Page MenuHomeVyOS Platform

vrf: nftables conntrack ct_iface_map contains multiple identical entries
Closed, ResolvedPublicBUG

Description

vyos@vyos:~$ sudo nft list table inet vrf_zones
table inet vrf_zones {
        map ct_iface_map {
                typeof iifname : ct zone
                elements = { "eth0" : 12817,
                             "dum0" : 12817,
                             "wg500" : 12817,
                             "wg501" : 12817,
                             "veth1" : 12817,
                             "bond10.5" : 12817,
                             "red" : 12817,
                             "bond10.500" : 12817,
                             "bond10.666" : 12817 }
        }

        chain vrf_zones_ct_in {
                type filter hook prerouting priority raw; policy accept;
                counter packets 1718123113 bytes 986223532227 ct original zone set iifname map @ct_iface_map
                counter packets 1718098550 bytes 986220580739 ct original zone set iifname map @ct_iface_map
                counter packets 1718095644 bytes 986220267697 ct original zone set iifname map @ct_iface_map
        }

        chain vrf_zones_ct_out {
                type filter hook output priority raw; policy accept;
                counter packets 179468909 bytes 41465072796 ct original zone set oifname map @ct_iface_map
                counter packets 179467883 bytes 41464947652 ct original zone set oifname map @ct_iface_map
                counter packets 179467781 bytes 41464933878 ct original zone set oifname map @ct_iface_map
        }

TODO

  • Add smoketest validating that also on interface removal, it's no longer part of the ct_iface_map

Details

Difficulty level
Normal (likely a few hours)
Version
1.4.0
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)