all lists on lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes
@ 2021-08-23 13:22 Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 1/5] evpn : add "ip route del vrf vrf_myzone unreachable default metric 4278198272" on exit node Alexandre Derumier
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

This patches serie add new user requested features and fixes.


Alexandre Derumier (5):
  evpn : add "ip route del vrf vrf_myzone unreachable default metric
    4278198272" on exit node
  evpn : add advertise-subnets option
  evpn: add exitnodes-local-routing
  vnet : alias : check pattern
  get_local_vnets: add permissions on /sdn/vnets/*

 PVE/Network/SDN.pm                            |  2 +-
 PVE/Network/SDN/Controllers.pm                |  2 +-
 PVE/Network/SDN/Controllers/EvpnPlugin.pm     | 56 ++++++++++++++++---
 PVE/Network/SDN/Controllers/FaucetPlugin.pm   |  2 +-
 PVE/Network/SDN/VnetPlugin.pm                 |  2 +
 PVE/Network/SDN/Zones/EvpnPlugin.pm           | 46 +++++++++++++--
 .../expected_controller_config                | 44 +++++++++++++++
 .../advertise_subnets/expected_sdn_interfaces | 42 ++++++++++++++
 test/zones/evpn/advertise_subnets/interfaces  |  7 +++
 test/zones/evpn/advertise_subnets/sdn_config  | 26 +++++++++
 .../evpn/exitnode/expected_sdn_interfaces     |  2 +-
 .../expected_controller_config                | 37 ++++++++++++
 .../expected_sdn_interfaces                   | 56 +++++++++++++++++++
 .../evpn/exitnode_local_routing/interfaces    |  7 +++
 .../evpn/exitnode_local_routing/sdn_config    | 27 +++++++++
 .../exitnode_snat/expected_sdn_interfaces     |  2 +-
 16 files changed, 343 insertions(+), 17 deletions(-)
 create mode 100644 test/zones/evpn/advertise_subnets/expected_controller_config
 create mode 100644 test/zones/evpn/advertise_subnets/expected_sdn_interfaces
 create mode 100644 test/zones/evpn/advertise_subnets/interfaces
 create mode 100644 test/zones/evpn/advertise_subnets/sdn_config
 create mode 100644 test/zones/evpn/exitnode_local_routing/expected_controller_config
 create mode 100644 test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces
 create mode 100644 test/zones/evpn/exitnode_local_routing/interfaces
 create mode 100644 test/zones/evpn/exitnode_local_routing/sdn_config

-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] [PATCH pve-network 1/5] evpn : add "ip route del vrf vrf_myzone unreachable default metric 4278198272" on exit node
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
@ 2021-08-23 13:22 ` Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 2/5] evpn : add advertise-subnets option Alexandre Derumier
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

This is breaking routing between the evpn vrf && default vrf leak  on exit node only

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/Network/SDN/Zones/EvpnPlugin.pm                   | 10 +++++++---
 test/zones/evpn/exitnode/expected_sdn_interfaces      |  2 +-
 test/zones/evpn/exitnode_snat/expected_sdn_interfaces |  2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 4fa46f7..36edccd 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -73,6 +73,7 @@ sub generate_sdn_config {
     my $bgprouter = PVE::Network::SDN::Controllers::EvpnPlugin::find_bgp_controller($local_node, $controller_cfg);
     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
+    my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
 
     my $mtu = 1450;
     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
@@ -127,8 +128,6 @@ sub generate_sdn_config {
 
 	if ($subnet->{snat}) {
 
-	    my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
-
             #find outgoing interface
             my ($outip, $outiface) = PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
             if ($outip && $outiface && $is_evpn_gateway) {
@@ -158,7 +157,12 @@ sub generate_sdn_config {
 	#vrf interface
 	@iface_config = ();
 	push @iface_config, "vrf-table auto";
-	push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
+	if(!$is_evpn_gateway) {
+	    push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
+	} else {
+	    push @iface_config, "post-up ip route del vrf $vrf_iface unreachable default metric 4278198272";
+	}
+
 	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 
 	if ($vrfvxlan) {
diff --git a/test/zones/evpn/exitnode/expected_sdn_interfaces b/test/zones/evpn/exitnode/expected_sdn_interfaces
index 4cf13e0..5ab3084 100644
--- a/test/zones/evpn/exitnode/expected_sdn_interfaces
+++ b/test/zones/evpn/exitnode/expected_sdn_interfaces
@@ -14,7 +14,7 @@ iface myvnet
 auto vrf_myzone
 iface vrf_myzone
 	vrf-table auto
-	post-up ip route add vrf vrf_myzone unreachable default metric 4278198272
+	post-up ip route del vrf vrf_myzone unreachable default metric 4278198272
 
