Merge pull request #4754 from natali-rs1985/T7815

T7815: VPP: NAT44 rules with port requires protocol specification and vice versa

2 files changed, 19 insertions, 0 deletions

diff --git a/smoketest/scripts/cli/test_vpp.py b/smoketest/scripts/cli/test_vpp.py
index 3cfc2a853..eb14fb2df 100755
--- a/smoketest/scripts/cli/test_vpp.py
+++ b/smoketest/scripts/cli/test_vpp.py
@@ -1323,6 +1323,13 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         self.cli_set(
             base_nat + ['exclude', 'rule', '100', 'local-port', exclude_local_port]
         )
+
+        # cannot set local-port without specifying protocol
+        # expect raise ConfigError
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        self.cli_set(base_nat + ['exclude', 'rule', '100', 'protocol', 'tcp'])
         self.cli_set(
             base_nat + ['static', 'rule', '100', 'external', 'address', static_ext_addr]
         )
diff --git a/src/conf_mode/vpp_nat.py b/src/conf_mode/vpp_nat.py
index 7c9fd2765..8d18aa1fe 100644
--- a/src/conf_mode/vpp_nat.py
+++ b/src/conf_mode/vpp_nat.py
@@ -257,6 +257,12 @@ def verify(config):
                     'both be specified, or neither must be specified'
                 )
 
+            # Either both protocol and ports are set, or both no protocol and no ports
+            if (rule_config['protocol'] != 'all') != has_local_port:
+                raise ConfigError(
+                    f'{error_msg} protocol and ports must either both be specified or both omitted'
+                )
+
             ext_address = rule_config['external']['address']
             port = rule_config['external'].get('port')
             local_address = rule_config['local']['address']
@@ -335,6 +341,12 @@ def verify(config):
                     f'{rule_config["external_interface"]} must be a VPP interface for exclude rule {rule}'
                 )
 
+            # Either both protocol and local-port are set, or both no protocol and no port
+            if (rule_config['protocol'] != 'all') != ('local_port' in rule_config):
+                raise ConfigError(
+                    f'Protocol and local-port must either both be specified or both omitted for exclude rule {rule}'
+                )
+
 
 def generate(config):
     pass