T7832: Add support for assigning ACLs on subinterfaces

[inetman28]

Change summary

Support assigning ACLs to subinterfaces (e.g., eth0.100, eth5.200)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T7832

Related PR(s)

How to test / Smoketest result

set interfaces ethernet eth2 vif 1000 address '172.16.0.251/24'
set vpp settings interface eth2 driver 'dpdk'
set vpp settings interface eth2 rx-mode 'polling'
set vpp acl ip tag-name drop-all rule 1000 action 'deny'
set vpp acl ip interface eth2.1000 input acl-tag 100 tag-name 'drop-all'

vyos# commit

vyos@vyos# run show vpp acl ip interface 
Interface    Input ACLs    Output ACLs
-----------  ------------  -------------
eth2.1000     drop-all 
[edit]
vyos@vyos#

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

❌
PR title does not match the required format

[inetman28]

I have read the CLA Document and I hereby sign the CLA

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests VPP 👍 passed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• Config tests VPP 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed

[zdc]

Thank you for the contribution! This feature expansion would indeed be very useful, but it requires a bit more code to function properly.

In this specific case, simply relaxing the protection is not sufficient.

There is a critical distinction between Ethernet and all other interfaces in this context. Ethernet has two key characteristics:

• It cannot be removed from the system while it is running (with rare exceptions, which we can disregard here).
• VPP configures it at a very early stage, ensuring that there is never a situation where an Ethernet interface is configured in VPP but not properly connected to it.

This does not apply to other interfaces. For example:

1. Configure your example configuration.
2. Remove a VLAN from the Ethernet configuration.
3. Re-add the same VLAN.

The configuration may appear valid, but the ACL will not be applied to the interface anymore.

To ensure this works correctly, you must also establish the proper connection between VLANs and VPP ACLs.

[natali-rs1985]

We have a function that rertieves interfaces along with their sub-interfaces:
https://github.com/vyos/vyos-1x/blob/current/python/vyos/vpp/utils.py#L104
You can use the cli_ethernet_with_vifs_ifaces() function instead of cli_ifaces_list() when you specifically need all available sub-interfaces (such as for assigning ACLs)