 auto vrfbr_myzone
 iface vrfbr_myzone
diff --git a/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index a2a183e..47df77a 100644
--- a/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -33,7 +33,7 @@ iface myvnet2
 auto vrf_myzone
 iface vrf_myzone
 	vrf-table auto
-	post-up ip route add vrf vrf_myzone unreachable default metric 4278198272
+	post-up ip route del vrf vrf_myzone unreachable default metric 4278198272
 
 auto vrfbr_myzone
 iface vrfbr_myzone
-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] [PATCH pve-network 2/5] evpn : add advertise-subnets option
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 1/5] evpn : add "ip route del vrf vrf_myzone unreachable default metric 4278198272" on exit node Alexandre Derumier
@ 2021-08-23 13:22 ` Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 3/5] evpn: add exitnodes-local-routing Alexandre Derumier
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

allow to advertise type5 routes for evpn subnets, if vms are silents hosts.
(don't do any traffic, so anycast gateway don't have their mac-ip)

fix: https://bugzilla.proxmox.com/show_bug.cgi?id=3571
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/Network/SDN/Controllers/EvpnPlugin.pm     | 14 ++++++
 PVE/Network/SDN/Zones/EvpnPlugin.pm           |  6 +++
 .../expected_controller_config                | 44 +++++++++++++++++++
 .../advertise_subnets/expected_sdn_interfaces | 42 ++++++++++++++++++
 test/zones/evpn/advertise_subnets/interfaces  |  7 +++
 test/zones/evpn/advertise_subnets/sdn_config  | 26 +++++++++++
 6 files changed, 139 insertions(+)
 create mode 100644 test/zones/evpn/advertise_subnets/expected_controller_config
 create mode 100644 test/zones/evpn/advertise_subnets/expected_sdn_interfaces
 create mode 100644 test/zones/evpn/advertise_subnets/interfaces
 create mode 100644 test/zones/evpn/advertise_subnets/sdn_config

diff --git a/PVE/Network/SDN/Controllers/EvpnPlugin.pm b/PVE/Network/SDN/Controllers/EvpnPlugin.pm
index 55828ef..d629140 100644
--- a/PVE/Network/SDN/Controllers/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Controllers/EvpnPlugin.pm
@@ -113,6 +113,7 @@ sub generate_controller_zone_config {
     my $vrf = "vrf_$id";
     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
     my $exitnodes = $plugin_config->{'exitnodes'};
+    my $advertisesubnets = $plugin_config->{'advertise-subnets'};
 
     my $asn = $controller->{asn};
     my $ebgp = undef;
@@ -165,6 +166,19 @@ sub generate_controller_zone_config {
 	push @controller_config, "default-originate ipv4";
 	push @controller_config, "default-originate ipv6";
 	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
+    } elsif ($advertisesubnets) {
+
+	@controller_config = ();
+	#redistribute connected networks
+	push @controller_config, "redistribute connected";
+	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
+	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
+
+	@controller_config = ();
+	#advertise connected networks type5 route in evpn
+	push @controller_config, "advertise ipv4 unicast";
+	push @controller_config, "advertise ipv6 unicast";
+	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
     }
 
     return $config;
diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 36edccd..c463851 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -35,6 +35,11 @@ sub properties {
 	    optional => 1, format => 'mac-addr'
 	},
 	'exitnodes' => get_standard_option('pve-node-list'),
+	'advertise-subnets' => {
+	    type => 'boolean',
+	    description => "Advertise evpn subnets if you have silent hosts",
+	    optional => 1
+	}
     };
 }
 
