diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2025-10-31 15:25:03 +0000 |
|---|---|---|
| committer | Viacheslav Hletenko <v.gletenko@vyos.io> | 2025-10-31 15:31:58 +0000 |
| commit | b85fb0e04685d21b6f0dc4c0c1c8ee22105a971e (patch) | |
| tree | 4742d694b114c8e49f41f436e661fbf57c2efb3a | |
| parent | 7f6be577b88949f3d568ad6761c6572d40bac421 (diff) | |
| download | vyos-1x-b85fb0e04685d21b6f0dc4c0c1c8ee22105a971e.tar.gz vyos-1x-b85fb0e04685d21b6f0dc4c0c1c8ee22105a971e.zip | |
T7849: ZBF allow to use wildcard interfaces as member
Allow to use wildcard interfaces for zone-based firewall
It should allow interfaces like ipoe*/pppoe*/l2tp*
| -rw-r--r-- | interface-definitions/firewall.xml.in | 2 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 28 |
2 files changed, 29 insertions, 1 deletions
diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 7538c3cc5..e51cb68a6 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -466,7 +466,7 @@ <help>Interface associated with zone</help> </properties> <children> - #include <include/generic-interface-multi.xml.i> + #include <include/generic-interface-multi-wildcard.xml.i> <leafNode name="vrf"> <properties> <help>VRF associated with zone</help> diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 90a396df5..bc9900557 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -1086,6 +1086,34 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + def test_wildcard_interfaces(self): + wc_interfaces = [ + 'eth0', + 'eth0.*', + 'eth1', + 'eth1.23.*', + 'eth2.5.25', + 'eth2.5.25.54', + 'eth3*', + 'eth4.*', + 'ipoe*', + 'peth3', + 'peth3.', + 'pod-one', + 'pppoe*', + 'pptp*', + 'l2tp*', + 'sstp*', + 'vpptun*', + ] + for iface in wc_interfaces: + self.cli_set( + ['firewall', 'zone', 'smoketest-wildcard', 'member', 'interface', iface] + ) + self.cli_commit() + + self.verify_nftables(wc_interfaces, 'ip vyos_filter') + def test_flow_offload(self): self.cli_set(['interfaces', 'ethernet', 'eth0', 'vif', '10']) self.cli_set(['firewall', 'flowtable', 'smoketest', 'interface', 'eth0.10']) |