From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001 From: David Vølker Date: Mon, 1 Jun 2026 08:09:06 +0200 Subject: firewall: T8761: re-introduce VRF interface names in generated firewall config This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig --- src/conf_mode/interfaces_wireless.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'src/conf_mode/interfaces_wireless.py') diff --git a/src/conf_mode/interfaces_wireless.py b/src/conf_mode/interfaces_wireless.py index f7d4cd7c9..1ad16e816 100755 --- a/src/conf_mode/interfaces_wireless.py +++ b/src/conf_mode/interfaces_wireless.py @@ -25,6 +25,7 @@ from vyos.config import Config from vyos.configdep import set_dependents from vyos.configdep import call_dependents from vyos.configdict import get_interface_dict +from vyos.configdict import is_vrf_changed from vyos.configdict import dict_merge from vyos.configverify import verify_address from vyos.configverify import verify_bridge_delete @@ -92,7 +93,7 @@ def get_config(config=None): conf = Config() base = ['interfaces', 'wireless'] - _, wifi = get_interface_dict(conf, base) + ifname, wifi = get_interface_dict(conf, base) # retrieve global Wireless regulatory domain setting if conf.exists(country_code_path): @@ -145,6 +146,10 @@ def get_config(config=None): if 'static_arp' in wifi: set_dependents('static_arp', conf) + # Check vrf membership, to ensure firewall is updated + if is_vrf_changed(conf, ifname): + set_dependents('firewall', conf) + return wifi def verify(wifi): @@ -318,6 +323,9 @@ def apply(wifi): if 'deleted' in wifi: WiFiIf(**wifi).remove() + + # run the dependents and return + call_dependents() return None while (is_systemd_service_running(f'hostapd@{interface}.service') or \ @@ -393,8 +401,8 @@ def apply(wifi): elif wifi['type'] == 'station': call(f'systemctl start wpa_supplicant@{interface}.service') - if 'static_arp' in wifi: - call_dependents() + # run the dependents + call_dependents() return None -- cgit v1.2.3