PR #5175 introduced WireGuard fwmark IP policy rules at priority 1998 (ip {afi} rule add pref 1998 fwmark ... table {table_id}) to route marked packets into the correct VRF routing table. However, the VRF deletion cleanup in src/conf_mode/vrf.py uses:
while call(f'ip {afi} rule del table {table_id}') == 0:
This deletes any policy rule referencing that table ID, regardless of priority, which is too broad and could unintentionally remove rules unrelated to the fwmark WireGuard rules.
It should be narrowed to target only the pref 1998 rules:
while call(f'ip {afi} rule del pref 1998 table {table_id}') == 0:
This ensures that on VRF deletion, only the specific priority-1998 fwmark routing rules are cleaned up, leaving any other policy routing rules that may point to the same table intact.
Description
Description
Details
Details
- Version
- -
- Is it a breaking change?
- Perfectly compatible
- Issue type
- Bug (incorrect behavior)