From da2349c0eaca742dffa5e271d0d53937ecec9f8f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Thu, 26 Feb 2026 21:58:27 +0100 Subject: vrf: T8320: only allow alpha numerical characters, - and _ as VRF name This prevents the Kernel to error out. VRF names are limited within the Linux kernal as any other network interface name. See net/core/dev.c:dev_valid_name()! vyos@vyos# set vrf name MGM>T table 1000 vyos@vyos# commit [ vrf ] Traceback (most recent call last): File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script script.apply(c) File "/usr/libexec/vyos/conf_mode/vrf.py", line 317, in apply vrf_if.add_addr('127.0.0.1/8') File "/usr/lib/python3/dist-packages/vyos/ifconfig/interface.py", line 1294, in add_addr elif not is_intf_addr_assigned(self.ifname, addr, netns=netns): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/vyos/utils/network.py", line 444, in is_intf_addr_assigned json_out = json.loads(out) ^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/json/__init__.py", line 346, in loads return _default_decoder.decode(s) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) [[vrf]] failed Commit failed --- src/validators/vrf-name | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/validators') diff --git a/src/validators/vrf-name b/src/validators/vrf-name index cc4be2510..b56ebd036 100755 --- a/src/validators/vrf-name +++ b/src/validators/vrf-name @@ -24,15 +24,22 @@ if __name__ == '__main__': vrf = argv[1] length = len(vrf) + # must not exceed Linux Kernel IFNAMSIZ definition if length not in range(1, 16): exit(1) + # allow only alpha numerical characters, - and _ + pattern = r'^[A-Za-z0-9_-]+$' + if not re.match(pattern, vrf): + exit(1) + # Treat loopback interface "lo" explicitly. Adding "lo" explicitly to the # following regex pattern would deny any VRF name starting with lo - thuse # local-vrf would be illegal - and that we do not want. if vrf == "lo": exit(1) + # VRF name must not conflict with local interface type prefix pattern = r'^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|\ vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan|\d)\d*(\.\d+)?(v.+)?).*$' if not re.match(pattern, vrf): -- cgit v1.2.3