Change Details

The NAT64 "only one netfilter instance" check reads a mode node that does not exist, so it never fires. Location [[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/nat64.py#L82 | src/conf_mode/nat64.py:82, :105, :172 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/interface-definitions/nat64.xml.in | interface-definitions/nat64.xml.in ]] Problem `i.get('mode') == 'netfilter'` and` is_node_changed([..., 'instance-N', 'mode'])` reference keys that do not exist; generate() hard-codes framework: netfilter. Impact A second rule passes verify and fails inside apply after the first instance is created. Suggested fix Count all non-deleted rules (framework is always netfilter) and raise in verify.

The NAT64 "only one netfilter instance" check reads a mode node that does not exist, so it never fires. Location [[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/nat64.py#L82 | src/conf_mode/nat64.py:82, :105, :172 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/interface-definitions/nat64.xml.in | interface-definitions/nat64.xml.in ]] Problem `i.get('mode') == 'netfilter'` and `is_node_changed([..., 'instance-N', 'mode'])` reference keys that do not exist; generate() hard-codes framework: netfilter. Impact A second rule passes verify and fails inside apply after the first instance is created. Suggested fix Count all non-deleted rules (framework is always netfilter) and raise in verify.

The NAT64 "only one netfilter instance" check reads a mode node that does not exist, so it never fires. Location [[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/nat64.py#L82 | src/conf_mode/nat64.py:82, :105, :172 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/interface-definitions/nat64.xml.in | interface-definitions/nat64.xml.in ]] Problem `i.get('mode') == 'netfilter'` and` `is_node_changed([..., 'instance-N', 'mode'])` reference keys that do not exist; generate() hard-codes framework: netfilter. Impact A second rule passes verify and fails inside apply after the first instance is created. Suggested fix Count all non-deleted rules (framework is always netfilter) and raise in verify.