Age | Commit message (Collapse) | Author |
|
|
|
|
|
|
|
|
|
queried from the webgui and operational commands
|
|
|
|
|
|
|
|
* Inverted Zone priorities to comply with new commit implementation.
Previously, Zone priorities were:
245 zone-policy/zone/node.tag/from # after firewall, content-inspection
250 zone-policy # after zone-policy/zone/node.tag/from/
Now, Zone priorities look like this:
250 zone-policy # after firewall, content-inspection
251 zone-policy/zone/node.tag/from # after zone-policy
This required an in-depth look at all zone-policy templates and all of Zone FW
and IPS code to make sure that all of the different combinations of actions
under zone-policy still work right. The combination of actions that needed
most attention are the ones where actions in one priority are executed in
the same commit as actions in other priority. Example "deleting the only
interface in a zone and also, modifying firewall ruleset from that zone to
another zone and deleting content-inspection from that zone to another zone"
vyatta@vDUT-5# compare
[edit zone-policy zone dmz]
-interface eth0
[edit zone-policy zone lan from dmz]
-content-inspection {
- enable
-}
[edit zone-policy zone lan from dmz firewall]
>name allow_all_another
[edit]
|
|
|
|
* change syntax check to limit zone names to 18 chars [10 chars are
reserved for underneath zone chain names] and bump zone cfg-version
to enable config migration
(cherry picked from commit 8c1a5d7f9664fad5488e463d16f7587d7ebb385a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* code to configure content-inspection on a zone-pair basis
* COMING UP : as much as possible, move code applicable to firewall
and IPS and other future features to ZONE library
|
|
|
|
|
|
|
|
|
|
|
|
|