[pve-network.git] / src / PVE / Network / SDN / Zones / EvpnPlugin.pm

package PVE::Network::SDN::Zones::EvpnPlugin;

use strict;
use warnings;
use PVE::Network::SDN::Zones::VxlanPlugin;
use PVE::Exception qw(raise raise_param_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Tools qw($IPV4RE);
use PVE::INotify;
use PVE::Cluster;
use PVE::Tools;
use Net::IP;

use PVE::Network::SDN::Controllers::EvpnPlugin;

use base('PVE::Network::SDN::Zones::VxlanPlugin');

sub type {
    return 'evpn';
}

PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt);
sub pve_verify_sdn_bgp_rt {
    my ($rt) = @_;

    if ($rt =~ m/^(\d+):(\d+)$/) {
	my $asn = $1;
	my $id = $2;

	if ($asn < 0 || $asn > 4294967295) {
	    die "value does not look like a valid bgp route-target\n";
	}
	if ($id < 0 || $id > 4294967295) {
	    die "value does not look like a valid bgp route-target\n";
	}
    } else {
	die "value does not look like a valid bgp route-target\n";
    }
    return $rt;
}

sub properties {
    return {
	'vrf-vxlan' => {
	    type => 'integer',
	    description => "l3vni.",
	},
	'controller' => {
	    type => 'string',
	    description => "Frr router name",
	},
	'mac' => {
	    type => 'string',
	    description => "Anycast logical router mac address",
	    optional => 1, format => 'mac-addr'
	},
	'exitnodes' => get_standard_option('pve-node-list'),
	'exitnodes-local-routing' => {
	    type => 'boolean',
	    description => "Allow exitnodes to connect to evpn guests",
	    optional => 1
	},
	'exitnodes-primary' => get_standard_option('pve-node', {
	    description => "Force traffic to this exitnode first."}),
	'advertise-subnets' => {
	    type => 'boolean',
	    description => "Advertise evpn subnets if you have silent hosts",
	    optional => 1
	},
	'disable-arp-nd-suppression' => {
	    type => 'boolean',
	    description => "Disable ipv4 arp && ipv6 neighbour discovery suppression",
	    optional => 1
	},
	'rt-import' => {
	    type => 'string',
	    description => "Route-Target import",
	    optional => 1, format => 'pve-sdn-bgp-rt-list'
        }
    };
}

sub options {
    return {
	nodes => { optional => 1},
	'vrf-vxlan' => { optional => 0 },
	controller => { optional => 0 },
	exitnodes => { optional => 1 },
	'exitnodes-local-routing' => { optional => 1 },
	'exitnodes-primary' => { optional => 1 },
	'advertise-subnets' => { optional => 1 },
	'disable-arp-nd-suppression' => { optional => 1 },
	'rt-import' => { optional => 1 },
	'vxlan-port' => { optional => 1 },
	mtu => { optional => 1 },
	mac => { optional => 1 },
	dns => { optional => 1 },
	reversedns => { optional => 1 },
	dnszone => { optional => 1 },
	ipam => { optional => 1 },
    };
}

# Plugin implementation
sub generate_sdn_config {
    my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;

    my $tag = $vnet->{tag};
    my $alias = $vnet->{alias};
    my $mac = $plugin_config->{'mac'};
    my $vxlanport = $plugin_config->{'vxlan-port'};

    my $vrf_iface = "vrf_$zoneid";
    my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
    my $local_node = PVE::INotify::nodename();

    die "missing vxlan tag" if !$tag;
    die "missing controller" if !$controller;
    warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};

    my @peers = PVE::Tools::split_list($controller->{'peers'});
    my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
    my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
    my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
    my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};


    my $mtu = 1450;
    $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
    $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};

    #vxlan interface
    my $vxlan_iface = "vxlan_$vnetid";
    my @iface_config = ();
    push @iface_config, "vxlan-id $tag";
    push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
    push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
    push @iface_config, "bridge-learning off";
    push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};

    push @iface_config, "mtu $mtu" if $mtu;
    push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};

