PVE/Network/SDN/Zones/EvpnPlugin.pm

   1 package PVE::Network::SDN::Zones::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Zones::VxlanPlugin;
   6 use PVE::Exception qw(raise raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw($IPV4RE);
   9 use PVE::INotify;
  10 use PVE::Cluster;
  11 use PVE::Tools;
  12
  13 use PVE::Network::SDN::Controllers::EvpnPlugin;
  14
  15 use base('PVE::Network::SDN::Zones::VxlanPlugin');
  16
  17 sub type {
  18     return 'evpn';
  19 }
  20
  21 sub properties {
  22     return {
  23         'vrf-vxlan' => {
  24             type => 'integer',
  25             description => "l3vni.",
  26         },
  27         'controller' => {
  28             type => 'string',
  29             description => "Frr router name",
  30         },
  31         'exitnodes' => get_standard_option('pve-node-list'),
  32     };
  33 }
  34
  35 sub options {
  36
  37     return {
  38         nodes => { optional => 1},
  39         'vrf-vxlan' => { optional => 0 },
  40         controller => { optional => 0 },
  41         exitnodes => { optional => 1 },
  42         mtu => { optional => 1 },
  43         dns => { optional => 1 },
  44         reversedns => { optional => 1 },
  45         dnszone => { optional => 1 },
  46         ipam => { optional => 0 },
  47     };
  48 }
  49
  50 # Plugin implementation
  51 sub generate_sdn_config {
  52     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
  53
  54     my $tag = $vnet->{tag};
  55     my $alias = $vnet->{alias};
  56     my $ipv4 = $vnet->{ipv4};
  57     my $ipv6 = $vnet->{ipv6};
  58     my $mac = $vnet->{mac};
  59
  60     my $vrf_iface = "vrf_$zoneid";
  61     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
  62     my $local_node = PVE::INotify::nodename();
  63
  64     die "missing vxlan tag" if !$tag;
  65     die "missing controller" if !$controller;
  66     warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
  67
  68     my @peers = PVE::Tools::split_list($controller->{'peers'});
  69     my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
  70     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
  71     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
  72
  73     my $mtu = 1450;
  74     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
  75     $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
  76
  77     #vxlan interface
  78     my $vxlan_iface = "vxlan_$vnetid";
  79     my @iface_config = ();
  80     push @iface_config, "vxlan-id $tag";
  81     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
  82     push @iface_config, "bridge-learning off";
  83     push @iface_config, "bridge-arp-nd-suppress on";
  84
  85     push @iface_config, "mtu $mtu" if $mtu;
  86     push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
  87
  88     #vnet bridge
  89     @iface_config = ();
  90
  91     my $address = {};
  92     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
  93     foreach my $subnetid (sort keys %{$subnets}) {
  94         my $subnet = $subnets->{$subnetid};
  95         my $cidr = $subnet->{cidr};
  96
  97         my $gateway = $subnet->{gateway};
  98         if ($gateway) {
  99             push @iface_config, "address $gateway" if !defined($address->{$gateway});
 100             $address->{$gateway} = 1;
 101         }
 102         if ($subnet->{snat}) {
 103             my $gatewaynodes = $controller->{'gateway-nodes'};
 104             my $is_evpn_gateway = "";
 105             foreach my $evpn_gatewaynode (PVE::Tools::split_list($gatewaynodes)) {
 106                 $is_evpn_gateway = 1 if $evpn_gatewaynode eq $local_node;
 107             }
 108             #find outgoing interface
 109             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip('8.8.8.8');
 110             if ($outip && $outiface && $is_evpn_gateway) {
 111                 #use snat, faster than masquerade
 112                 push @iface_config, "post-up iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 113                 push @iface_config, "post-down iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 114                 #add conntrack zone once on outgoing interface
 115                 push @iface_config, "post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
 116                 push @iface_config, "post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
 117             }
 118         }
 119     }
 120
 121     push @iface_config, "hwaddress $mac" if $mac;
 122     push @iface_config, "bridge_ports $vxlan_iface";
 123     push @iface_config, "bridge_stp off";
 124     push @iface_config, "bridge_fd 0";
 125     push @iface_config, "mtu $mtu" if $mtu;
 126     push @iface_config, "alias $alias" if $alias;
 127     push @iface_config, "ip-forward on" if $ipv4;
 128     push @iface_config, "ip6-forward on" if $ipv6;
 129     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 130     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
 131     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 132
 133     if ($vrf_iface) {
 134         #vrf interface
 135         @iface_config = ();
 136         push @iface_config, "vrf-table auto";
 137         push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 138
 139         if ($vrfvxlan) {
 140             #l3vni vxlan interface
 141             my $iface_vrf_vxlan = "vrfvx_$zoneid";
 142             @iface_config = ();
 143             push @iface_config, "vxlan-id $vrfvxlan";
 144             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 145             push @iface_config, "bridge-learning off";
 146             push @iface_config, "bridge-arp-nd-suppress on";
 147             push @iface_config, "mtu $mtu" if $mtu;
 148             push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
 149
 150             #l3vni bridge
 151             my $brvrf = "vrfbr_$zoneid";
 152             @iface_config = ();
 153             push @iface_config, "bridge-ports $iface_vrf_vxlan";
 154             push @iface_config, "bridge_stp off";
 155             push @iface_config, "bridge_fd 0";
 156             push @iface_config, "mtu $mtu" if $mtu;
 157             push @iface_config, "vrf $vrf_iface";
 158             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 159         }
 160     }
 161
 162     return $config;
 163 }
 164
 165 sub on_update_hook {
 166     my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
 167
 168     # verify that controller exist
 169     my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
 170     if (!defined($controller_cfg->{ids}->{$controller})) {
 171         die "controller $controller don't exist";
 172     } else {
 173         die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
 174     }
 175
 176     #vrf-vxlan need to be defined
 177
 178     my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
 179     # verify that vrf-vxlan is not already declared in another zone
 180     foreach my $id (keys %{$zone_cfg->{ids}}) {
 181         next if $id eq $zoneid;
 182         die "vrf-vxlan $vrfvxlan is already declared in $id"
 183                 if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 184     }
 185
 186 }
 187
 188
 189 sub vnet_update_hook {
 190     my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
 191
 192     my $vnet = $vnet_cfg->{ids}->{$vnetid};
 193     my $tag = $vnet->{tag};
 194
 195     raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
 196     raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
 197
 198     # verify that tag is not already defined globally (vxlan-id are unique)
 199     foreach my $id (keys %{$vnet_cfg->{ids}}) {
 200         next if $id eq $vnetid;
 201         my $othervnet = $vnet_cfg->{ids}->{$id};
 202         my $other_tag = $othervnet->{tag};
 203         my $other_zoneid = $othervnet->{zone};
 204         my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
 205         next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
 206         raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
 207     }
 208
 209     if (!defined($vnet->{mac})) {
 210         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 211         $vnet->{mac} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 212     }
 213 }
 214
 215
 216 1;
 217
 218