From d2ce5c18498ad054c5c1fa1294892d25317fb589 Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Tue, 5 Mar 2024 13:20:44 +0000 Subject: T6075: firewall and NAT: check if interface-group exists when using them in firewall|nat rules. (cherry picked from commit 3c0634e572ffdecaf24a9dac16678427f22761ab) --- src/conf_mode/firewall.py | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'src/conf_mode/firewall.py') diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index acb7dfa41..3c27655b0 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -282,6 +282,15 @@ def verify_rule(firewall, rule_conf, ipv6): if direction in rule_conf: if 'name' in rule_conf[direction] and 'group' in rule_conf[direction]: raise ConfigError(f'Cannot specify both interface group and interface name for {direction}') + if 'group' in rule_conf[direction]: + group_name = rule_conf[direction]['group'] + if group_name[0] == '!': + group_name = group_name[1:] + group_obj = dict_search_args(firewall, 'group', 'interface_group', group_name) + if group_obj is None: + raise ConfigError(f'Invalid interface group "{group_name}" on firewall rule') + if not group_obj: + Warning(f'interface-group "{group_name}" has no members!') def verify_nested_group(group_name, group, groups, seen): if 'include' not in group: -- cgit v1.2.3