summaryrefslogtreecommitdiff
path: root/src/conf_mode/vrf.py
AgeCommit message (Collapse)Author
2023-04-13T5150: initial VRF support for Kernel/Zebra route-map filteringChristian Breunig
2023-01-06static: T4883: fix KeyError: 'table'Christian Poessinger
Commit dafb0da2 ("static: T4883: add a description field for routing tables") added an iproute2 description table but lacked checking if the key exists. This has been fixed and also converted to Jinja2 to keep the "common" style inside the routing protocols. It might feel overengineered indeed.
2022-07-12vrf: T4527: Prevent to create VRF with reserved namesViacheslav Hletenko
VRF names: "add, all, broadcast, default, delete, dev, get, inet, mtu, link, type, vrf" are reserved and cannot be used for vrf name
2022-05-07vrf: T4419: support to disable IP forwarding within a given VRFChristian Poessinger
2022-05-01vrf: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-04-07ipv6: T4346: delete (migrate) CLI command to disable IPv6 address familyChristian Poessinger
2022-03-30vrf: T4319: do not add IPv6 localhost address if IPv6 is disabledChristian Poessinger
2022-03-25vyos.util: T4319: rename sysctl() -> sysctl_write()Christian Poessinger
2022-02-13vrf: T4191: bugfix for "ip rule" when VRFs are createdChristian Poessinger
We always mangled and worked on the "ip rule" singleton even when nothing needed to be changed. This resulted in a VRF hickup when the same VRF was added and removed multiple times. set interfaces ethernet eth1 vrf foo set vrf name foo table '1000' commit delete interfaces ethernet eth1 vrf delete vrf commit set interfaces ethernet eth1 vrf foo set vrf name foo table '1000' commit broke reachability on eth1 - a reboot was required. This change will now only alter the ip rule tables once when VRF instances are created for the first time and will not touch the Kernel "ip rule" representation afterwards.
2021-11-15vrf: T3655: remove superfluous import of NamedTemporaryFileChristian Poessinger
2021-08-13vrf: T3734: T3728: vni must be configured with a higher priority then bgpdChristian Poessinger
When removing bgp (vrf) instances the assigned VRF vni must be deleted from FRR prior the removal of the bgp settings (T3734). This is now done by moving the CLI command "set vrf name red vni 1000" to a dedicated Python script with a priority higher then bgp.
2021-08-06frr: T3694: temporary disable VRF VNI assignmentChristian Poessinger
Somehow we hit a priority inversion here as we need to remove the VRF assigned VNI before we can remove a BGP bound VRF instance. Maybe move this to an individual helper script that set's up the VNI for the given VRF after any routing protocol (in our case this was triggered by running "make testc" when building an ISO image by the bgp-rpki config).
2021-08-06frr: T2175: remove no longer required loop when removing VRF VNIChristian Poessinger
This is a completing commit to a55585a833 ("frr: T2175: remove no longer required loop when removing routing protocols") that was missed out previously.
2021-07-19vrf: T3655: fix potential error when removing VRF connection tracking tableChristian Poessinger
This extends commit 22791e26 ("VRF: T3655: proper connection tracking for VRFs") so that when the netfilter table is removed, we first check if it exists at all, and if it does not exist we do not remove it. This fixes the smoketest error: PermissionError: [Errno 1] failed to run command: nft delete table inet vrf_zones
2021-07-17VRF: T3655: proper connection tracking for VRFszsdc
Currently, all VRFs share the same connection tracking table, which can lead to problems: - traffic leaks to a wrong VRF - improper NAT rules handling when multiple VRFs contain the same IP networks - stateful firewall rules issues The commit implements connection tracking zones support. Each VRF utilizes its own zone, so connections will never mix up. It also adds some restrictions to VRF names and assigned table numbers, because of nftables and conntrack requirements: - VRF name should always start from a letter (interfaces that start from numbers are not supported in nftables rules) - table number must be in the 100-65535 range because conntrack supports only 65535 zones
2021-06-20vrf: T3637: bind-to-all didn't work properlyDate Huang
because of typo change from `bind_to_all` to `bind-to-all` refer: interface-definitions/vrf.xml.in
2021-04-07vrf: T3344: re-add virtual network identifierChristian Poessinger
Commit 548d9057e3e (vrf: T3344: move dynamic routing protocols under "vrf name <name> protocols") temporary removed the possibility to specify the VNI for a given VRF to to changing of the CLI configuration nodes. As VNI is set inside zebra, we can re-use the now widely deployed frr python library to configure and change the configuration without any interference to other FRR daemons.
2021-03-17vrf: T31: ignore iproute2 errorsChristian Poessinger
Re-issuing the same iproute2 commands can lead to errors, simply ignore them and not raise a Python exception.
