firewall: T5729: T5681: T5217: backport subsystem from current branch

This is a combined backport for all accumulated changes done to the firewall
subsystem on the current branch.

1 files changed, 13 insertions, 0 deletions

diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index 4fc1abb15..a2622fa00 100644
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -87,6 +87,7 @@ def nft_action(vyos_action):
 
 def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
     output = []
+
     if ip_name == 'ip6':
         def_suffix = '6'
         family = 'ipv6'
@@ -261,6 +262,9 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
 
                     output.append(f'{proto} {prefix}port {operator} @P_{group_name}')
 
+    if dict_search_args(rule_conf, 'action') == 'synproxy':
+        output.append('ct state invalid,untracked')
+
     if 'hop_limit' in rule_conf:
         operators = {'eq': '==', 'gt': '>', 'lt': '<'}
         for op, operator in operators.items():
@@ -440,6 +444,15 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
                     queue_opts = ','.join(rule_conf['queue_options'])
                     output.append(f'{queue_opts}')
 
+        # Synproxy
+        if 'synproxy' in rule_conf:
+            synproxy_mss = dict_search_args(rule_conf, 'synproxy', 'tcp', 'mss')
+            if synproxy_mss:
+                output.append(f'mss {synproxy_mss}')
+            synproxy_ws = dict_search_args(rule_conf, 'synproxy', 'tcp', 'window_scale')
+            if synproxy_ws:
+                output.append(f'wscale {synproxy_ws} timestamp sack-perm')
+
     else:
         output.append('return')