From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001 From: David Vølker Date: Mon, 1 Jun 2026 08:09:06 +0200 Subject: firewall: T8761: re-introduce VRF interface names in generated firewall config This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig --- smoketest/scripts/cli/test_firewall.py | 35 +++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index baafc9d6e..928a4e72b 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -1150,8 +1150,13 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['vrf', 'name', 'VRF-1', 'table', '101']) self.cli_set(['vrf', 'name', 'VRF-2', 'table', '102']) self.cli_set(['interfaces', 'ethernet', 'eth0', 'vrf', 'VRF-1']) - self.cli_set(['interfaces', 'vti', 'vti1', 'vrf', 'VRF-2']) + self.cli_set(['interfaces', 'ethernet', 'eth0', 'vif', '10', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'ethernet', 'eth3', 'vif-s', '10', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'ethernet', 'eth3', 'vif-s', '20', 'vif-c', '30', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'vti', 'vti1', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'vti', 'vti2', 'vrf', 'VRF-2']) + # commit the config self.cli_commit() nftables_search = [ @@ -1162,8 +1167,10 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['chain VYOS_ZONE_FORWARD'], ['type filter hook forward priority filter + 1'], ['oifname { "eth1", "eth2" }', 'counter packets', 'jump VZONE_ZONE1'], + ['oifname { "eth0", "vti1", "eth0.10", "eth3.10", "eth3.20.30" }', 'counter packets', 'jump VZONE_ZONE1'], ['oifname "VRF-1"', 'counter packets', 'jump VZONE_ZONE1'], ['oifname "vtun66"', 'counter packets', 'jump VZONE_ZONE2'], + ['oifname "vti2"', 'counter packets', 'jump VZONE_ZONE2'], ['oifname "VRF-2"', 'counter packets', 'jump VZONE_ZONE2'], ['chain VYOS_ZONE_LOCAL'], ['type filter hook input priority filter + 1'], @@ -1197,8 +1204,10 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['chain VYOS_ZONE_FORWARD'], ['type filter hook forward priority filter + 1'], ['oifname { "eth1", "eth2" }', 'counter packets', 'jump VZONE_ZONE1'], + ['oifname { "eth0", "vti1", "eth0.10", "eth3.10", "eth3.20.30" }', 'counter packets', 'jump VZONE_ZONE1'], ['oifname "VRF-1"', 'counter packets', 'jump VZONE_ZONE1'], ['oifname "vtun66"', 'counter packets', 'jump VZONE_ZONE2'], + ['oifname "vti2"', 'counter packets', 'jump VZONE_ZONE2'], ['oifname "VRF-2"', 'counter packets', 'jump VZONE_ZONE2'], ['chain VYOS_ZONE_LOCAL'], ['type filter hook input priority filter + 1'], @@ -1210,6 +1219,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['counter packets', 'drop', 'comment "zone_LOCAL default-action drop"'], ['chain VZONE_LOCAL_OUT'], ['oifname "vtun66"', 'counter packets', 'jump NAME6_LOCAL_to_ZONE2_v6'], + ['oifname "vti2"', 'counter packets', 'jump NAME6_LOCAL_to_ZONE2_v6'], ['oifname "VRF-2"', 'counter packets', 'jump NAME6_LOCAL_to_ZONE2_v6'], ['counter packets', 'drop', 'comment "zone_LOCAL default-action drop"'], ['chain VZONE_ZONE1'], @@ -1225,6 +1235,29 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + # change memberships in vrf plus delete and add subifs + self.cli_set(['interfaces', 'vti', 'vti1', 'vrf', 'VRF-2']) + self.cli_delete(['interfaces', 'ethernet', 'eth0', 'vif', '10']) + self.cli_delete(['interfaces', 'ethernet', 'eth3', 'vif-s', '10']) + self.cli_delete(['interfaces', 'ethernet', 'eth3', 'vif-s', '20', 'vif-c', '30']) + self.cli_set(['interfaces', 'ethernet', 'eth0', 'vif', '20', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'ethernet', 'eth3', 'vif-s', '20', 'vrf', 'VRF-1']) + self.cli_set(['interfaces', 'ethernet', 'eth3', 'vif-s', '20', 'vif-c', '40', 'vrf', 'VRF-1']) + self.cli_commit() + + # make som verifications to ensure the interface swapped vrf + nftables_search = [ + ['oifname { "eth0", "eth0.20", "eth3.20", "eth3.20.40" }', 'counter packets', 'jump VZONE_ZONE1'], + ['oifname { "vti1", "vti2" }', 'counter packets', 'jump VZONE_ZONE2'], + ] + + nftables_search_v6 = [ + ['oifname { "eth0", "eth0.20", "eth3.20", "eth3.20.40" }', 'counter packets', 'jump VZONE_ZONE1'], + ['oifname { "vti1", "vti2" }', 'counter packets', 'jump VZONE_ZONE2'], + ] + self.verify_nftables(nftables_search, 'ip vyos_filter') + self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + def test_zone_without_member(self): self.cli_set(['firewall', 'zone', 'wan', 'default-action', 'drop']) error_message = 'Zone "wan" has no interfaces and is not the local zone' -- cgit v1.2.3