PVE/Network/SDN/Zones/EvpnPlugin.pm

   1 package PVE::Network::SDN::Zones::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Zones::VxlanPlugin;
   6 use PVE::Exception qw(raise raise_param_exc);
   7 use PVE::Tools qw($IPV4RE);
   8 use PVE::INotify;
   9 use PVE::Cluster;
  10 use PVE::Tools;
  11
  12 use PVE::Network::SDN::Controllers::EvpnPlugin;
  13
  14 use base('PVE::Network::SDN::Zones::VxlanPlugin');
  15
  16 sub type {
  17     return 'evpn';
  18 }
  19
  20 sub properties {
  21     return {
  22         'vrf-vxlan' => {
  23             type => 'integer',
  24             description => "l3vni.",
  25         },
  26         'controller' => {
  27             type => 'string',
  28             description => "Frr router name",
  29         },
  30     };
  31 }
  32
  33 sub options {
  34
  35     return {
  36         nodes => { optional => 1},
  37         'vrf-vxlan' => { optional => 0 },
  38         'controller' => { optional => 0 },
  39         mtu => { optional => 1 },
  40         dns => { optional => 1 },
  41         reversedns => { optional => 1 },
  42         dnszone => { optional => 1 },
  43     };
  44 }
  45
  46 # Plugin implementation
  47 sub generate_sdn_config {
  48     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $subnet_cfg, $interfaces_config, $config) = @_;
  49
  50     my $tag = $vnet->{tag};
  51     my $alias = $vnet->{alias};
  52     my $ipv4 = $vnet->{ipv4};
  53     my $ipv6 = $vnet->{ipv6};
  54     my $mac = $vnet->{mac};
  55
  56     my $vrf_iface = "vrf_$zoneid";
  57     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
  58     my $local_node = PVE::INotify::nodename();
  59
  60     die "missing vxlan tag" if !$tag;
  61     warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
  62
  63     my @peers = PVE::Tools::split_list($controller->{'peers'});
  64     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers);
  65
  66     my $mtu = 1450;
  67     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
  68     $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
  69
  70     #vxlan interface
  71     my $vxlan_iface = "vxlan_$vnetid";
  72     my @iface_config = ();
  73     push @iface_config, "vxlan-id $tag";
  74     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
  75     push @iface_config, "bridge-learning off";
  76     push @iface_config, "bridge-arp-nd-suppress on";
  77
  78     push @iface_config, "mtu $mtu" if $mtu;
  79     push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
  80
  81     #vnet bridge
  82     @iface_config = ();
  83
  84     my $address = {};
  85     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
  86     foreach my $subnetid (sort keys %{$subnets}) {
  87         my $subnet = $subnets->{$subnetid};
  88         my $cidr = $subnetid =~ s/-/\//r;
  89         my $gateway = $subnet->{gateway};
  90         if ($gateway) {
  91             push @iface_config, "address $gateway" if !defined($address->{$gateway});
  92             $address->{$gateway} = 1;
  93         }
  94         if ($subnet->{snat}) {
  95             my $gatewaynodes = $controller->{'gateway-nodes'};
  96             my $is_evpn_gateway = "";
  97             foreach my $evpn_gatewaynode (PVE::Tools::split_list($gatewaynodes)) {
  98                 $is_evpn_gateway = 1 if $evpn_gatewaynode eq $local_node;
  99             }
 100             #find outgoing interface
 101             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip('8.8.8.8');
 102             if ($outip && $outiface && $is_evpn_gateway) {
 103                 #use snat, faster than masquerade
 104                 push @iface_config, "post-up iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 105                 push @iface_config, "post-down iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 106                 #add conntrack zone once on outgoing interface
 107                 push @iface_config, "post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
 108                 push @iface_config, "post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
 109             }
 110         }
 111     }
 112
 113     push @iface_config, "hwaddress $mac" if $mac;
 114     push @iface_config, "bridge_ports $vxlan_iface";
 115     push @iface_config, "bridge_stp off";
 116     push @iface_config, "bridge_fd 0";
 117     push @iface_config, "mtu $mtu" if $mtu;
 118     push @iface_config, "alias $alias" if $alias;
 119     push @iface_config, "ip-forward on" if $ipv4;
 120     push @iface_config, "ip6-forward on" if $ipv6;
 121     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 122     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
 123     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 124
 125     if ($vrf_iface) {
 126         #vrf interface
 127         @iface_config = ();
 128         push @iface_config, "vrf-table auto";
 129         push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 130
 131         if ($vrfvxlan) {
 132             #l3vni vxlan interface
 133             my $iface_vrf_vxlan = "vrfvx_$zoneid";
 134             @iface_config = ();
 135             push @iface_config, "vxlan-id $vrfvxlan";
 136             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 137             push @iface_config, "bridge-learning off";
 138             push @iface_config, "bridge-arp-nd-suppress on";
 139             push @iface_config, "mtu $mtu" if $mtu;
 140             push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
 141
 142             #l3vni bridge
 143             my $brvrf = "vrfbr_$zoneid";
 144             @iface_config = ();
 145             push @iface_config, "bridge-ports $iface_vrf_vxlan";
 146             push @iface_config, "bridge_stp off";
 147             push @iface_config, "bridge_fd 0";
 148             push @iface_config, "mtu $mtu" if $mtu;
 149             push @iface_config, "vrf $vrf_iface";
 150             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 151         }
 152     }
 153
 154     return $config;
 155 }
 156
 157 sub on_update_hook {
 158     my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
 159
 160     # verify that controller exist
 161     my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
 162     if (!defined($controller_cfg->{ids}->{$controller})) {
 163         die "controller $controller don't exist";
 164     } else {
 165         die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
 166     }
 167
 168     #vrf-vxlan need to be defined
 169
 170     my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
 171     # verify that vrf-vxlan is not already declared in another zone
 172     foreach my $id (keys %{$zone_cfg->{ids}}) {
 173         next if $id eq $zoneid;
 174         die "vrf-vxlan $vrfvxlan is already declared in $id"
 175                 if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 176     }
 177
 178 }
 179
 180
 181 sub vnet_update_hook {
 182     my ($class, $vnet) = @_;
 183
 184     raise_param_exc({ tag => "missing vxlan tag"}) if !defined($vnet->{tag});
 185     raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $vnet->{tag} > 16777216;
 186
 187     if (!defined($vnet->{mac})) {
 188         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 189         $vnet->{mac} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 190     }
 191 }
 192
 193
 194 1;
 195
 196