    #vnet bridge
    @iface_config = ();

    my $address = {};
    my $ipv4 = undef;
    my $ipv6 = undef;
    my $enable_forward_v4 = undef;
    my $enable_forward_v6 = undef;
    my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
    foreach my $subnetid (sort keys %{$subnets}) {
	my $subnet = $subnets->{$subnetid};
	my $cidr = $subnet->{cidr};
	my $mask = $subnet->{mask};

	my $gateway = $subnet->{gateway};
	if ($gateway) {
	    push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
	    $address->{$gateway} = 1;
	}

        my $iptables = undef;
        my $checkrouteip = undef;
        my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;

	if ($ipversion == 6) {
	    $ipv6 = 1;
	    $iptables = "ip6tables";
	    $checkrouteip = '2001:4860:4860::8888';
	    $enable_forward_v6 = 1 if $gateway;
	} else {
	    $ipv4 = 1;
	    $iptables = "iptables";
	    $checkrouteip = '8.8.8.8';
	    $enable_forward_v4 = 1 if $gateway;
	}

	if ($subnet->{snat}) {

            #find outgoing interface
            my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
            if ($outip && $outiface && $is_evpn_gateway) {
                #use snat, faster than masquerade
                push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
                push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
                #add conntrack zone once on outgoing interface
                push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
                push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
            }
        }
    }

    push @iface_config, "hwaddress $mac" if $mac;
    push @iface_config, "bridge_ports $vxlan_iface";
    push @iface_config, "bridge_stp off";
    push @iface_config, "bridge_fd 0";
    push @iface_config, "mtu $mtu" if $mtu;
    push @iface_config, "alias $alias" if $alias;
    push @iface_config, "ip-forward on" if $enable_forward_v4;
    push @iface_config, "ip6-forward on" if $enable_forward_v6;
    push @iface_config, "arp-accept on" if $ipv4||$ipv6;
    push @iface_config, "vrf $vrf_iface" if $vrf_iface;
    push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};

    if ($vrf_iface) {
	#vrf interface
	@iface_config = ();
	push @iface_config, "vrf-table auto";
	if(!$is_evpn_gateway) {
	    push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
	} else {
	    push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
	}

	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};

	if ($vrfvxlan) {
	    #l3vni vxlan interface
	    my $iface_vrf_vxlan = "vrfvx_$zoneid";
	    @iface_config = ();
	    push @iface_config, "vxlan-id $vrfvxlan";
	    push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
	    push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
	    push @iface_config, "bridge-learning off";
	    push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
	    push @iface_config, "mtu $mtu" if $mtu;
	    push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};

	    #l3vni bridge
	    my $brvrf = "vrfbr_$zoneid";
	    @iface_config = ();
	    push @iface_config, "bridge-ports $iface_vrf_vxlan";
	    push @iface_config, "bridge_stp off";
	    push @iface_config, "bridge_fd 0";
	    push @iface_config, "mtu $mtu" if $mtu;
	    push @iface_config, "vrf $vrf_iface";
	    push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
	}

	if ( $is_evpn_gateway && $exitnodes_local_routing ) {
	    #add a veth pair for local cross-vrf routing
	    my $iface_xvrf = "xvrf_$zoneid";
	    my $iface_xvrfp = "xvrfp_$zoneid";

	    @iface_config = ();
	    push @iface_config, "link-type veth";
	    push @iface_config, "address 10.255.255.1/30";
	    push @iface_config, "veth-peer-name $iface_xvrfp";
	    push @iface_config, "mtu ".($mtu+50) if $mtu;
	    push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};

	    @iface_config = ();
	    push @iface_config, "link-type veth";
	    push @iface_config, "address 10.255.255.2/30";
	    push @iface_config, "veth-peer-name $iface_xvrf";
	    push @iface_config, "vrf $vrf_iface";
	    push @iface_config, "mtu ".($mtu+50) if $mtu;
	    push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
	}
    }
    return $config;
}

sub on_update_hook {
    my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;

    # verify that controller exist
    my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
    if (!defined($controller_cfg->{ids}->{$controller})) {
	die "controller $controller don't exist";
    } else {
	die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
    }

    #vrf-vxlan need to be defined

    my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
    # verify that vrf-vxlan is not already declared in another zone
    foreach my $id (keys %{$zone_cfg->{ids}}) {
	next if $id eq $zoneid;
	die "vrf-vxlan $vrfvxlan is already declared in $id"
		if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
    }

    if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
	my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	$zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
    }
}


sub vnet_update_hook {
    my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;

    my $vnet = $vnet_cfg->{ids}->{$vnetid};
    my $tag = $vnet->{tag};

    raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
    raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;

    # verify that tag is not already defined globally (vxlan-id are unique)
    foreach my $id (keys %{$vnet_cfg->{ids}}) {
	next if $id eq $vnetid;
	my $othervnet = $vnet_cfg->{ids}->{$id};
	my $other_tag = $othervnet->{tag};
	my $other_zoneid = $othervnet->{zone};
	my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
	next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
	raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
    }
}


