firewall: T7739: Default ruleset for firewall zones

[apschultz]

In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax:
set firewall zone default_firewall name
set firewall zone default_firewall ipv6_name

The proposed behavior is the following:

• local in:
  • The default firewall ruleset for the local zone will be appended after all from configurations.
• local out:
  • If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname
• forward:
  • The default firewall ruleset for the zone will be appended after all from configurations

To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset.

The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules.

Change summary

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T7739

Related PR(s)

How to test / Smoketest result

Added additional firewall smoketest case to validate. All smoke tests are passing.

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests VPP ❌ failed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• Config tests VPP 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed

[apschultz]

I have read the CLA Document and I hereby sign the CLA

[Copilot]

Pull Request Overview

This PR implements default firewall rulesets for firewall zones, allowing administrators to define fallback rules that apply when specific zone-to-zone rules are not configured. This simplifies management of large networks with many zones by reducing the need to explicitly configure rules between every zone pair.

Key changes:

• Adds default-firewall configuration syntax for zones with IPv4 and IPv6 ruleset options
• Implements logic to apply default rulesets when explicit zone-to-zone rules are absent
• Updates nftables templates to generate appropriate rules for default firewall behavior

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/conf_mode/firewall.py	Adds configuration parsing and validation for default firewall rulesets
interface-definitions/firewall.xml.in	Defines XML schema for new default-firewall configuration node
data/templates/firewall/nftables-zone.j2	Updates nftables template to generate rules for default firewall behavior
smoketest/scripts/cli/test_firewall.py	Adds comprehensive test case validating default firewall functionality

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The indentation uses tabs instead of spaces, which is inconsistent with the surrounding XML. The file appears to use 2-space indentation consistently elsewhere.

Suggested change

	<node name="default-firewall">
	<properties>
	<help>Default firewall options for traffic coming into this zone</help>
	</properties>
	<children>
	<leafNode name="ipv6-name">
	<properties>
	<help>IPv6 firewall ruleset</help>
	<completionHelp>
	<path>firewall ipv6 name</path>
	</completionHelp>
	</properties>
	</leafNode>
	<leafNode name="name">
	<properties>
	<help>IPv4 firewall ruleset</help>
	<completionHelp>
	<path>firewall ipv4 name</path>
	</completionHelp>
	</properties>
	</leafNode>
	</children>
	</node>
	<node name="default-firewall">
	<properties>
	<help>Default firewall options for traffic coming into this zone</help>
	</properties>
	<children>
	<leafNode name="ipv6-name">
	<properties>
	<help>IPv6 firewall ruleset</help>
	<completionHelp>
	<path>firewall ipv6 name</path>
	</completionHelp>
	</properties>
	</leafNode>
	<leafNode name="name">
	<properties>
	<help>IPv4 firewall ruleset</help>
	<completionHelp>
	<path>firewall ipv4 name</path>
	</completionHelp>
	</properties>
	</leafNode>
	</children>
	</node>

[Copilot]

The template uses double quotes around the VRF interface name, but other interface references in the template use bare names without quotes. This inconsistency could cause nftables syntax errors or unexpected behavior.