Merge pull request #5393 from c-po/interface-no-vrf

xml: T9179: reject VRF names in interface-name constraint

1 files changed, 40 insertions, 0 deletions

diff --git a/src/validators/interface-exists b/src/validators/interface-exists
new file mode 100755
index 000000000..d78247e1b
--- /dev/null
+++ b/src/validators/interface-exists
@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Passes only if $1 is a net device that exists on the system and is not a
+# VRF. Used as a fallback alongside a naming-pattern regex, so a currently
+# existing device is accepted as a physical/logical interface only if it is
+# not a VRF (VRFs are real net devices but must never be accepted where an
+# interface is expected).
+
+case "$1" in
+    ""|.|..|*/*)
+        echo "Error: $1 does not exist"
+        exit 1
+        ;;
+esac
+
+if [ ! -d "/sys/class/net/$1" ]; then
+    echo "Error: $1 does not exist"
+    exit 1
+fi
+
+if ip vrf show "$1" >/dev/null 2>&1; then
+    echo "Error: $1 is a VRF, not a network interface"
+    exit 1
+fi
+
+exit 0