summaryrefslogtreecommitdiff
path: root/python
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2024-01-19 21:01:52 +0100
committerChristian Breunig <christian@breunig.cc>2024-01-22 07:47:17 +0100
commit2ec023752bdd400835eb69a8f1f9d2873cef61fa (patch)
tree136e81b7fac983ff74601efdd90dfb4255fb35d6 /python
parent5c6d4b17d90cdfdf1541d81fb081575c54b168a7 (diff)
downloadvyos-1x-2ec023752bdd400835eb69a8f1f9d2873cef61fa.tar.gz
vyos-1x-2ec023752bdd400835eb69a8f1f9d2873cef61fa.zip
firewall: T5729: T5681: T5217: backport subsystem from current branch
This is a combined backport for all accumulated changes done to the firewall subsystem on the current branch.
Diffstat (limited to 'python')
-rw-r--r--python/vyos/firewall.py13
-rw-r--r--python/vyos/template.py6
2 files changed, 16 insertions, 3 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index 4fc1abb15..a2622fa00 100644
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -87,6 +87,7 @@ def nft_action(vyos_action):
def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
output = []
+
if ip_name == 'ip6':
def_suffix = '6'
family = 'ipv6'
@@ -261,6 +262,9 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
output.append(f'{proto} {prefix}port {operator} @P_{group_name}')
+ if dict_search_args(rule_conf, 'action') == 'synproxy':
+ output.append('ct state invalid,untracked')
+
if 'hop_limit' in rule_conf:
operators = {'eq': '==', 'gt': '>', 'lt': '<'}
for op, operator in operators.items():
@@ -440,6 +444,15 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
queue_opts = ','.join(rule_conf['queue_options'])
output.append(f'{queue_opts}')
+ # Synproxy
+ if 'synproxy' in rule_conf:
+ synproxy_mss = dict_search_args(rule_conf, 'synproxy', 'tcp', 'mss')
+ if synproxy_mss:
+ output.append(f'mss {synproxy_mss}')
+ synproxy_ws = dict_search_args(rule_conf, 'synproxy', 'tcp', 'window_scale')
+ if synproxy_ws:
+ output.append(f'wscale {synproxy_ws} timestamp sack-perm')
+
else:
output.append('return')
diff --git a/python/vyos/template.py b/python/vyos/template.py
index 4b6dca254..d1b3e8fa8 100644
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -574,10 +574,10 @@ def nft_rule(rule_conf, fw_hook, fw_name, rule_id, ip_name='ip'):
return parse_rule(rule_conf, fw_hook, fw_name, rule_id, ip_name)
@register_filter('nft_default_rule')
-def nft_default_rule(fw_conf, fw_name, ipv6=False):
+def nft_default_rule(fw_conf, fw_name, family):
output = ['counter']
default_action = fw_conf['default_action']
- family = 'ipv6' if ipv6 else 'ipv4'
+ #family = 'ipv6' if ipv6 else 'ipv4'
if 'default_log' in fw_conf:
action_suffix = default_action[:1].upper()
@@ -587,7 +587,7 @@ def nft_default_rule(fw_conf, fw_name, ipv6=False):
output.append(f'{default_action}')
if 'default_jump_target' in fw_conf:
target = fw_conf['default_jump_target']
- def_suffix = '6' if ipv6 else ''
+ def_suffix = '6' if family == 'ipv6' else ''
output.append(f'NAME{def_suffix}_{target}')
output.append(f'comment "{fw_name} default-action {default_action}"')