summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorDaniil Baturin <daniil@vyos.io>2024-03-18 18:55:09 +0100
committerGitHub <noreply@github.com>2024-03-18 18:55:09 +0100
commit8c52e7334ef5f92d48b4a6049ec42e8d84dfe673 (patch)
tree1dc9c52b76d3511b24b8b0462a8d5327700d44a6 /src
parent12b9c577330cf1e160e6ff780100876d6690a57b (diff)
parente2df1f4929774792c1d4bfb78c2dfa5bdf7f0825 (diff)
downloadvyos-1x-8c52e7334ef5f92d48b4a6049ec42e8d84dfe673.tar.gz
vyos-1x-8c52e7334ef5f92d48b4a6049ec42e8d84dfe673.zip
Merge pull request #3146 from nicolas-fort/T6136
T6136: add error checks when using dynamic firewall groups
Diffstat (limited to 'src')
-rwxr-xr-xsrc/conf_mode/firewall.py12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 3c27655b0..810437dda 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -268,6 +268,18 @@ def verify_rule(firewall, rule_conf, ipv6):
if 'port' in side_conf and dict_search_args(side_conf, 'group', 'port_group'):
raise ConfigError(f'{side} port-group and port cannot both be defined')
+ if 'add_address_to_group' in rule_conf:
+ for type in ['destination_address', 'source_address']:
+ if type in rule_conf['add_address_to_group']:
+ if 'address_group' not in rule_conf['add_address_to_group'][type]:
+ raise ConfigError(f'Dynamic address group must be defined.')
+ else:
+ target = rule_conf['add_address_to_group'][type]['address_group']
+ fwall_group = 'ipv6_address_group' if ipv6 else 'address_group'
+ group_obj = dict_search_args(firewall, 'group', 'dynamic_group', fwall_group, target)
+ if group_obj is None:
+ raise ConfigError(f'Invalid dynamic address group on firewall rule')
+
if 'log_options' in rule_conf:
if 'log' not in rule_conf:
raise ConfigError('log-options defined, but log is not enable')