1;
Commit	Line	Data
f5eabba0	1	package PVE::Network::SDN::Zones::EvpnPlugin;
63586d2f AD	2
	3	use strict;
	4	use warnings;
f5eabba0	5	use PVE::Network::SDN::Zones::VxlanPlugin;
7fdeb441	6	use PVE::Exception qw(raise raise_param_exc);
f23633dc	7	use PVE::JSONSchema qw(get_standard_option);
63586d2f AD	8	use PVE::Tools qw($IPV4RE);
63586d2f AD	9	use PVE::INotify;
5ca07ed9 AD	10	use PVE::Cluster;
5ca07ed9 AD	11	use PVE::Tools;
645d5f4e	12	use Net::IP;
5ca07ed9	13
4405f2de	14	use PVE::Network::SDN::Controllers::EvpnPlugin;
63586d2f	15
f5eabba0	16	use base('PVE::Network::SDN::Zones::VxlanPlugin');
63586d2f AD	17
	18	sub type {
	19	return 'evpn';
	20	}
	21
96794fd6 AD	22	PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt);
	23	sub pve_verify_sdn_bgp_rt {
	24	my ($rt) = @_;
	25
	26	if ($rt =~ m/^(\d+):(\d+)$/) {
	27	my $asn = $1;
	28	my $id = $2;
	29
	30	if ($asn < 0 \|\| $asn > 4294967295) {
	31	die "value does not look like a valid bgp route-target\n";
	32	}
	33	if ($id < 0 \|\| $id > 4294967295) {
	34	die "value does not look like a valid bgp route-target\n";
	35	}
	36	} else {
	37	die "value does not look like a valid bgp route-target\n";
	38	}
	39	return $rt;
	40	}
	41
63586d2f AD	42	sub properties {
63586d2f AD	43	return {
63586d2f AD	44	'vrf-vxlan' => {
	45	type => 'integer',
	46	description => "l3vni.",
	47	},
	48	'controller' => {
	49	type => 'string',
	50	description => "Frr router name",
	51	},
65cb893e TL	52	'mac' => {
	53	type => 'string',
	54	description => "Anycast logical router mac address",
	55	optional => 1, format => 'mac-addr'
	56	},
f23633dc	57	'exitnodes' => get_standard_option('pve-node-list'),
3d135423 AD	58	'exitnodes-local-routing' => {
	59	type => 'boolean',
	60	description => "Allow exitnodes to connect to evpn guests",
	61	optional => 1
	62	},
847f5144 AD	63	'exitnodes-primary' => get_standard_option('pve-node', {
847f5144 AD	64	description => "Force traffic to this exitnode first."}),
92d8effb AD	65	'advertise-subnets' => {
	66	type => 'boolean',
	67	description => "Advertise evpn subnets if you have silent hosts",
	68	optional => 1
b1a5c31e AD	69	},
	70	'disable-arp-nd-suppression' => {
	71	type => 'boolean',
	72	description => "Disable ipv4 arp && ipv6 neighbour discovery suppression",
	73	optional => 1
96794fd6 AD	74	},
	75	'rt-import' => {
	76	type => 'string',
	77	description => "Route-Target import",
	78	optional => 1, format => 'pve-sdn-bgp-rt-list'
	79	}
63586d2f AD	80	};
	81	}
	82
	83	sub options {
63586d2f	84	return {
65cb893e TL	85	nodes => { optional => 1},
	86	'vrf-vxlan' => { optional => 0 },
	87	controller => { optional => 0 },
f23633dc	88	exitnodes => { optional => 1 },
3d135423	89	'exitnodes-local-routing' => { optional => 1 },
847f5144	90	'exitnodes-primary' => { optional => 1 },
92d8effb	91	'advertise-subnets' => { optional => 1 },
b1a5c31e	92	'disable-arp-nd-suppression' => { optional => 1 },
96794fd6	93	'rt-import' => { optional => 1 },
b84eacc8	94	'vxlan-port' => { optional => 1 },
823f2e2a	95	mtu => { optional => 1 },
8313a2c0	96	mac => { optional => 1 },
4ad78442 AD	97	dns => { optional => 1 },
	98	reversedns => { optional => 1 },
	99	dnszone => { optional => 1 },
57a335c4	100	ipam => { optional => 1 },
63586d2f AD	101	};
	102	}
	103
	104	# Plugin implementation
	105	sub generate_sdn_config {
efffa0ff	106	my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
63586d2f AD	107
	108	my $tag = $vnet->{tag};
	109	my $alias = $vnet->{alias};
8313a2c0	110	my $mac = $plugin_config->{'mac'};
b84eacc8	111	my $vxlanport = $plugin_config->{'vxlan-port'};
63586d2f	112
1de0abc0	113	my $vrf_iface = "vrf_$zoneid";
63586d2f	114	my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
53b2cc90	115	my $local_node = PVE::INotify::nodename();
63586d2f AD	116
63586d2f AD	117	die "missing vxlan tag" if !$tag;
f23633dc	118	die "missing controller" if !$controller;
912fb443	119	warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
63586d2f	120
5a60da84	121	my @peers = PVE::Tools::split_list($controller->{'peers'});
