summaryrefslogtreecommitdiff
path: root/src/conf_mode/firewall.py
diff options
context:
space:
mode:
authorDaniil Baturin <daniil@vyos.io>2024-03-06 12:33:11 +0100
committerGitHub <noreply@github.com>2024-03-06 12:33:11 +0100
commit028fd9d9b40aa3dea7a2ea4a875468524d6f7a50 (patch)
treef8d8408218699612af43a0e074687ae36ddea559 /src/conf_mode/firewall.py
parentfb30b19e88e21f2ceaffcd4f2c20a5ebb2627d84 (diff)
parent3c0634e572ffdecaf24a9dac16678427f22761ab (diff)
downloadvyos-1x-028fd9d9b40aa3dea7a2ea4a875468524d6f7a50.tar.gz
vyos-1x-028fd9d9b40aa3dea7a2ea4a875468524d6f7a50.zip
Merge pull request #3088 from nicolas-fort/T6075
T6075: firewall and NAT: check if interface-group exists when using them in firewall|nat rules.
Diffstat (limited to 'src/conf_mode/firewall.py')
-rwxr-xr-xsrc/conf_mode/firewall.py9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index acb7dfa41..3c27655b0 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -282,6 +282,15 @@ def verify_rule(firewall, rule_conf, ipv6):
if direction in rule_conf:
if 'name' in rule_conf[direction] and 'group' in rule_conf[direction]:
raise ConfigError(f'Cannot specify both interface group and interface name for {direction}')
+ if 'group' in rule_conf[direction]:
+ group_name = rule_conf[direction]['group']
+ if group_name[0] == '!':
+ group_name = group_name[1:]
+ group_obj = dict_search_args(firewall, 'group', 'interface_group', group_name)
+ if group_obj is None:
+ raise ConfigError(f'Invalid interface group "{group_name}" on firewall rule')
+ if not group_obj:
+ Warning(f'interface-group "{group_name}" has no members!')
def verify_nested_group(group_name, group, groups, seen):
if 'include' not in group: