* [pve-devel] [PATCH container 0/1] evpn: prevent route leaking
@ 2021-04-08 8:32 Alexandre Bruyelles
2021-04-08 8:32 ` [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak Alexandre Bruyelles
2021-04-08 8:33 ` [pve-devel] [PATCH libnetwork 0/1] evpn: prevent route leaking Alexandre Bruyelles
0 siblings, 2 replies; 4+ messages in thread
From: Alexandre Bruyelles @ 2021-04-08 8:32 UTC (permalink / raw)
To: pve-devel; +Cc: Alexandre Bruyelles
Alexandre Bruyelles (1):
zones: evpn: add a default unreachable, to prevent vrf leak
PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
1 file changed, 1 insertion(+)
--
2.31.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak
2021-04-08 8:32 [pve-devel] [PATCH container 0/1] evpn: prevent route leaking Alexandre Bruyelles
@ 2021-04-08 8:32 ` Alexandre Bruyelles
2021-04-08 12:02 ` aderumier
2021-04-08 8:33 ` [pve-devel] [PATCH libnetwork 0/1] evpn: prevent route leaking Alexandre Bruyelles
1 sibling, 1 reply; 4+ messages in thread
From: Alexandre Bruyelles @ 2021-04-08 8:32 UTC (permalink / raw)
To: pve-devel; +Cc: Alexandre Bruyelles
On Linux, when no route is found in a vrf, it somehow fallback
to the default routing table. In our case, that means a leak
from the overlay to the underlay.
Adding a low priority unreachable catch-all route is the way to go, as
per the doc: https://www.kernel.org/doc/Documentation/networking/vrf.txt
Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
---
PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm b/PVE/Network/SDN/Zones/EvpnPlugin.pm
index e6ee839..ca000cf 100644
--- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -134,6 +134,7 @@ sub generate_sdn_config {
#vrf interface
@iface_config = ();
push @iface_config, "vrf-table auto";
+ push @iface_config, "post-up ip route add vrf $vrf_iface unreachable default metric 4278198272";
push(@{$config->{$vrf_iface}}, @iface_config) if !$config->{$vrf_iface};
if ($vrfvxlan) {
--
2.31.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak
2021-04-08 8:32 ` [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak Alexandre Bruyelles
@ 2021-04-08 12:02 ` aderumier
0 siblings, 0 replies; 4+ messages in thread
From: aderumier @ 2021-04-08 12:02 UTC (permalink / raw)
To: Proxmox VE development discussion; +Cc: Alexandre Bruyelles
Good Catch.
Thanks Jack !
Le jeudi 08 avril 2021 à 10:32 +0200, Alexandre Bruyelles a écrit :
> On Linux, when no route is found in a vrf, it somehow fallback
> to the default routing table. In our case, that means a leak
> from the overlay to the underlay.
> Adding a low priority unreachable catch-all route is the way to go,
> as
> per the doc:
> https://www.kernel.org/doc/Documentation/networking/vrf.txt
>
> Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
> ---
> PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/PVE/Network/SDN/Zones/EvpnPlugin.pm
> b/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index e6ee839..ca000cf 100644
> --- a/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -134,6 +134,7 @@ sub generate_sdn_config {
> #vrf interface
> @iface_config = ();
> push @iface_config, "vrf-table auto";
> + push @iface_config, "post-up ip route add vrf $vrf_iface
> unreachable default metric 4278198272";
> push(@{$config->{$vrf_iface}}, @iface_config) if !$config-
> >{$vrf_iface};
>
> if ($vrfvxlan) {
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [pve-devel] [PATCH libnetwork 0/1] evpn: prevent route leaking
2021-04-08 8:32 [pve-devel] [PATCH container 0/1] evpn: prevent route leaking Alexandre Bruyelles
2021-04-08 8:32 ` [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak Alexandre Bruyelles
@ 2021-04-08 8:33 ` Alexandre Bruyelles
1 sibling, 0 replies; 4+ messages in thread
From: Alexandre Bruyelles @ 2021-04-08 8:33 UTC (permalink / raw)
To: pve-devel
On 4/8/21 10:32 AM, Alexandre Bruyelles wrote:
> Alexandre Bruyelles (1):
> zones: evpn: add a default unreachable, to prevent vrf leak
>
> PVE/Network/SDN/Zones/EvpnPlugin.pm | 1 +
> 1 file changed, 1 insertion(+)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-08 12:03 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-08 8:32 [pve-devel] [PATCH container 0/1] evpn: prevent route leaking Alexandre Bruyelles
2021-04-08 8:32 ` [pve-devel] [PATCH container 1/1] zones: evpn: add a default unreachable, to prevent vrf leak Alexandre Bruyelles
2021-04-08 12:02 ` aderumier
2021-04-08 8:33 ` [pve-devel] [PATCH libnetwork 0/1] evpn: prevent route leaking Alexandre Bruyelles
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox