T6265: firewall: allow only ethernet interfaces to flowtables.

[nicolas-fort]

Change Summary

Allow only ethernet interfaces to flowtables.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6265

Related PR(s)

Component(s) name

firewall

Proposed changes

How to test

vyos@ftables# set firewall flowtable ft01 interface eth1
[edit]
vyos@ftables# commit
[edit]
vyos@ftables# set firewall flowtable ft02 interface 
Possible completions:
   <text>               Interfaces to use this flowtable
   eth0                 
   eth1                 
   eth2                 
   eth3                 
   lo                   

      
[edit]
vyos@ftables# set firewall flowtable ft02 interface br0

  
  
  Only ethernet and loopback interfaces are allowed in flowtables
  Value validation failed
  Set failed

[edit]
vyos@ftables# 

Example of migration:

root@latest:/home/vyos# show config comm | grep flowt
set firewall flowtable ft01 interface 'br0'
set firewall flowtable ft01 interface 'eth2'
set firewall flowtable ft01 interface 'eth3.33'
set firewall flowtable ft02 interface 'eth1'
set firewall flowtable ft03 interface 'lo'
set firewall flowtable ft04 interface 'eth0'
set firewall flowtable ft04 interface 'eth3'
set firewall flowtable ft05 interface 'vti0'
root@latest:/home/vyos# ./mig-test.sh config.boot
root@latest:/home/vyos# vyos-config-to-commands config.boot | grep flowt
set firewall flowtable ft01 interface 'eth2'
set firewall flowtable ft02 interface 'eth1'
set firewall flowtable ft03 interface 'lo'
set firewall flowtable ft04 interface 'eth0'
set firewall flowtable ft04 interface 'eth3'
set firewall flowtable ft05 interface 'lo'
root@latest:/home/vyos# 

Smoketest result

test_firewall.py --> OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[nicolas-fort]

Changing it to draft as more checks are needed

[nvollmar]

Not sure how it is handled in VyOS, but on my other Debian based systems ethernet NICs may also end up as enoX (ocp slots) or enpXsY (pci slots). ensX or enxMACADR are also possible on systemd.