@@ -44,6 +49,7 @@ sub options {
 	'vrf-vxlan' => { optional => 0 },
 	controller => { optional => 0 },
 	exitnodes => { optional => 1 },
+	'advertise-subnets' => { optional => 1 },
 	mtu => { optional => 1 },
 	mac => { optional => 1 },
 	dns => { optional => 1 },
diff --git a/test/zones/evpn/advertise_subnets/expected_controller_config b/test/zones/evpn/advertise_subnets/expected_controller_config
new file mode 100644
index 0000000..aa6b3bd
--- /dev/null
+++ b/test/zones/evpn/advertise_subnets/expected_controller_config
@@ -0,0 +1,44 @@
+log syslog informational
+ip forwarding
+ipv6 forwarding
+frr defaults datacenter
+service integrated-vtysh-config
+hostname localhost
+!
+!
+vrf vrf_myzone
+ vni 1000
+exit-vrf
+!
+router bgp 65000
+ bgp router-id 192.168.0.1
+ no bgp default ipv4-unicast
+ coalesce-time 1000
+ neighbor VTEP peer-group
+ neighbor VTEP remote-as 65000
+ neighbor VTEP bfd
+ neighbor 192.168.0.2 peer-group VTEP
+ neighbor 192.168.0.3 peer-group VTEP
+ !
+ address-family l2vpn evpn
+  neighbor VTEP activate
+  advertise-all-vni
+ exit-address-family
+!
+router bgp 65000 vrf vrf_myzone
+ !
+ address-family ipv4 unicast
+  redistribute connected
+ exit-address-family
+ !
+ address-family ipv6 unicast
+  redistribute connected
+ exit-address-family
+ !
+ address-family l2vpn evpn
+  advertise ipv4 unicast
+  advertise ipv6 unicast
+ exit-address-family
+!
+line vty
+!
\ No newline at end of file
diff --git a/test/zones/evpn/advertise_subnets/expected_sdn_interfaces b/test/zones/evpn/advertise_subnets/expected_sdn_interfaces
new file mode 100644
index 0000000..9d1c64c
--- /dev/null
+++ b/test/zones/evpn/advertise_subnets/expected_sdn_interfaces
@@ -0,0 +1,42 @@
+#version:1
+
+auto myvnet
+iface myvnet
+	address 10.0.0.1/24
+	hwaddress A2:1D:CB:1A:C0:8B
+	bridge_ports vxlan_myvnet
+	bridge_stp off
+	bridge_fd 0
+	mtu 1450
+	ip-forward on
+	arp-accept on
+	vrf vrf_myzone
+
+auto vrf_myzone
+iface vrf_myzone
+	vrf-table auto
+	post-up ip route add vrf vrf_myzone unreachable default metric 4278198272
+
+auto vrfbr_myzone
+iface vrfbr_myzone
+	bridge-ports vrfvx_myzone
+	bridge_stp off
+	bridge_fd 0
+	mtu 1450
+	vrf vrf_myzone
+
+auto vrfvx_myzone
+iface vrfvx_myzone
+	vxlan-id 1000
+	vxlan-local-tunnelip 192.168.0.1
+	bridge-learning off
+	bridge-arp-nd-suppress on
+	mtu 1450
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+	vxlan-id 100
+	vxlan-local-tunnelip 192.168.0.1
+	bridge-learning off
+	bridge-arp-nd-suppress on
+	mtu 1450
diff --git a/test/zones/evpn/advertise_subnets/interfaces b/test/zones/evpn/advertise_subnets/interfaces
new file mode 100644
index 0000000..66bb826
--- /dev/null
+++ b/test/zones/evpn/advertise_subnets/interfaces
@@ -0,0 +1,7 @@
+auto vmbr0
+iface vmbr0 inet static
+	address 192.168.0.1/24
+	gateway 192.168.0.254
+        bridge-ports eth0
+        bridge-stp off
+        bridge-fd 0
diff --git a/test/zones/evpn/advertise_subnets/sdn_config b/test/zones/evpn/advertise_subnets/sdn_config
new file mode 100644
index 0000000..76f16a1
--- /dev/null
+++ b/test/zones/evpn/advertise_subnets/sdn_config
@@ -0,0 +1,26 @@
+{
+  version => 1,
+  vnets   => {
+               ids => {
+                        myvnet => { tag => "100", type => "vnet", zone => "myzone" },
+                      },
+             },
+
+  zones   => {
+               ids => { myzone => { ipam => "pve", type => "evpn", controller => "evpnctl", 'vrf-vxlan' => 1000, 'mac' => 'A2:1D:CB:1A:C0:8B', 'advertise-subnets' => 1 } },
+             },
+  controllers  => {
+               ids => { evpnctl => { type => "evpn", 'peers' => '192.168.0.1,192.168.0.2,192.168.0.3', asn => "65000" } },
+             },
+
+  subnets => {
+              ids => { 'myzone-10.0.0.0-24' => {
+							'type' => 'subnet',
+							'vnet' => 'myvnet',
+							'gateway' => '10.0.0.1',
+						  }
+		     }
+	     }
+}
+
+
-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] [PATCH pve-network 3/5] evpn: add exitnodes-local-routing
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 1/5] evpn : add "ip route del vrf vrf_myzone unreachable default metric 4278198272" on exit node Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 2/5] evpn : add advertise-subnets option Alexandre Derumier
@ 2021-08-23 13:22 ` Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 4/5] vnet : alias : check pattern Alexandre Derumier
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

