vyos-1x.git/data/templates/firewall/nftables.j2, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2026-03-14T08:20:45+00:00T8383: fix extra space in nftables ipv6 output chain2026-03-14T08:20:45+00:00Alex Kudentsov43482574+alexk37@users.noreply.github.com2026-03-14T08:20:45+00:00urn:sha1:641825aaa26ba95a2ad73027d050276f0f336e69geoip: T7926: Refactor geoip handling2026-01-21T10:52:29+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2025-10-02T15:47:10+00:00urn:sha1:7f6f94370ec04ce48e7a19880a74ba0c25f7bfb5
* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
firewall: T7475: Remove redundant if statement in jinja template2025-09-13T10:29:40+00:00l0crian1ryan.claridge13@gmail.com2025-09-13T10:29:40+00:00urn:sha1:61e234a74a95f68c665a21437c9ffaa8747bbc3aFirewall: T7475: Disable conntrack per firewall chain2025-09-05T20:37:19+00:00l0crian1ryan.claridge13@gmail.com2025-09-05T20:37:19+00:00urn:sha1:6611627f6a73af912082dc79c3039e6c492a6cc6
- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest
firewall: T6951: Add a configuration command for ethertypes that bridge firewalls should always accept2025-06-17T15:16:51+00:00Nataliia Solomkonatalirs1985@gmail.com2025-06-13T09:20:40+00:00urn:sha1:8dbc3c5e67cc1fd043a78dd3446a1a733ebd814fT7523: firewall: Accepting invalid traffic for pppoe discovery and wol2025-06-05T04:25:21+00:00opswillwill@nixops.org2025-06-05T04:04:10+00:00urn:sha1:bfdba4079b0a76a8c578277adae3f36add832b41T7512: firewall: Modify accepting invalid traffic for VLAN aware bridge2025-06-02T04:52:08+00:00Indrajit Raychaudhuriirc@indrajit.com2025-06-02T04:32:13+00:00urn:sha1:b47adae7a3e963bfca3b775f4b84d5121907c76d
Allow accepting invalid packets for ethernet types `8021q` and `8021ad`
in addition to ARP and UDP types so that stateful bridge firewall works
for VLAN-aware bridges in addition to regular bridges.
firewall: T7358: add offload option to global state policy2025-04-18T14:26:18+00:00l0crian1ryan.claridge13@gmail.com2025-04-18T14:26:18+00:00urn:sha1:12ba00ecdd2927207106f709a3ba2b23448a5997
- fixed CI smoketest failures (again)
firewall: T7358: add offload option to global state policy2025-04-18T14:16:59+00:00l0crian1ryan.claridge13@gmail.com2025-04-18T14:16:59+00:00urn:sha1:76c4fcbad8698f277b2b5ed859edb068359af463
- Fixed CI smoketest failures
firewall: T7358: add offload option to global state policy2025-04-16T18:49:44+00:00l0crian1ryan.claridge13@gmail.com2025-04-16T16:31:34+00:00urn:sha1:382c6fc6ffe76d7ce418018f69902572701215a3
Since the jump to the global state chain is inserted before all rules,
it wasn't possible to use offload with the global state policies
This commit adds a new chain for offloaded traffic in the forward
chain and jumps to that chain. Please enter the commit message for your changes. Lines starting