => { |
33 | type => 'string', | |
34 | description => "Anycast logical router mac address", | |
35 | optional => 1, format => 'mac-addr' | |
36 | }, | |
f23633dc | 37 | 'exitnodes' => get_standard_option('pve-node-list'), |
3d135423 AD |
38 | 'exitnodes-local-routing' => { |
39 | type => 'boolean', | |
40 | description => "Allow exitnodes to connect to evpn guests", | |
41 | optional => 1 | |
42 | }, | |
847f5144 AD |
43 | 'exitnodes-primary' => get_standard_option('pve-node', { |
44 | description => "Force traffic to this exitnode first."}), | |
92d8effb AD |
45 | 'advertise-subnets' => { |
46 | type => 'boolean', | |
47 | description => "Advertise evpn subnets if you have silent hosts", | |
48 | optional => 1 | |
b1a5c31e AD |
49 | }, |
50 | 'disable-arp-nd-suppression' => { | |
51 | type => 'boolean', | |
52 | description => "Disable ipv4 arp && ipv6 neighbour discovery suppression", | |
53 | optional => 1 | |
92d8effb | 54 | } |
63586d2f AD |
55 | }; |
56 | } | |
57 | ||
58 | sub options { | |
63586d2f | 59 | return { |
65cb893e TL |
60 | nodes => { optional => 1}, |
61 | 'vrf-vxlan' => { optional => 0 }, | |
62 | controller => { optional => 0 }, | |
f23633dc | 63 | exitnodes => { optional => 1 }, |
3d135423 | 64 | 'exitnodes-local-routing' => { optional => 1 }, |
847f5144 | 65 | 'exitnodes-primary' => { optional => 1 }, |
92d8effb | 66 | 'advertise-subnets' => { optional => 1 }, |
b1a5c31e | 67 | 'disable-arp-nd-suppression' => { optional => 1 }, |
823f2e2a | 68 | mtu => { optional => 1 }, |
8313a2c0 | 69 | mac => { optional => 1 }, |
4ad78442 AD |
70 | dns => { optional => 1 }, |
71 | reversedns => { optional => 1 }, | |
72 | dnszone => { optional => 1 }, | |
57a335c4 | 73 | ipam => { optional => 1 }, |
63586d2f AD |
74 | }; |
75 | } | |
76 | ||
77 | # Plugin implementation | |
78 | sub generate_sdn_config { | |
efffa0ff | 79 | my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_; |
63586d2f AD |
80 | |
81 | my $tag = $vnet->{tag}; | |
82 | my $alias = $vnet->{alias}; | |
8313a2c0 | 83 | my $mac = $plugin_config->{'mac'}; |
63586d2f | 84 | |
1de0abc0 | 85 | my $vrf_iface = "vrf_$zoneid"; |
63586d2f | 86 | my $vrfvxlan = $plugin_config->{'vrf-vxlan'}; |
53b2cc90 | 87 | my $local_node = PVE::INotify::nodename(); |
63586d2f AD |
88 | |
89 | die "missing vxlan tag" if !$tag; | |
f23633dc | 90 | die "missing controller" if !$controller; |
912fb443 | 91 | warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware}; |
63586d2f | 92 | |
5a60da84 | 93 | my @peers = PVE::Tools::split_list($controller->{'peers'}); |
efffa0ff AD |
94 | my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg); |
95 | my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback}; | |
f23633dc | 96 | my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback); |
110b881d | 97 | my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node}; |
3d135423 AD |
98 | my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'}; |
99 | ||
63586d2f AD |
100 | |
101 | my $mtu = 1450; | |
ba7ac021 | 102 | $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu}; |
0251ed2f | 103 | $mtu = $plugin_config->{mtu} if $plugin_config->{mtu}; |
63586d2f AD |
104 | |
105 | #vxlan interface | |
1de0abc0 | 106 | my $vxlan_iface = "vxlan_$vnetid"; |
63586d2f AD |
107 | my @iface_config = (); |
108 | push @iface_config, "vxlan-id $tag"; | |
63586d2f AD |
109 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; |
110 | push @iface_config, "bridge-learning off"; | |
b1a5c31e | 111 | push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'}; |
63586d2f AD |
112 | |
113 | push @iface_config, "mtu $mtu" if $mtu; | |
1de0abc0 | 114 | push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface}; |
63586d2f AD |
115 | |
116 | #vnet bridge | |
117 | @iface_config = (); | |
7024ec2b | 118 | |
