summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-09-19ipset: T2189: optimized firewall groups performancezsdc
This commit optimizes the speed of interaction with the ipset. * removed extra `sudo` from `ipset` commands, because scripts that run `ipset` commands already run under `sudo`. This gives approximately 4x performance improvement. * replaced logic in the `member_exists` function for port groups. Instead of calling `ipset -T` for each port now the whole list is received in one command and a search process is done inside Perl. This significantly improves speed for port groups with long port ranges inside. * delete ip address and port ranges using a single command instead deleting each element individually. * added the same ranges validation for address-group as for port-group.
2022-03-10Merge pull request #32 from zdc/T4002-equuleus1.3.2Christian Poessinger
ipset: T4002: Generate a temporary set name from UUID
2022-03-06ipset: T4002: Generate a temporary set name from UUIDzsdc
ipset allows assigning set names up to 31 characters long. Currently, we use a process -PID number as a suffix for generating temporary set names. But this cuts effective set name to 25 characters only (`set name in CLI` + `-` + `PID number`), however in CLI we have a limit set to 31. So, set names with long prefixes cannot be configured. This commit replaces PID-based temporary name with UUID-based, which allows configuring set names with full name size.
2022-01-29Merge pull request #29 from goodNETnick/default-rule-numChristian Poessinger
firewall: T4100: default action number
2022-01-11firewall: T4100: default action numbergoodNETnick
2021-12-31Merge pull request #27 from goodNETnick/equuleusChristian Poessinger
Firewall: T4100: increase maximum number of rules
2021-12-27Firewall: T4100: increase maximum number of rulesroot
(cherry picked from commit df69f68e09b82f3e1ee928963709b1263cea5bdf)
2021-12-27Firewall: T4100: increase maximum number of rulespkmaster
2021-09-24Merge pull request #25 from vfreex/bridge-vifs-equuleusChristian Poessinger
T3115: Add firewall options for bridge vifs
2021-09-24T3115: Add firewall options for bridge vifsYuxiang Zhu
2021-06-25T2023: macsec: fix interface tree referenceChristian Poessinger
2021-06-13T2023: add macsec interface firewall supportChristian Poessinger
(cherry picked from commit 44f91525cc72a26b365bb24cab22344bc5e06540)
2021-06-13T3620: rename wirelessmodem -> wwanChristian Poessinger
(cherry picked from commit c5a8a802fa017808ba044d9151dd35a48ae60b94)
2021-05-25firewall: ICMP code/type: T3569srividya0208
Fixed the completion help for icmp code & type which was showing out of range values 0-4294967295 than the allowed values i.e. 0-255 (cherry picked from commit c89cbf844bc2f54fb599ab7bbb7821f3160b7d28)
2021-04-20conntrack: T3290: remove references to removed GRE pluginsBrandon Stepler
(cherry picked from commit 55fe5936b39b9ba20b6ac927f3b8930ed2d0af60)
2021-04-05T3456: add missing priority when removing per interface firewall rulesChristian Poessinger
This is the second commit for fixing this issue, the first was for the policy based routing and fixed in commit dc80ce45f95 ("T3456: add missing priority when deleting interface policy"). set firewall name FOO rule 10 action 'accept' set interfaces ethernet eth0 firewall local name 'FOO' commit This was not able to be removed again in one commit, two commits are required. vyos@r4-roll# delete firewall [edit] vyos@r4-roll# delete interfaces ethernet eth0 firewall [edit] vyos@r4-roll# commit [ firewall name FOO ] Firewall configuration error: Cannot delete rule set "FOO" (still in use) delete [ firewall name FOO ] failed delete [ firewall ] failed Commit failed [edit] vyos@r4-roll# (cherry picked from commit 8e1ab2a747a26a3a574c411b95ffb2a3ca7e3854)
2021-04-05T3456: add missing priority when deleting interface policyChristian Poessinger
