controllers: evpn : use frr restart if reload fail
[pve-network.git] / PVE / Network / SDN / Controllers / EvpnPlugin.pm
1 package PVE::Network::SDN::Controllers::EvpnPlugin;
2
3 use strict;
4 use warnings;
5
6 use PVE::INotify;
7 use PVE::JSONSchema qw(get_standard_option);
8 use PVE::Tools qw(run_command file_set_contents file_get_contents);
9
10 use PVE::Network::SDN::Controllers::Plugin;
11 use PVE::Network::SDN::Zones::Plugin;
12 use Net::IP;
13
14 use base('PVE::Network::SDN::Controllers::Plugin');
15
16 sub type {
17 return 'evpn';
18 }
19
20 sub properties {
21 return {
22 asn => {
23 type => 'integer',
24 description => "autonomous system number",
25 minimum => 0,
26 maximum => 4294967296
27 },
28 peers => {
29 description => "peers address list.",
30 type => 'string', format => 'ip-list'
31 },
32 };
33 }
34
35 sub options {
36 return {
37 'asn' => { optional => 0 },
38 'peers' => { optional => 0 },
39 };
40 }
41
42 # Plugin implementation
43 sub generate_controller_config {
44 my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;
45
46 my @peers;
47 @peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};
48
49 my $local_node = PVE::INotify::nodename();
50
51 my $asn = $plugin_config->{asn};
52 my $ebgp = undef;
53 my $loopback = undef;
54 my $autortas = undef;
55 my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
56 if($bgprouter) {
57 $ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
58 $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
59 $asn = $bgprouter->{asn} if $bgprouter->{asn};
60 $autortas = $plugin_config->{'asn'} if $ebgp;
61 }
62
63 return if !$asn;
64
65 my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};
66
67 my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
68
69 my $remoteas = $ebgp ? "external" : $asn;
70
71 #global options
72 my @controller_config = (
73 "bgp router-id $ifaceip",
74 "no bgp default ipv4-unicast",
75 "coalesce-time 1000",
76 );
77
78 push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;
79
80 @controller_config = ();
81
82 #VTEP neighbors
83 push @controller_config, "neighbor VTEP peer-group";
84 push @controller_config, "neighbor VTEP remote-as $remoteas";
85 push @controller_config, "neighbor VTEP bfd";
86
87 if($ebgp && $loopback) {
88 push @controller_config, "neighbor VTEP ebgp-multihop 10";
89 push @controller_config, "neighbor VTEP update-source $loopback";
90 }
91
92 # VTEP peers
93 foreach my $address (@peers) {
94 next if $address eq $ifaceip;
95 push @controller_config, "neighbor $address peer-group VTEP";
96 }
97
98 push(@{$bgp->{""}}, @controller_config);
99
100 # address-family l2vpn
101 @controller_config = ();
102 push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
103 push @controller_config, "neighbor VTEP activate";
104 push @controller_config, "advertise-all-vni";
105 push @controller_config, "autort as $autortas" if $autortas;
106 push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
107
108 push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []);
109
110 return $config;
111 }
112
113 sub generate_controller_zone_config {
114 my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;
115
116 my $local_node = PVE::INotify::nodename();
117
118 my $vrf = "vrf_$id";
119 my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
120 my $exitnodes = $plugin_config->{'exitnodes'};
121 my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
122 my $advertisesubnets = $plugin_config->{'advertise-subnets'};
123 my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
124 my $rt_import = [PVE::Tools::split_list($plugin_config->{'rt-import'})] if $plugin_config->{'rt-import'};
125
126 my $asn = $controller->{asn};
127 my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
128 my $ebgp = undef;
129 my $loopback = undef;
130 my $autortas = undef;
131 my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
132 if($bgprouter) {
133 $ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
134 $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
135 $asn = $bgprouter->{asn} if $bgprouter->{asn};
136 $autortas = $controller->{'asn'} if $ebgp;
137 }
138
139 return if !$vrf || !$vrfvxlan || !$asn;
140
141 my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
142
143 # vrf
144 my @controller_config = ();
145 push @controller_config, "vni $vrfvxlan";