e612faf6 | 119 | my $address = {}; |
645d5f4e AD |
120 | my $ipv4 = undef; |
121 | my $ipv6 = undef; | |
bdec7089 AD |
122 | my $enable_forward_v4 = undef; |
123 | my $enable_forward_v6 = undef; | |
5d3e0248 | 124 | my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1); |
e612faf6 AD |
125 | foreach my $subnetid (sort keys %{$subnets}) { |
126 | my $subnet = $subnets->{$subnetid}; | |
e8736dac | 127 | my $cidr = $subnet->{cidr}; |
9f4f6c2e | 128 | my $mask = $subnet->{mask}; |
e8736dac | 129 | |
e612faf6 AD |
130 | my $gateway = $subnet->{gateway}; |
131 | if ($gateway) { | |
9f4f6c2e | 132 | push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway}); |
e612faf6 AD |
133 | $address->{$gateway} = 1; |
134 | } | |
b634e577 | 135 | |
645d5f4e AD |
136 | my $iptables = undef; |
137 | my $checkrouteip = undef; | |
138 | my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4; | |
139 | ||
140 | if ($ipversion == 6) { | |
141 | $ipv6 = 1; | |
142 | $iptables = "ip6tables"; | |
143 | $checkrouteip = '2001:4860:4860::8888'; | |
bdec7089 | 144 | $enable_forward_v6 = 1 if $gateway; |
645d5f4e AD |
145 | } else { |
146 | $ipv4 = 1; | |
147 | $iptables = "iptables"; | |
148 | $checkrouteip = '8.8.8.8'; | |
bdec7089 | 149 | $enable_forward_v4 = 1 if $gateway; |
645d5f4e AD |
150 | } |
151 | ||
53b2cc90 | 152 | if ($subnet->{snat}) { |
b634e577 | 153 | |
53b2cc90 | 154 | #find outgoing interface |
645d5f4e | 155 | my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip); |
53b2cc90 AD |
156 | if ($outip && $outiface && $is_evpn_gateway) { |
157 | #use snat, faster than masquerade | |
645d5f4e AD |
158 | push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; |
159 | push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; | |
53b2cc90 | 160 | #add conntrack zone once on outgoing interface |
645d5f4e AD |
161 | push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1"; |
162 | push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1"; | |
53b2cc90 AD |
163 | } |
164 | } | |
7024ec2b AD |
165 | } |
166 | ||
63586d2f | 167 | push @iface_config, "hwaddress $mac" if $mac; |
1de0abc0 | 168 | push @iface_config, "bridge_ports $vxlan_iface"; |
63586d2f AD |
169 | push @iface_config, "bridge_stp off"; |
170 | push @iface_config, "bridge_fd 0"; | |
171 | push @iface_config, "mtu $mtu" if $mtu; | |
172 | push @iface_config, "alias $alias" if $alias; | |
bdec7089 AD |
173 | push @iface_config, "ip-forward on" if $enable_forward_v4; |
174 | push @iface_config, "ip6-forward on" if $enable_forward_v6; | |
63586d2f | 175 | push @iface_config, "arp-accept on" if $ipv4||$ipv6; |
1de0abc0 | 176 | push @iface_config, "vrf $vrf_iface" if $vrf_iface; |
63586d2f AD |
177 | push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid}; |
178 | ||
1de0abc0 | 179 | if ($vrf_iface) { |
63586d2f AD |
180 | #vrf interface |
181 | @iface_config = (); | |
182 | push @iface_config, "vrf-table auto"; | |
110b881d AD |
183 | if(!$is_evpn_gateway) { |
184 | push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272"; | |
185 | } else { | |
186 | push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272"; | |
187 | } | |
188 | ||
1de0abc0 | 189 | push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface}; |
63586d2f AD |
190 | |
191 | if ($vrfvxlan) { | |
192 | #l3vni vxlan interface | |
1de0abc0 | 193 | my $iface_vrf_vxlan = "vrfvx_$zoneid"; |
63586d2f AD |
194 | @iface_config = (); |
195 | push @iface_config, "vxlan-id $vrfvxlan"; | |
196 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; | |
197 | push @iface_config, "bridge-learning off"; | |
b1a5c31e | 198 | push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'}; |
63586d2f | 199 | push @iface_config, "mtu $mtu" if $mtu; |
1de0abc0 | 200 | push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan}; |
