T4072: change same helpers in xml definitions; add notrack action for…

… prerouting chain; re introduce <set vrf> in policy; change global options for passing traffic to IPvX firewall; update smoketest

data/templates/firewall/sysctl-firewall.conf.j2

@@ -13,9 +13,9 @@ net.ipv4.conf.*.send_redirects = {{ 1 if global_options.send_redirects == 'enabl
 net.ipv4.tcp_syncookies = {{ 1 if global_options.syn_cookies == 'enable' else 0 }}
 net.ipv4.tcp_rfc1337 = {{ 1 if global_options.twa_hazards_protection == 'enable' else 0 }}
 
-{% if global_options.apply_for_bridge is vyos_defined %}
-net.bridge.bridge-nf-call-iptables = {{ 1 if global_options.apply_for_bridge.ipv4 is vyos_defined else 0 }}
-net.bridge.bridge-nf-call-ip6tables = {{ 1 if global_options.apply_for_bridge.ipv6 is vyos_defined else 0 }}
+{% if global_options.apply_to_bridged_traffic is vyos_defined %}
+net.bridge.bridge-nf-call-iptables = {{ 1 if global_options.apply_to_bridged_traffic.ipv4 is vyos_defined else 0 }}
+net.bridge.bridge-nf-call-ip6tables = {{ 1 if global_options.apply_to_bridged_traffic.ipv6 is vyos_defined else 0 }}
 {% else %}
 net.bridge.bridge-nf-call-iptables = 0
 net.bridge.bridge-nf-call-ip6tables = 0

interface-definitions/include/firewall/bridge-custom-name.xml.i

@@ -32,6 +32,7 @@
       </properties>
       <children>
         #include <include/firewall/common-rule-bridge.xml.i>
+        #include <include/firewall/action-l2.xml.i>
         #include <include/firewall/connection-mark.xml.i>
         #include <include/firewall/connection-status.xml.i>
         #include <include/firewall/state.xml.i>

interface-definitions/include/firewall/bridge-hook-forward.xml.i

@@ -26,6 +26,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-bridge.xml.i>
+            #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
             #include <include/firewall/state.xml.i>

interface-definitions/include/firewall/bridge-hook-input.xml.i

@@ -26,6 +26,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-bridge.xml.i>
+            #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
             #include <include/firewall/state.xml.i>

interface-definitions/include/firewall/bridge-hook-output.xml.i

@@ -26,6 +26,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-bridge.xml.i>
+            #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
             #include <include/firewall/state.xml.i>

interface-definitions/include/firewall/bridge-hook-prerouting.xml.i

@@ -14,7 +14,7 @@
         #include <include/generic-description.xml.i>
         <tagNode name="rule">
           <properties>
-            <help>Bridge Firewall prerouting filter rule number</help>
+            <help>Bridge firewall prerouting filter rule number</help>
             <valueHelp>
               <format>u32:1-999999</format>
               <description>Number for this firewall rule</description>
@@ -26,7 +26,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-bridge.xml.i>
-            #include <include/firewall/set-packet-modifications.xml.i>
+            #include <include/firewall/action-and-notrack.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
           </children>
         </tagNode>

interface-definitions/include/firewall/common-rule-bridge.xml.i

@@ -1,7 +1,6 @@
 <!-- include start from firewall/common-rule-bridge.xml.i -->
 #include <include/generic-description.xml.i>
 #include <include/generic-disable-node.xml.i>
-#include <include/firewall/action-l2.xml.i>
 #include <include/firewall/dscp.xml.i>
 #include <include/firewall/firewall-mark.xml.i>
 #include <include/firewall/fragment.xml.i>

interface-definitions/include/firewall/global-options.xml.i

@@ -44,7 +44,7 @@
       </properties>
       <defaultValue>disable</defaultValue>
     </leafNode>
-    <node name="apply-for-bridge">
+    <node name="apply-to-bridged-traffic">
       <properties>
         <help>Apply configured firewall rules to traffic switched by bridges</help>
       </properties>

