]>
Commit | Line | Data |
---|---|---|
1 | package PVE::Network::SDN::Zones::EvpnPlugin; | |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | use PVE::Network::SDN::Zones::VxlanPlugin; | |
6 | use PVE::Exception qw(raise raise_param_exc); | |
7 | use PVE::JSONSchema qw(get_standard_option); | |
8 | use PVE::Tools qw($IPV4RE); | |
9 | use PVE::INotify; | |
10 | use PVE::Cluster; | |
11 | use PVE::Tools; | |
12 | use Net::IP; | |
13 | ||
14 | use PVE::Network::SDN::Controllers::EvpnPlugin; | |
15 | ||
16 | use base('PVE::Network::SDN::Zones::VxlanPlugin'); | |
17 | ||
18 | sub type { | |
19 | return 'evpn'; | |
20 | } | |
21 | ||
22 | PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt); | |
23 | sub pve_verify_sdn_bgp_rt { | |
24 | my ($rt) = @_; | |
25 | ||
26 | if ($rt =~ m/^(\d+):(\d+)$/) { | |
27 | my $asn = $1; | |
28 | my $id = $2; | |
29 | ||
30 | if ($asn < 0 || $asn > 4294967295) { | |
31 | die "value does not look like a valid bgp route-target\n"; | |
32 | } | |
33 | if ($id < 0 || $id > 4294967295) { | |
34 | die "value does not look like a valid bgp route-target\n"; | |
35 | } | |
36 | } else { | |
37 | die "value does not look like a valid bgp route-target\n"; | |
38 | } | |
39 | return $rt; | |
40 | } | |
41 | ||
42 | sub properties { | |
43 | return { | |
44 | 'vrf-vxlan' => { | |
45 | type => 'integer', | |
46 | description => "l3vni.", | |
47 | }, | |
48 | 'controller' => { | |
49 | type => 'string', | |
50 | description => "Frr router name", | |
51 | }, | |
52 | 'mac' => { | |
53 | type => 'string', | |
54 | description => "Anycast logical router mac address", | |
55 | optional => 1, format => 'mac-addr' | |
56 | }, | |
57 | 'exitnodes' => get_standard_option('pve-node-list'), | |
58 | 'exitnodes-local-routing' => { | |
59 | type => 'boolean', | |
60 | description => "Allow exitnodes to connect to evpn guests", | |
61 | optional => 1 | |
62 | }, | |
63 | 'exitnodes-primary' => get_standard_option('pve-node', { | |
64 | description => "Force traffic to this exitnode first."}), | |
65 | 'advertise-subnets' => { | |
66 | type => 'boolean', | |
67 | description => "Advertise evpn subnets if you have silent hosts", | |
68 | optional => 1 | |
69 | }, | |
70 | 'disable-arp-nd-suppression' => { | |
71 | type => 'boolean', | |
72 | description => "Disable ipv4 arp && ipv6 neighbour discovery suppression", | |
73 | optional => 1 | |
74 | }, | |
75 | 'rt-import' => { | |
76 | type => 'string', | |
77 | description => "Route-Target import", | |
78 | optional => 1, format => 'pve-sdn-bgp-rt-list' | |
79 | } | |
80 | }; | |
81 | } | |
82 | ||
83 | sub options { | |
84 | return { | |
85 | nodes => { optional => 1}, | |
86 | 'vrf-vxlan' => { optional => 0 }, | |
87 | controller => { optional => 0 }, | |
88 | exitnodes => { optional => 1 }, | |
89 | 'exitnodes-local-routing' => { optional => 1 }, | |
90 | 'exitnodes-primary' => { optional => 1 }, | |
91 | 'advertise-subnets' => { optional => 1 }, | |
92 | 'disable-arp-nd-suppression' => { optional => 1 }, | |
93 | 'rt-import' => { optional => 1 }, | |
94 | mtu => { optional => 1 }, | |
95 | mac => { optional => 1 }, | |
96 | dns => { optional => 1 }, | |
97 | reversedns => { optional => 1 }, | |
98 | dnszone => { optional => 1 }, | |
99 | ipam => { optional => 1 }, | |
100 | }; | |
101 | } | |
102 | ||
103 | # Plugin implementation | |
104 | sub generate_sdn_config { | |
105 | my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_; | |
106 | ||
107 | my $tag = $vnet->{tag}; | |
108 | my $alias = $vnet->{alias}; | |
109 | my $mac = $plugin_config->{'mac'}; | |
110 | ||
111 | my $vrf_iface = "vrf_$zoneid"; | |
112 | my $vrfvxlan = $plugin_config->{'vrf-vxlan'}; | |
113 | my $local_node = PVE::INotify::nodename(); | |
114 | ||
115 | die "missing vxlan tag" if !$tag; | |
116 | die "missing controller" if !$controller; | |
117 | warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware}; | |
118 | ||
119 | my @peers = PVE::Tools::split_list($controller->{'peers'}); | |
