T5502: firewall: add validator for interface matcher, and allow only interface-name or interface-group

1 files changed, 5 insertions, 0 deletions

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 8ad3f27fc..d32ae497a 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -259,6 +259,11 @@ def verify_rule(firewall, rule_conf, ipv6):
         if 'queue_threshold' in rule_conf['log_options'] and 'group' not in rule_conf['log_options']:
             raise ConfigError('log-options queue-threshold defined, but log group is not define')
 
+    for direction in ['inbound_interface','outbound_interface']:
+        if direction in rule_conf:
+            if 'interface_name' in rule_conf[direction] and 'interface_group' in rule_conf[direction]:
+                raise ConfigError(f'Cannot specify both interface-group and interface-name for {direction}')
+
 def verify_nested_group(group_name, group, groups, seen):
     if 'include' not in group:
         return