diff options
| author | Daniil Baturin <daniil@vyos.io> | 2024-09-02 12:01:50 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-09-02 12:01:50 +0100 |
| commit | c78c5bd7e65b19e0e50ef6944dc74fb33660ff71 (patch) | |
| tree | 8662a3ade15426575ed0280902b566c2b4c204a2 /interface-definitions | |
| parent | 497863bb45cf9a20ce9e055c8b09f31c75754941 (diff) | |
| parent | 8e0e1a99e5510c7575ab8a09145d6b4354692d55 (diff) | |
| download | vyos-1x-c78c5bd7e65b19e0e50ef6944dc74fb33660ff71.tar.gz vyos-1x-c78c5bd7e65b19e0e50ef6944dc74fb33660ff71.zip | |
Merge pull request #4018 from nicolas-fort/T6647
T6647: firewall. Introduce patch for accepting invalid ARP and DHCP
Diffstat (limited to 'interface-definitions')
| -rwxr-xr-x[-rw-r--r--] | interface-definitions/include/firewall/common-rule-bridge.xml.i | 1 | ||||
| -rwxr-xr-x[-rw-r--r--] | interface-definitions/include/firewall/global-options.xml.i | 6 | ||||
| -rwxr-xr-x | interface-definitions/include/firewall/match-ether-type.xml.i | 30 |
3 files changed, 37 insertions, 0 deletions
diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i index 9ae28f7be..80088bbec 100644..100755 --- a/interface-definitions/include/firewall/common-rule-bridge.xml.i +++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i @@ -10,6 +10,7 @@ #include <include/firewall/limit.xml.i> #include <include/firewall/log.xml.i> #include <include/firewall/log-options.xml.i> +#include <include/firewall/match-ether-type.xml.i> #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/match-vlan.xml.i> #include <include/firewall/nft-queue.xml.i> diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index cee8f1854..05fdd75cb 100644..100755 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -49,6 +49,12 @@ <help>Apply configured firewall rules to traffic switched by bridges</help> </properties> <children> + <leafNode name="invalid-connections"> + <properties> + <help>Accept ARP and DHCP despite they are marked as invalid connection</help> + <valueless/> + </properties> + </leafNode> <leafNode name="ipv4"> <properties> <help>Apply configured IPv4 firewall rules</help> diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i new file mode 100755 index 000000000..abfa9034d --- /dev/null +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -0,0 +1,30 @@ +<!-- include start from firewall/match-ether-type.xml.i --> +<leafNode name="ethernet-type"> + <properties> + <help>Ethernet type</help> + <completionHelp> + <list>802.1q 802.1ad arp ipv4 ipv6</list> + </completionHelp> + <valueHelp> + <format>802.1q</format> + <description>Customer VLAN tag type</description> + </valueHelp> + <valueHelp> + <format>802.1ad</format> + <description>Service VLAN tag type</description> + </valueHelp> + <valueHelp> + <format>arp</format> + <description>Adress Resolution Protocol</description> + </valueHelp> + <valueHelp> + <format>_ipv4</format> + <description>Internet Protocol version 4</description> + </valueHelp> + <valueHelp> + <format>_ipv6</format> + <description>Internet Protocol version 6</description> + </valueHelp> + </properties> +</leafNode> +<!-- include end --> |