Page MenuHomeVyOS Platform

Firewall interface-group with a container interface fails validation on reboot
Closed, ResolvedPublicBUG

Description

Issue:
After adding a container interface, “pod-XX”, to a firewall interface group, it disappears from the group upon reboot. The following error is logged in /var/log/vyatta/vyos-boot-config-loader.log for all pod interfaces:

Value validation failed
Set ['firewall' 'group' 'interface-group' 'INT_GROUP' 'interface' 'pod-XX'] failed

Possible solution:

The issue appears to be related to an interface name validation constraint in the following definition:
Interface Name Constraint

To resolve this, the regular expression in interface-name.xml.i can be updated as follows:

Original:

<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|lo</regex>

to add pod-[-_a-zA-Z0-9]{1,11} from the constants of the container network.

Proposed:

<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|pod-[-_a-zA-Z0-9]{1,11}|lo</regex>

This modification ensures that the “pod-XX” container interface is preserved through reboots.

It appears that T6841 may have inadvertently introduced this change in behavior. T7144 appears to be related as well.

Details

Version
latest rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

Viacheslav triaged this task as Normal priority.Tue, Feb 18, 5:29 PM
Viacheslav subscribed.

@markh0338 Are you able to add a Pull Request?

Viacheslav changed the task status from Open to Needs testing.Thu, Feb 20, 8:21 AM
Viacheslav assigned this task to markh0338.
dmbaturin renamed this task from Firewall interface-group with container interface fails validation on reboot to Firewall interface-group with a container interface fails validation on reboot.Wed, Mar 12, 5:21 PM
dmbaturin closed this task as Resolved.
dmbaturin moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.2) board.
dmbaturin moved this task from Open to Finished on the VyOS 1.5 Circinus board.
dmbaturin moved this task from Need Triage to Completed on the VyOS Rolling board.