diff options
| author | Nicolas Fort <nicolasfort1988@gmail.com> | 2023-03-31 13:05:50 +0000 |
|---|---|---|
| committer | Nicolas Fort <nicolasfort1988@gmail.com> | 2023-03-31 13:05:50 +0000 |
| commit | c41af9698abaeb1dc656933570c14fc9d75c9ce5 (patch) | |
| tree | f5cc6b34c0e96e34b4ff01ed1b992730abc3a4f5 | |
| parent | 599c5405e7ff5b76aa774b8cc97a82fbc053d46c (diff) | |
| download | vyos-1x-c41af9698abaeb1dc656933570c14fc9d75c9ce5.tar.gz vyos-1x-c41af9698abaeb1dc656933570c14fc9d75c9ce5.zip | |
T5128: Add contraint for firewall interface. Also update smoketest to include at least one wildcarded interface
| -rw-r--r-- | interface-definitions/firewall.xml.in | 3 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 624d61759..edbf1e03a 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -349,6 +349,9 @@ <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> + <constraint> + #include <include/constraint/interface-name-with-wildcard.xml.in> + </constraint> </properties> <children> <node name="in"> diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index e071b7df9..99d3b3ca1 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -198,6 +198,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): def test_ipv4_basic_rules(self): name = 'smoketest' interface = 'eth0' + interface_wc = 'l2tp*' mss_range = '501-1460' conn_mark = '555' @@ -240,6 +241,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'name', name, 'rule', '6', 'connection-mark', conn_mark]) self.cli_set(['firewall', 'interface', interface, 'in', 'name', name]) + self.cli_set(['firewall', 'interface', interface_wc, 'in', 'name', name]) self.cli_commit() @@ -247,6 +249,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): nftables_search = [ [f'iifname "{interface}"', f'jump NAME_{name}'], + [f'iifname "{interface_wc}"', f'jump NAME_{name}'], ['saddr 172.16.20.10', 'daddr 172.16.10.10', 'log prefix "[smoketest-1-A]" log level debug', 'ip ttl 15', 'return'], ['tcp flags syn / syn,ack', 'tcp dport 8888', 'log prefix "[smoketest-2-R]" log level err', 'ip ttl > 102', 'reject'], ['tcp dport 22', 'limit rate 5/minute', 'return'], |