interface-definitions/include/firewall/set-packet-modifications.xml.i

@@ -6,10 +6,10 @@
   <children>
     <leafNode name="connection-mark">
       <properties>
-        <help>Connection marking</help>
+        <help>Set connection mark</help>
         <valueHelp>
           <format>u32:0-2147483647</format>
-          <description>Connection marking</description>
+          <description>Connection mark</description>
         </valueHelp>
         <constraint>
           <validator name="numeric" argument="--range 0-2147483647"/>
@@ -18,7 +18,7 @@
     </leafNode>
     <leafNode name="dscp">
       <properties>
-        <help>Packet Differentiated Services Codepoint (DSCP)</help>
+        <help>Set DSCP (Packet Differentiated Services Codepoint) bits</help>
         <valueHelp>
           <format>u32:0-63</format>
           <description>DSCP number</description>
@@ -30,10 +30,10 @@
     </leafNode>
     <leafNode name="mark">
       <properties>
-        <help>Packet marking</help>
+        <help>Set packet mark</help>
         <valueHelp>
           <format>u32:1-2147483647</format>
-          <description>Packet marking</description>
+          <description>Packet mark</description>
         </valueHelp>
         <constraint>
           <validator name="numeric" argument="--range 1-2147483647"/>
@@ -42,7 +42,7 @@
     </leafNode>
     <leafNode name="table">
       <properties>
-        <help>Routing table to forward packet with</help>
+        <help>Set the routing table for matched packets</help>
         <valueHelp>
           <format>u32:1-200</format>
           <description>Table number</description>
@@ -61,9 +61,27 @@
         </completionHelp>
       </properties>
     </leafNode>
+    <leafNode name="vrf">
+      <properties>
+        <help>VRF to forward packet with</help>
+        <valueHelp>
+          <format>txt</format>
+          <description>VRF instance name</description>
+        </valueHelp>
+        <valueHelp>
+          <format>default</format>
+          <description>Forward into default global VRF</description>
+        </valueHelp>
+        <completionHelp>
+          <list>default</list>
+          <path>vrf name</path>
+        </completionHelp>
+        #include <include/constraint/vrf.xml.i>
+      </properties>
+    </leafNode>
     <leafNode name="tcp-mss">
       <properties>
-        <help>TCP Maximum Segment Size</help>
+        <help>Set TCP Maximum Segment Size</help>
         <valueHelp>
           <format>u32:500-1460</format>
           <description>Explicitly set TCP MSS value</description>

smoketest/scripts/cli/test_firewall.py

@@ -708,7 +708,7 @@ def test_bridge_firewall(self):
 
         self.cli_set(['firewall', 'group', 'ipv6-address-group', 'AGV6', 'address', '2001:db1::1'])
         self.cli_set(['firewall', 'global-options', 'state-policy', 'established', 'action', 'accept'])
-        self.cli_set(['firewall', 'global-options', 'apply-for-bridge', 'ipv4'])
+        self.cli_set(['firewall', 'global-options', 'apply-to-bridged-traffic', 'ipv4'])
 
         self.cli_set(['firewall', 'bridge', 'name', name, 'default-action', 'accept'])
         self.cli_set(['firewall', 'bridge', 'name', name, 'default-log'])
@@ -731,10 +731,9 @@ def test_bridge_firewall(self):
         self.cli_set(['firewall', 'bridge', 'input', 'filter', 'rule', '1', 'source', 'address', '192.0.2.2'])
         self.cli_set(['firewall', 'bridge', 'input', 'filter', 'rule', '1', 'state', 'new'])
 
-        self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'action', 'drop'])
+        self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'action', 'notrack'])
         self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'destination', 'group', 'ipv6-address-group', 'AGV6'])
 
-
         self.cli_commit()
 
         nftables_search = [
@@ -755,7 +754,7 @@ def test_bridge_firewall(self):
             ['ct state new', 'ip saddr 192.0.2.2', f'iifname "{interface_in}"', 'accept'],
             ['chain VYOS_PREROUTING_filter'],
             ['type filter hook prerouting priority filter; policy accept;'],
-            ['ip6 daddr @A6_AGV6', 'drop']
+            ['ip6 daddr @A6_AGV6', 'notrack']
         ]
 
         self.verify_nftables(nftables_search, 'bridge vyos_filter')

src/conf_mode/firewall.py

@@ -48,7 +48,12 @@
     'domain_group',
     'network_group',
     'port_group',
-    'interface_group'
+    'interface_group',
+    ## Added for group ussage in bridge firewall
+    'ipv4_address_group',
+    'ipv6_address_group',
+    'ipv4_network_group',
+    'ipv6_network_group'
 ]
 
 nested_group_types = [
@@ -129,7 +134,7 @@ def get_config(config=None):
 
     return firewall
 
-def verify_rule(firewall, rule_conf, ipv6):
+def verify_rule(firewall, family, chain, priority, rule_id, rule_conf):
     if 'action' not in rule_conf:
         raise ConfigError('Rule action must be defined')
 
@@ -140,12 +145,8 @@ def verify_rule(firewall, rule_conf, ipv6):
         if 'jump' not in rule_conf['action']:
             raise ConfigError('jump-target defined, but action jump needed and it is not defined')
         target = rule_conf['jump_target']
-        if not ipv6:
-            if target not in dict_search_args(firewall, 'ipv4', 'name'):
-                raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
-        else:
-            if target not in dict_search_args(firewall, 'ipv6', 'name'):
-                raise ConfigError(f'Invalid jump-target. Firewall ipv6 name {target} does not exist on the system')
+        if target not in dict_search_args(firewall, family, 'name'):
+                raise ConfigError(f'Invalid jump-target. Firewall {family} name {target} does not exist on the system')
 
     if rule_conf['action'] == 'offload':
         if 'offload_target' not in rule_conf:
@@ -205,9 +206,9 @@ def verify_rule(firewall, rule_conf, ipv6):
                 raise ConfigError(f'Cannot match a tcp flag as set and not set')
 
     if 'protocol' in rule_conf:
-        if rule_conf['protocol'] == 'icmp' and ipv6:
+        if rule_conf['protocol'] == 'icmp' and family == 'ipv6':
             raise ConfigError(f'Cannot match IPv4 ICMP protocol on IPv6, use ipv6-icmp')
-        if rule_conf['protocol'] == 'ipv6-icmp' and not ipv6:
+        if rule_conf['protocol'] == 'ipv6-icmp' and family == 'ipv4':
             raise ConfigError(f'Cannot match IPv6 ICMP protocol on IPv4, use icmp')
 
     for side in ['destination', 'source']:
@@ -225,7 +226,18 @@ def verify_rule(firewall, rule_conf, ipv6):
                     if group in side_conf['group']:
                         group_name = side_conf['group'][group]
 