63586d2f AD |
201 | |
202 | #l3vni bridge | |
1de0abc0 | 203 | my $brvrf = "vrfbr_$zoneid"; |
63586d2f | 204 | @iface_config = (); |
1de0abc0 | 205 | push @iface_config, "bridge-ports $iface_vrf_vxlan"; |
63586d2f AD |
206 | push @iface_config, "bridge_stp off"; |
207 | push @iface_config, "bridge_fd 0"; | |
208 | push @iface_config, "mtu $mtu" if $mtu; | |
1de0abc0 | 209 | push @iface_config, "vrf $vrf_iface"; |
63586d2f AD |
210 | push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf}; |
211 | } | |
63586d2f | 212 | |
3d135423 AD |
213 | if ( $is_evpn_gateway && $exitnodes_local_routing ) { |
214 | #add a veth pair for local cross-vrf routing | |
215 | my $iface_xvrf = "xvrf_$zoneid"; | |
216 | my $iface_xvrfp = "xvrfp_$zoneid"; | |
217 | ||
218 | @iface_config = (); | |
219 | push @iface_config, "link-type veth"; | |
220 | push @iface_config, "address 10.255.255.1/30"; | |
221 | push @iface_config, "veth-peer-name $iface_xvrfp"; | |
222 | push @iface_config, "mtu ".($mtu+50) if $mtu; | |
223 | push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf}; | |
224 | ||
225 | @iface_config = (); | |
226 | push @iface_config, "link-type veth"; | |
227 | push @iface_config, "address 10.255.255.2/30"; | |
228 | push @iface_config, "veth-peer-name $iface_xvrf"; | |
229 | push @iface_config, "vrf $vrf_iface"; | |
230 | push @iface_config, "mtu ".($mtu+50) if $mtu; | |
231 | push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp}; | |
232 | } | |
233 | } | |
63586d2f AD |
234 | return $config; |
235 | } | |
236 | ||
237 | sub on_update_hook { | |
a2b32a94 AD |
238 | my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_; |
239 | ||
240 | # verify that controller exist | |
241 | my $controller = $zone_cfg->{ids}->{$zoneid}->{controller}; | |
242 | if (!defined($controller_cfg->{ids}->{$controller})) { | |
243 | die "controller $controller don't exist"; | |
244 | } else { | |
245 | die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn'; | |
246 | } | |
63586d2f | 247 | |
7cb9714d | 248 | #vrf-vxlan need to be defined |
a2b32a94 AD |
249 | |
250 | my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'}; | |
251 | # verify that vrf-vxlan is not already declared in another zone | |
252 | foreach my $id (keys %{$zone_cfg->{ids}}) { | |
253 | next if $id eq $zoneid; | |
254 | die "vrf-vxlan $vrfvxlan is already declared in $id" | |
255 | if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan); | |
63586d2f | 256 | } |
5ca07ed9 | 257 | |
8313a2c0 AD |
258 | if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) { |
259 | my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg'); | |
260 | $zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix}); | |
261 | } | |
63586d2f AD |
262 | } |
263 | ||
1d44ce70 | 264 | |
5ca07ed9 | 265 | sub vnet_update_hook { |
88d9562b | 266 | my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_; |
5ca07ed9 | 267 | |
88d9562b AD |
268 | my $vnet = $vnet_cfg->{ids}->{$vnetid}; |
269 | my $tag = $vnet->{tag}; | |
270 | ||
271 | raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag); | |
272 | raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216; | |
273 | ||
274 | # verify that tag is not already defined globally (vxlan-id are unique) | |
275 | foreach my $id (keys %{$vnet_cfg->{ids}}) { | |
276 | next if $id eq $vnetid; | |
277 | my $othervnet = $vnet_cfg->{ids}->{$id}; | |
278 | my $other_tag = $othervnet->{tag}; | |
279 | my $other_zoneid = $othervnet->{zone}; | |
280 | my $other_zone = $zone_cfg->{ids}->{$other_zoneid}; | |
281 | next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn'; | |
282 | raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag; | |
283 | } | |
1d44ce70 AD |
284 | } |
285 | ||
5ca07ed9 | 286 | |
63586d2f AD |
287 | 1; |
288 | ||
289 |