set interfaces ethernet eth1 policy route 'LAN-POLICY-BASED-ROUTING' set policy route LAN-POLICY-BASED-ROUTING rule 10 destination set policy route LAN-POLICY-BASED-ROUTING rule 10 disable set policy route LAN-POLICY-BASED-ROUTING rule 10 set table '10' set policy route LAN-POLICY-BASED-ROUTING rule 10 source address '192.168.0.119/32' set policy route LAN-POLICY-BASED-ROUTING rule 20 destination set policy route LAN-POLICY-BASED-ROUTING rule 20 set table '100' set policy route LAN-POLICY-BASED-ROUTING rule 20 source address '192.168.0.240' This was not able to be deleted in only one commit, two commits were required. vyos@vyos# delete policy vyos@vyos# delete interfaces ethernet eth1 policy vyos@vyos# commit [ policy route LAN-POLICY-BASED-ROUTING ] Firewall configuration error: Cannot delete rule set "LAN-POLICY-BASED-ROUTING" (still in use) delete [ policy route LAN-POLICY-BASED-ROUTING ] failed [[]] failed Commit failed copy failed [/opt/vyatta/config/tmp/tmp_7724/work/.unionfs-fuse][/opt/vyatta/config/tmp/new_config_7724/.unionfs-fuse] Failed to generate committed config [edit] vyos@vyos# (cherry picked from commit dc80ce45f95e243afc6c3d9016f051cfab690846)
2021-04-04Jenkins: use build library from proper branch "equuleus"Christian Poessinger
2021-01-08Debian: also package files for dummy interfacesChristian Poessinger
(cherry picked from commit eba416df08429eead009b30b7b72a286dd194dd4)
2021-01-04Update debian version.Daniil Baturin
2020-11-27Merge pull request #19 from sever-sever/T2868Daniil Baturin
cfg-firewall: T2868: Delete option pmtu for tcp-mss
2020-11-27cfg-firewall: T2868: Delete option pmtu for tcp-msssever-sever
2020-07-29Debian: set compatibility level to 9Christian Poessinger
2020-07-29Merge pull request #18 from sever-sever/T1241Daniil Baturin
firewall: T1241: Check file before del
2020-07-29firewall: T1241: Check file before delsever-sever
2020-06-23Jenkins: T2625: migrate to build libraryChristian Poessinger
2020-03-21Jenkins: T1870: support GitHub PullRequest buildsChristian Poessinger
2020-02-23pppoe: T1318: de-nest pppoe interfaceChristian Poessinger
2019-12-27Jenkins: make pipeline branch independentChristian Poessinger
2019-12-18Merge branch 'equuleus' of github.com:vyos/vyatta-cfg-firewall into currentChristian Poessinger
* 'equuleus' of github.com:vyos/vyatta-cfg-firewall: Jenkins: import Pipeline from vyos-1x commit bd00ec7 update Jenkins file for equuleus
2019-09-28Jenkins: import Pipeline from vyos-1x commit bd00ec7Christian Poessinger
2019-09-28Jenkins: import Pipeline from vyos-1x commit bd00ec7VyOS_1.2-2019Q4Christian Poessinger
2019-09-28Jenkins: import Pipeline from vyos-1x commit 4d225f6Christian Poessinger
2019-08-14update Jenkins file for equuleusUnicronNL
2019-06-23Merge pull request #15 from woodypl/currentChristian Poessinger
T1471: Fix wireguard entry in firewall template generator.
2019-06-23T1471: Fix wireguard entry in firewall template generator.Paweł Drewniak
2019-06-20Merge pull request #14 from zdc/T1456Daniil Baturin
[ipset] T1456: Add check for duplicate items in port-group before commit
2019-06-19[ipset] T1456: Add check for duplicate items in port-group before commitzsdc
2019-05-21Create Jenkinsfile currentKim Hagen
2019-02-08T484: Rules can't be deleted from firewall rule sets used in zone policiesJoshua McBeth
2019-02-08Revert "Bug #T171 fix Open Task T171 Unable to Delte Rule"Christian Poessinger
This reverts commit d1164b989295016436f20caa709603ec5d85a4d3.
2019-01-29Merge pull request #12 from mevertse/currenthagbard-01
T166: Changed NPTv6 to use NETMAP
2019-01-29Merge branch 'current' of https://github.com/mevertse/vyatta-cfg-firewall ↵Merijn Evertse
into HEAD
2019-01-29T166: Changed NPTv6 to use NETMAPMerijn Evertse
2018-12-17T1111: use unique recent packet list names in rules.Daniil Baturin
2018-12-16T1087: add wireguard to interface template generators.Daniil Baturin
2018-11-18T573: add support for matching IPv6 hop limit.Daniil Baturin
Patch by Ray Patrick Soucy.
2018-11-13T1006: replace check_prefix_boundary with ipaddrcheck.Daniil Baturin
2018-10-26T59: Inspect action still exists in firewall and should be removedhagbard
2018-07-24T666: remove the firewall option from the old VRRP CLI.Daniil Baturin
If left in place, it will create incorrect command definition tree when vyatta-vrrp is removed and cause config loading errors.
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 02:59:34 +0000