diff options
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/defaults.py | 6 | ||||
| -rwxr-xr-x | python/vyos/firewall.py | 14 |
2 files changed, 14 insertions, 6 deletions
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py index 65e702927..17f8aed51 100644 --- a/python/vyos/defaults.py +++ b/python/vyos/defaults.py @@ -90,6 +90,12 @@ rt_symbolic_names = { rt_global_vrf = rt_symbolic_names['main'] rt_global_table = rt_symbolic_names['main'] +# Firewall marks fragments with bit 31 of the packet mark until the filter +# hooks are done. Firewall and routing policy marks stop at 2147483647, so the +# bit is free - anything matching a mark while the bit can be set must mask it. +fragment_mark_bit = '0x80000000' +user_mark_mask = '0x7fffffff' + vyconfd_conf = '/etc/vyos/vyconfd.conf' DEFAULT_COMMIT_CONFIRM_MINUTES = 10 diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 1e33462f4..847e74531 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -23,8 +23,10 @@ from vyos.utils.dict import dict_search_args from vyos.utils.dict import dict_search_recursive from vyos.utils.process import cmdl from vyos.utils.network import get_vrf_tableid +from vyos.defaults import fragment_mark_bit from vyos.defaults import rt_global_table from vyos.defaults import rt_global_vrf +from vyos.defaults import user_mark_mask # Conntrack def conntrack_required(conf): @@ -462,11 +464,11 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): if 'fragment' in rule_conf: # Checking for fragmentation after priority -400 is not possible, - # so we use a priority -450 hook to set a mark + # a priority -450 hook sets bit 31 of the mark on fragments if 'match_frag' in rule_conf['fragment']: - output.append('meta mark 0xffff1') + output.append(f'meta mark & {fragment_mark_bit} == {fragment_mark_bit}') if 'match_non_frag' in rule_conf['fragment']: - output.append('meta mark != 0xffff1') + output.append(f'meta mark & {fragment_mark_bit} != {fragment_mark_bit}') if 'limit' in rule_conf: if 'rate' in rule_conf['limit']: @@ -536,7 +538,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): if mark[0] == '!': operator = '!=' mark = mark[1:] - output.append(f'meta mark {operator} {{{mark}}}') + output.append(f'meta mark & {user_mark_mask} {operator} {{{mark}}}') if 'vlan' in rule_conf: if 'id' in rule_conf['vlan']: @@ -608,7 +610,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): output.append(f'ip{def_suffix} dscp set {dscp}') if 'mark' in rule_conf['set']: mark = rule_conf['set']['mark'] - output.append(f'meta mark set {mark}') + output.append(f'meta mark set meta mark & {fragment_mark_bit} | {mark}') if 'vrf' in rule_conf['set']: set_table = True vrf_name = rule_conf['set']['vrf'] @@ -624,7 +626,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): table = rt_global_table if set_table: mark = 0x7FFFFFFF - int(table) - output.append(f'meta mark set {mark}') + output.append(f'meta mark set meta mark & {fragment_mark_bit} | {mark}') if 'tcp_mss' in rule_conf['set']: mss = rule_conf['set']['tcp_mss'] output.append(f'tcp option maxseg size set {mss}') |