[pve-devel] [PATCH container 0/1] evpn: prevent route leaking

[pve-devel] [PATCH container 0/1] evpn: prevent route leaking

[Alexandre Bruyelles]

Alexandre Bruyelles (1):
  zones: evpn: add a default unreachable, to prevent vrf leak

 PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
 1 file changed, 1 insertion(+)

-- 
2.31.0

[pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak

[Alexandre Bruyelles]

On Linux, when no route is found in a vrf, it somehow fallback
to the default routing table. In our case, that means a leak
from the overlay to the underlay.
Adding a low priority unreachable catch-all route is the way to go, as
per the doc: https://www.kernel.org/doc/Documentation/networking/vrf.txt

Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
---
 PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index e6ee839..ca000cf 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -134,6 +134,7 @@ sub generate_sdn_config {
 	#vrf interface
 	@iface_config = ();
 	push @iface_config, "vrf-table auto";
+	push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
 	push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
 
 	if ($vrfvxlan) {
-- 
2.31.0

Re: [pve-devel] [PATCH libnetwork 0/1] evpn: prevent route leaking

[Alexandre Bruyelles]

On 4/8/21 10:32 AM, Alexandre Bruyelles wrote:
> Alexandre Bruyelles (1):
>    zones: evpn: add a default unreachable, to prevent vrf leak
> 
>   PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
>   1 file changed, 1 insertion(+)
> 

Re: [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak

[aderumier]

Good Catch.

Thanks Jack !


Le jeudi 08 avril 2021 à 10:32 +0200, Alexandre Bruyelles a écrit :
> On Linux, when no route is found in a vrf, it somehow fallback
> to the default routing table. In our case, that means a leak
> from the overlay to the underlay.
> Adding a low priority unreachable catch-all route is the way to go,
> as
> per the doc:
> https://www.kernel.org/doc/Documentation/networking/vrf.txt
> 
> Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
> ---
>  PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm
> b/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index e6ee839..ca000cf 100644
> --- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -134,6 +134,7 @@ sub generate_sdn_config {
>         #vrf interface
>         @iface_config = ();
>         push @iface_config, "vrf-table auto";
> +       push @iface_config, "post-up ip route add vrf $vrf_iface
> unreachable default metric 4278198272";
>         push(@{$config->{$vrf_iface}}, @iface_config) if !$config-
> >{$vrf_iface};
>  
>         if ($vrfvxlan) {