vpp: T8419: Disallow cross-membership between VPP and kernel bonding/bridge interfaces

1 files changed, 10 insertions, 1 deletions

diff --git a/src/conf_mode/interfaces_bridge.py b/src/conf_mode/interfaces_bridge.py
index c6792404b..b13a7d3fb 100755
--- a/src/conf_mode/interfaces_bridge.py
+++ b/src/conf_mode/interfaces_bridge.py
@@ -33,6 +33,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.utils.dict import dict_search
 from vyos.utils.network import interface_exists
+from vyos.vpp.utils import cli_ifaces_list
 from vyos import ConfigError
 
 from vyos import airbag
@@ -128,6 +129,8 @@ def get_config(config=None):
     if 'static_arp' in bridge:
         set_dependents('static_arp', conf)
 
+    bridge['vpp_ifaces'] = cli_ifaces_list(conf)
+
     return bridge
 
 def verify(bridge):
@@ -153,7 +156,7 @@ def verify(bridge):
 
     if dict_search('member.interface', bridge):
         for interface, interface_config in bridge['member']['interface'].items():
-            error_msg = f'Can not add interface "{interface}" to bridge, '
+            error_msg = f'Cannot add interface "{interface}" to bridge, '
 
             if interface == 'lo':
                 raise ConfigError('Loopback interface "lo" can not be added to a bridge')
@@ -190,6 +193,12 @@ def verify(bridge):
             if interface.startswith('vtun') and not interface_config['valid_ovpn']:
                 raise ConfigError(error_msg + 'OpenVPN device-type must be set to "tap"')
 
+            iface_base = interface.split('.')[0]  # get the parent interface name
+            if iface_base in bridge['vpp_ifaces']:
+                raise ConfigError(
+                    error_msg + 'it is already configured as VPP interface'
+                )
+
     if 'enable_vlan' in bridge:
         if dict_search('vif.1', bridge):
             raise ConfigError(f'VLAN 1 sub interface cannot be set for VLAN aware bridge {ifname}, and VLAN 1 is always the parent interface')