This option allow an exit-node to reach itself a guest in evpn network.

Forum user have requested it, the exitnode need to reach virtual dns server in evpn.

This use a veth-pair instead a simple leak.
It's not enable by default is slowing down a little bit the routing.

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/Network/SDN/Controllers.pm                |  2 +-
 PVE/Network/SDN/Controllers/EvpnPlugin.pm     | 48 ++++++++++++----
 PVE/Network/SDN/Controllers/FaucetPlugin.pm   |  2 +-
 PVE/Network/SDN/Zones/EvpnPlugin.pm           | 30 +++++++++-
 .../expected_controller_config                | 37 ++++++++++++
 .../expected_sdn_interfaces                   | 56 +++++++++++++++++++
 .../evpn/exitnode_local_routing/interfaces    |  7 +++
 .../evpn/exitnode_local_routing/sdn_config    | 27 +++++++++
 8 files changed, 195 insertions(+), 14 deletions(-)
 create mode 100644 test/zones/evpn/exitnode_local_routing/expected_controller_config
 create mode 100644 test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces
 create mode 100644 test/zones/evpn/exitnode_local_routing/interfaces
 create mode 100644 test/zones/evpn/exitnode_local_routing/sdn_config

diff --git a/PVE/Network/SDN/Controllers.pm b/PVE/Network/SDN/Controllers.pm
index e1cf9e0..a23048e 100644
--- a/PVE/Network/SDN/Controllers.pm
+++ b/PVE/Network/SDN/Controllers.pm
@@ -125,7 +125,7 @@ sub generate_controller_config {
 	my $controller = $controller_cfg->{ids}->{$controllerid};
 	if ($controller) {
 	    my $controller_plugin = PVE::Network::SDN::Controllers::Plugin->lookup($controller->{type});
-	    $controller_plugin->generate_controller_vnet_config($plugin_config, $controller, $zoneid, $id, $config);
+	    $controller_plugin->generate_controller_vnet_config($plugin_config, $controller, $zone, $zoneid, $id, $config);
 	}
     }
 
diff --git a/PVE/Network/SDN/Controllers/EvpnPlugin.pm b/PVE/Network/SDN/Controllers/EvpnPlugin.pm
index d629140..3e450cf 100644
--- a/PVE/Network/SDN/Controllers/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Controllers/EvpnPlugin.pm
@@ -114,6 +114,7 @@ sub generate_controller_zone_config {
     my $vrfvxlan = $plugin_config->{'vrf-vxlan'};
     my $exitnodes = $plugin_config->{'exitnodes'};
     my $advertisesubnets = $plugin_config->{'advertise-subnets'};
+    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
 
     my $asn = $controller->{asn};
     my $ebgp = undef;
@@ -149,17 +150,19 @@ sub generate_controller_zone_config {
 
