[PATCH pve-network 09/16] sdn: zones: add vxlan-gbp option to vxlan and evpn zones

[Hannes Laimer <h.laimer@proxmox.com>]

Add an opt-in per-zone vxlan-gbp flag that creates the zone's vxlan
interfaces with VXLAN-GBP, so the source group rides the GBP field
across hosts and microsegmentation can enforce on the receiving node.
For evpn it covers both the per-vnet device and the l3vni. Off by
default, and every VTEP in the zone must have it enabled or it drops
the GBP-tagged traffic.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm  | 3 +++
 src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index dfbd7e9..d8ce733 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -118,6 +118,7 @@ sub options {
         'bridge-disable-mac-learning' => { optional => 1 },
         'rt-import' => { optional => 1 },
         'vxlan-port' => { optional => 1 },
+        'vxlan-gbp' => { optional => 1 },
         mtu => { optional => 1 },
         mac => { optional => 1 },
         dns => { optional => 1 },
@@ -223,6 +224,7 @@ sub generate_sdn_config {
     push @iface_config, "vxlan-id $tag";
     push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
     push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
+    push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
     push @iface_config, "bridge-learning off";
     push @iface_config, "bridge-arp-nd-suppress on"
         if !$plugin_config->{'disable-arp-nd-suppression'};
@@ -319,6 +321,7 @@ sub generate_sdn_config {
             push @iface_config, "vxlan-id $vrfvxlan";
             push @iface_config, "vxlan-local-tunnelip $ifaceip" if $ifaceip;
             push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
+            push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
             push @iface_config, "bridge-learning off";
             push @iface_config, "bridge-arp-nd-suppress on"
                 if !$plugin_config->{'disable-arp-nd-suppression'};
diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
index a408261..167f470 100644
--- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
@@ -44,6 +44,13 @@ sub properties {
             type => 'string',
             format => 'pve-sdn-fabric-id',
         },
+        'vxlan-gbp' => {
+            description => "Enable VXLAN Group Based Policy (GBP) on the zone's VXLAN"
+                . " interfaces. Carries the source group across hosts for"
+                . " microsegmentation; every VTEP in the zone must have it enabled.",
+            type => 'boolean',
+            optional => 1,
+        },
     };
 }
 
@@ -58,6 +65,7 @@ sub options {
         dnszone => { optional => 1 },
         ipam => { optional => 1 },
         fabric => { optional => 1 },
+        'vxlan-gbp' => { optional => 1 },
     };
 }
 
@@ -132,6 +140,7 @@ sub generate_sdn_config {
         push @iface_config, "vxlan_remoteip $address";
     }
     push @iface_config, "vxlan-port $vxlanport" if $vxlanport;
+    push @iface_config, "vxlan-gbp on" if $plugin_config->{'vxlan-gbp'};
 
     push @iface_config, "mtu $mtu" if $mtu;
     push(@{ $config->{$vxlan_iface} }, @iface_config) if !$config->{$vxlan_iface};
-- 
2.47.3