firewall: T8761: re-introduce VRF interface names in generated firewall config

This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.

Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
  over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2

Co-authored-by: Christian Breunig <christian@breunig.cc>

1 files changed, 11 insertions, 3 deletions

diff --git a/src/conf_mode/interfaces_wireless.py b/src/conf_mode/interfaces_wireless.py
index f7d4cd7c9..1ad16e816 100755
--- a/src/conf_mode/interfaces_wireless.py
+++ b/src/conf_mode/interfaces_wireless.py
@@ -25,6 +25,7 @@ from vyos.config import Config
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import dict_merge
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -92,7 +93,7 @@ def get_config(config=None):
         conf = Config()
     base = ['interfaces', 'wireless']
 
-    _, wifi = get_interface_dict(conf, base)
+    ifname, wifi = get_interface_dict(conf, base)
 
     # retrieve global Wireless regulatory domain setting
     if conf.exists(country_code_path):
@@ -145,6 +146,10 @@ def get_config(config=None):
     if 'static_arp' in wifi:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return wifi
 
 def verify(wifi):
@@ -318,6 +323,9 @@ def apply(wifi):
 
     if 'deleted' in wifi:
         WiFiIf(**wifi).remove()
+
+        # run the dependents and return
+        call_dependents()
         return None
 
     while (is_systemd_service_running(f'hostapd@{interface}.service') or \
@@ -393,8 +401,8 @@ def apply(wifi):
         elif wifi['type'] == 'station':
             call(f'systemctl start wpa_supplicant@{interface}.service')
 
-    if 'static_arp' in wifi:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None