T5804: nat: allow <any> interface for inbound and outbound

[nicolas-fort]

…

Change Summary

Allow interface for inbound and outbound interface name in vyos cli. When used, append nothing while generating the rule.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T5804

Related PR(s)

Component(s) name

nat

Proposed changes

How to test

vyos@nat-any:~$ show config comm | grep nat
set nat destination rule 10 destination address '2.2.2.2'
set nat destination rule 10 inbound-interface name 'eth2'
set nat destination rule 10 translation address '3.3.3.3'
set nat destination rule 20 destination address '8.8.8.8'
set nat destination rule 20 inbound-interface name 'any'
set nat destination rule 20 translation address '9.9.9.9'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 translation address 'masquerade'
set nat source rule 20 outbound-interface name 'any'
set nat source rule 20 translation address '1.1.1.1'
vyos@nat-any:~$ sudo nft list table ip vyos_nat
table ip vyos_nat {
        chain PREROUTING {
                type nat hook prerouting priority dstnat; policy accept;
                counter packets 129 bytes 30933 jump VYOS_PRE_DNAT_HOOK
                iifname "eth2" ip daddr 2.2.2.2 counter packets 0 bytes 0 dnat to 3.3.3.3 comment "DST-NAT-10"
                ip daddr 8.8.8.8 counter packets 0 bytes 0 dnat to 9.9.9.9 comment "DST-NAT-20"
        }

        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 2 bytes 152 jump VYOS_PRE_SNAT_HOOK
                oifname "eth0" counter packets 2 bytes 152 masquerade comment "SRC-NAT-10"
                counter packets 0 bytes 0 snat to 1.1.1.1 comment "SRC-NAT-20"
        }

        chain VYOS_PRE_DNAT_HOOK {
                return
        }

        chain VYOS_PRE_SNAT_HOOK {
                return
        }
}
vyos@nat-any:~$ 

Smoketest result

root@nat-any:/usr/libexec/vyos/tests/smoke/cli# ./test_nat.py 
test_dnat (__main__.TestNAT.test_dnat) ... ok
test_dnat_negated_addresses (__main__.TestNAT.test_dnat_negated_addresses) ... ok
test_dnat_redirect (__main__.TestNAT.test_dnat_redirect) ... ok
test_dnat_without_translation_address (__main__.TestNAT.test_dnat_without_translation_address) ... ok
test_nat_balance (__main__.TestNAT.test_nat_balance) ... ok
test_nat_no_rules (__main__.TestNAT.test_nat_no_rules) ... ok
test_snat (__main__.TestNAT.test_snat) ... ok
test_snat_groups (__main__.TestNAT.test_snat_groups) ... ok
test_snat_required_translation_address (__main__.TestNAT.test_snat_required_translation_address) ... 
Source NAT configuration error in rule 5: translation requires address
and/or port

ok
test_static_nat (__main__.TestNAT.test_static_nat) ... ok

----------------------------------------------------------------------
Ran 10 tests in 20.896s

OK
root@nat-any:/usr/libexec/vyos/tests/smoke/cli# 

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[dmbaturin]

I believe we should adjust the migration script to delete the interface option instead, now that any is the implicit default.

[c-po]

I believe we should adjust the migration script to delete the interface option instead, now that any is the implicit default.

Why not even make it an explicit default by using defaultValue any on the XML dedinition, users will then get notified this automatically when using tab completio

[nicolas-fort]

I believe we should adjust the migration script to delete the interface option instead, now that any is the implicit default.

Why not even make it an explicit default by using defaultValue any on the XML dedinition, users will then get notified this automatically when using tab completio

I would just go for updating migration script and do not support as an option, not even defualt value. Otherwise, looks like we should allow any for any other matchers as default: any protocol, any source address, any pakcet size, etc...
Any == do not use matcher.

[nicolas-fort]

I'll update PR on Monday. Moving to draft for now

[nicolas-fort]

I'm closing this one in favor of #2611, which just contains corrections to migration script