PVE/Network/SDN/Controllers/EvpnPlugin.pm

   1 package PVE::Network::SDN::Controllers::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::INotify;
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw(run_command file_set_contents file_get_contents);
   9
  10 use PVE::Network::SDN::Controllers::Plugin;
  11 use PVE::Network::SDN::Zones::Plugin;
  12 use Net::IP;
  13
  14 use base('PVE::Network::SDN::Controllers::Plugin');
  15
  16 sub type {
  17     return 'evpn';
  18 }
  19
  20 sub properties {
  21     return {
  22         asn => {
  23             type => 'integer',
  24             description => "autonomous system number",
  25             minimum => 0,
  26             maximum => 4294967296
  27         },
  28         peers => {
  29             description => "peers address list.",
  30             type => 'string', format => 'ip-list'
  31         },
  32     };
  33 }
  34
  35 sub options {
  36     return {
  37         'asn' => { optional => 0 },
  38         'peers' => { optional => 0 },
  39     };
  40 }
  41
  42 # Plugin implementation
  43 sub generate_controller_config {
  44     my ($class, $plugin_config, $controller_cfg, $id, $uplinks, $config) = @_;
  45
  46     my @peers;
  47     @peers = PVE::Tools::split_list($plugin_config->{'peers'}) if $plugin_config->{'peers'};
  48
  49     my $local_node = PVE::INotify::nodename();
  50
  51     my $asn = $plugin_config->{asn};
  52     my $ebgp = undef;
  53     my $loopback = undef;
  54     my $autortas = undef;
  55     my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
  56     if($bgprouter) {
  57         $ebgp = 1 if $plugin_config->{'asn'} ne $bgprouter->{asn};
  58         $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
  59         $asn = $bgprouter->{asn} if $bgprouter->{asn};
  60         $autortas = $plugin_config->{'asn'} if $ebgp;
  61     }
  62
  63     return if !$asn;
  64
  65     my $bgp = $config->{frr}->{router}->{"bgp $asn"} //= {};
  66
  67     my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
  68
  69     my $remoteas = $ebgp ? "external" : $asn;
  70
  71     #global options
  72     my @controller_config = (
  73         "bgp router-id $ifaceip",
  74         "no bgp default ipv4-unicast",
  75         "coalesce-time 1000",
  76     );
  77
  78     push(@{$bgp->{""}}, @controller_config) if keys %{$bgp} == 0;
  79
  80     @controller_config = ();
  81
  82     #VTEP neighbors
  83     push @controller_config, "neighbor VTEP peer-group";
  84     push @controller_config, "neighbor VTEP remote-as $remoteas";
  85     push @controller_config, "neighbor VTEP bfd";
  86
  87     if($ebgp && $loopback) {
  88         push @controller_config, "neighbor VTEP ebgp-multihop 10";
  89         push @controller_config, "neighbor VTEP update-source $loopback";
  90     }
  91
  92     # VTEP peers
  93     foreach my $address (@peers) {
  94         next if $address eq $ifaceip;
  95         push @controller_config, "neighbor $address peer-group VTEP";
  96     }
  97
  98     push(@{$bgp->{""}}, @controller_config);
  99
 100     # address-family l2vpn
 101     @controller_config = ();
 102     push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
 103     push @controller_config, "neighbor VTEP activate";
 104     push @controller_config, "advertise-all-vni";
 105     push @controller_config, "autort as $autortas" if $autortas;
 106     push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
 107
 108     push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []);
 109
 110     return $config;
 111 }
 112
 113 sub generate_controller_zone_config {
 114     my ($class, $plugin_config, $controller, $controller_cfg, $id, $uplinks, $config) = @_;
 115
 116     my $local_node = PVE::INotify::nodename();
 117
 118     my $vrf = "vrf_$id";
 119     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
 120     my $exitnodes = $plugin_config->{'exitnodes'};
 121     my $exitnodes_primary = $plugin_config->{'exitnodes-primary'};
 122     my $advertisesubnets = $plugin_config->{'advertise-subnets'};
 123     my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
 124
 125     my $asn = $controller->{asn};
 126     my @peers = PVE::Tools::split_list($controller->{'peers'}) if $controller->{'peers'};
 127     my $ebgp = undef;
 128     my $loopback = undef;
 129     my $autortas = undef;
 130     my $bgprouter = find_bgp_controller($local_node, $controller_cfg);
 131     if($bgprouter) {
 132         $ebgp = 1 if $controller->{'asn'} ne $bgprouter->{asn};
 133         $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
 134         $asn = $bgprouter->{asn} if $bgprouter->{asn};
 135         $autortas = $controller->{'asn'} if $ebgp;
 136     }
 137
 138     return if !$vrf || !$vrfvxlan || !$asn;
 139
 140     my ($ifaceip, $interface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
 141
 142     # vrf
 143     my @controller_config = ();
 144     push @controller_config, "vni $vrfvxlan";
 145     push(@{$config->{frr}->{vrf}->{"$vrf"}}, @controller_config);
 146
 147     #main vrf router
