firewall: T8761: re-introduce VRF interface names in generated firewall config

This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.

Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
  over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2

Co-authored-by: Christian Breunig <christian@breunig.cc>

2 files changed, 48 insertions, 3 deletions

diff --git a/data/config-mode-dependencies/vyos-1x.json b/data/config-mode-dependencies/vyos-1x.json
index 6b9cc0e42..24118a02b 100644
--- a/data/config-mode-dependencies/vyos-1x.json
+++ b/data/config-mode-dependencies/vyos-1x.json
@@ -9,41 +9,71 @@
     },
     "interfaces_bonding": {
         "ethernet": ["interfaces_ethernet"],
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_bridge": {
         "vxlan": ["interfaces_vxlan"],
         "wlan": ["interfaces_wireless"],
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
+    "interfaces_dummy": {
+        "firewall": ["firewall"]
+    },
     "interfaces_ethernet": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_geneve": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_l2tpv3": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_macsec": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
+    "interfaces_openvpn": {
+        "firewall": ["firewall"]
+    },
+    "interfaces_pppoe": {
+        "firewall": ["firewall"]
+    },
     "interfaces_pseudo_ethernet": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
+    "interfaces_sstpc": {
+        "firewall": ["firewall"]
+    },
+    "interfaces_tunnel": {
+        "firewall": ["firewall"]
+    },
     "interfaces_virtual_ethernet": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
+    "interfaces_vti": {
+        "firewall": ["firewall"]
+    },
     "interfaces_vxlan": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_wireless": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_wwan": {
+        "firewall": ["firewall"],
         "static_arp": ["protocols_static_arp"]
     },
     "interfaces_wireguard": {
+        "firewall": ["firewall"],
         "vxlan": ["interfaces_vxlan"]
     },
     "load_balancing_wan": {
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2
index 7b4128082..45804c9d1 100644
--- a/data/templates/firewall/nftables-zone.j2
+++ b/data/templates/firewall/nftables-zone.j2
@@ -9,9 +9,14 @@
 {% for zone_name, zone_conf in zone.items() %}
 {%     if 'local_zone' not in zone_conf %}
 {%         if 'interface' in zone_conf.member %}
-        oifname { {{ zone_conf.member.interface | quoted_join(',') }} } counter jump VZONE_{{ zone_name }}
+        oifname { {{ zone_conf.member.interface | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
 {%         endif %}
 {%         if 'vrf' in zone_conf.member %}
+{%             for vrf_name in zone_conf.member.vrf %}
+{%                 if zone_conf.vrf_interfaces[vrf_name] | length > 0 %}
+        oifname { {{ zone_conf.vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
+{%                 endif %}
+{%             endfor %}
         oifname { {{ zone_conf.member.vrf | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
 {%         endif %}
 {%     endif %}
@@ -71,6 +76,12 @@
         oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return
 {%                 endif %}
 {%                 if 'vrf' in zone[from_zone].member %}
+{%                     for vrf_name in zone[from_zone].member.vrf %}
+{%                         if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %}
+        oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
+        oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return
+{%                         endif %}
+{%                     endfor %}
         oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
         oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
 {%                 endif %}
@@ -84,9 +95,13 @@
 {%                 endif %}
 {%                 if 'vrf' in zone[from_zone].member %}
 {%                     for vrf_name in zone[from_zone].member.vrf %}
-        oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }}
-        oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter return
+{%                         if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %}
+        oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }}
+        oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return
+{%                         endif %}
 {%                     endfor %}
+        oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
+        oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
 {%                 endif %}
 {%             endfor %}
 {%         endif %}