diff options
| author | zsdc <taras@vyos.io> | 2021-07-12 22:59:48 +0300 |
|---|---|---|
| committer | zsdc <taras@vyos.io> | 2021-07-17 22:36:39 +0300 |
| commit | 22791e26f444766dc9f9e1729b72893208f58079 (patch) | |
| tree | e412fd0e8247c3fc11b9f90d33646aafaf29247c /src/validators | |
| parent | 83721c1ce672b76d40c710f38b0ab05c370a2191 (diff) | |
| download | vyos-1x-22791e26f444766dc9f9e1729b72893208f58079.tar.gz vyos-1x-22791e26f444766dc9f9e1729b72893208f58079.zip | |
VRF: T3655: proper connection tracking for VRFs
Currently, all VRFs share the same connection tracking table, which can
lead to problems:
- traffic leaks to a wrong VRF
- improper NAT rules handling when multiple VRFs contain the same IP
networks
- stateful firewall rules issues
The commit implements connection tracking zones support. Each VRF
utilizes its own zone, so connections will never mix up.
It also adds some restrictions to VRF names and assigned table numbers,
because of nftables and conntrack requirements:
- VRF name should always start from a letter (interfaces that start from
numbers are not supported in nftables rules)
- table number must be in the 100-65535 range because conntrack supports
only 65535 zones
Diffstat (limited to 'src/validators')
| -rwxr-xr-x | src/validators/vrf-name | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/validators/vrf-name b/src/validators/vrf-name index c78a80776..29167c635 100755 --- a/src/validators/vrf-name +++ b/src/validators/vrf-name @@ -33,8 +33,8 @@ if __name__ == '__main__': if vrf == "lo": exit(1) - pattern = "^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|" \ - "vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan)\d+(\.\d+(v.+)?)?$).*$" + pattern = r'^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|\ + vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan|\d)\d*(\.\d+)?(v.+)?).*$' if not re.match(pattern, vrf): exit(1) |