146 push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);
147
148 #main vrf router
149 @controller_config = ();
150 push @controller_config, "bgp router-id $ifaceip";
151 # push @controller_config, "!";
152 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);
153
154 if ($autortas) {
155 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
156 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
157 }
158
159 my $is_gateway = $exitnodes->{$local_node};
160
161 if ($is_gateway) {
162
163 if($exitnodes_primary && $exitnodes_primary ne $local_node) {
164 my $routemap_config = ();
165 push @{$routemap_config}, "match evpn vni $vrfvxlan";
166 push @{$routemap_config}, "match evpn route-type prefix";
167 push @{$routemap_config}, "set metric 200";
168 unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config);
169 }
170
171 if (!$exitnodes_local_routing) {
172 @controller_config = ();
173 #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
174 push @controller_config, "import vrf $vrf";
175 push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
176 push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
177
178 @controller_config = ();
179 #redistribute connected to be able to route to local vms on the gateway
180 push @controller_config, "redistribute connected";
181 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
182 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
183 }
184
185 @controller_config = ();
186 #add default originate to announce 0.0.0.0/0 type5 route in evpn
187 push @controller_config, "default-originate ipv4";
188 push @controller_config, "default-originate ipv6";
189 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
190 } elsif ($advertisesubnets) {
191
192 @controller_config = ();
193 #redistribute connected networks
194 push @controller_config, "redistribute connected";
195 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
196 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
197
198 @controller_config = ();
199 #advertise connected networks type5 route in evpn
200 push @controller_config, "advertise ipv4 unicast";
201 push @controller_config, "advertise ipv6 unicast";
202 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
203 }
204
205 if($rt_import) {
206 @controller_config = ();
207 foreach my $rt (sort @{$rt_import}) {
208 push @controller_config, "route-target import $rt";
209 }
210 push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
211 }
212
213 return $config;
214 }
215
216 sub generate_controller_vnet_config {
217 my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
218
219 my $exitnodes = $zone->{'exitnodes'};
220 my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};
221
222 return if !$exitnodes_local_routing;
223
224 my $local_node = PVE::INotify::nodename();
225 my $is_gateway = $exitnodes->{$local_node};
226
227 return if !$is_gateway;
228
229 my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
230 my @controller_config = ();
231 foreach my $subnetid (sort keys %{$subnets}) {
232 my $subnet = $subnets->{$subnetid};
233 my $cidr = $subnet->{cidr};
234 push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
235 }
236 push(@{$config->{frr}->{''}}, @controller_config);
237 }
238
239 sub on_delete_hook {
240 my ($class, $controllerid, $zone_cfg) = @_;
241
242 # verify that zone is associated to this controller
243 foreach my $id (keys %{$zone_cfg->{ids}}) {
244 my $zone = $zone_cfg->{ids}->{$id};
245 die "controller $controllerid is used by $id"
246 if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
247 }
248 }
249
250 sub on_update_hook {
251 my ($class, $controllerid, $controller_cfg) = @_;
252
253 # we can only have 1 evpn controller / 1 asn by server
254
255 my $controllernb = 0;
256 foreach my $id (keys %{$controller_cfg->{ids}}) {
257 next if $id eq $controllerid;
258 my $controller = $controller_cfg->{ids}->{$id};
259 next if $controller->{type} ne "evpn";
260 $controllernb++;
261 die "only 1 global evpn controller can be defined" if $controllernb > 1;
262 }
263 }
264
265 sub find_bgp_controller {
266 my ($nodename, $controller_cfg) = @_;
267
268 my $controller = undef;
269 foreach my $id (keys %{$controller_cfg->{ids}}) {
270 $controller = $controller_cfg->{ids}->{$id};
271 next if $controller->{type} ne 'bgp';
272 next if $controller->{node} ne $nodename;
273 last;
