firewall: T8761: re-introduce VRF interface names in generated firewall config

This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.

Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
  over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2

Co-authored-by: Christian Breunig <christian@breunig.cc>

1 files changed, 29 insertions, 0 deletions

diff --git a/python/vyos/configdict.py b/python/vyos/configdict.py
index e721942ca..1a3165a8f 100644
--- a/python/vyos/configdict.py
+++ b/python/vyos/configdict.py
@@ -19,6 +19,7 @@ A library for retrieving value dicts from VyOS configs in a declarative fashion.
 import os
 import json
 
+from vyos.config import Config
 from vyos.utils.dict import dict_search
 from vyos.utils.process import cmd
 
@@ -300,6 +301,34 @@ def has_vrf_configured(conf, intf):
     conf.set_level(old_level)
     return ret
 
+def is_vrf_changed(conf : Config, intf) -> bool:
+    """
+    Checks if interface has a VRF changed.
+
+    Returns True if interface has VRF changed, False if it doesn't.
+    """
+    from vyos.ifconfig import Section
+
+    # set default path for this interface
+    intfpath = ['interfaces', Section.section(intf), intf]
+
+    # Check top-level interface
+    if is_node_changed(conf, intfpath + ['vrf']):
+        return True
+
+    # check sub interfaces
+    for vif in conf.list_nodes(intfpath + ['vif']):
+        if is_node_changed(conf, intfpath + ['vif', vif, 'vrf']):
+            return True
+    for vif_s in conf.list_nodes(intfpath + ['vif-s']):
+        if is_node_changed(conf, intfpath + ['vif-s', vif_s, 'vrf']):
+            return True
+        for vif_c in conf.list_nodes(intfpath + ['vif-s', vif_s, 'vif-c']):
+            if is_node_changed(conf, intfpath + ['vif-s', vif_s, 'vif-c', vif_c, 'vrf']):
+                return True
+
+    return False
+
 def has_vlan_subinterface_configured(conf, intf):
     """
     Checks if interface has an VLAN subinterface configured.