From a57dd68ed40ec77ba0a0fc5a2c641fe344fc0570 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 11 Aug 2026 20:32:52 +0200 Subject: xml: T9179: reject VRF names in interface-name constraint Tab completion for source-interface and other interface leafNodes already excludes VRF names, but the shared interface-name constraint accepted them anyway: an existing VRF is a real net device, so it passed the file-path existence check even though it failed the interface-name regex. Replace the file-path validator with a new interface-exists validator that requires the value to both exist under /sys/class/net and not be a VRF. The regex-match fallback is unchanged, so dynamic interfaces (e.g. pppoe) referenced before they exist still validate correctly. --- src/validators/interface-exists | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100755 src/validators/interface-exists (limited to 'src') diff --git a/src/validators/interface-exists b/src/validators/interface-exists new file mode 100755 index 000000000..d78247e1b --- /dev/null +++ b/src/validators/interface-exists @@ -0,0 +1,40 @@ +#!/bin/sh +# +# Copyright (C) VyOS Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# Passes only if $1 is a net device that exists on the system and is not a +# VRF. Used as a fallback alongside a naming-pattern regex, so a currently +# existing device is accepted as a physical/logical interface only if it is +# not a VRF (VRFs are real net devices but must never be accepted where an +# interface is expected). + +case "$1" in + ""|.|..|*/*) + echo "Error: $1 does not exist" + exit 1 + ;; +esac + +if [ ! -d "/sys/class/net/$1" ]; then + echo "Error: $1 does not exist" + exit 1 +fi + +if ip vrf show "$1" >/dev/null 2>&1; then + echo "Error: $1 is a VRF, not a network interface" + exit 1 +fi + +exit 0 -- cgit v1.2.3 From e31c2f6e816a70ae246ab04e07db745a3af31249 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 17 Aug 2026 13:32:42 +0200 Subject: flow-accounting: T9179: remove checks for source-interface is a VRF Checks ar enow handled generally in the CLI interface validation logic. --- smoketest/scripts/cli/test_system_flow-accounting.py | 7 ++----- src/conf_mode/system_flow-accounting.py | 12 ------------ 2 files changed, 2 insertions(+), 17 deletions(-) (limited to 'src') diff --git a/smoketest/scripts/cli/test_system_flow-accounting.py b/smoketest/scripts/cli/test_system_flow-accounting.py index d2d3e87f2..a98fe917f 100755 --- a/smoketest/scripts/cli/test_system_flow-accounting.py +++ b/smoketest/scripts/cli/test_system_flow-accounting.py @@ -278,12 +278,9 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase): # A source-interface that names a VRF is not an interface and must be # rejected - self.cli_set( - base_path - + ['netflow', 'server', '198.51.100.9', 'source-interface', vrf_name] - ) with self.assertRaises(ConfigSessionError): - self.cli_commit() + self.cli_set(base_path + ['netflow', 'server', '198.51.100.9', + 'source-interface', vrf_name]) self.cli_delete(base_path + ['netflow', 'server', '198.51.100.9']) self.cli_delete(['interfaces', 'dummy', dummy_if]) diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py index eb728571f..3eafa101c 100755 --- a/src/conf_mode/system_flow-accounting.py +++ b/src/conf_mode/system_flow-accounting.py @@ -25,9 +25,7 @@ from vyos.config import config_dict_merge from vyos.configverify import verify_vrf from vyos.configverify import verify_interface_exists from vyos.template import render -from vyos.utils.dict import dict_search from vyos.utils.file import read_file -from vyos.utils.network import get_interface_config from vyos.utils.network import get_interface_vrf from vyos.utils.network import interface_exists from vyos.utils.network import is_addr_assigned @@ -121,16 +119,6 @@ def verify(flow_config): verify_interface_exists( flow_config, data['source_interface'], warning_only=True ) - # A VRF is not an interface. Cisco and Juniper both source a flow - # exporter from a routed interface and never from a VRF, and VRF - # export is already selected with "system flow-accounting vrf", so - # reject a source-interface that names a VRF device. - source_interface_config = get_interface_config(data['source_interface']) - if dict_search('linkinfo.info_kind', source_interface_config) == 'vrf': - raise ConfigError( - f'Configured "netflow server {server} source-interface ' - f'{data["source_interface"]}" is a VRF, not an interface!' - ) # A source-interface used together with a VRF must be a member of # that VRF, otherwise the exported flows would silently leave via a # different routing table. Due to the VyOS priorities the interface -- cgit v1.2.3