2021-01-16vrf: T31: add support for - and _ in VRF namesChristian Poessinger
2021-01-16vrf: T31: migrate to get_config_dict()Christian Poessinger
2021-01-02vrf: T2321: assign loopback IP addresses to individual VRF interfacesChristian Poessinger
47: bar: <NOARP,MASTER,UP,LOWER_UP> mtu 65536 qdisc noqueue state UP group default qlen 1000 link/ether 76:7d:c0:53:6d:89 brd ff:ff:ff:ff:ff:ff inet 127.0.0.1/8 scope host bar valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever
2020-08-31configd: T2582: add scripts to include list for daemonJohn Estabrook
2020-07-04cleanup: no need to call sudo for configuration mode scriptsChristian Poessinger
2020-07-01config: T2667: adapt for refinements to get_config_dictJohn Estabrook
2020-05-29airbag: T2088: explicit enabling of the featureThomas Mangin
airbag must now be explicitly installed. the patch also allow to fully disables the installation of the logging code at setup (and not just installing and doing nothing)
2020-04-12template: T2230: use render to generate templatesThomas Mangin
convert all call to jinja to use template.render
2020-04-08vrf: add additional documentation linkChristian Poessinger
2020-04-06util: T2206: rewrite vrf to cmdThomas Mangin
2020-04-05vrf: T2230: move inlined templates to dedicated filesChristian Poessinger
2020-04-04vrf: T2221: when deleting vrf also delete unreachable routeChristian Poessinger
If the unreachable routes for IPv4 and IPv6 are not deleted, there will be an error when creating the same VRF again after removal. Error changing VRF: Command '['sudo', 'ip', '-4', 'route', 'del', 'vrf', 'Blue', 'unreachable', 'default', 'metric', '4278198272']' returned non-zero exit status 2.
2020-04-04vrf: T2221: only set l3mdev when changedChristian Poessinger
2020-03-29vrf: T31: bugfix after converting remove list to dictChristian Poessinger
The list of VRFs to remove has been converted to a dict. The deletion of a VRF was no longer triggered as the logic still thought it is a list.
2020-03-07vrf: T31: move to Python3 f-strings where possibleChristian Poessinger
2020-03-07vrf: T31: ensure VRF can not be deleted with an attached routing protocolChristian Poessinger
2020-03-07vrf: T31: rephrase error messagesChristian Poessinger
2020-03-07vrf: T31: reuse Config in interfaces_with_vrf()Christian Poessinger
2020-03-07vrf: T31: properly set configuration level when parsingChristian Poessinger
2020-03-05vrf: T31: improve kernel rule lookup table codeChristian Poessinger
2020-03-05vrf: T31: modify kernel rule lookup table only onceChristian Poessinger
2020-03-05vrf: T31: add more documentation linksChristian Poessinger
2020-03-05vrf: T31: use subprocess check_output over check_callChristian Poessinger
2020-03-05vrf: T31: routing table IDs must be uniqueChristian Poessinger
2020-03-05vrf: T31: use vyos.ifconfig to set ifaliasChristian Poessinger
2020-03-05vrf: T31: table id is mandatoryChristian Poessinger
2020-03-04vrf: T31: remove pass in exception handlerChristian Poessinger
2020-03-04vrf: T31: reorder routing table lookupsChristian Poessinger
Linux routing uses rules to find tables - routing targets are then looked up in those tables. If the lookup got a matching route, the process ends. TL;DR; first table with a matching entry wins! You can see your routing table lookup rules using "ip rule", sadly the local lookup is hit before any VRF lookup. Pinging an addresses from the VRF will usually find a hit in the local table, and never reach the VRF routing table - this is usually not what you want. Thus we will re-arrange the tables and move the local lookup furhter down once VRFs are enabled.
2020-03-04vrf: T31: adding unreachable routes to the routing tablesChristian Poessinger
2020-03-04vrf: T31: prior to the v4.8 kernel iif and oif rules are neededChristian Poessinger
.. we run on 4.19 thus this is no longer needed.
2020-03-04vrf: T31: create iproute2 table to name mapping referenceChristian Poessinger
2020-03-04vrf: T31: rename 'vrf disable-bind-to-all ipv4' to 'vrf bind-to-all'Christian Poessinger
By default the scope of the port bindings for unbound sockets is limited to the default VRF. That is, it will not be matched by packets arriving on interfaces enslaved to an l3mdev and processes may bind to the same port if they bind to an l3mdev. TCP & UDP services running in the default VRF context (ie., not bound to any VRF device) can work across all VRF domains by enabling the 'vrf bind-to-all' option.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 20:48:14 +0000