From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001 From: David Vølker Date: Mon, 1 Jun 2026 08:09:06 +0200 Subject: firewall: T8761: re-introduce VRF interface names in generated firewall config This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig --- src/conf_mode/firewall.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/conf_mode/firewall.py') diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index 4b6a4d272..29181b4ef 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -142,7 +142,9 @@ def get_config(config=None): if 'vrf' in local_zone_member: local_zone_conf['vrf_interfaces'] = {} for vrf_name in local_zone_member['vrf']: - local_zone_conf['vrf_interfaces'][vrf_name] = ','.join(get_vrf_members(vrf_name)) + local_zone_conf['vrf_interfaces'][vrf_name] = get_vrf_members( + vrf_name + ) continue local_zone_conf['from_local'] = {} -- cgit v1.2.3