From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 52A33DF30 for ; Wed, 20 Apr 2022 16:20:10 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 493DBC90A for ; Wed, 20 Apr 2022 16:19:40 +0200 (CEST) Received: from bastionodiso.odiso.net (bastionodiso.odiso.net [185.151.191.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id E392DC8E7 for ; Wed, 20 Apr 2022 16:19:37 +0200 (CEST) Received: from kvmformation3.odiso.net (formationkvm3.odiso.net [10.3.94.12]) by bastionodiso.odiso.net (Postfix) with ESMTP id 60745A8AF; Wed, 20 Apr 2022 16:19:31 +0200 (CEST) Received: by kvmformation3.odiso.net (Postfix, from userid 0) id 47E1684378; Wed, 20 Apr 2022 16:19:31 +0200 (CEST) From: Alexandre Derumier To: pve-devel@lists.proxmox.com Date: Wed, 20 Apr 2022 16:19:30 +0200 Message-Id: <20220420141930.1626073-2-aderumier@odiso.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220420141930.1626073-1-aderumier@odiso.com> References: <20220420141930.1626073-1-aderumier@odiso.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.135 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% HEADER_FROM_DIFFERENT_DOMAINS 0.248 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods NO_DNS_FOR_FROM 0.001 Envelope sender has no MX or A DNS records SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record T_SCC_BODY_TEXT_LINE -0.01 - URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [evpnplugin.pm, bgpplugin.pm] Subject: [pve-devel] [PATCH pve-network 1/1] controllers: evpn: fix multiple exit-nodes with route-map filtering X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Apr 2022 14:20:10 -0000 Currently, when multiple exit-nodes are defined, each exit-nodes exchanges their own default route, so traffic is looping between both exit nodes instead going out. This add a new route-map to filter received type-5 on exit node Signed-off-by: Alexandre Derumier --- PVE/Network/SDN/Controllers/BgpPlugin.pm | 5 ++-- PVE/Network/SDN/Controllers/EvpnPlugin.pm | 23 +++++++++++++++---- .../expected_controller_config | 3 +++ .../expected_controller_config | 3 +++ .../evpn/ebgp/expected_controller_config | 3 +++ .../ebgp_loopback/expected_controller_config | 3 +++ .../evpn/exitnode/expected_controller_config | 6 +++++ .../expected_controller_config | 6 +++++ .../expected_controller_config | 3 +++ .../exitnode_snat/expected_controller_config | 6 +++++ .../evpn/ipv4/expected_controller_config | 3 +++ .../evpn/ipv4ipv6/expected_controller_config | 3 +++ .../expected_controller_config | 3 +++ .../evpn/ipv6/expected_controller_config | 3 +++ .../expected_controller_config | 3 +++ .../evpn/rt_import/expected_controller_config | 3 +++ 16 files changed, 72 insertions(+), 7 deletions(-) diff --git a/PVE/Network/SDN/Controllers/BgpPlugin.pm b/PVE/Network/SDN/Controllers/BgpPlugin.pm index 73ed171..6e69f67 100644 --- a/PVE/Network/SDN/Controllers/BgpPlugin.pm +++ b/PVE/Network/SDN/Controllers/BgpPlugin.pm @@ -121,10 +121,11 @@ sub generate_controller_config { push(@{$config->{frr}->{''}}, "ip prefix-list loopbacks_ips seq 10 permit 0.0.0.0/0 le 32"); push(@{$config->{frr}->{''}}, "ip protocol bgp route-map correct_src"); - my $routemap_config = []; + my $routemap_config = (); push @{$routemap_config}, "match ip address prefix-list loopbacks_ips"; push @{$routemap_config}, "set src $ifaceip"; - push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap_config); + my $routemap = { rule => $routemap_config, action => "permit" }; + push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap); } return $config; diff --git a/PVE/Network/SDN/Controllers/EvpnPlugin.pm b/PVE/Network/SDN/Controllers/EvpnPlugin.pm index 0c49893..22480d4 100644 --- a/PVE/Network/SDN/Controllers/EvpnPlugin.pm +++ b/PVE/Network/SDN/Controllers/EvpnPlugin.pm @@ -99,13 +99,16 @@ sub generate_controller_config { # address-family l2vpn @controller_config = (); + push @controller_config, "neighbor VTEP route-map MAP_VTEP_IN in"; push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out"; push @controller_config, "neighbor VTEP activate"; push @controller_config, "advertise-all-vni"; push @controller_config, "autort as $autortas" if $autortas; push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config); - push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []); + my $routemap = { rule => undef, action => "permit" }; + push(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap ); + push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap ); return $config; } @@ -160,14 +163,22 @@ sub generate_controller_zone_config { if ($is_gateway) { - if($exitnodes_primary && $exitnodes_primary ne $local_node) { + if(!