PVE/Network/SDN/Zones/EvpnPlugin.pm

   1 package PVE::Network::SDN::Zones::EvpnPlugin;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Network::SDN::Zones::VxlanPlugin;
   6 use PVE::Exception qw(raise raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw($IPV4RE);
   9 use PVE::INotify;
  10 use PVE::Cluster;
  11 use PVE::Tools;
  12 use Net::IP;
  13
  14 use PVE::Network::SDN::Controllers::EvpnPlugin;
  15
  16 use base('PVE::Network::SDN::Zones::VxlanPlugin');
  17
  18 sub type {
  19     return 'evpn';
  20 }
  21
  22 PVE::JSONSchema::register_format('pve-sdn-bgp-rt', \&pve_verify_sdn_bgp_rt);
  23 sub pve_verify_sdn_bgp_rt {
  24     my ($rt) = @_;
  25
  26     if ($rt =~ m/^(\d+):(\d+)$/) {
  27         my $asn = $1;
  28         my $id = $2;
  29
  30         if ($asn < 0 || $asn > 4294967295) {
  31             die "value does not look like a valid bgp route-target\n";
  32         }
  33         if ($id < 0 || $id > 4294967295) {
  34             die "value does not look like a valid bgp route-target\n";
  35         }
  36     } else {
  37         die "value does not look like a valid bgp route-target\n";
  38     }
  39     return $rt;
  40 }
  41
  42 sub properties {
  43     return {
  44         'vrf-vxlan' => {
  45             type => 'integer',
  46             description => "l3vni.",
  47         },
  48         'controller' => {
  49             type => 'string',
  50             description => "Frr router name",
  51         },
  52         'mac' => {
  53             type => 'string',
  54             description => "Anycast logical router mac address",
  55             optional => 1, format => 'mac-addr'
  56         },
  57         'exitnodes' => get_standard_option('pve-node-list'),
  58         'exitnodes-local-routing' => {
  59             type => 'boolean',
  60             description => "Allow exitnodes to connect to evpn guests",
  61             optional => 1
  62         },
  63         'exitnodes-primary' => get_standard_option('pve-node', {
  64             description => "Force traffic to this exitnode first."}),
  65         'advertise-subnets' => {
  66             type => 'boolean',
  67             description => "Advertise evpn subnets if you have silent hosts",
  68             optional => 1
  69         },
  70         'disable-arp-nd-suppression' => {
  71             type => 'boolean',
  72             description => "Disable ipv4 arp && ipv6 neighbour discovery suppression",
  73             optional => 1
  74         },
  75         'rt-import' => {
  76             type => 'string',
  77             description => "Route-Target import",
  78             optional => 1, format => 'pve-sdn-bgp-rt-list'
  79         }
  80     };
  81 }
  82
  83 sub options {
  84     return {
  85         nodes => { optional => 1},
  86         'vrf-vxlan' => { optional => 0 },
  87         controller => { optional => 0 },
  88         exitnodes => { optional => 1 },
  89         'exitnodes-local-routing' => { optional => 1 },
  90         'exitnodes-primary' => { optional => 1 },
  91         'advertise-subnets' => { optional => 1 },
  92         'disable-arp-nd-suppression' => { optional => 1 },
  93         'rt-import' => { optional => 1 },
  94         mtu => { optional => 1 },
  95         mac => { optional => 1 },
  96         dns => { optional => 1 },
  97         reversedns => { optional => 1 },
  98         dnszone => { optional => 1 },
  99         ipam => { optional => 1 },
 100     };
 101 }
 102
 103 # Plugin implementation
 104 sub generate_sdn_config {
 105     my ($class, $plugin_config, $zoneid, $vnetid, $vnet, $controller, $controller_cfg, $subnet_cfg, $interfaces_config, $config) = @_;
 106
 107     my $tag = $vnet->{tag};
 108     my $alias = $vnet->{alias};
 109     my $mac = $plugin_config->{'mac'};
 110
 111     my $vrf_iface = "vrf_$zoneid";
 112     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
 113     my $local_node = PVE::INotify::nodename();
 114
 115     die "missing vxlan tag" if !$tag;
 116     die "missing controller" if !$controller;
 117     warn "vlan-aware vnet can't be enabled with evpn plugin" if $vnet->{vlanaware};
 118
 119     my @peers = PVE::Tools::split_list($controller->{'peers'});
 120     my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
