From 6eda98d14ad98c3e4d5f3cf159c7a3532a8128d7 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Thu, 28 Sep 2023 20:04:21 +0200
Subject: firewall: T5217: Synproxy bugfix and ct state conflict checking

---
 src/conf_mode/firewall.py | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/conf_mode/firewall.py')

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 2ca4bbe2d..f6480ab0a 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -176,6 +176,8 @@ def verify_rule(firewall, rule_conf, ipv6):
     if rule_conf['action'] != 'synproxy' and 'synproxy' in rule_conf:
         raise ConfigError('"synproxy" option allowed only for action synproxy')
     if rule_conf['action'] == 'synproxy':
+        if 'state' in rule_conf:
+            raise ConfigError('For action "synproxy" state cannot be defined')
         if not rule_conf.get('synproxy', {}).get('tcp'):
             raise ConfigError('synproxy TCP MSS is not defined')
         if rule_conf.get('protocol', {}) != 'tcp':
-- 
cgit v1.2.3