vxlan: T3700: support VLAN tunnel mapping of VLAN aware bridges

FRR supports a new way of configuring VLAN-to-VNI mappings for EVPN-VXLAN, when
working with the Linux kernel. In this new way, the mapping of a VLAN to a VNI
is configured against a container VXLAN interface which is referred to as a
'Single VXLAN device (SVD)'.

Multiple VLAN to VNI mappings can be configured against the same SVD. This
allows for a significant scaling of the number of VNIs since a separate VXLAN
interface is no longer required for each VNI.

Sample configuration of SVD with VLAN to VNI mappings is shown below.

set interfaces bridge br0 member interface vxlan0
set interfaces vxlan vxlan0 external
set interfaces vxlan vxlan0 source-interface 'dum0'
set interfaces vxlan vxlan0 vlan-to-vni 10 vni '10010'
set interfaces vxlan vxlan0 vlan-to-vni 11 vni '10011'
set interfaces vxlan vxlan0 vlan-to-vni 30 vni '10030'
set interfaces vxlan vxlan0 vlan-to-vni 31 vni '10031'

6 files changed, 195 insertions, 4 deletions

diff --git a/interface-definitions/interfaces-vxlan.xml.in b/interface-definitions/interfaces-vxlan.xml.in
index fb60c93d0..b246d9a09 100644
--- a/interface-definitions/interfaces-vxlan.xml.in
+++ b/interface-definitions/interfaces-vxlan.xml.in
@@ -101,6 +101,22 @@
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
           #include <include/vni.xml.i>
+          <tagNode name="vlan-to-vni">
+            <properties>
+              <help>Configuring VLAN-to-VNI mappings for EVPN-VXLAN</help>
+              <valueHelp>
+                <format>u32:0-4094</format>
+                <description>Virtual Local Area Network (VLAN) ID</description>
+              </valueHelp>
+              <constraint>
+                <validator name="numeric" argument="--range 0-4094"/>
+              </constraint>
+              <constraintErrorMessage>VLAN ID must be between 0 and 4094</constraintErrorMessage>
+            </properties>
+            <children>
+              #include <include/vni.xml.i>
+            </children>
+            </tagNode>
         </children>
       </tagNode>
     </children>
diff --git a/python/vyos/ifconfig/vxlan.py b/python/vyos/ifconfig/vxlan.py
index 6a9911588..1fe5db7cd 100644
--- a/python/vyos/ifconfig/vxlan.py
+++ b/python/vyos/ifconfig/vxlan.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2022 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2023 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -13,9 +13,15 @@
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
+from json import loads
+
 from vyos import ConfigError
+from vyos.configdict import list_diff
 from vyos.ifconfig import Interface
+from vyos.utils.assertion import assert_list
 from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_config
+from vyos.utils.network import get_vxlan_vlan_tunnels
 
 @Interface.register
 class VXLANIf(Interface):
@@ -49,6 +55,13 @@ class VXLANIf(Interface):
         }
     }
 
