vyos-1x.git/data/templates/firewall/nftables-defines.j2, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2025-06-26T14:23:13+00:00vrf: T7544: Ensure correct quoting for VRF ifnames in nftables2025-06-26T14:23:13+00:00Andrew Toppandrewt@telekinetica.net2025-06-26T14:23:13+00:00urn:sha1:c741a290261eb53d5f9ca4849109f19ced8fda9f
* For VRF create/delete:
* Simple dquoting, as before, was parsed away by the shell
* Just escaping the double quotes could cause issues with the shell mangling
VRF names (however unlikely)
* Wrapping original quotes in shell-escaped single quotes is a quick & easy
way to guard against both improper shell parsing and string names being
taken as nft keywords.
* Firewall configuration:
* Firewall "interface name" rules support VRF ifnames and used them unquoted,
fixed for nft_rule template tags (parse_rule)
* Went through and quoted all iif/oifname usage by zones and interface
groups. VRF ifnames weren't available for all cases, but there is
no harm in completeness.
* For this, also created a simple quoted_join template filter to replace
any use of |join(',')
* PBR calls nft but doesn't mind the "vni" name - table IDs used instead
I may have missed some niche nft use-cases that would be exposed to this problem.
T7386: firewall: allow mix of IPv4 and IPv6 addresses/prefixes/ranges in remote groups2025-05-07T14:55:00+00:00Mark Hayesmark.hayes0338@gmail.com2025-04-25T15:10:07+00:00urn:sha1:02c63e7ded23ea90d55638f768ff943671c2c574firewall: T5493: Implement remote-group2025-03-21T20:08:50+00:00Alex Wembezzle.dev@proton.me2025-01-30T20:22:41+00:00urn:sha1:9e2bdc96ea63e7ee1adb002df17e0d9ecc1cd410T4072: firewall: extend firewall bridge capabilities, in order to include new chains, priorities, and firewall groups2024-08-01T16:25:31+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-24T14:08:19+00:00urn:sha1:20551379e8e2b4b6e342b39ea67738876e559bbfT4839: firewall: Add dynamic address group in firewall configuration, and appropiate commands to populate such groups using source and destination address of the packet.2024-01-25T12:35:46+00:00Nicolas Fortnicolasfort1988@gmail.com2024-01-05T12:13:17+00:00urn:sha1:6ce5fedb602c5ea0df52049a5e9c4fb4f5a86122T4072: add firewall bridge filtering. First implementation only applies for forward chain and few matchers. Should be extended in the future.2023-09-07T20:30:50+00:00Nicolas Fortnicolasfort1988@gmail.com2023-09-07T20:30:50+00:00urn:sha1:1772c0a7232789e6eeb0caa78fe630fab899522dMerge pull request #1626 from nicolas-fort/fwall_group_interface2022-12-17T07:30:18+00:00Christian Poessingerchristian@poessinger.com2022-12-17T07:30:18+00:00urn:sha1:8637b02bb60baf499fc63696c28aa1af3559c308
T4780: Firewall: add firewall groups in firewall. Extend matching cri…T4780: Firewall: add firewall groups in firewall. Extend matching criteria so this new group can be used in inbound and outbound matcher2022-11-19T14:31:32+00:00Nicolas Fortnicolasfort1988@gmail.com2022-10-28T18:19:47+00:00urn:sha1:9a5dfb4b7ec9e065a73511a38e1713aec03eee0efirewall: T970: Refactor domain resolver, add firewall source/destination `fqdn` node2022-11-03T20:09:28+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2022-10-31T13:26:51+00:00urn:sha1:051e063fdf2e459a0716a35778b33ea6bb2fdcb6firewall: T2199: enable "auto-merge" on sets2022-09-16T19:55:31+00:00Christian Poessingerchristian@poessinger.com2022-09-16T19:53:17+00:00urn:sha1:bd81d5e8d0fc2300c864754804ff8be74f14cfce
vyos@vyos# show firewall
+name foo {
+ rule 1 {
+ action accept
+ packet-length 100
+ packet-length 105
+ packet-length 200-300
+ packet-length 220-250
+ }
+}
will report a nftables error upon load: Error: conflicting intervals specified
With nftables 1.0.3 there is an "auto-merge" option which corrects this:
https://lwn.net/Articles/896732/