     if ($is_gateway) {
 
-	@controller_config = ();
-	#import /32 routes of evpn network from vrf1 to default vrf (for packet return)
-	push @controller_config, "import vrf $vrf";
-	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
-	push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
-
-	@controller_config = ();
-	#redistribute connected to be able to route to local vms on the gateway
-	push @controller_config, "redistribute connected";
-	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
-	push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
+	if (!$exitnodes_local_routing) {
+	    @controller_config = ();
+	    #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
+	    push @controller_config, "import vrf $vrf";
+	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
+	    push(@{$config->{frr}->{router}->{"bgp $asn"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
+
+	    @controller_config = ();
+	    #redistribute connected to be able to route to local vms on the gateway
+	    push @controller_config, "redistribute connected";
+	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv4 unicast"}}, @controller_config);
+	    push(@{$config->{frr}->{router}->{"bgp $asn vrf $vrf"}->{"address-family"}->{"ipv6 unicast"}}, @controller_config);
+	}
 
 	@controller_config = ();
 	#add default originate to announce 0.0.0.0/0 type5 route in evpn
@@ -184,6 +187,29 @@ sub generate_controller_zone_config {
     return $config;
 }
 
+sub generate_controller_vnet_config {
+    my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
+
+    my $exitnodes = $zone->{'exitnodes'};
+    my $exitnodes_local_routing = $zone->{'exitnodes-local-routing'};
+
+    return if !$exitnodes_local_routing;
+
+    my $local_node = PVE::INotify::nodename();
+    my $is_gateway = $exitnodes->{$local_node};
+    
+    return if !$is_gateway;
+
+    my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
+    my @controller_config = ();
+    foreach my $subnetid (sort keys %{$subnets}) {
+        my $subnet = $subnets->{$subnetid};
+	my $cidr = $subnet->{cidr};
+	push @controller_config, "ip route $cidr 10.255.255.2 xvrf_$zoneid";
+    }
+    push(@{$config->{frr}->{''}}, @controller_config);
+}
+
 sub on_delete_hook {
     my ($class, $controllerid, $zone_cfg) = @_;
 
diff --git a/PVE/Network/SDN/Controllers/FaucetPlugin.pm b/PVE/Network/SDN/Controllers/FaucetPlugin.pm
index 5742187..4f3bb5c 100644
--- a/PVE/Network/SDN/Controllers/FaucetPlugin.pm
+++ b/PVE/Network/SDN/Controllers/FaucetPlugin.pm
@@ -43,7 +43,7 @@ sub generate_controller_zone_config {
 
 
 sub generate_controller_vnet_config {
-    my ($class, $plugin_config, $controller, $zoneid, $vnetid, $config) = @_;
+    my ($class, $plugin_config, $controller, $zone, $zoneid, $vnetid, $config) = @_;
 
     my $mac = $plugin_config->{mac};
     my $ipv4 = $plugin_config->{ipv4};
diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index c463851..648f7c7 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -35,6 +35,11 @@ sub properties {
 	    optional => 1, format => 'mac-addr'
 	},
 	'exitnodes' => get_standard_option('pve-node-list'),
+	'exitnodes-local-routing' => {
+	    type => 'boolean',
+	    description => "Allow exitnodes to connect to evpn guests",
+	    optional => 1
+	},
 	'advertise-subnets' => {
 	    type => 'boolean',
 	    description => "Advertise evpn subnets if you have silent hosts",
@@ -49,6 +54,7 @@ sub options {
 	'vrf-vxlan' => { optional => 0 },
 	controller => { optional => 0 },
 	exitnodes => { optional => 1 },
+	'exitnodes-local-routing' => { optional => 1 },
 	'advertise-subnets' => { optional => 1 },
 	mtu => { optional => 1 },
 	mac => { optional => 1 },
@@ -80,6 +86,8 @@ sub generate_sdn_config {
     my $loopback = $bgprouter->{loopback} if $bgprouter->{loopback};
     my ($ifaceip, $iface) = PVE::Network::SDN::Zones::Plugin::find_local_ip_interface_peers(\@peers, $loopback);
     my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
+    my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
+
 
     my $mtu = 1450;
     $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
@@ -192,8 +200,28 @@ sub generate_sdn_config {
 	    push @iface_config, "vrf $vrf_iface";
 	    push(@{$config->{$brvrf}}, @iface_config) if !$config->{$brvrf};
 	}
-    }
 
