NAS-130230 / 24.10 / Prevent removing failover group from critical in…

…terfaces (#14083)

src/middlewared/middlewared/plugins/network.py

@@ -1049,6 +1049,12 @@ def _get_filters(key):
                             f'{schema_name}.{i}',
                             f'{str(validation_attrs[i][0]) + str(validation_attrs[i][2])}',
                         )
+            else:
+                if data.get('failover_critical') and data.get('failover_group') is None:
+                    verrors.add(
+                        f'{schema_name}.failover_group',
+                        'A failover group is required when configuring a critical failover interface.'
+                    )
 
             # creating a "failover" lagg interface on HA systems and trying
             # to mark it "critical for failover" isn't allowed as it can cause

tests/api2/test_005_interface.py

@@ -4,8 +4,10 @@
 apifolder = os.getcwd()
 sys.path.append(apifolder)
 
+import errno
 import pytest
 
+from middlewared.service_exception import ValidationError, ValidationErrors
 from auto_config import interface, ha, netmask
 from middlewared.test.integration.utils.client import client, truenas_server
 from middlewared.test.integration.utils import call
@@ -118,3 +120,14 @@ def test_002_configure_interface(request, ws_client, get_payload):
 
 def test_003_recheck_ipvx(request):
     assert int(call('tunable.get_sysctl', f'net.ipv6.conf.{interface}.autoconf')) == 0
+
+def test_004_remove_critical_failover_group(request):
+    with pytest.raises(ValidationErrors) as ve:
+        call('interface.update', interface, {'failover_group': None, 'failover_critical': True})
+        assert ve.value.errors == [
+            ValidationError(
+                'interface_update.failover_group',
+                'A failover group is required when configuring a critical failover interface.',
+                errno.EINVAL
+            )
+        ]