 121     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
 122     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
 123     my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
 124     my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
 125
 126
 127     my $mtu = 1450;
 128     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
 129     $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
 130
 131     #vxlan interface
 132     my $vxlan_iface = "vxlan_$vnetid";
 133     my @iface_config = ();
 134     push @iface_config, "vxlan-id $tag";
 135     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 136     push @iface_config, "bridge-learning off";
 137     push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
 138
 139     push @iface_config, "mtu $mtu" if $mtu;
 140     push(@{$config->{$vxlan_iface}}, @iface_config) if !$config->{$vxlan_iface};
 141
 142     #vnet bridge
 143     @iface_config = ();
 144
 145     my $address = {};
 146     my $ipv4 = undef;
 147     my $ipv6 = undef;
 148     my $enable_forward_v4 = undef;
 149     my $enable_forward_v6 = undef;
 150     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
 151     foreach my $subnetid (sort keys %{$subnets}) {
 152         my $subnet = $subnets->{$subnetid};
 153         my $cidr = $subnet->{cidr};
 154         my $mask = $subnet->{mask};
 155
 156         my $gateway = $subnet->{gateway};
 157         if ($gateway) {
 158             push @iface_config, "address $gateway/$mask" if !defined($address->{$gateway});
 159             $address->{$gateway} = 1;
 160         }
 161
 162         my $iptables = undef;
 163         my $checkrouteip = undef;
 164         my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4;
 165
 166         if ($ipversion == 6) {
 167             $ipv6 = 1;
 168             $iptables = "ip6tables";
 169             $checkrouteip = '2001:4860:4860::8888';
 170             $enable_forward_v6 = 1 if $gateway;
 171         } else {
 172             $ipv4 = 1;
 173             $iptables = "iptables";
 174             $checkrouteip = '8.8.8.8';
 175             $enable_forward_v4 = 1 if $gateway;
 176         }
 177
 178         if ($subnet->{snat}) {
 179
 180             #find outgoing interface
 181             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
 182             if ($outip && $outiface && $is_evpn_gateway) {
 183                 #use snat, faster than masquerade
 184                 push @iface_config, "post-up $iptables -t nat -A POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 185                 push @iface_config, "post-down $iptables -t nat -D POSTROUTING -s '$cidr' -o $outiface -j SNAT --to-source $outip";
 186                 #add conntrack zone once on outgoing interface
 187                 push @iface_config, "post-up $iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1";
 188                 push @iface_config, "post-down $iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1";
 189             }
 190         }
 191     }
 192
 193     push @iface_config, "hwaddress $mac" if $mac;
 194     push @iface_config, "bridge_ports $vxlan_iface";
 195     push @iface_config, "bridge_stp off";
 196     push @iface_config, "bridge_fd 0";
 197     push @iface_config, "mtu $mtu" if $mtu;
 198     push @iface_config, "alias $alias" if $alias;
 199     push @iface_config, "ip-forward on" if $enable_forward_v4;
 200     push @iface_config, "ip6-forward on" if $enable_forward_v6;
 201     push @iface_config, "arp-accept on" if $ipv4||$ipv6;
 202     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
 203     push(@{$config->{$vnetid}}, @iface_config) if !$config->{$vnetid};
 204
 205     if ($vrf_iface) {
 206         #vrf interface
 207         @iface_config = ();
 208         push @iface_config, "vrf-table auto";
 209         if(!$is_evpn_gateway) {
 210             push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
 211         } else {
 212             push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
 213         }
 214
 215         push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 216
 217         if ($vrfvxlan) {
 218             #l3vni vxlan interface
 219             my $iface_vrf_vxlan = "vrfvx_$zoneid";