+	if ( $is_evpn_gateway && $exitnodes_local_routing ) {
+	    #add a veth pair for local cross-vrf routing
+	    my $iface_xvrf = "xvrf_$zoneid";
+	    my $iface_xvrfp = "xvrfp_$zoneid";
+
+	    @iface_config = ();
+	    push @iface_config, "link-type veth";
+	    push @iface_config, "address 10.255.255.1/30";
+	    push @iface_config, "veth-peer-name $iface_xvrfp";
+	    push @iface_config, "mtu ".($mtu+50) if $mtu;
+	    push(@{$config->{$iface_xvrf}}, @iface_config) if !$config->{$iface_xvrf};
+
+	    @iface_config = ();
+	    push @iface_config, "link-type veth";
+	    push @iface_config, "address 10.255.255.2/30";
+	    push @iface_config, "veth-peer-name $iface_xvrf";
+	    push @iface_config, "vrf $vrf_iface";
+	    push @iface_config, "mtu ".($mtu+50) if $mtu;
+	    push(@{$config->{$iface_xvrfp}}, @iface_config) if !$config->{$iface_xvrfp};
+	}
+    }
     return $config;
 }
 
diff --git a/test/zones/evpn/exitnode_local_routing/expected_controller_config b/test/zones/evpn/exitnode_local_routing/expected_controller_config
new file mode 100644
index 0000000..abd065b
--- /dev/null
+++ b/test/zones/evpn/exitnode_local_routing/expected_controller_config
@@ -0,0 +1,37 @@
+log syslog informational
+ip forwarding
+ipv6 forwarding
+frr defaults datacenter
+service integrated-vtysh-config
+hostname localhost
+!
+ip route 10.0.0.0/24 10.255.255.2 xvrf_myzone
+!
+vrf vrf_myzone
+ vni 1000
+exit-vrf
+!
+router bgp 65000
+ bgp router-id 192.168.0.1
+ no bgp default ipv4-unicast
+ coalesce-time 1000
+ neighbor VTEP peer-group
+ neighbor VTEP remote-as 65000
+ neighbor VTEP bfd
+ neighbor 192.168.0.2 peer-group VTEP
+ neighbor 192.168.0.3 peer-group VTEP
+ !
+ address-family l2vpn evpn
+  neighbor VTEP activate
+  advertise-all-vni
+ exit-address-family
+!
+router bgp 65000 vrf vrf_myzone
+ !
+ address-family l2vpn evpn
+  default-originate ipv4
+  default-originate ipv6
+ exit-address-family
+!
+line vty
+!
\ No newline at end of file
diff --git a/test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces b/test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces
new file mode 100644
index 0000000..301f5b3
--- /dev/null
+++ b/test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces
@@ -0,0 +1,56 @@
+#version:1
+
+auto myvnet
+iface myvnet
+	address 10.0.0.1/24
+	bridge_ports vxlan_myvnet
+	bridge_stp off
+	bridge_fd 0
+	mtu 1450
+	ip-forward on
+	arp-accept on
+	vrf vrf_myzone
+
+auto vrf_myzone
+iface vrf_myzone
+	vrf-table auto
+	post-up ip route del vrf vrf_myzone unreachable default metric 4278198272
+
+auto vrfbr_myzone
+iface vrfbr_myzone
+	bridge-ports vrfvx_myzone
+	bridge_stp off
+	bridge_fd 0
+	mtu 1450
+	vrf vrf_myzone
+
+auto vrfvx_myzone
+iface vrfvx_myzone
+	vxlan-id 1000
+	vxlan-local-tunnelip 192.168.0.1
+	bridge-learning off
+	bridge-arp-nd-suppress on
+	mtu 1450
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+	vxlan-id 100
+	vxlan-local-tunnelip 192.168.0.1
+	bridge-learning off
+	bridge-arp-nd-suppress on
+	mtu 1450
+
+auto xvrf_myzone
+iface xvrf_myzone
+	link-type veth
+	address 10.255.255.1/30
+	veth-peer-name xvrfp_myzone
+	mtu 1500
+
+auto xvrfp_myzone
+iface xvrfp_myzone
+	link-type veth
+	address 10.255.255.2/30
+	veth-peer-name xvrf_myzone
+	vrf vrf_myzone
+	mtu 1500
diff --git a/test/zones/evpn/exitnode_local_routing/interfaces b/test/zones/evpn/exitnode_local_routing/interfaces
new file mode 100644
index 0000000..66bb826
--- /dev/null
+++ b/test/zones/evpn/exitnode_local_routing/interfaces
@@ -0,0 +1,7 @@
+auto vmbr0
+iface vmbr0 inet static
+	address 192.168.0.1/24
+	gateway 192.168.0.254
+        bridge-ports eth0
+        bridge-stp off
+        bridge-fd 0
diff --git a/test/zones/evpn/exitnode_local_routing/sdn_config b/test/zones/evpn/exitnode_local_routing/sdn_config
new file mode 100644
index 0000000..f5f7ca1
--- /dev/null
+++ b/test/zones/evpn/exitnode_local_routing/sdn_config
@@ -0,0 +1,27 @@
+{
+  version => 1,
+  vnets   => {
+               ids => {
+                        myvnet => { tag => "100", type => "vnet", zone => "myzone" },
+                      },
+             },
+
+  zones   => {
+               ids => { myzone => { ipam => "pve", type => "evpn", controller => "evpnctl", 'vrf-vxlan' => 1000, exitnodes => { 'localhost' => 1 }, 'exitnodes-local-routing' => 1 },
+		      },
+             },
+  controllers  => {
+               ids => { evpnctl => { type => "evpn", 'peers' => '192.168.0.1,192.168.0.2,192.168.0.3', asn => "65000" } },
+             },
+
+  subnets => {
+              ids => { 'myzone-10.0.0.0-24' => {
+							'type' => 'subnet',
+							'vnet' => 'myvnet',
+							'gateway' => '10.0.0.1',
+						  },
+		     }
+	     }
+}
+
+
-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] [PATCH pve-network 4/5] vnet : alias : check pattern
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
                   ` (2 preceding siblings ...)
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 3/5] evpn: add exitnodes-local-routing Alexandre Derumier
@ 2021-08-23 13:22 ` Alexandre Derumier
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 5/5] get_local_vnets: add permissions on /sdn/vnets/* Alexandre Derumier
  2021-08-24 12:26 ` [pve-devel] applied-series: Re: [PATCH pve-network 0/5] evpn improvments + fixes Thomas Lamprecht
  5 siblings, 0 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

