vrf: T7544: Ensure correct quoting for VRF ifnames in nftables

* For VRF create/delete:
  * Simple dquoting, as before, was parsed away by the shell
  * Just escaping the double quotes could cause issues with the shell mangling
    VRF names (however unlikely)
  * Wrapping original quotes in shell-escaped single quotes is a quick & easy
    way to guard against both improper shell parsing and string names being
    taken as nft keywords.

* Firewall configuration:
  * Firewall "interface name" rules support VRF ifnames and used them unquoted,
    fixed for nft_rule template tags (parse_rule)
  * Went through and quoted all iif/oifname usage by zones and interface
    groups. VRF ifnames weren't available for all cases, but there is
    no harm in completeness.
  * For this, also created a simple quoted_join template filter to replace
    any use of |join(',')

* PBR calls nft but doesn't mind the "vni" name - table IDs used instead

I may have missed some niche nft use-cases that would be exposed to this problem.

0 files changed, 0 insertions, 0 deletions