summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--python/vyos/firewall.py5
-rwxr-xr-xsrc/conf_mode/firewall.py2
2 files changed, 4 insertions, 3 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index ab40688cc..9122e264e 100644
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -263,9 +263,8 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
output.append(f'{proto} {prefix}port {operator} @P_{group_name}')
- if rule_conf['action'] == 'synproxy':
- if 'synproxy' in rule_conf:
- output.append('ct state invalid,untracked')
+ if dict_search_args(rule_conf, 'action') == 'synproxy':
+ output.append('ct state invalid,untracked')
if 'hop_limit' in rule_conf:
operators = {'eq': '==', 'gt': '>', 'lt': '<'}
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 2ca4bbe2d..f6480ab0a 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -176,6 +176,8 @@ def verify_rule(firewall, rule_conf, ipv6):
if rule_conf['action'] != 'synproxy' and 'synproxy' in rule_conf:
raise ConfigError('"synproxy" option allowed only for action synproxy')
if rule_conf['action'] == 'synproxy':
+ if 'state' in rule_conf:
+ raise ConfigError('For action "synproxy" state cannot be defined')
if not rule_conf.get('synproxy', {}).get('tcp'):
raise ConfigError('synproxy TCP MSS is not defined')
if rule_conf.get('protocol', {}) != 'tcp':