274 }
275
276 return $controller;
277 }
278
279
280 sub sort_frr_config {
281 my $order = {};
282 $order->{''} = 0;
283 $order->{'vrf'} = 1;
284 $order->{'ipv4 unicast'} = 1;
285 $order->{'ipv6 unicast'} = 2;
286 $order->{'l2vpn evpn'} = 3;
287
288 my $a_val = 100;
289 my $b_val = 100;
290
291 $a_val = $order->{$a} if defined($order->{$a});
292 $b_val = $order->{$b} if defined($order->{$b});
293
294 if ($a =~ /bgp (\d+)$/) {
295 $a_val = 2;
296 }
297
298 if ($b =~ /bgp (\d+)$/) {
299 $b_val = 2;
300 }
301
302 return $a_val <=> $b_val;
303 }
304
305 sub generate_frr_recurse{
306 my ($final_config, $content, $parentkey, $level) = @_;
307
308 my $keylist = {};
309 $keylist->{vrf} = 1;
310 $keylist->{'address-family'} = 1;
311 $keylist->{router} = 1;
312
313 my $exitkeylist = {};
314 $exitkeylist->{vrf} = 1;
315 $exitkeylist->{'address-family'} = 1;
316
317 # FIXME: make this generic
318 my $paddinglevel = undef;
319 if ($level == 1 || $level == 2) {
320 $paddinglevel = $level - 1;
321 } elsif ($level == 3 || $level == 4) {
322 $paddinglevel = $level - 2;
323 }
324
325 my $padding = "";
326 $padding = ' ' x ($paddinglevel) if $paddinglevel;
327
328 if (ref $content eq 'HASH') {
329 foreach my $key (sort sort_frr_config keys %$content) {
330 if ($parentkey && defined($keylist->{$parentkey})) {
331 push @{$final_config}, $padding."!";
332 push @{$final_config}, $padding."$parentkey $key";
333 } elsif ($key ne '' && !defined($keylist->{$key})) {
334 push @{$final_config}, $padding."$key";
335 }
336
337 my $option = $content->{$key};
338 generate_frr_recurse($final_config, $option, $key, $level+1);
339
340 push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
341 }
342 }
343
344 if (ref $content eq 'ARRAY') {
345 push @{$final_config}, map { $padding . "$_" } @$content;
346 }
347 }
348
349 sub generate_frr_routemap {
350 my ($final_config, $routemaps) = @_;
351
352 foreach my $id (sort keys %$routemaps) {
353
354 my $routemap = $routemaps->{$id};
355 my $order = 0;
356 foreach my $seq (@$routemap) {
357 $order++;
358 my @config = ();
359 push @config, "!";
360 push @config, "route-map $id permit $order";
361 push @config, map { " $_" } @$seq;
362 push @{$final_config}, @config;
363 }
364 }
365 }
366 sub generate_controller_rawconfig {
367 my ($class, $plugin_config, $config) = @_;
368
369 my $nodename = PVE::INotify::nodename();
370
371 my $final_config = [];
372 push @{$final_config}, "frr version 8.0.1";
373 push @{$final_config}, "frr defaults datacenter";
374 push @{$final_config}, "hostname $nodename";
375 push @{$final_config}, "log syslog informational";
376 push @{$final_config}, "service integrated-vtysh-config";
377 push @{$final_config}, "!";
378
379 if (-e "/etc/frr/frr.conf.local") {
380 generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
381 generate_frr_routemap($final_config, $config->{frr_routemap});
382 push @{$final_config}, "!";
383
384 my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
385 chomp ($local_conf);
386 push @{$final_config}, $local_conf;
387 } else {
388 generate_frr_recurse($final_config, $config->{frr}, undef, 0);
389 generate_frr_routemap($final_config, $config->{frr_routemap});
390 }
391
392 push @{$final_config}, "!";
393 push @{$final_config}, "line vty";
394 push @{$final_config}, "!";
395
396 my $rawconfig = join("\n", @{$final_config});
397
398 return if !$rawconfig;
399 return $rawconfig;
400 }
401
402 sub write_controller_config {
403 my ($class, $plugin_config, $config) = @_;
404
405 my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
406 return if !$rawconfig;
407 return if !-d "/etc/frr";
408
409 file_set_contents("/etc/frr/frr.conf", $rawconfig);
410 }
411
412 sub reload_controller {
413 my ($class) = @_;
414
415 my $conf_file = "/etc/frr/frr.conf";
416 my $bin_path = "/usr/lib/frr/frr-reload.py";
417
418 if (!-e $bin_path) {
419 warn "missing $bin_path. Please install frr-pythontools package";
420 return;
421 }
422
423 my $err = sub {
424 my $line = shift;
425 if ($line =~ /ERROR:/) {
426 warn "$line \n";
427 }
428 };
429
430 if (-e $conf_file && -e $bin_path) {
431 eval {
432 run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
433 };
434 if ($@) {
435 warn "frr reload command fail. Restarting frr.";
436 eval { run_command(['systemctl', 'restart', 'frr']); };
437 }
438 }
439 }
440
441 1;
442
443