Merge pull request #2804 from vyos/mergify/bp/sagitta/pr-2798

T5791: T5918: use generic pattern to detect dynamic interfaces for ipsec and dynamic dns (backport #2798)

3 files changed, 22 insertions, 11 deletions

diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index 85423142d..5d3723876 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -1,4 +1,4 @@
-# Copyright 2020-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -25,6 +25,9 @@ from vyos import ConfigError
 from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_recursive
 
+# pattern re-used in ipsec migration script
+dynamic_interface_pattern = r'(ppp|pppoe|sstpc|l2tp|ipoe)[0-9]+'
+
 def verify_mtu(config):
     """
     Common helper function used by interface implementations to perform
@@ -290,7 +293,7 @@ def verify_source_interface(config):
 
     src_ifname = config['source_interface']
     # We do not allow sourcing other interfaces (e.g. tunnel) from dynamic interfaces
-    tmp = re.compile(r'(ppp|pppoe|sstpc|l2tp|ipoe)[0-9]+')
+    tmp = re.compile(dynamic_interface_pattern)
     if tmp.match(src_ifname):
         raise ConfigError(f'Can not source "{ifname}" from dynamic interface "{src_ifname}"!')
 
diff --git a/src/conf_mode/service_dns_dynamic.py b/src/conf_mode/service_dns_dynamic.py
index 99fa8feee..845aaa1b5 100755
--- a/src/conf_mode/service_dns_dynamic.py
+++ b/src/conf_mode/service_dns_dynamic.py
@@ -21,8 +21,10 @@ from sys import exit
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configverify import verify_interface_exists
+from vyos.configverify import dynamic_interface_pattern
 from vyos.template import render
 from vyos.utils.process import call
+from vyos.utils.network import interface_exists
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -30,9 +32,6 @@ airbag.enable()
 config_file = r'/run/ddclient/ddclient.conf'
 systemd_override = r'/run/systemd/system/ddclient.service.d/override.conf'
 
-# Dynamic interfaces that might not exist when the configuration is loaded
-dynamic_interfaces = ('pppoe', 'sstpc')
-
 # Protocols that require zone
 zone_necessary = ['cloudflare', 'digitalocean', 'godaddy', 'hetzner', 'gandi',
                   'nfsn', 'nsupdate']
@@ -81,7 +80,6 @@ def verify(dyndns):
 
     # Dynamic DNS service provider - configuration validation
     for service, config in dyndns['name'].items():
-
         error_msg_req = f'is required for Dynamic DNS service "{service}"'
         error_msg_uns = f'is not supported for Dynamic DNS service "{service}"'
 
@@ -93,10 +91,12 @@ def verify(dyndns):
         # that the interface exists (or just warn if dynamic interface)
         # and that web-options are not set
         if config['address'] != 'web':
+            tmp = re.compile(dynamic_interface_pattern)
             # exclude check interface for dynamic interfaces
-            if config['address'].startswith(dynamic_interfaces):
-                Warning(f'Interface "{config["address"]}" does not exist yet and cannot '
-                        f'be used for Dynamic DNS service "{service}" until it is up!')
+            if tmp.match(config["address"]):
+                if not interface_exists(config["address"]):
+                    Warning(f'Interface "{config["address"]}" does not exist yet and cannot '
+                            f'be used for Dynamic DNS service "{service}" until it is up!')
             else:
                 verify_interface_exists(config['address'])
             if 'web_options' in config:
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index adbac0405..d074ed159 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -27,6 +27,7 @@ from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import leaf_node_changed
 from vyos.configverify import verify_interface_exists
+from vyos.configverify import dynamic_interface_pattern
 from vyos.defaults import directories
 from vyos.ifconfig import Interface
 from vyos.pki import encode_certificate
@@ -160,8 +161,15 @@ def verify(ipsec):
                     raise ConfigError(f'Authentication psk "{psk}" missing "id" or "secret"')
 
     if 'interface' in ipsec:
-        for ifname in ipsec['interface']:
-            verify_interface_exists(ifname)
+        tmp = re.compile(dynamic_interface_pattern)
+        for interface in ipsec['interface']:
+            # exclude check interface for dynamic interfaces
+            if tmp.match(interface):
+                if not interface_exists(interface):
+                    Warning(f'Interface "{interface}" does not exist yet and cannot be used '
+                            f'for IPsec until it is up!')
+            else:
+                verify_interface_exists(interface)
 
     if 'l2tp' in ipsec:
         if 'esp_group' in ipsec['l2tp']: