diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-03-25 17:32:31 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-03-25 17:32:31 +0300 |
| commit | f8c5643b36bd0df630453d8b6e5e25c6df984ec4 (patch) | |
| tree | 791ef93f74e382b79ecf0790296f53236e599bf5 /src/migration-scripts/firewall | |
| parent | fbae51d4683e97fd9f32b5f1d71b903e728cdca3 (diff) | |
| download | vyos-1x-f8c5643b36bd0df630453d8b6e5e25c6df984ec4.tar.gz vyos-1x-f8c5643b36bd0df630453d8b6e5e25c6df984ec4.zip | |
firewall: T8277: Resolve migration issue when using `port-group` with protocol 'all'
Updated the migration script to ensure that when migrating firewall rules,
if a `port-group` exists, the protocol will be set to 'tcp_udp' only
when its previous value is 'all'.
Diffstat (limited to 'src/migration-scripts/firewall')
| -rw-r--r-- | src/migration-scripts/firewall/6-to-7 | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/src/migration-scripts/firewall/6-to-7 b/src/migration-scripts/firewall/6-to-7 index 2626d76ee..c914a71ee 100644 --- a/src/migration-scripts/firewall/6-to-7 +++ b/src/migration-scripts/firewall/6-to-7 @@ -194,8 +194,14 @@ def migrate(config: ConfigTree) -> None: pg_base = base + ['name', name, 'rule', rule, direction, 'group', 'port-group'] proto_base = base + ['name', name, 'rule', rule, 'protocol'] - if config.exists(pg_base) and not config.exists(proto_base): - config.set(proto_base, value='tcp_udp') + if config.exists(pg_base): + if config.exists(proto_base): + proto_name = config.return_value(proto_base) + set_as_tcp_udp = proto_name == 'all' + else: + set_as_tcp_udp = False + if set_as_tcp_udp: + config.set(proto_base, value='tcp_udp') if '+' in name: replacement_string = "_" @@ -291,8 +297,14 @@ def migrate(config: ConfigTree) -> None: pg_base = base + ['ipv6-name', name, 'rule', rule, direction, 'group', 'port-group'] proto_base = base + ['ipv6-name', name, 'rule', rule, 'protocol'] - if config.exists(pg_base) and not config.exists(proto_base): - config.set(proto_base, value='tcp_udp') + if config.exists(pg_base): + if config.exists(proto_base): + proto_name = config.return_value(proto_base) + set_as_tcp_udp = proto_name == 'all' + else: + set_as_tcp_udp = False + if set_as_tcp_udp: + config.set(proto_base, value='tcp_udp') if '+' in name: replacement_string = "_" |