From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <git@jack.fr.eu.org>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id BABF87155B
for <pve-devel@lists.proxmox.com>; Thu, 8 Apr 2021 10:40:35 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id B70B6184EA
for <pve-devel@lists.proxmox.com>; Thu, 8 Apr 2021 10:40:05 +0200 (CEST)
Received: from jack.fr.eu.org (equ57-h01-128-78-42-217.dsl.sta.abo.bbox.fr
[128.78.42.217])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id A01A0184D5
for <pve-devel@lists.proxmox.com>; Thu, 8 Apr 2021 10:40:04 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
by jack.fr.eu.org (Postfix) with ESMTP id 2A2861011DF4;
Thu, 8 Apr 2021 10:32:46 +0200 (CEST)
Received: from jack.fr.eu.org ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 2_5WEFwUhik7; Thu, 8 Apr 2021 10:32:42 +0200 (CEST)
Received-SPF: softfail (jack.fr.eu.org: Sender is not authorized by default to
use 'git@jack.fr.eu.org' in 'mfrom' identity, however domain is not currently
prepared for false failures (mechanism '~all' matched))
receiver=jack.fr.eu.org; identity=mailfrom; envelope-from="git@jack.fr.eu.org";
helo=debian.m6.fr; client-ip=192.168.1.50
Received: from debian.m6.fr (unknown [192.168.1.50])
by jack.fr.eu.org (Postfix) with ESMTPSA id 345CC107B91B;
Thu, 8 Apr 2021 10:32:42 +0200 (CEST)
From: Alexandre Bruyelles <git@jack.fr.eu.org>
To: pve-devel@lists.proxmox.com
Cc: Alexandre Bruyelles <git@jack.fr.eu.org>
Date: Thu, 8 Apr 2021 10:32:27 +0200
Message-Id: <20210408083227.17478-2-git@jack.fr.eu.org>
X-Mailer: git-send-email 2.31.0
In-Reply-To: <20210408083227.17478-1-git@jack.fr.eu.org>
References: <20210408083227.17478-1-git@jack.fr.eu.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RDNS_DYNAMIC 0.363 Delivered to internal network by host with dynamic-looking
rDNS SPF_HELO_PASS -0.001 SPF: HELO matches SPF record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [evpnplugin.pm]
X-Mailman-Approved-At: Thu, 08 Apr 2021 10:45:35 +0200
Subject: [pve-devel] [PATCH container 1/1] zones: evpn: add a default
unreachable, to prevent vrf leak
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Thu, 08 Apr 2021 08:40:35 -0000
On Linux, when no route is found in a vrf, it somehow fallback
to the default routing table. In our case, that means a leak
from the overlay to the underlay.
Adding a low priority unreachable catch-all route is the way to go, as
per the doc: https://www.kernel.org/doc/Documentation/networking/vrf.txt
Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
---
PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index e6ee839..ca000cf 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -134,6 +134,7 @@ sub generate_sdn_config {
#vrf interface
@iface_config = ();
push @iface_config, "vrf-table auto";
+ push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
if ($vrfvxlan) {
--
2.31.0