T8138: add nat66 as dependent of firewall groups

Add nat66 as a dependency of firewall groups, because nat66 may
reference firewall groups via source-destination-group-ipv6.xml.i. The
dependency is necessary to ensure a fresh nft ruleset is built when
dependent groups are updated, so that the changes actually take effect
in nat66 on commit.

Add a smoketest to cover nft rulesets failing to update as a result of
changes to dependent firewall groups.

Original commit adding support for groups in nat66 is commit f96733dd.

1 files changed, 26 insertions, 0 deletions

diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py
index 5e5e4829a..403c428cf 100755
--- a/smoketest/scripts/cli/test_nat66.py
+++ b/smoketest/scripts/cli/test_nat66.py
@@ -39,6 +39,32 @@ class TestNAT66(VyOSUnitTestSHIM.TestCase):
         # always forward to base class
         super().tearDown()
 
+    def test_firewall_group_dependence(self):
+        address_group = 'smoketest_addr_dependence'
+        address_group_member_1 = 'fc00::1'
+        address_group_member_2 = 'fc00::2'
+        translation_prefix = 'fc01::/64'
+
+        # add an address group and set a nat66 rule with it
+        self.cli_set(['firewall', 'group', 'ipv6-address-group', address_group, 'address', address_group_member_1])
+        self.cli_set(dst_path + ['rule', '1', 'destination', 'group', 'address-group', address_group])
+        self.cli_set(src_path + ['rule', '1', 'translation', 'address', translation_prefix])
+        # commit changes to build configuration file
+        self.cli_commit()
+
+        # replace the member of the address group
+        self.cli_delete(['firewall', 'group', 'ipv6-address-group', address_group, 'address', address_group_member_1])
+        self.cli_set(['firewall', 'group', 'ipv6-address-group', address_group, 'address', address_group_member_2])
+        self.cli_commit()
+
+        # verify that the new member is in the address group
+        nftables_search = [
+            [f'set A6_{address_group}'],
+            [f'elements = {{ {address_group_member_2} }}']
+        ]
+
+        self.verify_nftables(nftables_search, 'ip6 vyos_nat')
+
     def test_source_nat66(self):
         source_prefix = 'fc00::/64'
         translation_prefix = 'fc01::/64'