+    _command_set = {**Interface._command_set, **{
+        'vlan_tunnel': {
+            'validate': lambda v: assert_list(v, ['on', 'off']),
+            'shellcmd': 'bridge link set dev {ifname} vlan_tunnel {value}',
+        },
+    }}
+
     def _create(self):
         # This table represents a mapping from VyOS internal config dict to
         # arguments used by iproute2. For more information please refer to:
@@ -99,3 +112,54 @@ class VXLANIf(Interface):
                 cmd = f'bridge fdb append to 00:00:00:00:00:00 dst {remote} ' \
                        'port {port} dev {ifname}'
                 self._cmd(cmd.format(**self.config))
+
+    def set_vlan_vni_mapping(self, state):
+        """
+        Controls whether vlan to tunnel mapping is enabled on the port.
+        By default this flag is off.
+        """
+        if not isinstance(state, bool):
+            raise ValueError('Value out of range')
+
+        cur_vlan_ids = []
+        if 'vlan_to_vni_removed' in self.config:
+            cur_vlan_ids = self.config['vlan_to_vni_removed']
+            for vlan in cur_vlan_ids:
+                self._cmd(f'bridge vlan del dev {self.ifname} vid {vlan}')
+
+        # Determine current OS Kernel vlan_tunnel setting - only adjust when needed
+        tmp = get_interface_config(self.ifname)
+        cur_state = 'on' if dict_search(f'linkinfo.info_slave_data.vlan_tunnel', tmp) == True else 'off'
+        new_state = 'on' if state else 'off'
+        if cur_state != new_state:
+            self.set_interface('vlan_tunnel', new_state)
+
+        # Determine current OS Kernel configured VLANs
+        os_configured_vlan_ids = get_vxlan_vlan_tunnels(self.ifname)
+
+        if 'vlan_to_vni' in self.config:
+            add_vlan = list_diff(list(self.config['vlan_to_vni'].keys()), os_configured_vlan_ids)
+
+            for vlan, vlan_config in self.config['vlan_to_vni'].items():
+                # VLAN mapping already exists - skip
+                if vlan not in add_vlan:
+                    continue
+
+                vni = vlan_config['vni']
+                # The following commands must be run one after another,
+                # they can not be combined with linux 6.1 and iproute2 6.1
+                self._cmd(f'bridge vlan add dev {self.ifname} vid {vlan}')
+                self._cmd(f'bridge vlan add dev {self.ifname} vid {vlan} tunnel_info id {vni}')
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class last
+        super().update(config)
+
+        # Enable/Disable VLAN tunnel mapping
+        # This is only possible after the interface was assigned to the bridge
+        self.set_vlan_vni_mapping(dict_search('vlan_to_vni', config) != None)
diff --git a/python/vyos/utils/network.py b/python/vyos/utils/network.py
index 55ff29f0c..4c579c760 100644
--- a/python/vyos/utils/network.py
+++ b/python/vyos/utils/network.py
@@ -408,7 +408,7 @@ def is_subnet_connected(subnet, primary=False):
 
     return False
 
-def is_afi_configured(interface, afi):
+def is_afi_configured(interface: str, afi):
     """ Check if given address family is configured, or in other words - an IP
     address is assigned to the interface. """
     from netifaces import ifaddresses
@@ -425,3 +425,46 @@ def is_afi_configured(interface, afi):
         return False
 
     return afi in addresses
+
+def get_vxlan_vlan_tunnels(interface: str) -> list:
+    """ Return a list of strings with VLAN IDs configured in the Kernel """
+    from json import loads
+    from vyos.utils.process import cmd
+
+    if not interface.startswith('vxlan'):
+        raise ValueError('Only applicable for VXLAN interfaces!')
+
+    # Determine current OS Kernel configured VLANs
+    #
+    # $ bridge -j -p vlan tunnelshow dev vxlan0
+    # [ {
+    #         "ifname": "vxlan0",
+    #         "tunnels": [ {
+    #                 "vlan": 10,
+    #                 "vlanEnd": 11,
+    #                 "tunid": 10010,
+    #                 "tunidEnd": 10011
+    #             },{
+    #                 "vlan": 20,
+    #                 "tunid": 10020
+    #             } ]
+    #     } ]
+    #
+    os_configured_vlan_ids = []
+    tmp = loads(cmd(f'bridge --json vlan tunnelshow dev {interface}'))
+    if tmp:
+        for tunnel in tmp[0].get('tunnels', {}):
+            vlanStart = tunnel['vlan']
+            if 'vlanEnd' in tunnel:
+                vlanEnd = tunnel['vlanEnd']
+                # Build a real list for user VLAN IDs
+                vlan_list = list(range(vlanStart, vlanEnd +1))
+                # Convert list of integers to list or strings
+                os_configured_vlan_ids.extend(map(str, vlan_list))
+                # Proceed with next tunnel - this one is complete
+                continue
+
+            # Add single tunel id - not part of a range
+            os_configured_vlan_ids.append(str(vlanStart))
+
+    return os_configured_vlan_ids
diff --git a/python/vyos/utils/process.py b/python/vyos/utils/process.py
index c2ef98140..9ecdddf09 100644
--- a/python/vyos/utils/process.py
+++ b/python/vyos/utils/process.py
@@ -139,7 +139,7 @@ def cmd(command, flag='', shell=None, input=None, timeout=None, env=None,
     expect:  a list of error codes to consider as normal
     """
     decoded, code = popen(
-        command, flag,
+        command.lstrip(), flag,
         stdout=stdout, stderr=stderr,
         input=input, timeout=timeout,
         env=env, shell=shell,
diff --git a/smoketest/scripts/cli/test_interfaces_vxlan.py b/smoketest/scripts/cli/test_interfaces_vxlan.py
index f6b203de4..e9c9e68fd 100755
--- a/smoketest/scripts/cli/test_interfaces_vxlan.py
+++ b/smoketest/scripts/cli/test_interfaces_vxlan.py
@@ -20,6 +20,8 @@ from vyos.configsession import ConfigSessionError
 from vyos.ifconfig import Interface
 from vyos.utils.network import get_bridge_fdb
 from vyos.utils.network import get_interface_config
+from vyos.utils.network import interface_exists
+from vyos.utils.network import get_vxlan_vlan_tunnels
 from vyos.template import is_ipv6
 from base_interfaces_test import BasicInterfaceTest
 