$exitnodes_primary || $exitnodes_primary eq $local_node) { + #filter default type5 route coming from other exit nodes on primary node or both nodes if no primary is defined. + my $routemap_config = (); + push @{$routemap_config}, "match evpn route-type prefix"; + my $routemap = { rule => $routemap_config, action => "deny" }; + unshift(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap); + } elsif ($exitnodes_primary ne $local_node) { my $routemap_config = (); push @{$routemap_config}, "match evpn vni $vrfvxlan"; push @{$routemap_config}, "match evpn route-type prefix"; push @{$routemap_config}, "set metric 200"; - unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config); + my $routemap = { rule => $routemap_config, action => "permit" }; + unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap); } + if (!$exitnodes_local_routing) { @controller_config = (); #import /32 routes of evpn network from vrf1 to default vrf (for packet return) @@ -355,10 +366,12 @@ sub generate_frr_routemap { my $order = 0; foreach my $seq (@$routemap) { $order++; + next if !defined($seq->{action}); my @config = (); push @config, "!"; - push @config, "route-map $id permit $order"; - push @config, map { " $_" } @$seq; + push @config, "route-map $id $seq->{action} $order"; + my $rule = $seq->{rule}; + push @config, map { " $_" } @$rule; push @{$final_config}, @config; } } diff --git a/test/zones/evpn/advertise_subnets/expected_controller_config b/test/zones/evpn/advertise_subnets/expected_controller_config index c9545bc..742bbf4 100644 --- a/test/zones/evpn/advertise_subnets/expected_controller_config +++ b/test/zones/evpn/advertise_subnets/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -41,6 +42,8 @@ router bgp 65000 vrf vrf_myzone advertise ipv6 unicast exit-address-family ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/disable_arp_nd_suppression/expected_controller_config b/test/zones/evpn/disable_arp_nd_suppression/expected_controller_config index 5a8fb99..2f819e5 100644 --- a/test/zones/evpn/disable_arp_nd_suppression/expected_controller_config +++ b/test/zones/evpn/disable_arp_nd_suppression/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -28,6 +29,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ebgp/expected_controller_config b/test/zones/evpn/ebgp/expected_controller_config index 5c9a7c6..d1956df 100644 --- a/test/zones/evpn/ebgp/expected_controller_config +++ b/test/zones/evpn/ebgp/expected_controller_config @@ -31,6 +31,7 @@ router bgp 65001 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -45,6 +46,8 @@ router bgp 65001 vrf vrf_myzone route-target export 65000:1000 exit-address-family ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ebgp_loopback/expected_controller_config b/test/zones/evpn/ebgp_loopback/expected_controller_config index 5ec19a8..905433b 100644 --- a/test/zones/evpn/ebgp_loopback/expected_controller_config +++ b/test/zones/evpn/ebgp_loopback/expected_controller_config @@ -36,6 +36,7 @@ router bgp 65001 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -50,6 +51,8 @@ router bgp 65001 vrf vrf_myzone route-target export 65000:1000 exit-address-family ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! route-map correct_src permit 1 diff --git a/test/zones/evpn/exitnode/expected_controller_config b/test/zones/evpn/exitnode/expected_controller_config index 96d89f3..0ee4b8a 100644 --- a/test/zones/evpn/exitnode/expected_controller_config +++ b/test/zones/evpn/exitnode/expected_controller_config @@ -28,6 +28,7 @@ router bgp 65000 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone default-originate ipv6 exit-address-family ! +route-map MAP_VTEP_IN deny 1 + match evpn route-type prefix +! +route-map MAP_VTEP_IN permit 2 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/exitnode_local_routing/expected_controller_config