Merge pull request #5086 from natali-rs1985/T8419

vpp: T8419: Disallow cross-membership between VPP and kernel bonding/bridge interfaces

3 files changed, 58 insertions, 3 deletions

diff --git a/src/conf_mode/interfaces_bonding.py b/src/conf_mode/interfaces_bonding.py
index 4d6cafc9d..55581d6ad 100755
--- a/src/conf_mode/interfaces_bonding.py
+++ b/src/conf_mode/interfaces_bonding.py
@@ -44,6 +44,7 @@ from vyos.configdict import has_address_configured
 from vyos.configdict import has_vrf_configured
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
+from vyos.vpp.utils import cli_ifaces_list
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -170,6 +171,8 @@ def get_config(config=None):
     if 'static_arp' in bond:
         set_dependents('static_arp', conf)
 
+    bond['vpp_ifaces'] = cli_ifaces_list(conf)
+
     return bond
 
 
@@ -205,7 +208,7 @@ def verify(bond):
     bond_name = bond['ifname']
     if dict_search('member.interface', bond):
         for interface, interface_config in bond['member']['interface'].items():
-            error_msg = f'Can not add interface "{interface}" to bond, '
+            error_msg = f'Cannot add interface "{interface}" to bond, '
 
             if interface == 'lo':
                 raise ConfigError('Loopback interface "lo" can not be added to a bond')
@@ -239,6 +242,12 @@ def verify(bond):
                         continue
                     raise ConfigError(error_msg + f'it has a "{option_path.replace(".", " ")}" assigned!')
 
+            iface_base = interface.split('.')[0]  # get the parent interface name
+            if iface_base in bond['vpp_ifaces']:
+                raise ConfigError(
+                    error_msg + 'it is already configured as VPP interface'
+                )
+
             if mtu := bond.get('mtu'):
                 mtu = int(mtu)
                 max_mtu = int(EthernetIf(interface).get_max_mtu())
diff --git a/src/conf_mode/interfaces_bridge.py b/src/conf_mode/interfaces_bridge.py
index 2060ecd8b..206d89d84 100755
--- a/src/conf_mode/interfaces_bridge.py
+++ b/src/conf_mode/interfaces_bridge.py
@@ -33,6 +33,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.utils.dict import dict_search
 from vyos.utils.network import interface_exists
+from vyos.vpp.utils import cli_ifaces_list
 from vyos import ConfigError
 
 from vyos import airbag
@@ -128,6 +129,8 @@ def get_config(config=None):
     if 'static_arp' in bridge:
         set_dependents('static_arp', conf)
 
+    bridge['vpp_ifaces'] = cli_ifaces_list(conf)
+
     return bridge
 
 def verify(bridge):
@@ -153,7 +156,7 @@ def verify(bridge):
 
     if dict_search('member.interface', bridge):
         for interface, interface_config in bridge['member']['interface'].items():
-            error_msg = f'Can not add interface "{interface}" to bridge, '
+            error_msg = f'Cannot add interface "{interface}" to bridge, '
 
             if interface == 'lo':
                 raise ConfigError('Loopback interface "lo" can not be added to a bridge')
@@ -190,6 +193,12 @@ def verify(bridge):
             if interface.startswith('vtun') and not interface_config['valid_ovpn']:
                 raise ConfigError(error_msg + 'OpenVPN device-type must be set to "tap"')
 
+            iface_base = interface.split('.')[0]  # get the parent interface name
+            if iface_base in bridge['vpp_ifaces']:
+                raise ConfigError(
+                    error_msg + 'it is already configured as VPP interface'
+                )
+
     if 'enable_vlan' in bridge:
         if dict_search('vif.1', bridge):
             raise ConfigError(f'VLAN 1 sub interface cannot be set for VLAN aware bridge {ifname}, and VLAN 1 is always the parent interface')
diff --git a/src/conf_mode/vpp.py b/src/conf_mode/vpp.py
index ecf7f09b1..7b41c54fe 100755
--- a/src/conf_mode/vpp.py
+++ b/src/conf_mode/vpp.py
@@ -31,7 +31,7 @@ from vyos.base import Warning
 from vyos.config import Config, config_dict_merge
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
-from vyos.configdict import node_changed
+from vyos.configdict import node_changed, is_member
 from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_virtual_interface_exists
 from vyos.ifconfig import Section
@@ -67,6 +67,7 @@ from vyos.vpp.config_resource_checks import memory
 from vyos.vpp.config_resource_checks.resource_defaults import default_resource_map
 from vyos.vpp.config_filter import iface_filter_eth
 from vyos.vpp.utils import EthtoolGDrvinfo
+from vyos.vpp.utils import cli_ethernet_with_vifs_ifaces
 from vyos.vpp.configdb import JSONStorage
 
 airbag.enable()
@@ -395,6 +396,9 @@ def get_config(config=None):
     # Return to config dictionary
     config['persist_config'] = eth_ifaces_persist
 
+    # list of all Ethernet interfaces with vifs
+    ifaces_with_vifs = cli_ethernet_with_vifs_ifaces(conf, include_nested_vifs=True)
+
     if 'settings' in config:
         if 'interface' in config['settings']:
             interface_rx_mode = config['settings'].get('interface_rx_mode')
@@ -427,6 +431,26 @@ def get_config(config=None):
                 #         }
                 #     )
 
+                # Collect memberships as sets for uniqueness
+                bond_member = is_member(conf, iface, 'bonding')
+                bridge_member = is_member(conf, iface, 'bridge')
+
+                # Look for VLAN interfaces of this parent
+                vlans = [
+                    vlan_iface
+                    for vlan_iface in ifaces_with_vifs
+                    if vlan_iface.startswith(f'{iface}.')
+                ]
+                for vlan_iface in vlans:
+                    bond_member.update(is_member(conf, vlan_iface, 'bonding'))
+                    bridge_member.update(is_member(conf, vlan_iface, 'bridge'))
+
+                # Store as lists
+                if bond_member:
+                    iface_config['bond_member'] = list(bond_member)
+                if bridge_member:
+                    iface_config['bridge_member'] = list(bridge_member)
+
                 # Get PCI address or device ID
                 if iface_config['driver'] == 'dpdk':
                     if 'dpdk_options' not in iface_config:
@@ -610,6 +634,18 @@ def verify(config):
                 'To proceed at your own risk, enable: "set vpp settings allow-unsupported-nics".'
             )
 
+        err_message = f'Cannot add {iface} to VPP - '
+        if 'bond_member' in iface_config:
+            raise ConfigError(
+                err_message
+                + f'interface (or its VLAN) is a member of bond(s): {", ".join(iface_config["bond_member"])}'
+            )
+        if 'bridge_member' in iface_config:
+            raise ConfigError(
+                err_message
+                + f'interface (or its VLAN) is a member of bridge(s): {", ".join(iface_config["bridge_member"])}'
+            )
+
         if iface_config['driver'] == 'xdp' and 'xdp_options' in iface_config:
             if iface_config['xdp_options']['num_rx_queues'] != 'all':
                 rx_queues = iface_config['xdp_api_params']['rxq_num']
@@ -672,6 +708,7 @@ def verify(config):
         else:
             verify_interface_exists(config, pppoe_iface)
 
+
 def generate(config):
     if not config or 'remove' in config:
         # Remove old config and return