vyos-1x.git/interface-definitions/include/firewall, branch sever-sever-patch-1

T6918: Fix punctuation

2024-12-17T03:03:53+00:00

Co-authored-by: Daniil Baturin

T6918: Accept invalid PPPoE Session in stateful bridge firewall.

2024-12-13T07:50:06+00:00

xml: T6430: add re-usable vrf CLI node for firewall and pbr

2024-10-07T15:17:42+00:00

T6760: firewall: add packet modifications existing in policy route to regular firewall ruleset.

2024-10-03T14:51:55+00:00

T6698: firewall: add matcher for vlan type. (#4027)

2024-09-10T06:56:18+00:00

T6647: firewall. Introduce patch for accepting ARP and DHCP replies on stateful bridge firewall. This patch is needed because ARP and DHCP are marked as invalid connections. Also, add ehternet-type matcher in bridge firewall.

2024-08-28T12:19:19+00:00

firewall: T4694: fix GRE key include path in XML

2024-08-05T05:44:29+00:00

firewall: T4694: Adding GRE flags & fields matches to firewall rules

2024-08-04T07:52:57+00:00

* Only matching flags and fields used by modern RFC2890 "extended GRE" - this is backwards-compatible, but does not match all possible flags. * There are no nftables helpers for the GRE key field, which is critical to match individual tunnel sessions (more detail in the forum post) * nft expression syntax is not flexible enough for multiple field matches in a single rule and the key offset changes depending on flags. * Thus, clumsy compromise in requiring an explicit match on the "checksum" flag if a key is present, so we know where key will be. In most cases, nobody uses the checksum, but assuming it to be off or automatically adding a "not checksum" match unless told otherwise would be confusing * The automatic "flags key" check when specifying a key doesn't have similar validation, I added it first and it makes sense. I would still like to find a workaround to the "checksum" offset problem. * If we could add 2 rules from 1 config definition, we could match both cases with appropriate offsets, but this would break existing FW generation logic, logging, etc. * Added a "test_gre_match" smoketest

T4072: change same helpers in xml definitions; add notrack action for prerouting chain; re introduce in policy; change global options for passing traffic to IPvX firewall; update smoketest

2024-08-02T12:50:26+00:00

T6570: firewall: add global-option to configure sysctl parameter for enabling/disabling sending traffic from bridge layer to ipvX layer

2024-08-01T16:25:39+00:00