diff options
| author | Nicolas Fort <nicolasfort1988@gmail.com> | 2024-08-26 18:10:01 +0000 |
|---|---|---|
| committer | Nicolas Fort <nicolasfort1988@gmail.com> | 2024-08-28 12:19:19 +0000 |
| commit | 8e0e1a99e5510c7575ab8a09145d6b4354692d55 (patch) | |
| tree | 12c4d27314384f84b67a5e370e9d8f181ea15742 /interface-definitions | |
| parent | 003209eeab231675e82abb8cf6eab7ca0384bc3f (diff) | |
| download | vyos-1x-8e0e1a99e5510c7575ab8a09145d6b4354692d55.tar.gz vyos-1x-8e0e1a99e5510c7575ab8a09145d6b4354692d55.zip | |
T6647: firewall. Introduce patch for accepting ARP and DHCP replies on stateful bridge firewall. This patch is needed because ARP and DHCP are marked as invalid connections. Also, add ehternet-type matcher in bridge firewall.
Diffstat (limited to 'interface-definitions')
| -rwxr-xr-x[-rw-r--r--] | interface-definitions/include/firewall/common-rule-bridge.xml.i | 1 | ||||
| -rwxr-xr-x[-rw-r--r--] | interface-definitions/include/firewall/global-options.xml.i | 6 | ||||
| -rwxr-xr-x | interface-definitions/include/firewall/match-ether-type.xml.i | 30 |
3 files changed, 37 insertions, 0 deletions
diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i index 9ae28f7be..80088bbec 100644..100755 --- a/interface-definitions/include/firewall/common-rule-bridge.xml.i +++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i @@ -10,6 +10,7 @@ #include <include/firewall/limit.xml.i> #include <include/firewall/log.xml.i> #include <include/firewall/log-options.xml.i> +#include <include/firewall/match-ether-type.xml.i> #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/match-vlan.xml.i> #include <include/firewall/nft-queue.xml.i> diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index cee8f1854..05fdd75cb 100644..100755 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -49,6 +49,12 @@ <help>Apply configured firewall rules to traffic switched by bridges</help> </properties> <children> + <leafNode name="invalid-connections"> + <properties> + <help>Accept ARP and DHCP despite they are marked as invalid connection</help> + <valueless/> + </properties> + </leafNode> <leafNode name="ipv4"> <properties> <help>Apply configured IPv4 firewall rules</help> diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i new file mode 100755 index 000000000..abfa9034d --- /dev/null +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -0,0 +1,30 @@ +<!-- include start from firewall/match-ether-type.xml.i --> +<leafNode name="ethernet-type"> + <properties> + <help>Ethernet type</help> + <completionHelp> + <list>802.1q 802.1ad arp ipv4 ipv6</list> + </completionHelp> + <valueHelp> + <format>802.1q</format> + <description>Customer VLAN tag type</description> + </valueHelp> + <valueHelp> + <format>802.1ad</format> + <description>Service VLAN tag type</description> + </valueHelp> + <valueHelp> + <format>arp</format> + <description>Adress Resolution Protocol</description> + </valueHelp> + <valueHelp> + <format>_ipv4</format> + <description>Internet Protocol version 4</description> + </valueHelp> + <valueHelp> + <format>_ipv6</format> + <description>Internet Protocol version 6</description> + </valueHelp> + </properties> +</leafNode> +<!-- include end --> |