efffa0ff AD	122	my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
efffa0ff AD	123	my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
f23633dc	124	my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
110b881d	125	my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
3d135423 AD	126	my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
3d135423 AD	127
63586d2f AD	128
63586d2f AD	129	my $mtu = 1450;
ba7ac021	130	$mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
0251ed2f	131	$mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
63586d2f AD	132
63586d2f AD	133	#vxlan interface
1de0abc0	134	my $vxlan_iface = "vxlan_$vnetid";
63586d2f AD	135	my @iface_config = ();
63586d2f AD	136	push @iface_config, "vxlan-id $tag";
63586d2f	137	push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
b84eacc8	138	push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
63586d2f	139	push @iface_config, "bridge-learning off";
b1a5c31e	140	push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
63586d2f AD	141
63586d2f AD	142	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	143	push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
63586d2f AD	144
	145	#vnet bridge
	146	@iface_config = ();
7024ec2b	147
e612faf6	148	my $address = {};
645d5f4e AD	149	my $ipv4 = undef;
645d5f4e AD	150	my $ipv6 = undef;
bdec7089 AD	151	my $enable_forward_v4 = undef;
bdec7089 AD	152	my $enable_forward_v6 = undef;
5d3e0248	153	my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
e612faf6 AD	154	foreach my $subnetid (sort keys %{$subnets}) {
e612faf6 AD	155	my $subnet = $subnets->{$subnetid};
e8736dac	156	my $cidr = $subnet->{cidr};
9f4f6c2e	157	my $mask = $subnet->{mask};
e8736dac	158
e612faf6 AD	159	my $gateway = $subnet->{gateway};
e612faf6 AD	160	if ($gateway) {
9f4f6c2e	161	push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
e612faf6 AD	162	$address->{$gateway} = 1;
e612faf6 AD	163	}
b634e577	164
645d5f4e AD	165	my $iptables = undef;
	166	my $checkrouteip = undef;
	167	my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;
	168
	169	if ($ipversion == 6) {
	170	$ipv6 = 1;
	171	$iptables = "ip6tables";
	172	$checkrouteip = '2001:4860:4860::8888';
bdec7089	173	$enable_forward_v6 = 1 if $gateway;
645d5f4e AD	174	} else {
	175	$ipv4 = 1;
	176	$iptables = "iptables";
	177	$checkrouteip = '8.8.8.8';
bdec7089	178	$enable_forward_v4 = 1 if $gateway;
645d5f4e AD	179	}
645d5f4e AD	180
53b2cc90	181	if ($subnet->{snat}) {
b634e577	182
53b2cc90	183	#find outgoing interface
645d5f4e	184	my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
53b2cc90 AD	185	if ($outip && $outiface && $is_evpn_gateway) {
53b2cc90 AD	186	#use snat, faster than masquerade
645d5f4e AD	187	push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
645d5f4e AD	188	push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
53b2cc90	189	#add conntrack zone once on outgoing interface
645d5f4e AD	190	push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
645d5f4e AD	191	push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
53b2cc90 AD	192	}
53b2cc90 AD	193	}
7024ec2b AD	194	}
7024ec2b AD	195
63586d2f	196	push @iface_config, "hwaddress $mac" if $mac;
1de0abc0	197	push @iface_config, "bridge_ports $vxlan_iface";
63586d2f AD	198	push @iface_config, "bridge_stp off";
	199	push @iface_config, "bridge_fd 0";
	200	push @iface_config, "mtu $mtu" if $mtu;
	201	push @iface_config, "alias $alias" if $alias;
bdec7089 AD	202	push @iface_config, "ip-forward on" if $enable_forward_v4;
bdec7089 AD	203	push @iface_config, "ip6-forward on" if $enable_forward_v6;
63586d2f	204	push @iface_config, "arp-accept on" if $ipv4\|\|$ipv6;
1de0abc0	205	push @iface_config, "vrf $vrf_iface" if $vrf_iface;
63586d2f AD	206	push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
63586d2f AD	207
1de0abc0	208	if ($vrf_iface) {
63586d2f AD	209	#vrf interface
	210	@iface_config = ();
	211	push @iface_config, "vrf-table auto";
110b881d AD	212	if(!$is_evpn_gateway) {
	213	push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
	214	} else {