 148     @controller_config = ();
 149     push @controller_config, "bgp router-id $ifaceip";
 150     push @controller_config, "no bgp ebgp-requires-policy" if $ebgp;
 151 #    push @controller_config, "!";
 152     push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{""}}, @controller_config);
 153
 154     if ($autortas) {
 155         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target import $autortas:$vrfvxlan");
 156         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, "route-target export $autortas:$vrfvxlan");
 157     }
 158
 159     my $is_gateway = $exitnodes->{$local_node};
 160
 161     if ($is_gateway) {
 162
 163         if($exitnodes_primary && $exitnodes_primary ne $local_node) {
 164             my $routemap_config = ();
 165             push @{$routemap_config}, "match evpn vni $vrfvxlan";
 166             push @{$routemap_config}, "match evpn route-type prefix";
 167             push @{$routemap_config}, "set metric 200";
 168             unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config);
 169         }
 170
 171         if (!$exitnodes_local_routing) {
 172             @controller_config = ();
 173             #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
 174             push @controller_config, "import vrf $vrf";
 175             push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
 176             push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
 177
 178             @controller_config = ();
 179             #redistribute connected to be able to route to local vms on the gateway
 180             push @controller_config, "redistribute connected";
 181             push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
 182             push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
 183         }
 184
 185         @controller_config = ();
 186         #add default originate to announce 0.0.0.0/0 type5 route in evpn
 187         push @controller_config, "default-originate ipv4";
 188         push @controller_config, "default-originate ipv6";
 189         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
 190     } elsif ($advertisesubnets) {
 191
 192         @controller_config = ();
 193         #redistribute connected networks
 194         push @controller_config, "redistribute connected";
 195         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
 196         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
 197
 198         @controller_config = ();
 199         #advertise connected networks type5 route in evpn
 200         push @controller_config, "advertise ipv4 unicast";
 201         push @controller_config, "advertise ipv6 unicast";
 202         push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
 203     }
 204
 205     return $config;
 206 }
 207
 208 sub generate_controller_vnet_config {
 209     my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
 210
 211     my $exitnodes = $zone->{'exitnodes'};
 212     my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};
 213
 214     return if !$exitnodes_local_routing;
 215
 216     my $local_node = PVE::INotify::nodename();
 217     my $is_gateway = $exitnodes->{$local_node};
 218
 219     return if !$is_gateway;
 220
 221     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
 222     my @controller_config = ();
 223     foreach my $subnetid (sort keys %{$subnets}) {
 224         my $subnet = $subnets->{$subnetid};
 225         my $cidr = $subnet->{cidr};
 226         push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
 227     }
 228     push(@{$config->{frr}->{''}}, @controller_config);
 229 }
 230
 231 sub on_delete_hook {
 232     my ($class, $controllerid, $zone_cfg) = @_;
 233
 234     # verify that zone is associated to this controller
 235     foreach my $id (keys %{$zone_cfg->{ids}}) {
 236         my $zone = $zone_cfg->{ids}->{$id};
 237         die "controller $controllerid is used by $id"
 238             if (defined($zone->{controller}) && $zone->{controller} eq $controllerid);
 239     }
 240 }
 241
 242 sub on_update_hook {
 243     my ($class, $controllerid, $controller_cfg) = @_;
 244
 245     # we can only have 1 evpn controller / 1 asn by server
 246
 247     my $controllernb = 0;
 248     foreach my $id (keys %{$controller_cfg->{ids}}) {
 249         next if $id eq $controllerid;
 250         my $controller = $controller_cfg->{ids}->{$id};
 251         next if $controller->{type} ne "evpn";
 252         $controllernb++;
 253         die "only 1 global evpn controller can be defined" if $controllernb > 1;
 254     }
 255 }
 256
 257 sub find_bgp_controller {
 258     my ($nodename, $controller_cfg) = @_;
 259
 260     my $controller = undef;
 261     foreach my $id  (keys %{$controller_cfg->{ids}}) {
 262         $controller = $controller_cfg->{ids}->{$id};
 263         next if $controller->{type} ne 'bgp';
 264         next if $controller->{node} ne $nodename;
 265         last;
 266     }
 267
 268     return $controller;
 269 }
 270
 271
 272 sub sort_frr_config {
 273     my $order = {};
