From c031fd07a098b958cbcac681e3431e33a435da3c Mon Sep 17 00:00:00 2001 From: Lee Clements Date: Sat, 25 Jul 2026 20:00:20 -0400 Subject: nhrp: T9128: fix duplicate nftables meter name for multiple redirect tunnels Committing a second NHRP tunnel with "redirect" enabled failed with "Failed to apply NHRP tunnel firewall rules". The redirect chain in nhrpd_nftables.conf.j2 is rendered in a per-tunnel loop but hardcoded the nftables meter name "loglimit-0". With two redirect-enabled tunnels the loop declared the named set "loglimit-0" twice in table vyos_nhrp_redirect, which nft rejects, aborting the atomic ruleset load so the commit failed. Derive the meter name from the loop index (loglimit-0, loglimit-1, ...) so every redirect-enabled tunnel gets a unique meter. The first tunnel keeps the name "loglimit-0", leaving single-tunnel setups unchanged. Add a smoketest that configures two tunnels with redirect + multicast and verifies the commit succeeds and both meters are present. Also clear the "vpn ipsec" tree in tearDown so the IPsec profile created by the existing test does not leak into the new one. --- data/templates/frr/nhrpd_nftables.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'data') diff --git a/data/templates/frr/nhrpd_nftables.conf.j2 b/data/templates/frr/nhrpd_nftables.conf.j2 index 6ae35ef52..90a81c70b 100644 --- a/data/templates/frr/nhrpd_nftables.conf.j2 +++ b/data/templates/frr/nhrpd_nftables.conf.j2 @@ -37,7 +37,7 @@ table ip vyos_nhrp_redirect { {% if tunnel is vyos_defined %} {% for tun, tunnel_conf in tunnel.items() %} {% if tunnel_conf.redirect is vyos_defined %} - iifname "{{ tun }}" oifname "{{ tun }}" meter loglimit-0 size 65535 { ip daddr & 255.255.255.0 . ip saddr & 255.255.255.0 timeout 1m limit rate 4/minute burst 1 packets } counter log group {{ redirect }} + iifname "{{ tun }}" oifname "{{ tun }}" meter loglimit-{{ loop.index0 }} size 65535 { ip daddr & 255.255.255.0 . ip saddr & 255.255.255.0 timeout 1m limit rate 4/minute burst 1 packets } counter log group {{ redirect }} {% endif %} {% endfor %} {% endif %} -- cgit v1.2.3