	215	push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
	216	}
	217
1de0abc0	218	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
63586d2f AD	219
	220	if ($vrfvxlan) {
	221	#l3vni vxlan interface
1de0abc0	222	my $iface_vrf_vxlan = "vrfvx_$zoneid";
63586d2f AD	223	@iface_config = ();
	224	push @iface_config, "vxlan-id $vrfvxlan";
	225	push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
b84eacc8	226	push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
63586d2f	227	push @iface_config, "bridge-learning off";
b1a5c31e	228	push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
63586d2f	229	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	230	push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
63586d2f AD	231
63586d2f AD	232	#l3vni bridge
1de0abc0	233	my $brvrf = "vrfbr_$zoneid";
63586d2f	234	@iface_config = ();
1de0abc0	235	push @iface_config, "bridge-ports $iface_vrf_vxlan";
63586d2f AD	236	push @iface_config, "bridge_stp off";
	237	push @iface_config, "bridge_fd 0";
	238	push @iface_config, "mtu $mtu" if $mtu;
1de0abc0	239	push @iface_config, "vrf $vrf_iface";
63586d2f AD	240	push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
63586d2f AD	241	}
63586d2f	242
3d135423 AD	243	if ( $is_evpn_gateway && $exitnodes_local_routing ) {
	244	#add a veth pair for local cross-vrf routing
	245	my $iface_xvrf = "xvrf_$zoneid";
	246	my $iface_xvrfp = "xvrfp_$zoneid";
	247
	248	@iface_config = ();
	249	push @iface_config, "link-type veth";
	250	push @iface_config, "address 10.255.255.1/30";
	251	push @iface_config, "veth-peer-name $iface_xvrfp";
	252	push @iface_config, "mtu ".($mtu+50) if $mtu;
	253	push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};
	254
	255	@iface_config = ();
	256	push @iface_config, "link-type veth";
	257	push @iface_config, "address 10.255.255.2/30";
	258	push @iface_config, "veth-peer-name $iface_xvrf";
	259	push @iface_config, "vrf $vrf_iface";
	260	push @iface_config, "mtu ".($mtu+50) if $mtu;
	261	push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
	262	}
	263	}
63586d2f AD	264	return $config;
	265	}
	266
	267	sub on_update_hook {
a2b32a94 AD	268	my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
	269
	270	# verify that controller exist
	271	my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
	272	if (!defined($controller_cfg->{ids}->{$controller})) {
	273	die "controller $controller don't exist";
	274	} else {
	275	die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
	276	}
63586d2f	277
7cb9714d	278	#vrf-vxlan need to be defined
a2b32a94 AD	279
	280	my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
	281	# verify that vrf-vxlan is not already declared in another zone
	282	foreach my $id (keys %{$zone_cfg->{ids}}) {
	283	next if $id eq $zoneid;
	284	die "vrf-vxlan $vrfvxlan is already declared in $id"
	285	if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
63586d2f	286	}
5ca07ed9	287
8313a2c0 AD	288	if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
	289	my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	290	$zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
	291	}
63586d2f AD	292	}
63586d2f AD	293
1d44ce70	294
5ca07ed9	295	sub vnet_update_hook {
88d9562b	296	my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
5ca07ed9	297
88d9562b AD	298	my $vnet = $vnet_cfg->{ids}->{$vnetid};
	299	my $tag = $vnet->{tag};
	300
	301	raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
	302	raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
	303
	304	# verify that tag is not already defined globally (vxlan-id are unique)
	305	foreach my $id (keys %{$vnet_cfg->{ids}}) {
	306	next if $id eq $vnetid;
	307	my $othervnet = $vnet_cfg->{ids}->{$id};
	308	my $other_tag = $othervnet->{tag};
	309	my $other_zoneid = $othervnet->{zone};
	310	my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
	311	next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
	312	raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
	313	}
1d44ce70 AD	314	}
1d44ce70 AD	315
5ca07ed9	316
63586d2f AD	317	1;
	318
	319