vyos-1x.git/interface-definitions/include/firewall/ipv6-hook-input.xml.i, branch fix/T8955-http-api-verify-tlsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls2025-09-05T20:37:19+00:00Firewall: T7475: Disable conntrack per firewall chain2025-09-05T20:37:19+00:00l0crian1ryan.claridge13@gmail.com2025-09-05T20:37:19+00:00urn:sha1:6611627f6a73af912082dc79c3039e6c492a6cc6
- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest
firewall: T4694: Adding rt ipsec exists/missing match to firewall configs (#3616)2024-07-28T11:47:07+00:00talmakionandrewt@telekinetica.net2024-07-28T11:47:07+00:00urn:sha1:e2bf8812f73a75356f56274968be8859a2186d73
* Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for
fw rules
* Add ipsec match-ipsec-out and match-none-out
* Change all the points where the match-ipsec.xml.i include was used
before, making sure the new includes (match-ipsec-in/out.xml.i) are
used appropriately. There were a handful of spots where match-ipsec.xml.i
had snuck back in for output hooked chains already
(the common-rule-* includes)
* Add the -out generators to rendered templates
* Heavy modification to firewall config validators:
* I needed to check for ipsec-in matches no matter how deeply nested
under an output-hook chain(via jump-target) - this always generates
an error.
* Ended up retrofitting the jump-targets validator from root chains
and for named custom chains. It checks for recursive loops and improper
IPsec matches.
* Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation"
smoketestsT5977: firewall: remove ipsec options in output chain rule definitions, since it's not supported.2024-01-23T18:43:34+00:00Nicolas Fortnicolasfort1988@gmail.com2024-01-23T18:43:34+00:00urn:sha1:9d490ecf616eb9d019beee37a3802705c4109d9dfirewall: T5834: Rename 'enable-default-log' to 'default-log'2023-12-26T22:28:25+00:00Indrajit Raychaudhuriirc@indrajit.com2023-12-18T08:45:12+00:00urn:sha1:245e758aa2ea8779186d0c92d79d33170d036992
Rename chain level defaults log option from `enable-default-log` to
`default-log` for consistency.
T5637: add new rule at the end of base chains for default-actions. This enables log capabilities for default-action in base chains. And of course, add option for enabling log for default-action2023-10-06T14:31:23+00:00Nicolas Fortnicolasfort1988@gmail.com2023-10-06T14:31:23+00:00urn:sha1:6582bbc0f431c34a3405039d971af878aa23971bT5160: firewall refactor: fix regexep for connection-status. Create new file with common matcher for ipv4 and ipv6, and use include on all chains for all this comman matchers2023-08-11T14:50:00+00:00Nicolas Fortnicolasfort1988@gmail.com2023-07-04T12:58:26+00:00urn:sha1:f57ad85b346a08bd3aa31d95c9a7438f783c2b6eT5160: firewall refactor: move <set firewall ipv6 ipv6-name ...> to <set firewall ipv6 name ...> . Also fix some unexpected behaviour with geoip.2023-08-11T14:50:00+00:00Nicolas Fortnicolasfort1988@gmail.com2023-07-03T19:32:37+00:00urn:sha1:0300bf433d9aaff81fdecf9eeaabba8d06c1999fT5160: firewall refactor: new cli structure. Update only all xml2023-08-11T13:41:30+00:00Nicolas Fortnicolasfort1988@gmail.com2023-05-23T17:48:15+00:00urn:sha1:1c2209c1dc84993d0f766f3d14df1fb3adf9dda2