120 | my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg); | |
121 | my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback}; | |
122 | my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback); | |
123 | my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node}; | |
124 | my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'}; | |
125 | ||
126 | ||
127 | my $mtu = 1450; | |
128 | $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu}; | |
129 | $mtu = $plugin_config->{mtu} if $plugin_config->{mtu}; | |
130 | ||
131 | #vxlan interface | |
132 | my $vxlan_iface = "vxlan_$vnetid"; | |
133 | my @iface_config = (); | |
134 | push @iface_config, "vxlan-id $tag"; | |
135 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; | |
136 | push @iface_config, "bridge-learning off"; | |
137 | push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'}; | |
138 | ||
139 | push @iface_config, "mtu $mtu" if $mtu; | |
140 | push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface}; | |
141 | ||
142 | #vnet bridge | |
143 | @iface_config = (); | |
144 | ||
145 | my $address = {}; | |
146 | my $ipv4 = undef; | |
147 | my $ipv6 = undef; | |
148 | my $enable_forward_v4 = undef; | |
149 | my $enable_forward_v6 = undef; | |
150 | my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1); | |
151 | foreach my $subnetid (sort keys %{$subnets}) { | |
152 | my $subnet = $subnets->{$subnetid}; | |
153 | my $cidr = $subnet->{cidr}; | |
154 | my $mask = $subnet->{mask}; | |
155 | ||
156 | my $gateway = $subnet->{gateway}; | |
157 | if ($gateway) { | |
158 | push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway}); | |
159 | $address->{$gateway} = 1; | |
160 | } | |
161 | ||
162 | my $iptables = undef; | |
163 | my $checkrouteip = undef; | |
164 | my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4; | |
165 | ||
166 | if ($ipversion == 6) { | |
167 | $ipv6 = 1; | |
168 | $iptables = "ip6tables"; | |
169 | $checkrouteip = '2001:4860:4860::8888'; | |
170 | $enable_forward_v6 = 1 if $gateway; | |
171 | } else { | |
172 | $ipv4 = 1; | |
173 | $iptables = "iptables"; | |
174 | $checkrouteip = '8.8.8.8'; | |
175 | $enable_forward_v4 = 1 if $gateway; | |
176 | } | |
177 | ||
178 | if ($subnet->{snat}) { | |
179 | ||
180 | #find outgoing interface | |
181 | my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip); | |
182 | if ($outip && $outiface && $is_evpn_gateway) { | |
183 | #use snat, faster than masquerade | |
184 | push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; | |
185 | push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip"; | |
186 | #add conntrack zone once on outgoing interface | |
187 | push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1"; | |
188 | push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1"; | |
189 | } | |
190 | } | |
191 | } | |
192 | ||
193 | push @iface_config, "hwaddress $mac" if $mac; | |
194 | push @iface_config, "bridge_ports $vxlan_iface"; | |
195 | push @iface_config, "bridge_stp off"; | |
196 | push @iface_config, "bridge_fd 0"; | |
197 | push @iface_config, "mtu $mtu" if $mtu; | |
198 | push @iface_config, "alias $alias" if $alias; | |
199 | push @iface_config, "ip-forward on" if $enable_forward_v4; | |
200 | push @iface_config, "ip6-forward on" if $enable_forward_v6; | |
201 | push @iface_config, "arp-accept on" if $ipv4||$ipv6; | |
202 | push @iface_config, "vrf $vrf_iface" if $vrf_iface; | |
203 | push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid}; | |
204 | ||
205 | if ($vrf_iface) { | |
206 | #vrf interface | |
207 | @iface_config = (); | |
208 | push @iface_config, "vrf-table auto"; | |
209 | if(!$is_evpn_gateway) { | |
210 | push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272"; | |
211 | } else { | |
212 | push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272"; | |
213 | } | |
214 | ||
215 | push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface}; | |
216 | ||
217 | if ($vrfvxlan) { | |