b/test/zones/evpn/exitnode_local_routing/expected_controller_config index 812043e..6ceaca7 100644 --- a/test/zones/evpn/exitnode_local_routing/expected_controller_config +++ b/test/zones/evpn/exitnode_local_routing/expected_controller_config @@ -21,6 +21,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -34,6 +35,11 @@ router bgp 65000 vrf vrf_myzone default-originate ipv6 exit-address-family ! +route-map MAP_VTEP_IN deny 1 + match evpn route-type prefix +! +route-map MAP_VTEP_IN permit 2 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/exitnode_primary/expected_controller_config b/test/zones/evpn/exitnode_primary/expected_controller_config index 5f23bdc..dfa158d 100644 --- a/test/zones/evpn/exitnode_primary/expected_controller_config +++ b/test/zones/evpn/exitnode_primary/expected_controller_config @@ -28,6 +28,7 @@ router bgp 65000 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -49,6 +50,8 @@ router bgp 65000 vrf vrf_myzone default-originate ipv6 exit-address-family ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 match evpn vni 1000 match evpn route-type prefix diff --git a/test/zones/evpn/exitnode_snat/expected_controller_config b/test/zones/evpn/exitnode_snat/expected_controller_config index 96d89f3..0ee4b8a 100644 --- a/test/zones/evpn/exitnode_snat/expected_controller_config +++ b/test/zones/evpn/exitnode_snat/expected_controller_config @@ -28,6 +28,7 @@ router bgp 65000 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone default-originate ipv6 exit-address-family ! +route-map MAP_VTEP_IN deny 1 + match evpn route-type prefix +! +route-map MAP_VTEP_IN permit 2 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ipv4/expected_controller_config b/test/zones/evpn/ipv4/expected_controller_config index 5a8fb99..2f819e5 100644 --- a/test/zones/evpn/ipv4/expected_controller_config +++ b/test/zones/evpn/ipv4/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -28,6 +29,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ipv4ipv6/expected_controller_config b/test/zones/evpn/ipv4ipv6/expected_controller_config index 5a8fb99..2f819e5 100644 --- a/test/zones/evpn/ipv4ipv6/expected_controller_config +++ b/test/zones/evpn/ipv4ipv6/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -28,6 +29,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ipv4ipv6nogateway/expected_controller_config b/test/zones/evpn/ipv4ipv6nogateway/expected_controller_config index 5a8fb99..2f819e5 100644 --- a/test/zones/evpn/ipv4ipv6nogateway/expected_controller_config +++ b/test/zones/evpn/ipv4ipv6nogateway/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -28,6 +29,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/ipv6/expected_controller_config b/test/zones/evpn/ipv6/expected_controller_config index 5a8fb99..2f819e5 100644 --- a/test/zones/evpn/ipv6/expected_controller_config +++ b/test/zones/evpn/ipv6/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -28,6 +29,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/multipath_relax/expected_controller_config b/test/zones/evpn/multipath_relax/expected_controller_config index ec3ce69..4f8d7de 100644 --- a/test/zones/evpn/multipath_relax/expected_controller_config +++ b/test/zones/evpn/multipath_relax/expected_controller_config @@ -32,6 +32,7 @@ router bgp 65000 exit-address-family ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -40,6 +41,8 @@ router bgp 65000 router bgp 65000 vrf vrf_myzone bgp router-id 192.168.0.1 ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty diff --git a/test/zones/evpn/rt_import/expected_controller_config b/test/zones/evpn/rt_import/expected_controller_config index bcd2479..60d22e3 100644 --- a/test/zones/evpn/rt_import/expected_controller_config +++ b/test/zones/evpn/rt_import/expected_controller_config @@ -20,6 +20,7 @@ router bgp 65000 neighbor 192.168.0.3 peer-group VTEP ! address-family l2vpn evpn + neighbor VTEP route-map MAP_VTEP_IN in neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP activate advertise-all-vni @@ -34,6 +35,8 @@ router bgp 65000 vrf vrf_myzone route-target import 65003:1000 exit-address-family ! +route-map MAP_VTEP_IN permit 1 +! route-map MAP_VTEP_OUT permit 1 ! line vty -- 2.30.2