diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-11-04 15:27:50 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-04 15:27:50 +0000 |
| commit | 6d0324506a5b0419eb0ae001d8d006a414030405 (patch) | |
| tree | 6f7fe23d6b9d4663479d57669d4f5aa0dc5bc887 | |
| parent | 3c1dfa94dba6fff763a32666683c3bdd35af9bea (diff) | |
| parent | b85fb0e04685d21b6f0dc4c0c1c8ee22105a971e (diff) | |
| download | vyos-1x-6d0324506a5b0419eb0ae001d8d006a414030405.tar.gz vyos-1x-6d0324506a5b0419eb0ae001d8d006a414030405.zip | |
Merge pull request #4825 from vyos/T7849
T7849: ZBF allow to use wildcard interfaces as member
| -rw-r--r-- | interface-definitions/firewall.xml.in | 2 | ||||
| -rw-r--r-- | interface-definitions/include/constraint/interface-name-with-wildcard.xml.i | 3 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 28 |
3 files changed, 31 insertions, 2 deletions
diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 7538c3cc5..e51cb68a6 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -466,7 +466,7 @@ <help>Interface associated with zone</help> </properties> <children> - #include <include/generic-interface-multi.xml.i> + #include <include/generic-interface-multi-wildcard.xml.i> <leafNode name="vrf"> <properties> <help>VRF associated with zone</help> diff --git a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i index adff530b6..aa40017e9 100644 --- a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i +++ b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i @@ -1,4 +1,5 @@ <!-- include start from constraint/interface-name-with-wildcard.xml.i --> -<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vpptap|vpptun|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(pod-[-_a-zA-Z0-9]{1,11})</regex> <validator name="file-path --lookup-path /sys/class/net --directory"/> <!-- include end --> diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 90a396df5..bc9900557 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -1086,6 +1086,34 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + def test_wildcard_interfaces(self): + wc_interfaces = [ + 'eth0', + 'eth0.*', + 'eth1', + 'eth1.23.*', + 'eth2.5.25', + 'eth2.5.25.54', + 'eth3*', + 'eth4.*', + 'ipoe*', + 'peth3', + 'peth3.', + 'pod-one', + 'pppoe*', + 'pptp*', + 'l2tp*', + 'sstp*', + 'vpptun*', + ] + for iface in wc_interfaces: + self.cli_set( + ['firewall', 'zone', 'smoketest-wildcard', 'member', 'interface', iface] + ) + self.cli_commit() + + self.verify_nftables(wc_interfaces, 'ip vyos_filter') + def test_flow_offload(self): self.cli_set(['interfaces', 'ethernet', 'eth0', 'vif', '10']) self.cli_set(['firewall', 'flowtable', 'smoketest', 'interface', 'eth0.10']) |