@@ -133,5 +135,53 @@ class VXLANInterfaceTest(BasicInterfaceTest.TestCase):
         self.assertTrue(options['linkinfo']['info_data']['external'])
         self.assertEqual('vxlan',    options['linkinfo']['info_kind'])
 
+    def test_vxlan_vlan_vni_mapping(self):
+        bridge = 'br0'
+        interface = 'vxlan0'
+        source_interface = 'eth0'
+
+        vlan_to_vni = {
+            '10': '10010',
+            '11': '10011',
+            '12': '10012',
+            '13': '10013',
+            '20': '10020',
+            '30': '10030',
+            '31': '10031',
+        }
+
+        self.cli_set(self._base_path + [interface, 'external'])
+        self.cli_set(self._base_path + [interface, 'source-interface', source_interface])
+
+        for vlan, vni in vlan_to_vni.items():
+            self.cli_set(self._base_path + [interface, 'vlan-to-vni', vlan, 'vni', vni])
+
+        # This must fail as this VXLAN interface is not associated with any bridge
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        self.cli_set(['interfaces', 'bridge', bridge, 'member', 'interface', interface])
+
+        # It is not allowed to use duplicate VNIs
+        self.cli_set(self._base_path + [interface, 'vlan-to-vni', '11', 'vni', vlan_to_vni['10']])
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        # restore VLAN - VNI mappings
+        for vlan, vni in vlan_to_vni.items():
+            self.cli_set(self._base_path + [interface, 'vlan-to-vni', vlan, 'vni', vni])
+
+        # commit configuration
+        self.cli_commit()
+
+        self.assertTrue(interface_exists(bridge))
+        self.assertTrue(interface_exists(interface))
+
+        tmp = get_interface_config(interface)
+        self.assertEqual(tmp['master'], bridge)
+
+        tmp = get_vxlan_vlan_tunnels('vxlan0')
+        self.assertEqual(tmp, list(vlan_to_vni))
+
+        self.cli_delete(['interfaces', 'bridge', bridge])
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/src/conf_mode/interfaces-vxlan.py b/src/conf_mode/interfaces-vxlan.py
index a3b0867e0..05f68112a 100755
--- a/src/conf_mode/interfaces-vxlan.py
+++ b/src/conf_mode/interfaces-vxlan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2022 VyOS maintainers and contributors
+# Copyright (C) 2019-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -24,6 +24,7 @@ from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import leaf_node_changed
 from vyos.configdict import is_node_changed
+from vyos.configdict import node_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_mtu_ipv6
@@ -58,6 +59,9 @@ def get_config(config=None):
             vxlan.update({'rebuild_required': {}})
             break
 
+    tmp = node_changed(conf, base + [ifname, 'vlan-to-vni'], recursive=True)
+    if tmp: vxlan.update({'vlan_to_vni_removed': tmp})
+
     # We need to verify that no other VXLAN tunnel is configured when external
     # mode is in use - Linux Kernel limitation
     conf.set_level(base)
@@ -146,6 +150,20 @@ def verify(vxlan):
                     raise ConfigError(error_msg)
                 protocol = 'ipv4'
 
+    if 'vlan_to_vni' in vxlan:
+        if 'is_bridge_member' not in vxlan:
+            raise ConfigError('VLAN to VNI mapping requires that VXLAN interface '\
+                              'is member of a bridge interface!')
+
+        vnis_used = []
+        for vif, vif_config in vxlan['vlan_to_vni'].items():
+            if 'vni' not in vif_config:
+                raise ConfigError(f'Must define VNI for VLAN "{vif}"!')
+            vni = vif_config['vni']
+            if vni in vnis_used:
+                raise ConfigError(f'VNI "{vni}" is already assigned to a different VLAN!')
+            vnis_used.append(vni)
+
     verify_mtu_ipv6(vxlan)
     verify_address(vxlan)
     verify_bond_bridge_member(vxlan)