218 | #l3vni vxlan interface | |
219 | my $iface_vrf_vxlan = "vrfvx_$zoneid"; | |
220 | @iface_config = (); | |
221 | push @iface_config, "vxlan-id $vrfvxlan"; | |
222 | push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip; | |
223 | push @iface_config, "bridge-learning off"; | |
224 | push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'}; | |
225 | push @iface_config, "mtu $mtu" if $mtu; | |
226 | push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan}; | |
227 | ||
228 | #l3vni bridge | |
229 | my $brvrf = "vrfbr_$zoneid"; | |
230 | @iface_config = (); | |
231 | push @iface_config, "bridge-ports $iface_vrf_vxlan"; | |
232 | push @iface_config, "bridge_stp off"; | |
233 | push @iface_config, "bridge_fd 0"; | |
234 | push @iface_config, "mtu $mtu" if $mtu; | |
235 | push @iface_config, "vrf $vrf_iface"; | |
236 | push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf}; | |
237 | } | |
238 | ||
239 | if ( $is_evpn_gateway && $exitnodes_local_routing ) { | |
240 | #add a veth pair for local cross-vrf routing | |
241 | my $iface_xvrf = "xvrf_$zoneid"; | |
242 | my $iface_xvrfp = "xvrfp_$zoneid"; | |
243 | ||
244 | @iface_config = (); | |
245 | push @iface_config, "link-type veth"; | |
246 | push @iface_config, "address 10.255.255.1/30"; | |
247 | push @iface_config, "veth-peer-name $iface_xvrfp"; | |
248 | push @iface_config, "mtu ".($mtu+50) if $mtu; | |
249 | push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf}; | |
250 | ||
251 | @iface_config = (); | |
252 | push @iface_config, "link-type veth"; | |
253 | push @iface_config, "address 10.255.255.2/30"; | |
254 | push @iface_config, "veth-peer-name $iface_xvrf"; | |
255 | push @iface_config, "vrf $vrf_iface"; | |
256 | push @iface_config, "mtu ".($mtu+50) if $mtu; | |
257 | push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp}; | |
258 | } | |
259 | } | |
260 | return $config; | |
261 | } | |
262 | ||
263 | sub on_update_hook { | |
264 | my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_; | |
265 | ||
266 | # verify that controller exist | |
267 | my $controller = $zone_cfg->{ids}->{$zoneid}->{controller}; | |
268 | if (!defined($controller_cfg->{ids}->{$controller})) { | |
269 | die "controller $controller don't exist"; | |
270 | } else { | |
271 | die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn'; | |
272 | } | |
273 | ||
274 | #vrf-vxlan need to be defined | |
275 | ||
276 | my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'}; | |
277 | # verify that vrf-vxlan is not already declared in another zone | |
278 | foreach my $id (keys %{$zone_cfg->{ids}}) { | |
279 | next if $id eq $zoneid; | |
280 | die "vrf-vxlan $vrfvxlan is already declared in $id" | |
281 | if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan); | |
282 | } | |
283 | ||
284 | if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) { | |
285 | my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg'); | |
286 | $zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix}); | |
287 | } | |
288 | } | |
289 | ||
290 | ||
291 | sub vnet_update_hook { | |
292 | my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_; | |
293 | ||
294 | my $vnet = $vnet_cfg->{ids}->{$vnetid}; | |
295 | my $tag = $vnet->{tag}; | |
296 | ||
297 | raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag); | |
298 | raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216; | |
299 | ||
300 | # verify that tag is not already defined globally (vxlan-id are unique) | |
301 | foreach my $id (keys %{$vnet_cfg->{ids}}) { | |
302 | next if $id eq $vnetid; | |
303 | my $othervnet = $vnet_cfg->{ids}->{$id}; | |
304 | my $other_tag = $othervnet->{tag}; | |
305 | my $other_zoneid = $othervnet->{zone}; | |
306 | my $other_zone = $zone_cfg->{ids}->{$other_zoneid}; | |
307 | next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn'; | |
308 | raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag; | |
309 | } | |
310 | } | |
311 | ||
312 | ||
313 | 1; | |
314 | ||
315 |