Page MenuHomeVyOS Platform

Incorrect validation of ports in VPP ACLs
Closed, ResolvedPublicBUG

Description

Config allows this command but commit produces an error

vyos@vyos# set vpp acl ip tag-name ssh rule 10 destination port ssh
[edit]
vyos@vyos# comp
[vpp]
+ acl {
+     ip {
+         interface eth4 {
+             input {
+                 acl-tag 10 {
+                     tag-name "ssh"
+                 }
+             }
+         }
+         tag-name ssh {
+             rule 10 {
+                 action "deny"
+                 destination {
+                     port "ssh"
+                 }
+             }
+         }
+     }
+ }

[edit]
vyos@vyos# commit
[ vpp acl ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/vpp_acl.py", line 397, in <module>
    apply(c)
  File "/usr/libexec/vyos/conf_mode/vpp_acl.py", line 364, in apply
    rules = create_ip_rules_list(
            ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/conf_mode/vpp_acl.py", line 107, in create_ip_rules_list
    dst_first_port, dst_last_port = get_port_first_last(
                                    ^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/conf_mode/vpp_acl.py", line 75, in get_port_first_last
    return int(first_port), int(last_port)
           ^^^^^^^^^^^^^^^
ValueError: invalid literal for int() with base 10: 'ssh'

[[vpp acl]] failed
Commit failed

Details

Version
2025.11.14-0020-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)