fix : https://bugzilla.proxmox.com/show_bug.cgi?id=2966
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/Network/SDN/VnetPlugin.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/PVE/Network/SDN/VnetPlugin.pm b/PVE/Network/SDN/VnetPlugin.pm
index 96a13b4..121fb7f 100644
--- a/PVE/Network/SDN/VnetPlugin.pm
+++ b/PVE/Network/SDN/VnetPlugin.pm
@@ -68,6 +68,8 @@ sub properties {
         alias => {
             type => 'string',
             description => "alias name of the vnet",
+            pattern => qr/[a-z0-9\._\-\+\s]{1,256}/i,
+            maxLength => 256,
 	    optional => 1,
         },
     };
-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] [PATCH pve-network 5/5] get_local_vnets: add permissions on /sdn/vnets/*
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
                   ` (3 preceding siblings ...)
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 4/5] vnet : alias : check pattern Alexandre Derumier
@ 2021-08-23 13:22 ` Alexandre Derumier
  2021-08-24 12:26 ` [pve-devel] applied-series: Re: [PATCH pve-network 0/5] evpn improvments + fixes Thomas Lamprecht
  5 siblings, 0 replies; 7+ messages in thread
From: Alexandre Derumier @ 2021-08-23 13:22 UTC (permalink / raw)
  To: pve-devel

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 PVE/Network/SDN.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/PVE/Network/SDN.pm b/PVE/Network/SDN.pm
index d3399ce..b95dd5b 100644
--- a/PVE/Network/SDN.pm
+++ b/PVE/Network/SDN.pm
@@ -193,7 +193,7 @@ sub get_local_vnets {
 	my $privs = [ 'SDN.Audit', 'SDN.Allocate' ];
 
 	next if !$zoneid;
-	next if !$rpcenv->check_any($authuser, "/sdn/zones/$zoneid", $privs, 1);
+	next if !$rpcenv->check_any($authuser, "/sdn/zones/$zoneid", $privs, 1) && !$rpcenv->check_any($authuser, "/sdn/vnets/$vnetid", $privs, 1);
 
 	my $zone_config = PVE::Network::SDN::Zones::sdn_zones_config($zones_cfg, $zoneid);
 
