Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vrf: T6602: verify supplied VRF name on all interface types #3856

Merged
merged 1 commit into from
Jul 24, 2024

Conversation

c-po
Copy link
Member

@c-po c-po commented Jul 23, 2024

Change Summary

Only some (e.g. ethernet or wireguard) interfaces validate if the supplied VRF actually exists. If this is not validated, one can pass an invalid VRF to the system which generates an OSError exception.

To reproduce

set interfaces vxlan vxlan1 vni 1000
set interfaces vxlan vxlan1 remote 1.2.3.4
set interfaces vxlan vxlan1 vrf smoketest

results in

OSError: [Errno 255] failed to run command: ip link set dev vxlan1 master smoketest_mgmt

This commit adds the missing verify_vrf() call to the missing interface types and an appropriate smoketest for all interfaces supporting VRF assignment.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

Related PR(s)

Component(s) name

Proposed changes

How to test

Smoketest result

cpo@LR2.wue3:~$ /usr/libexec/vyos/tests/smoke/cli/test_interfaces_l2tpv3.py
test_add_multiple_ip_addresses (__main__.L2TPv3InterfaceTest.test_add_multiple_ip_addresses) ... ok
test_add_single_ip_address (__main__.L2TPv3InterfaceTest.test_add_single_ip_address) ... ok
test_add_to_invalid_vrf (__main__.L2TPv3InterfaceTest.test_add_to_invalid_vrf) ... ok <- NEW TESTCASE
test_dhcp_client_options (__main__.L2TPv3InterfaceTest.test_dhcp_client_options) ... skipped 'not supported'
test_dhcp_disable_interface (__main__.L2TPv3InterfaceTest.test_dhcp_disable_interface) ... skipped 'not supported'
test_dhcp_vrf (__main__.L2TPv3InterfaceTest.test_dhcp_vrf) ... skipped 'not supported'
test_dhcpv6_client_options (__main__.L2TPv3InterfaceTest.test_dhcpv6_client_options) ... skipped 'not supported'
test_dhcpv6_vrf (__main__.L2TPv3InterfaceTest.test_dhcpv6_vrf) ... skipped 'not supported'
test_dhcpv6pd_auto_sla_id (__main__.L2TPv3InterfaceTest.test_dhcpv6pd_auto_sla_id) ... skipped 'not supported'
test_dhcpv6pd_manual_sla_id (__main__.L2TPv3InterfaceTest.test_dhcpv6pd_manual_sla_id) ... skipped 'not supported'
test_interface_description (__main__.L2TPv3InterfaceTest.test_interface_description) ... ok
test_interface_disable (__main__.L2TPv3InterfaceTest.test_interface_disable) ... ok
test_interface_ip_options (__main__.L2TPv3InterfaceTest.test_interface_ip_options) ... ok
test_interface_ipv6_options (__main__.L2TPv3InterfaceTest.test_interface_ipv6_options) ... ok
test_interface_mtu (__main__.L2TPv3InterfaceTest.test_interface_mtu) ... ok
test_ipv6_link_local_address (__main__.L2TPv3InterfaceTest.test_ipv6_link_local_address) ... ok
test_move_interface_between_vrf_instances (__main__.L2TPv3InterfaceTest.test_move_interface_between_vrf_instances) ... ok
test_mtu_1200_no_ipv6_interface (__main__.L2TPv3InterfaceTest.test_mtu_1200_no_ipv6_interface) ... ok
test_span_mirror (__main__.L2TPv3InterfaceTest.test_span_mirror) ... skipped 'not supported'
test_vif_8021q_interfaces (__main__.L2TPv3InterfaceTest.test_vif_8021q_interfaces) ... skipped 'not supported'
test_vif_8021q_lower_up_down (__main__.L2TPv3InterfaceTest.test_vif_8021q_lower_up_down) ... skipped 'not supported'
test_vif_8021q_mtu_limits (__main__.L2TPv3InterfaceTest.test_vif_8021q_mtu_limits) ... skipped 'not supported'
test_vif_8021q_qos_change (__main__.L2TPv3InterfaceTest.test_vif_8021q_qos_change) ... skipped 'not supported'
test_vif_s_8021ad_vlan_interfaces (__main__.L2TPv3InterfaceTest.test_vif_s_8021ad_vlan_interfaces) ... skipped 'not supported'
test_vif_s_protocol_change (__main__.L2TPv3InterfaceTest.test_vif_s_protocol_change) ... skipped 'not supported'

----------------------------------------------------------------------
Ran 25 tests in 42.808s

OK (skipped=14)

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

Only some (e.g. ethernet or wireguard) interfaces validate if the supplied VRF
actually exists. If this is not validated, one can pass an invalid VRF to the
system which generates an OSError exception.

To reproduce

set interfaces vxlan vxlan1 vni 1000
set interfaces vxlan vxlan1 remote 1.2.3.4
set interfaces vxlan vxlan1 vrf smoketest

results in

OSError: [Errno 255] failed to run command: ip link set dev vxlan1 master smoketest_mgmt

This commit adds the missing verify_vrf() call to the missing interface types
and an appropriate smoketest for all interfaces supporting VRF assignment.
@c-po c-po requested a review from a team as a code owner July 23, 2024 17:10
@c-po
Copy link
Member Author

c-po commented Jul 23, 2024

@Mergifyio backport sagitta circinus

Copy link

github-actions bot commented Jul 23, 2024

👍
No issues in PR Title / Commit Title

Copy link
Contributor

mergify bot commented Jul 23, 2024

backport sagitta circinus

✅ Backports have been created

Copy link

👍
No issues in unused-imports

Copy link

CI integration ❌ failed!

Details

CI logs

  • CLI Smoketests ❌ failed
  • Config tests 👍 passed
  • RAID1 tests 👍 passed

@c-po c-po enabled auto-merge July 24, 2024 12:09
@c-po c-po merged commit dea5d45 into vyos:current Jul 24, 2024
14 of 15 checks passed
c-po added a commit that referenced this pull request Jul 25, 2024
vrf: T6602: verify supplied VRF name on all interface types (backport #3856)
@c-po c-po deleted the verify-vrf branch July 25, 2024 06:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

3 participants