From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001 From: David Vølker Date: Mon, 1 Jun 2026 08:09:06 +0200 Subject: firewall: T8761: re-introduce VRF interface names in generated firewall config This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig --- python/vyos/configdict.py | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'python') diff --git a/python/vyos/configdict.py b/python/vyos/configdict.py index e721942ca..1a3165a8f 100644 --- a/python/vyos/configdict.py +++ b/python/vyos/configdict.py @@ -19,6 +19,7 @@ A library for retrieving value dicts from VyOS configs in a declarative fashion. import os import json +from vyos.config import Config from vyos.utils.dict import dict_search from vyos.utils.process import cmd @@ -300,6 +301,34 @@ def has_vrf_configured(conf, intf): conf.set_level(old_level) return ret +def is_vrf_changed(conf : Config, intf) -> bool: + """ + Checks if interface has a VRF changed. + + Returns True if interface has VRF changed, False if it doesn't. + """ + from vyos.ifconfig import Section + + # set default path for this interface + intfpath = ['interfaces', Section.section(intf), intf] + + # Check top-level interface + if is_node_changed(conf, intfpath + ['vrf']): + return True + + # check sub interfaces + for vif in conf.list_nodes(intfpath + ['vif']): + if is_node_changed(conf, intfpath + ['vif', vif, 'vrf']): + return True + for vif_s in conf.list_nodes(intfpath + ['vif-s']): + if is_node_changed(conf, intfpath + ['vif-s', vif_s, 'vrf']): + return True + for vif_c in conf.list_nodes(intfpath + ['vif-s', vif_s, 'vif-c']): + if is_node_changed(conf, intfpath + ['vif-s', vif_s, 'vif-c', vif_c, 'vrf']): + return True + + return False + def has_vlan_subinterface_configured(conf, intf): """ Checks if interface has an VLAN subinterface configured. -- cgit v1.2.3