Merge pull request #5232 from natali-rs1985/T8936

vrf: T8936: Specify `pref 1998` when deleting fwmark routing rules on VRF removal

2 files changed, 6 insertions, 4 deletions

diff --git a/src/conf_mode/interfaces_wireguard.py b/src/conf_mode/interfaces_wireguard.py
index 92e3a239d..4cb544b72 100755
--- a/src/conf_mode/interfaces_wireguard.py
+++ b/src/conf_mode/interfaces_wireguard.py
@@ -31,6 +31,7 @@ from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_mirror_redirect
 from vyos.configverify import verify_bond_bridge_member
+from vyos.defaults import wireguard_fwmark_pref
 from vyos.ifconfig import WireGuardIf
 from vyos.utils.kernel import check_kmod
 from vyos.utils.network import check_port_availability
@@ -174,7 +175,7 @@ def apply(wireguard):
             if table_id is not None:
                 for afi in ['-4', '-6']:
                     call(
-                        f'ip {afi} rule del pref 1998 fwmark {prev_fwmark} table {table_id}'
+                        f'ip {afi} rule del pref {wireguard_fwmark_pref} fwmark {prev_fwmark} table {table_id}'
                     )
 
     # Add ip rule to route fwmark-marked WireGuard tunnel packets into the
@@ -185,7 +186,7 @@ def apply(wireguard):
         table_id = get_vrf_tableid(wireguard['vrf'])
         for afi in ['-4', '-6']:
             call(
-                f'ip {afi} rule add pref 1998 fwmark {wireguard["fwmark"]} table {table_id}'
+                f'ip {afi} rule add pref {wireguard_fwmark_pref} fwmark {wireguard["fwmark"]} table {table_id}'
             )
 
     domain_resolver_usage = '/run/use-vyos-domain-resolver-interfaces-wireguard-' + wireguard['ifname']
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index c307ae27e..405032ad5 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -23,6 +23,7 @@ import vyos.defaults
 from vyos.config import Config
 from vyos.configdict import node_changed
 from vyos.configverify import verify_route_map
+from vyos.defaults import wireguard_fwmark_pref
 from vyos.firewall import conntrack_required
 from vyos.frrender import FRRender
 from vyos.frrender import get_frrender_dict
@@ -265,10 +266,10 @@ def apply(vrf):
                 # Remove map element
                 cmd(f'nft {nft_del_element}')
 
-            # Remove all ip rules pointing to this VRF table
+            # Remove WireGuard fwmark routing rules created for this VRF table
             table_id = get_vrf_tableid(tmp)
             for afi in ['-4', '-6']:
-                while call(f'ip {afi} rule del table {table_id}') == 0:
+                while call(f'ip {afi} rule del pref {wireguard_fwmark_pref} table {table_id}') == 0:
                     pass
 
             # Delete the VRF Kernel interface