vyos-1x.git/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i, branch rollingVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling2026-02-15T11:58:14+00:00xml: T8271: consolidate source-destination-group.xml.i and it's IPv4 equivalent2026-02-15T11:58:14+00:00Christian Breunigchristian@breunig.cc2026-02-15T11:08:20+00:00urn:sha1:6b8139a9ed7426356f9515603e855fb89e5506af
$ make interface_definitions
$ git add -f templates-cfg
$ ... refactor
$ make interface_definitions
$ git diff templates-cfg
No change in any node.def file detected.
firewall: T4694: Adding rt ipsec exists/missing match to firewall configs (#3616)2024-07-28T11:47:07+00:00talmakionandrewt@telekinetica.net2024-07-28T11:47:07+00:00urn:sha1:e2bf8812f73a75356f56274968be8859a2186d73
* Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for
fw rules
* Add ipsec match-ipsec-out and match-none-out
* Change all the points where the match-ipsec.xml.i include was used
before, making sure the new includes (match-ipsec-in/out.xml.i) are
used appropriately. There were a handful of spots where match-ipsec.xml.i
had snuck back in for output hooked chains already
(the common-rule-* includes)
* Add the -out generators to rendered templates
* Heavy modification to firewall config validators:
* I needed to check for ipsec-in matches no matter how deeply nested
under an output-hook chain(via jump-target) - this always generates
an error.
* Ended up retrofitting the jump-targets validator from root chains
and for named custom chains. It checks for recursive loops and improper
IPsec matches.
* Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation"
smoketestsT3900: add support for raw table in firewall.2024-05-15T17:09:16+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-15T17:09:16+00:00urn:sha1:6871c5541c1962e63d7a9b75d2bb43df2a8d372bxml: T5738: use generic-disable-node building block for "disable" CLI nodes2024-03-05T19:20:27+00:00Christian Breunigchristian@breunig.cc2024-03-05T19:20:27+00:00urn:sha1:21b0bf0168697fdbe514ae49a4a28b39a91ec777
Make the code more uniform and maintainable.
firewall: T5834: Improve log message and simplify log-option include2023-12-27T03:49:51+00:00Indrajit Raychaudhuriirc@indrajit.com2023-12-22T23:22:20+00:00urn:sha1:53a48f499ae9bcc2f657136bb7779b38aad1c242
`include/firewall/rule-log-options.xml.i` is now more aptly renamed to
`include/firewall/log-options.xml.i`.
conntrack: T5217: Add tcp flag matching to `system conntrack ignore`2023-09-18T18:26:51+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2023-09-18T18:24:22+00:00urn:sha1:fb3ef9af5e394aa25692003fb3c185bfedefe3cb
- Moves MSS node out of `tcp-flags.xml.i` and into `tcp-mss.xml.i`
- Update smoketest to verify TCP flag matching
T5160: firewall refactor: fix regexep for connection-status. Create new file with common matcher for ipv4 and ipv6, and use include on all chains for all this comman matchers2023-08-11T14:50:00+00:00Nicolas Fortnicolasfort1988@gmail.com2023-07-04T12:58:26+00:00urn:sha1:f57ad85b346a08bd3aa31d95c9a7438f783c2b6eT5160: firewall refactor: new cli structure. Update only all xml2023-08-11T13:41:30+00:00Nicolas Fortnicolasfort1988@gmail.com2023-05-23T17:48:15+00:00urn:sha1:1c2209c1dc84993d0f766f3d14df1fb3adf9dda2