firewall: T7112: Default action drop fails

Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.

2 files changed, 12 insertions, 2 deletions

diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index bc9900557..c29471b63 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -1086,6 +1086,15 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         self.verify_nftables(nftables_search, 'ip vyos_filter')
         self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter')
 
+    def test_zone_without_member(self):
+        self.cli_set(['firewall', 'zone', 'wan', 'default-action', 'drop'])
+        error_message = 'Zone "wan" has no interfaces and is not the local zone'
+        with self.assertRaisesRegex(ConfigSessionError, error_message):
+            self.cli_commit()
+
+        self.cli_set(['firewall', 'zone', 'wan', 'member', 'interface', 'eth1'])
+        self.cli_commit()
+
     def test_wildcard_interfaces(self):
         wc_interfaces = [
             'eth0',
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 6630b811d..4a4212a0f 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -146,9 +146,10 @@ def get_config(config=None):
         for local_zone, local_zone_conf in firewall['zone'].items():
             if 'local_zone' not in local_zone_conf:
                 # Get physical interfaces assigned to the zone if vrf is used:
-                if 'vrf' in local_zone_conf['member']:
+                local_zone_member = local_zone_conf.get('member', {})
+                if 'vrf' in local_zone_member:
                     local_zone_conf['vrf_interfaces'] = {}
-                    for vrf_name in local_zone_conf['member']['vrf']:
+                    for vrf_name in local_zone_member['vrf']:
                         local_zone_conf['vrf_interfaces'][vrf_name] = ','.join(get_vrf_members(vrf_name))
                 continue