 274     $order->{''} = 0;
 275     $order->{'vrf'} = 1;
 276     $order->{'ipv4 unicast'} = 1;
 277     $order->{'ipv6 unicast'} = 2;
 278     $order->{'l2vpn evpn'} = 3;
 279
 280     my $a_val = 100;
 281     my $b_val = 100;
 282
 283     $a_val = $order->{$a} if defined($order->{$a});
 284     $b_val = $order->{$b} if defined($order->{$b});
 285
 286     if ($a =~ /bgp (\d+)$/) {
 287         $a_val = 2;
 288     }
 289
 290     if ($b =~ /bgp (\d+)$/) {
 291         $b_val = 2;
 292     }
 293
 294     return $a_val <=> $b_val;
 295 }
 296
 297 sub generate_frr_recurse{
 298    my ($final_config, $content, $parentkey, $level) = @_;
 299
 300    my $keylist = {};
 301    $keylist->{vrf} = 1;
 302    $keylist->{'address-family'} = 1;
 303    $keylist->{router} = 1;
 304
 305    my $exitkeylist = {};
 306    $exitkeylist->{vrf} = 1;
 307    $exitkeylist->{'address-family'} = 1;
 308
 309    # FIXME: make this generic
 310    my $paddinglevel = undef;
 311    if ($level == 1 || $level == 2) {
 312         $paddinglevel = $level - 1;
 313    } elsif ($level == 3 || $level ==  4) {
 314         $paddinglevel = $level - 2;
 315    }
 316
 317    my $padding = "";
 318    $padding = ' ' x ($paddinglevel) if $paddinglevel;
 319
 320    if (ref $content eq  'HASH') {
 321         foreach my $key (sort sort_frr_config keys %$content) {
 322             if ($parentkey && defined($keylist->{$parentkey})) {
 323                 push @{$final_config}, $padding."!";
 324                 push @{$final_config}, $padding."$parentkey $key";
 325             } elsif ($key ne '' && !defined($keylist->{$key})) {
 326                 push @{$final_config}, $padding."$key";
 327             }
 328
 329             my $option = $content->{$key};
 330             generate_frr_recurse($final_config, $option, $key, $level+1);
 331
 332             push @{$final_config}, $padding."exit-$parentkey" if $parentkey && defined($exitkeylist->{$parentkey});
 333         }
 334     }
 335
 336     if (ref $content eq 'ARRAY') {
 337         push @{$final_config}, map { $padding . "$_" } @$content;
 338     }
 339 }
 340
 341 sub generate_frr_routemap {
 342    my ($final_config, $routemaps) = @_;
 343
 344    foreach my $id (sort keys %$routemaps) {
 345
 346         my $routemap = $routemaps->{$id};
 347         my $order = 0;
 348         foreach my $seq (@$routemap) {
 349                 $order++;
 350                 my @config = ();
 351                 push @config, "!";
 352                 push @config, "route-map $id permit $order";
 353                 push @config, map { " $_" } @$seq;
 354                 push @{$final_config}, @config;
 355         }
 356    }
 357 }
 358 sub generate_controller_rawconfig {
 359     my ($class, $plugin_config, $config) = @_;
 360
 361     my $nodename = PVE::INotify::nodename();
 362
 363     my $final_config = [];
 364     push @{$final_config}, "log syslog informational";
 365     push @{$final_config}, "ip forwarding";
 366     push @{$final_config}, "ipv6 forwarding";
 367     push @{$final_config}, "frr defaults datacenter";
 368     push @{$final_config}, "service integrated-vtysh-config";
 369     push @{$final_config}, "hostname $nodename";
 370     push @{$final_config}, "!";
 371
 372     if (-e "/etc/frr/frr.conf.local") {
 373         generate_frr_recurse($final_config, $config->{frr}->{vrf}, "vrf", 1);
 374         generate_frr_routemap($final_config, $config->{frr_routemap});
 375         push @{$final_config}, "!";
 376
 377         my $local_conf = file_get_contents("/etc/frr/frr.conf.local");
 378         chomp ($local_conf);
 379         push @{$final_config}, $local_conf;
 380     } else {
 381         generate_frr_recurse($final_config, $config->{frr}, undef, 0);
 382         generate_frr_routemap($final_config, $config->{frr_routemap});
 383     }
 384
 385     push @{$final_config}, "!";
 386     push @{$final_config}, "line vty";
 387     push @{$final_config}, "!";
 388
 389     my $rawconfig = join("\n", @{$final_config});
 390
 391     return if !$rawconfig;
 392     return $rawconfig;
 393 }
 394
 395 sub write_controller_config {
 396     my ($class, $plugin_config, $config) = @_;
 397
 398     my $rawconfig = $class->generate_controller_rawconfig($plugin_config, $config);
 399     return if !$rawconfig;
 400     return if !-d "/etc/frr";
 401
 402     file_set_contents("/etc/frr/frr.conf", $rawconfig);
 403 }
 404
 405 sub reload_controller {
 406     my ($class) = @_;
 407
 408     my $conf_file = "/etc/frr/frr.conf";
 409     my $bin_path = "/usr/lib/frr/frr-reload.py";
 410
 411     if (!-e $bin_path) {
 412         warn "missing $bin_path. Please install frr-pythontools package";
 413         return;
 414     }
 415
 416     my $err = sub {
 417         my $line = shift;
 418         if ($line =~ /ERROR:/) {
 419             warn "$line \n";
 420         }
 421     };
 422
 423     if (-e $conf_file && -e $bin_path) {
 424         run_command([$bin_path, '--stdout', '--reload', $conf_file], outfunc => {}, errfunc => $err);
 425     }
 426 }
 427
 428 1;
 429
 430