vyos-1x.git - VyOS command definitions, scripts, and utilities (mirror of https://github.com/marekm72/vyos-1x.git)

Age	Commit message (Collapse)	Author
2022-06-10	firewall: T970: Fix for Regex for domain and check empty group	Viacheslav Hletenko
	It can be more then 5 symbols in top-level-domain address for example '.photography' and '.accountants' Firewall group can be added without address: * set firewall group domain-group DOMAIN Check if 'address' exists in group_config
2022-06-05	firewall: T970: Maintain a domain state to fallback if resolution fails	sarthurdev

2022-05-28	firewall: T970: Add firewall group domain-group	Viacheslav Hletenko
	Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } }
2022-05-01	firewall: T4353: fix Jinja2 linting errors	Christian Poessinger

2022-04-16	vyos.base: use Warning() helper where applicable	Christian Poessinger

2022-04-06	firewall: T4345: Fix incorrect rule limit rate syntax	sarthurdev

2022-02-04	firewall: T4209: Fix support for rule `recent` matches	sarthurdev

2022-01-31	firewall: T2199: Fix errors when referencing an empty chain	sarthurdev

2022-01-29	firewall: T4216: Add support for negated firewall groups	sarthurdev

2022-01-29	firewall: T4218: Adds a prefix to all user defined chains	sarthurdev

2022-01-21	firewall: T2199: Verify correct ICMP protocol for ipv4/ipv6	sarthurdev

2022-01-18	firewall: T2199: Raise ConfigError if deleted node is used in zone-policy	sarthurdev

2022-01-18	firewall: policy: T1292: Clean up any rules required to delete a chain	sarthurdev

2022-01-17	firewall: policy: T4178: Migrate and refactor tcp flags	sarthurdev
	* Add support for ECN and CWR flags
2022-01-14	firewall: T4178: Use lowercase for TCP flags and add an validator	sarthurdev

2022-01-11	firewall: T4159: Add warning when an empty group is applied to a rule	sarthurdev

2022-01-11	firewall: policy: T2199: Reload policy route script if `firewall group` node ↵	sarthurdev
	is changed
2022-01-11	firewall: policy: T4159: T4164: Fix empty firewall groups, create separate ↵	sarthurdev
	file for group definitions.
2022-01-10	firewall: 4149: Fix verify steps being bypassed when base node is removed	sarthurdev

2022-01-05	firewall: zone-policy: T4133: Prevent firewall from trying to clean-up ↵	sarthurdev
	zone-policy chains * Prevent firewall names from using the reserved VZONE prefix
2022-01-05	firewall: zone-policy: T2199: T4130: Fixes for firewall, state-policy and ↵	sarthurdev
	zone-policy
2022-01-04	firewall: T4130: Fix firewall state-policy errors	sarthurdev
	Also fixes: * Issue with multiple state-policy rules being created on firewall updates * Prevents interface rules being inserted before state-policy
2021-12-06	firewall: T2199: Migrate firewall to XML/Python	sarthurdev

2021-05-25	firewall: T3568: add XML definitions for firewall	Viacheslav Hletenko
	Add XML for configuration mode firewall. Used for future rewriting it to Python style.