summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-09-28 21:15:42 +0200
committerGitHub <noreply@github.com>2023-09-28 21:15:42 +0200
commitfed59f9bddead060275f368de69e4e4470015ca9 (patch)
tree4fe1a1f47f7fe320b06c7bf5a94c6245bd6be61b /src/conf_mode
parent34772d635fa5a44db8c944b6f0a84f184a704f1d (diff)
parent6eda98d14ad98c3e4d5f3cf159c7a3532a8128d7 (diff)
downloadvyos-1x-fed59f9bddead060275f368de69e4e4470015ca9.tar.gz
vyos-1x-fed59f9bddead060275f368de69e4e4470015ca9.zip
Merge pull request #2322 from sarthurdev/synproxy_fix
firewall: T5217: Synproxy bugfix and ct state conflict checking
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/firewall.py2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 2ca4bbe2d..f6480ab0a 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -176,6 +176,8 @@ def verify_rule(firewall, rule_conf, ipv6):
if rule_conf['action'] != 'synproxy' and 'synproxy' in rule_conf:
raise ConfigError('"synproxy" option allowed only for action synproxy')
if rule_conf['action'] == 'synproxy':
+ if 'state' in rule_conf:
+ raise ConfigError('For action "synproxy" state cannot be defined')
if not rule_conf.get('synproxy', {}).get('tcp'):
raise ConfigError('synproxy TCP MSS is not defined')
if rule_conf.get('protocol', {}) != 'tcp':