diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-03-21 05:30:01 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-21 05:30:01 +0100 |
| commit | f7a005ebecdfabc0a0af75ed9ad84b44ef1d6d5b (patch) | |
| tree | 8548ed770de9d795dc049deb42a94d4b77320dfa /src/conf_mode | |
| parent | 1c58b84c9bab195698cd8229e97f7a091d4100b6 (diff) | |
| parent | d19be874eb5cbdfa888742f88703e711a33d2dda (diff) | |
| download | vyos-1x-f7a005ebecdfabc0a0af75ed9ad84b44ef1d6d5b.tar.gz vyos-1x-f7a005ebecdfabc0a0af75ed9ad84b44ef1d6d5b.zip | |
Merge pull request #3160 from vyos/mergify/bp/sagitta/pr-3159
conntrack: T6147: Enable conntrack when firewall state-policy is defined (backport #3159)
Diffstat (limited to 'src/conf_mode')
| -rwxr-xr-x | src/conf_mode/system_conntrack.py | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/src/conf_mode/system_conntrack.py b/src/conf_mode/system_conntrack.py index 2a55daed4..4bea31bbb 100755 --- a/src/conf_mode/system_conntrack.py +++ b/src/conf_mode/system_conntrack.py @@ -180,12 +180,16 @@ def generate(conntrack): conntrack['ipv4_firewall_action'] = 'return' conntrack['ipv6_firewall_action'] = 'return' - for rules, path in dict_search_recursive(conntrack['firewall'], 'rule'): - if any(('state' in rule_conf or 'connection_status' in rule_conf or 'offload_target' in rule_conf) for rule_conf in rules.values()): - if path[0] == 'ipv4': - conntrack['ipv4_firewall_action'] = 'accept' - elif path[0] == 'ipv6': - conntrack['ipv6_firewall_action'] = 'accept' + if dict_search_args(conntrack['firewall'], 'global_options', 'state_policy') != None: + conntrack['ipv4_firewall_action'] = 'accept' + conntrack['ipv6_firewall_action'] = 'accept' + else: + for rules, path in dict_search_recursive(conntrack['firewall'], 'rule'): + if any(('state' in rule_conf or 'connection_status' in rule_conf or 'offload_target' in rule_conf) for rule_conf in rules.values()): + if path[0] == 'ipv4': + conntrack['ipv4_firewall_action'] = 'accept' + elif path[0] == 'ipv6': + conntrack['ipv6_firewall_action'] = 'accept' render(conntrack_config, 'conntrack/vyos_nf_conntrack.conf.j2', conntrack) render(sysctl_file, 'conntrack/sysctl.conf.j2', conntrack) |