Page MenuHomeVyOS Platform
Create Task
Maniphest T7572

Creating firewall zone without interface causes KeyError exception
Open, NormalPublicBUG
Actions

Description

When you create and commit a firewall zone that does not have an interface assigned will cause a Python KeyError: 'member' exception. Steps to reproduce:

vyos@vyos# set firewall zone BUG
[edit]
vyos@vyos# commit

Will cause the following exception:

[ firewall ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 143, in run_script
    c = script.get_config(config)
        ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos//conf_mode/firewall.py", line 146, in get_config
    if 'vrf' in local_zone_conf['member']:
                ~~~~~~~~~~~~~~~^^^^^^^^^^
KeyError: 'member'

[[firewall]] failed
Commit failed
[edit]
vyos@vyos#

It should not cause a KeyError, for example in VyOS 1.4 it would handle it more gracefully:

Zone "BUG" has no interfaces and is not the local zone

[[firewall]] failed
Commit failed

Details

Version
VyOS 1.5-rolling-20250619
Is it a breaking change?
Stricter validation
Issue type
Bug (incorrect behavior)

Event Timeline

yun created this task.Jun 23 2025, 2:53 PM
pasik subscribed.Jun 23 2025, 3:05 PM
yun renamed this task from Creating firewall zone without and interface causes KeyError exception to Creating firewall zone without interface causes KeyError exception.Jun 23 2025, 3:49 PM
Viacheslav triaged this task as Normal priority.Jun 24 2025, 5:33 AM
Viacheslav subscribed.Sep 25 2025, 2:11 AM

Still bug

vyos@r14# set firewall zone BUG
[edit]
vyos@r14# commit
[ firewall ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 144, in run_script
    c = script.get_config(config)
        ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/conf_mode/firewall.py", line 149, in get_config
    if 'vrf' in local_zone_conf['member']:
                ~~~~~~~~~~~~~~~^^^^^^^^^^
KeyError: 'member'

[[firewall]] failed
Commit failed
[edit]
vyos@r14# run show ver
Version:          VyOS 2025.09.23-0752-integration
Release train:    current
Viacheslav added a project: VyOS Rolling.Sep 25 2025, 2:11 AM