PVE/Network/SDN/Zones/EvpnPlugin.pm

   1 package PVE::Network::SDN::Zones::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Zones::VxlanPlugin;
   6 use PVE::Exception qw(raise raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw($IPV4RE);
   9 use PVE::INotify;
  10 use PVE::Cluster;
  11 use PVE::Tools;
  12 use Net::IP;
  13
  14 use PVE::Network::SDN::Controllers::EvpnPlugin;
  15
  16 use base('PVE::Network::SDN::Zones::VxlanPlugin');
  17
  18 sub type {
  19     return 'evpn';
  20 }
  21
  22 sub properties {
  23     return {
  24         'vrf-vxlan' => {
  25             type => 'integer',
  26             description => "l3vni.",
  27         },
  28         'controller' => {
  29             type => 'string',
  30             description => "Frr router name",
  31         },
  32         'mac' => {
  33             type => 'string',
  34             description => "Anycast logical router mac address",
  35             optional => 1, format => 'mac-addr'
  36         },
  37         'exitnodes' => get_standard_option('pve-node-list'),
  38         'exitnodes-local-routing' => {
  39             type => 'boolean',
  40             description => "Allow exitnodes to connect to evpn guests",
  41             optional => 1
  42         },
  43         'advertise-subnets' => {
  44             type => 'boolean',
  45             description => "Advertise evpn subnets if you have silent hosts",
  46             optional => 1
  47         }
  48     };
  49 }
  50
  51 sub options {
  52     return {
  53         nodes => { optional => 1},
  54         'vrf-vxlan' => { optional => 0 },
  55         controller => { optional => 0 },
  56         exitnodes => { optional => 1 },
  57         'exitnodes-local-routing' => { optional => 1 },
  58         'advertise-subnets' => { optional => 1 },
  59         mtu => { optional => 1 },
  60         mac => { optional => 1 },
  61         dns => { optional => 1 },
  62         reversedns => { optional => 1 },
  63         dnszone => { optional => 1 },
  64         ipam => { optional => 1 },
  65     };
  66 }
  67
  68 # Plugin implementation
  69 sub generate_sdn_config {
  70     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
  71
  72     my $tag = $vnet->{tag};
  73     my $alias = $vnet->{alias};
  74     my $mac = $plugin_config->{'mac'};
  75
  76     my $vrf_iface = "vrf_$zoneid";
  77     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
  78     my $local_node = PVE::INotify::nodename();
  79
  80     die "missing vxlan tag" if !$tag;
  81     die "missing controller" if !$controller;
  82     warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
  83
  84     my @peers = PVE::Tools::split_list($controller->{'peers'});
  85     my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
  86     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
  87     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
  88     my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
  89     my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
  90
  91
  92     my $mtu = 1450;
  93     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
  94     $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
  95
  96     #vxlan interface
  97     my $vxlan_iface = "vxlan_$vnetid";
  98     my @iface_config = ();
  99     push @iface_config, "vxlan-id $tag";
 100     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 101     push @iface_config, "bridge-learning off";
 102     push @iface_config, "bridge-arp-nd-suppress on";
 103
 104     push @iface_config, "mtu $mtu" if $mtu;
 105     push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
 106
 107     #vnet bridge
 108     @iface_config = ();
 109
 110     my $address = {};
 111     my $ipv4 = undef;
 112     my $ipv6 = undef;
 113     my $enable_forward_v4 = undef;
 114     my $enable_forward_v6 = undef;
 115     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
 116     foreach my $subnetid (sort keys %{$subnets}) {
 117         my $subnet = $subnets->{$subnetid};
 118         my $cidr = $subnet->{cidr};
 119         my $mask = $subnet->{mask};
 120
 121         my $gateway = $subnet->{gateway};
 122         if ($gateway) {
 123             push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
 124             $address->{$gateway} = 1;
 125         }
 126
 127         my $iptables = undef;
 128         my $checkrouteip = undef;
 129         my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;
 130
 131         if ($ipversion == 6) {
 132             $ipv6 = 1;
 133             $iptables = "ip6tables";
 134             $checkrouteip = '2001:4860:4860::8888';
 135             $enable_forward_v6 = 1 if $gateway;
 136         } else {
 137             $ipv4 = 1;
 138             $iptables = "iptables";
 139             $checkrouteip = '8.8.8.8';
 140             $enable_forward_v4 = 1 if $gateway;
 141         }
 142
 143         if ($subnet->{snat}) {
 144
 145             #find outgoing interface
 146             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
 147             if ($outip && $outiface && $is_evpn_gateway) {
 148                 #use snat, faster than masquerade
 149                 push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 150                 push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 151                 #add conntrack zone once on outgoing interface