-                        fw_group = f'ipv6_{group}' if ipv6 and group in ['address_group', 'network_group'] else group
+                        if family == 'ipv6' and group in ['address_group', 'network_group']:
+                            fw_group = f'ipv6_{group}'
+                        elif family == 'bridge':
+                            if group =='ipv4_address_group':
+                                fw_group = 'address_group'
+                            elif group == 'ipv4_network_group':
+                                fw_group = 'network_group'
+                            else:
+                                fw_group = group
+                        else:
+                            fw_group = group
+
                         error_group = fw_group.replace("_", "-")
 
                         if group in ['address_group', 'network_group', 'domain_group']:
@@ -261,7 +273,7 @@ def verify_rule(firewall, rule_conf, ipv6):
                     raise ConfigError(f'Dynamic address group must be defined.')
                 else:
                     target = rule_conf['add_address_to_group'][type]['address_group']
-                    fwall_group = 'ipv6_address_group' if ipv6 else 'address_group'
+                    fwall_group = 'ipv6_address_group' if family == 'ipv6' else 'address_group'
                     group_obj = dict_search_args(firewall, 'group', 'dynamic_group', fwall_group, target)
                     if group_obj is None:
                             raise ConfigError(f'Invalid dynamic address group on firewall rule')
@@ -338,47 +350,25 @@ def verify(firewall):
                 for group_name, group in groups.items():
                     verify_nested_group(group_name, group, groups, [])
 
-    if 'ipv4' in firewall:
-        for name in ['name','forward','input','output', 'prerouting']:
-            if name in firewall['ipv4']:
-                for name_id, name_conf in firewall['ipv4'][name].items():
-                    if 'jump' in name_conf['default_action'] and 'default_jump_target' not in name_conf:
-                        raise ConfigError('default-action set to jump, but no default-jump-target specified')
-                    if 'default_jump_target' in name_conf:
-                        target = name_conf['default_jump_target']
-                        if 'jump' not in name_conf['default_action']:
-                            raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
-                        if name_conf['default_jump_target'] == name_id:
-                            raise ConfigError(f'Loop detected on default-jump-target.')
-                        ## Now need to check that default-jump-target exists (other firewall chain/name)
-                        if target not in dict_search_args(firewall['ipv4'], 'name'):
-                            raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
-
-                    if 'rule' in name_conf:
-                        for rule_id, rule_conf in name_conf['rule'].items():
-                            verify_rule(firewall, rule_conf, False)
-
-    if 'ipv6' in firewall:
-        for name in ['name','forward','input','output', 'prerouting']:
-            if name in firewall['ipv6']:
-                for name_id, name_conf in firewall['ipv6'][name].items():
-                    if 'jump' in name_conf['default_action'] and 'default_jump_target' not in name_conf:
-                        raise ConfigError('default-action set to jump, but no default-jump-target specified')
-                    if 'default_jump_target' in name_conf:
-                        target = name_conf['default_jump_target']
-                        if 'jump' not in name_conf['default_action']:
-                            raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
-                        if name_conf['default_jump_target'] == name_id:
-                            raise ConfigError(f'Loop detected on default-jump-target.')
-                        ## Now need to check that default-jump-target exists (other firewall chain/name)
-                        if target not in dict_search_args(firewall['ipv6'], 'name'):
-                            raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
-
-                    if 'rule' in name_conf:
-                        for rule_id, rule_conf in name_conf['rule'].items():
-                            verify_rule(firewall, rule_conf, True)
-
-    #### ZONESSSS
+    for family in ['ipv4', 'ipv6', 'bridge']:
+        if family in firewall:
+            for chain in ['name','forward','input','output', 'prerouting']:
+                if chain in firewall[family]:
+                    for priority, priority_conf in firewall[family][chain].items():
+                        if 'jump' in priority_conf['default_action'] and 'default_jump_target' not in priority_conf:
+                            raise ConfigError('default-action set to jump, but no default-jump-target specified')
+                        if 'default_jump_target' in priority_conf:
+                            target = priority_conf['default_jump_target']
+                            if 'jump' not in priority_conf['default_action']:
+                                raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
+                            if priority_conf['default_jump_target'] == priority:
+                                raise ConfigError(f'Loop detected on default-jump-target.')
+                            if target not in dict_search_args(firewall[family], 'name'):
+                                raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
+                        if 'rule' in priority_conf:
+                            for rule_id, rule_conf in priority_conf['rule'].items():
+                                verify_rule(firewall, family, chain, priority, rule_id, rule_conf)
+
     local_zone = False
     zone_interfaces = []