Migration: MWAN policy issues with long and similar names

[francio87]

When migrating NethSecurity 7.9 to version 8, if there are two similar red interface names (e.g., timenet_ftth_12345 and timenet_fttc_212345), the process fails to correctly reassign the WAN zone to devices.

Steps to reproduce

Configure two WAN interfaces with similar names, such as timenet_ftth_12345 and timenet_fttc_12345.
Perform a migration to version 8 on the system.

Expected behavior

The system correctly reassigns the WAN zone to devices without errors.

Actual behavior

The system fails to reassign the WAN zone to devices.

The problem is that the name of the interface used inside the firewall db does not match with the named used inside the network db.

Value saved inside the network db:

    config interface 'timenet_ftth_1'
        option proto 'static'

Value saved inside 'firewall' db:

    config zone 'ns_wan'
        option name 'wan'
        option output 'ACCEPT'
        option input 'DROP'
        option forward 'REJECT'
        list network 'timenet_ftth_12345'

Also, the following unrelated error appears in the migration.log:

/usr/share/ns-migration/20wan /tmp/tmp.mMNElB/export
Command failed: Not found
Traceback (most recent call last):
  File "/usr/share/ns-migration/20wan", line 89, in <module>
    mwan.store_policy(u, f'{pname[0:6]}_only', [i])
  File "/usr/lib/python3.11/site-packages/nethsec/mwan/__init__.py", line 257, in store_policy
nethsec.utils.ValidationError: ('name', 'unique', 'timene_only')

Components
NethSecurity version: 8-23.05.5-ns.1.4.1

See also

• https://helpdesk.nethesis.it/a/tickets/185263

[Tbaile]

NS7: Using nethserver-firewall-migration-1.0.3-1.1.pr57.g60a838f.ns7.noarch.rpm check that exported network entries don't have labels but roles in the interface field.

NSec8: Using the image provided, check that ingesting a migration is successful and ensure no single network policy in MWAN is created.

[github-actions]

Testing image version: 8-24.10.0-ns.1.4.99-alpha1-9-g6f17bcc3

[francio87]

TC1 NS79 OK

{
  "snats": [],
  "forwardings": [],
  "bonds": [],
  "devices": {
    "52:54:00:16:d0:92": "eth0",
    "52:54:00:ed:96:94": "eth1",
    "52:54:00:e8:d1:bd": "eth2",
    "52:54:00:2c:96:5d": "eth3"
  },
  "skipped": [],
  "bridges": [],
  "zones": [
    {
      "network": [
        "wan1",
        "wan2",
        "wan3"
      ],
      "input": "DROP",
      "forward": "REJECT",
      "name": "wan",
      "output": "ACCEPT"
    },
    {
      "network": [
        "lan1"
      ],
      "input": "ACCEPT",
      "forward": "ACCEPT",
      "name": "lan",
      "output": "ACCEPT"
    }
  ],
  "vlans": [],
  "interfaces": [
    {
      "proto": "static",
      "zone": "lan",
      "name": "eth0",
      "hwaddr": "52:54:00:16:d0:92",
      "interface": "lan1",
      "netmask": "255.255.255.0",
      "role": "green",
      "ipaddr": "10.65.50.254"
    },
    {
      "proto": "static",
      "gateway": "192.168.122.1",
      "zone": "wan",
      "name": "eth1",
      "hwaddr": "52:54:00:ed:96:94",
      "bandwidth_up": "",
      "bandwidth_down": "",
      "interface": "wan1",
      "netmask": "255.255.255.0",
      "role": "red",
      "ipaddr": "192.168.122.166"
    },
    {
      "proto": "static",
      "gateway": "192.168.5.254",
      "zone": "wan",
      "name": "eth2",
      "hwaddr": "52:54:00:e8:d1:bd",
      "bandwidth_up": "",
      "bandwidth_down": "",
      "interface": "wan2",
      "netmask": "255.255.255.0",
      "role": "red",
      "ipaddr": "192.168.5.1"
    },
    {
      "proto": "static",
      "gateway": "192.168.6.254",
      "zone": "wan",
      "name": "eth3",
      "hwaddr": "52:54:00:2c:96:5d",
      "bandwidth_up": "",
      "bandwidth_down": "",
      "interface": "wan3",
      "netmask": "255.255.255.0",
      "role": "red",
      "ipaddr": "192.168.6.1"
    }
  ],
  "aliases": []
}

TC2 NSec8 OK

The migration is successful , no single policy are created in MWAN.

root@ns79:~# mwan3 status  
Interface status:
 interface wan1 is online and tracking is active (online 00h:01m:59s, uptime 00h:02m:02s)
 interface wan2 is offline and tracking is active
 interface wan3 is offline and tracking is active

Current ipv4 policies:
ns_ns7balance:
 wan1 (100%)

Current ipv6 policies:
ns_ns7balance:
 default