 152                 push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
 153                 push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
 154             }
 155         }
 156     }
 157
 158     push @iface_config, "hwaddress $mac" if $mac;
 159     push @iface_config, "bridge_ports $vxlan_iface";
 160     push @iface_config, "bridge_stp off";
 161     push @iface_config, "bridge_fd 0";
 162     push @iface_config, "mtu $mtu" if $mtu;
 163     push @iface_config, "alias $alias" if $alias;
 164     push @iface_config, "ip-forward on" if $enable_forward_v4;
 165     push @iface_config, "ip6-forward on" if $enable_forward_v6;
 166     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 167     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
 168     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 169
 170     if ($vrf_iface) {
 171         #vrf interface
 172         @iface_config = ();
 173         push @iface_config, "vrf-table auto";
 174         if(!$is_evpn_gateway) {
 175             push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
 176         } else {
 177             push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
 178         }
 179
 180         push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 181
 182         if ($vrfvxlan) {
 183             #l3vni vxlan interface
 184             my $iface_vrf_vxlan = "vrfvx_$zoneid";
 185             @iface_config = ();
 186             push @iface_config, "vxlan-id $vrfvxlan";
 187             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 188             push @iface_config, "bridge-learning off";
 189             push @iface_config, "bridge-arp-nd-suppress on";
 190             push @iface_config, "mtu $mtu" if $mtu;
 191             push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
 192
 193             #l3vni bridge
 194             my $brvrf = "vrfbr_$zoneid";
 195             @iface_config = ();
 196             push @iface_config, "bridge-ports $iface_vrf_vxlan";
 197             push @iface_config, "bridge_stp off";
 198             push @iface_config, "bridge_fd 0";
 199             push @iface_config, "mtu $mtu" if $mtu;
 200             push @iface_config, "vrf $vrf_iface";
 201             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 202         }
 203
 204         if ( $is_evpn_gateway && $exitnodes_local_routing ) {
 205             #add a veth pair for local cross-vrf routing
 206             my $iface_xvrf = "xvrf_$zoneid";
 207             my $iface_xvrfp = "xvrfp_$zoneid";
 208
 209             @iface_config = ();
 210             push @iface_config, "link-type veth";
 211             push @iface_config, "address 10.255.255.1/30";
 212             push @iface_config, "veth-peer-name $iface_xvrfp";
 213             push @iface_config, "mtu ".($mtu+50) if $mtu;
 214             push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};
 215
 216             @iface_config = ();
 217             push @iface_config, "link-type veth";
 218             push @iface_config, "address 10.255.255.2/30";
 219             push @iface_config, "veth-peer-name $iface_xvrf";
 220             push @iface_config, "vrf $vrf_iface";
 221             push @iface_config, "mtu ".($mtu+50) if $mtu;
 222             push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
 223         }
 224     }
 225     return $config;
 226 }
 227
 228 sub on_update_hook {
 229     my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
 230
 231     # verify that controller exist
 232     my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
 233     if (!defined($controller_cfg->{ids}->{$controller})) {
 234         die "controller $controller don't exist";
 235     } else {
 236         die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
 237     }
 238
 239     #vrf-vxlan need to be defined
 240
 241     my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
 242     # verify that vrf-vxlan is not already declared in another zone
 243     foreach my $id (keys %{$zone_cfg->{ids}}) {
 244         next if $id eq $zoneid;
 245         die "vrf-vxlan $vrfvxlan is already declared in $id"
 246                 if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 247     }
 248
 249     if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
 250         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 251         $zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 252     }
 253 }
 254
 255
 256 sub vnet_update_hook {
 257     my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
 258
 259     my $vnet = $vnet_cfg->{ids}->{$vnetid};
 260     my $tag = $vnet->{tag};
 261
 262     raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
 263     raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
 264
 265     # verify that tag is not already defined globally (vxlan-id are unique)
 266     foreach my $id (keys %{$vnet_cfg->{ids}}) {
 267         next if $id eq $vnetid;
 268         my $othervnet = $vnet_cfg->{ids}->{$id};
 269         my $other_tag = $othervnet->{tag};
 270         my $other_zoneid = $othervnet->{zone};
 271         my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
 272         next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
 273         raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
 274     }
 275 }
 276
 277
 278 1;
 279
 280