diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-11-05 10:21:10 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-11-05 10:30:31 +0300 |
| commit | 909780c13714bcba488467165494af84bc7262cf (patch) | |
| tree | 2c8ba9c2f88c69577fa9ff7d72cc7c2568dadc60 /smoketest/scripts/cli | |
| parent | cc60275ab0db2c45f2ad7387d6a91a96fa9d6337 (diff) | |
| download | vyos-1x-909780c13714bcba488467165494af84bc7262cf.tar.gz vyos-1x-909780c13714bcba488467165494af84bc7262cf.zip | |
firewall: T7112: Default action drop fails
Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.
Diffstat (limited to 'smoketest/scripts/cli')
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index bc9900557..c29471b63 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -1086,6 +1086,15 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + def test_zone_without_member(self): + self.cli_set(['firewall', 'zone', 'wan', 'default-action', 'drop']) + error_message = 'Zone "wan" has no interfaces and is not the local zone' + with self.assertRaisesRegex(ConfigSessionError, error_message): + self.cli_commit() + + self.cli_set(['firewall', 'zone', 'wan', 'member', 'interface', 'eth1']) + self.cli_commit() + def test_wildcard_interfaces(self): wc_interfaces = [ 'eth0', |