PVE/Network/SDN/Zones/EvpnPlugin.pm

   1 package PVE::Network::SDN::Zones::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Zones::VxlanPlugin;
   6 use PVE::Exception qw(raise raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw($IPV4RE);
   9 use PVE::INotify;
  10 use PVE::Cluster;
  11 use PVE::Tools;
  12
  13 use PVE::Network::SDN::Controllers::EvpnPlugin;
  14
  15 use base('PVE::Network::SDN::Zones::VxlanPlugin');
  16
  17 sub type {
  18     return 'evpn';
  19 }
  20
  21 sub properties {
  22     return {
  23         'vrf-vxlan' => {
  24             type => 'integer',
  25             description => "l3vni.",
  26         },
  27         'controller' => {
  28             type => 'string',
  29             description => "Frr router name",
  30         },
  31         'mac' => {
  32             type => 'string',
  33             description => "Anycast logical router mac address",
  34             optional => 1, format => 'mac-addr'
  35         },
  36         'exitnodes' => get_standard_option('pve-node-list'),
  37     };
  38 }
  39
  40 sub options {
  41
  42     return {
  43         nodes => { optional => 1},
  44         'vrf-vxlan' => { optional => 0 },
  45         controller => { optional => 0 },
  46         exitnodes => { optional => 1 },
  47         mtu => { optional => 1 },
  48         mac => { optional => 1 },
  49         dns => { optional => 1 },
  50         reversedns => { optional => 1 },
  51         dnszone => { optional => 1 },
  52         ipam => { optional => 0 },
  53     };
  54 }
  55
  56 # Plugin implementation
  57 sub generate_sdn_config {
  58     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
  59
  60     my $tag = $vnet->{tag};
  61     my $alias = $vnet->{alias};
  62     my $ipv4 = $vnet->{ipv4};
  63     my $ipv6 = $vnet->{ipv6};
  64     my $mac = $plugin_config->{'mac'};
  65
  66     my $vrf_iface = "vrf_$zoneid";
  67     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
  68     my $local_node = PVE::INotify::nodename();
  69
  70     die "missing vxlan tag" if !$tag;
  71     die "missing controller" if !$controller;
  72     warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
  73
  74     my @peers = PVE::Tools::split_list($controller->{'peers'});
  75     my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
  76     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
  77     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
  78
  79     my $mtu = 1450;
  80     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
  81     $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
  82
  83     #vxlan interface
  84     my $vxlan_iface = "vxlan_$vnetid";
  85     my @iface_config = ();
  86     push @iface_config, "vxlan-id $tag";
  87     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
  88     push @iface_config, "bridge-learning off";
  89     push @iface_config, "bridge-arp-nd-suppress on";
  90
  91     push @iface_config, "mtu $mtu" if $mtu;
  92     push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
  93
  94     #vnet bridge
  95     @iface_config = ();
  96
  97     my $address = {};
  98     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
  99     foreach my $subnetid (sort keys %{$subnets}) {
 100         my $subnet = $subnets->{$subnetid};
 101         my $cidr = $subnet->{cidr};
 102         my $mask = $subnet->{mask};
 103
 104         my $gateway = $subnet->{gateway};
 105         if ($gateway) {
 106             push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
 107             $address->{$gateway} = 1;
 108         }
 109
 110         if ($subnet->{snat}) {
 111
 112             my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
 113
 114             #find outgoing interface
 115             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip('8.8.8.8');
 116             if ($outip && $outiface && $is_evpn_gateway) {
 117                 #use snat, faster than masquerade
 118                 push @iface_config, "post-up iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 119                 push @iface_config, "post-down iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 120                 #add conntrack zone once on outgoing interface
 121                 push @iface_config, "post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
 122                 push @iface_config, "post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
 123             }
 124         }
 125     }
 126
 127     push @iface_config, "hwaddress $mac" if $mac;
 128     push @iface_config, "bridge_ports $vxlan_iface";
 129     push @iface_config, "bridge_stp off";
 130     push @iface_config, "bridge_fd 0";
 131     push @iface_config, "mtu $mtu" if $mtu;
 132     push @iface_config, "alias $alias" if $alias;
 133     push @iface_config, "ip-forward on" if $ipv4;
 134     push @iface_config, "ip6-forward on" if $ipv6;
 135     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 136     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
 137     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 138
 139     if ($vrf_iface) {
 140         #vrf interface
 141         @iface_config = ();
 142         push @iface_config, "vrf-table auto";
 143         push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
 144         push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 145
 146         if ($vrfvxlan) {
 147             #l3vni vxlan interface
 148             my $iface_vrf_vxlan = "vrfvx_$zoneid";
 149             @iface_config = ();
 150             push @iface_config, "vxlan-id $vrfvxlan";
 151             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 152             push @iface_config, "bridge-learning off";
 153             push @iface_config, "bridge-arp-nd-suppress on";
 154             push @iface_config, "mtu $mtu" if $mtu;
 155             push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
 156
 157             #l3vni bridge
 158             my $brvrf = "vrfbr_$zoneid";
 159             @iface_config = ();
 160             push @iface_config, "bridge-ports $iface_vrf_vxlan";
 161             push @iface_config, "bridge_stp off";
 162             push @iface_config, "bridge_fd 0";
 163             push @iface_config, "mtu $mtu" if $mtu;
 164             push @iface_config, "vrf $vrf_iface";
 165             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 166         }
 167     }
 168
 169     return $config;
 170 }
 171
 172 sub on_update_hook {
 173     my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
 174
 175     # verify that controller exist
 176     my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
 177     if (!defined($controller_cfg->{ids}->{$controller})) {
 178         die "controller $controller don't exist";
 179     } else {
 180         die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
 181     }
 182
 183     #vrf-vxlan need to be defined
 184
 185     my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
 186     # verify that vrf-vxlan is not already declared in another zone
 187     foreach my $id (keys %{$zone_cfg->{ids}}) {
 188         next if $id eq $zoneid;
 189         die "vrf-vxlan $vrfvxlan is already declared in $id"
 190                 if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 191     }
 192
 193     if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
 194         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 195         $zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 196     }
 197 }
 198
 199
 200 sub vnet_update_hook {
 201     my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
 202
 203     my $vnet = $vnet_cfg->{ids}->{$vnetid};
 204     my $tag = $vnet->{tag};
 205
 206     raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
 207     raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
 208
 209     # verify that tag is not already defined globally (vxlan-id are unique)
 210     foreach my $id (keys %{$vnet_cfg->{ids}}) {
 211         next if $id eq $vnetid;
 212         my $othervnet = $vnet_cfg->{ids}->{$id};
 213         my $other_tag = $othervnet->{tag};
 214         my $other_zoneid = $othervnet->{zone};
 215         my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
 216         next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
 217         raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
 218     }
 219 }
 220
 221
 222 1;
 223
 224