 220             @iface_config = ();
 221             push @iface_config, "vxlan-id $vrfvxlan";
 222             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
 223             push @iface_config, "bridge-learning off";
 224             push @iface_config, "bridge-arp-nd-suppress on" if !$plugin_config->{'disable-arp-nd-suppression'};
 225             push @iface_config, "mtu $mtu" if $mtu;
 226             push(@{$config->{$iface_vrf_vxlan}}, @iface_config) if !$config->{$iface_vrf_vxlan};
 227
 228             #l3vni bridge
 229             my $brvrf = "vrfbr_$zoneid";
 230             @iface_config = ();
 231             push @iface_config, "bridge-ports $iface_vrf_vxlan";
 232             push @iface_config, "bridge_stp off";
 233             push @iface_config, "bridge_fd 0";
 234             push @iface_config, "mtu $mtu" if $mtu;
 235             push @iface_config, "vrf $vrf_iface";
 236             push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 237         }
 238
 239         if ( $is_evpn_gateway && $exitnodes_local_routing ) {
 240             #add a veth pair for local cross-vrf routing
 241             my $iface_xvrf = "xvrf_$zoneid";
 242             my $iface_xvrfp = "xvrfp_$zoneid";
 243
 244             @iface_config = ();
 245             push @iface_config, "link-type veth";
 246             push @iface_config, "address 10.255.255.1/30";
 247             push @iface_config, "veth-peer-name $iface_xvrfp";
 248             push @iface_config, "mtu ".($mtu+50) if $mtu;
 249             push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};
 250
 251             @iface_config = ();
 252             push @iface_config, "link-type veth";
 253             push @iface_config, "address 10.255.255.2/30";
 254             push @iface_config, "veth-peer-name $iface_xvrf";
 255             push @iface_config, "vrf $vrf_iface";
 256             push @iface_config, "mtu ".($mtu+50) if $mtu;
 257             push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
 258         }
 259     }
 260     return $config;
 261 }
 262
 263 sub on_update_hook {
 264     my ($class, $zoneid, $zone_cfg, $controller_cfg) = @_;
 265
 266     # verify that controller exist
 267     my $controller = $zone_cfg->{ids}->{$zoneid}->{controller};
 268     if (!defined($controller_cfg->{ids}->{$controller})) {
 269         die "controller $controller don't exist";
 270     } else {
 271         die "$controller is not a evpn controller type" if $controller_cfg->{ids}->{$controller}->{type} ne 'evpn';
 272     }
 273
 274     #vrf-vxlan need to be defined
 275
 276     my $vrfvxlan = $zone_cfg->{ids}->{$zoneid}->{'vrf-vxlan'};
 277     # verify that vrf-vxlan is not already declared in another zone
 278     foreach my $id (keys %{$zone_cfg->{ids}}) {
 279         next if $id eq $zoneid;
 280         die "vrf-vxlan $vrfvxlan is already declared in $id"
 281                 if (defined($zone_cfg->{ids}->{$id}->{'vrf-vxlan'}) && $zone_cfg->{ids}->{$id}->{'vrf-vxlan'} eq $vrfvxlan);
 282     }
 283
 284     if (!defined($zone_cfg->{ids}->{$zoneid}->{'mac'})) {
 285         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 286         $zone_cfg->{ids}->{$zoneid}->{'mac'} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 287     }
 288 }
 289
 290
 291 sub vnet_update_hook {
 292     my ($class, $vnet_cfg, $vnetid, $zone_cfg) = @_;
 293
 294     my $vnet = $vnet_cfg->{ids}->{$vnetid};
 295     my $tag = $vnet->{tag};
 296
 297     raise_param_exc({ tag => "missing vxlan tag"}) if !defined($tag);
 298     raise_param_exc({ tag => "vxlan tag max value is 16777216"}) if $tag > 16777216;
 299
 300     # verify that tag is not already defined globally (vxlan-id are unique)
 301     foreach my $id (keys %{$vnet_cfg->{ids}}) {
 302         next if $id eq $vnetid;
 303         my $othervnet = $vnet_cfg->{ids}->{$id};
 304         my $other_tag = $othervnet->{tag};
 305         my $other_zoneid = $othervnet->{zone};
 306         my $other_zone = $zone_cfg->{ids}->{$other_zoneid};
 307         next if $other_zone->{type} ne 'vxlan' && $other_zone->{type} ne 'evpn';
 308         raise_param_exc({ tag => "vxlan tag $tag already exist in vnet $id in zone $other_zoneid "}) if $other_tag && $tag eq $other_tag;
 309     }
 310 }
 311
 312
 313 1;
 314
 315