configverify: T8413: fix issue in duplex shaping (redirect to input interface)

After commit 6eafdbf1a8 ("configdict: T8358: rename internal representation from
traffic_policy to qos) we uncovered a bug/added a feature in supporting QoS and
redirect on an interface.

The code in VyOS stream 2026.02 is:

  if ('mirror' in config or 'redirect' in config) and
    dict_search('traffic_policy.in', config) is not None:

and this got changed to:

  if 'qos' in config and ('mirror' in config or 'redirect' in config):

in the commit mentioned above. When looking at the code in 2026.02 release

$ git describe --tags
2026.02

$ git grep traffic_policy
python/vyos/configdict.py:     dict.update({'traffic_policy': {}})
python/vyos/configdict.py:         dict['vif'][vif].update({'traffic_policy': {}})
python/vyos/configdict.py:         dict['vif_s'][vif_s].update({'traffic_policy': {}})
python/vyos/configdict.py:             dict['vif_s'][vif_s]['vif_c'][vif_c].update({'traffic_policy': {}})
python/vyos/configverify.py: if ('mirror' in config or 'redirect' in config) and dict_search('traffic_policy.in', config) is not None:
python/vyos/ifconfig/interface.py:     if not 'traffic_policy' in self.config:

I never see traffic_policy.in set, so the check seems to have never worked in
the past at all.

During the QoS rewrite from 1.3 -> 1.4 CLI traffic-policy was renamed by me to
qos but we kept that synthetic key in the Python code. That is the root cause.
So it should have never worked (CLI wise) but during that bug it started to work
as expected, and even the Python code stated in a comment:

  if 'qos' in config and ('mirror' in config or 'redirect' in config):
      # XXX: support combination of limiting and redirect/mirror - this is an
      # artificial limitation
      raise ConfigError('Can not use QoS together with mirror/redirect!')

So we have enabled this feature for a long time by accident already.

1 files changed, 6 insertions, 6 deletions

diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index 5ff8dda2c..6e2fd1618 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -180,9 +180,14 @@ def verify_mirror_redirect(config):
 
     It makes no sense to mirror traffic back at yourself!
     """
-    if {'mirror', 'redirect'} <= set(config):
+    if 'mirror' in config and 'redirect' in config:
         raise ConfigError('Mirror and redirect can not be enabled at the same time!')
 
+    if 'mirror' in config and 'qos' in config:
+        # XXX: support combination of limiting and mirror - this is an artificial
+        # limitation from the past
+        raise ConfigError('Can not use QoS together with mirror!')
+
     if 'mirror' in config:
         for direction, mirror_interface in config['mirror'].items():
             if not interface_exists(mirror_interface):
@@ -199,11 +204,6 @@ def verify_mirror_redirect(config):
             raise ConfigError(f'Requested redirect interface "{redirect_ifname}" '\
                                'does not exist!')
 
-    if 'qos' in config and ('mirror' in config or 'redirect' in config):
-        # XXX: support combination of limiting and redirect/mirror - this is an
-        # artificial limitation
-        raise ConfigError('Can not use QoS together with mirror/redirect!')
-
 def verify_authentication(config):
     """
     Common helper function used by interface implementations to perform