-- 
2.30.2




^ permalink raw reply	[flat|nested] 7+ messages in thread

* [pve-devel] applied-series: Re: [PATCH pve-network 0/5] evpn improvments + fixes
  2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
                   ` (4 preceding siblings ...)
  2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 5/5] get_local_vnets: add permissions on /sdn/vnets/* Alexandre Derumier
@ 2021-08-24 12:26 ` Thomas Lamprecht
  5 siblings, 0 replies; 7+ messages in thread
From: Thomas Lamprecht @ 2021-08-24 12:26 UTC (permalink / raw)
  To: Proxmox VE development discussion, Alexandre Derumier

On 23/08/2021 15:22, Alexandre Derumier wrote:
> This patches serie add new user requested features and fixes.
> 
> 
> Alexandre Derumier (5):
>   evpn : add "ip route del vrf vrf_myzone unreachable default metric
>     4278198272" on exit node
>   evpn : add advertise-subnets option
>   evpn: add exitnodes-local-routing
>   vnet : alias : check pattern
>   get_local_vnets: add permissions on /sdn/vnets/*
> 
>  PVE/Network/SDN.pm                            |  2 +-
>  PVE/Network/SDN/Controllers.pm                |  2 +-
>  PVE/Network/SDN/Controllers/EvpnPlugin.pm     | 56 ++++++++++++++++---
>  PVE/Network/SDN/Controllers/FaucetPlugin.pm   |  2 +-
>  PVE/Network/SDN/VnetPlugin.pm                 |  2 +
>  PVE/Network/SDN/Zones/EvpnPlugin.pm           | 46 +++++++++++++--
>  .../expected_controller_config                | 44 +++++++++++++++
>  .../advertise_subnets/expected_sdn_interfaces | 42 ++++++++++++++
>  test/zones/evpn/advertise_subnets/interfaces  |  7 +++
>  test/zones/evpn/advertise_subnets/sdn_config  | 26 +++++++++
>  .../evpn/exitnode/expected_sdn_interfaces     |  2 +-
>  .../expected_controller_config                | 37 ++++++++++++
>  .../expected_sdn_interfaces                   | 56 +++++++++++++++++++
>  .../evpn/exitnode_local_routing/interfaces    |  7 +++
>  .../evpn/exitnode_local_routing/sdn_config    | 27 +++++++++
>  .../exitnode_snat/expected_sdn_interfaces     |  2 +-
>  16 files changed, 343 insertions(+), 17 deletions(-)
>  create mode 100644 test/zones/evpn/advertise_subnets/expected_controller_config
>  create mode 100644 test/zones/evpn/advertise_subnets/expected_sdn_interfaces
>  create mode 100644 test/zones/evpn/advertise_subnets/interfaces
>  create mode 100644 test/zones/evpn/advertise_subnets/sdn_config
>  create mode 100644 test/zones/evpn/exitnode_local_routing/expected_controller_config
>  create mode 100644 test/zones/evpn/exitnode_local_routing/expected_sdn_interfaces
>  create mode 100644 test/zones/evpn/exitnode_local_routing/interfaces
>  create mode 100644 test/zones/evpn/exitnode_local_routing/sdn_config
> 



applied series, thanks!




^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-08-24 12:27 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-23 13:22 [pve-devel] [PATCH pve-network 0/5] evpn improvments + fixes Alexandre Derumier
2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 1/5] evpn : add "ip route del vrf vrf_myzone unreachable default metric 4278198272" on exit node Alexandre Derumier
2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 2/5] evpn : add advertise-subnets option Alexandre Derumier
2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 3/5] evpn: add exitnodes-local-routing Alexandre Derumier
2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 4/5] vnet : alias : check pattern Alexandre Derumier
2021-08-23 13:22 ` [pve-devel] [PATCH pve-network 5/5] get_local_vnets: add permissions on /sdn/vnets/* Alexandre Derumier
2021-08-24 12:26 ` [pve-devel] applied-series: Re: [PATCH pve-network 0/5] evpn improvments + fixes Thomas Lamprecht

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal