vyos-1x.git/interface-definitions/include/version/firewall-version.xml.i, branch fix/T8955-http-api-verify-tlsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls2025-09-04T20:10:22+00:00T7366: Firewall rules allow empty nodes2025-09-04T20:10:22+00:00l0crian1ryan.claridge13@gmail.com2025-08-07T17:44:01+00:00urn:sha1:abf12142d52abfd586081a1fa45a37143c23a25b
Added checks in the verify_rule() function of firewall.py for empty nodes.
Added migration script 19-to-20 to remove empty nodes from the config.
firewall: T6951: Add a configuration command for ethertypes that bridge firewalls should always accept2025-06-17T15:16:51+00:00Nataliia Solomkonatalirs1985@gmail.com2025-06-13T09:20:40+00:00urn:sha1:8dbc3c5e67cc1fd043a78dd3446a1a733ebd814fT6841: firewall: improve config parsing for ZBF when using VRFs and interfaces attached to VRFs2025-01-06T11:05:22+00:00Nicolas Fortnicolasfort1988@gmail.com2024-10-29T19:05:52+00:00urn:sha1:df176d9b9b4cc67ae509ae2ff17a02f2520cc881firewall: T4694: Adding rt ipsec exists/missing match to firewall configs (#3616)2024-07-28T11:47:07+00:00talmakionandrewt@telekinetica.net2024-07-28T11:47:07+00:00urn:sha1:e2bf8812f73a75356f56274968be8859a2186d73
* Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for
fw rules
* Add ipsec match-ipsec-out and match-none-out
* Change all the points where the match-ipsec.xml.i include was used
before, making sure the new includes (match-ipsec-in/out.xml.i) are
used appropriately. There were a handful of spots where match-ipsec.xml.i
had snuck back in for output hooked chains already
(the common-rule-* includes)
* Add the -out generators to rendered templates
* Heavy modification to firewall config validators:
* I needed to check for ipsec-in matches no matter how deeply nested
under an output-hook chain(via jump-target) - this always generates
an error.
* Ended up retrofitting the jump-targets validator from root chains
and for named custom chains. It checks for recursive loops and improper
IPsec matches.
* Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation"
smoketestsT3900: T6394: extend functionalities in firewall; move netfilter sysctl timeout parameters defined in conntrack to firewall global-opton section.2024-06-04T13:22:24+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-24T16:44:41+00:00urn:sha1:770edf016838523c248e3c8a36c5f327a0b98415T5535: firewall: migrate command <set system ip disable-directed-broadcast> to firewall global-optinos2024-04-15T14:15:14+00:00Nicolas Fortnicolasfort1988@gmail.com2024-04-15T14:15:14+00:00urn:sha1:76dcecafca977b640dd16d8e68c4a050ca1af4fbfirewall: T5834: Migration for 'enable-default-log' to 'default-log'2023-12-27T03:10:27+00:00Indrajit Raychaudhuriirc@indrajit.com2023-12-18T08:57:01+00:00urn:sha1:7c40b70af9def9242b30d1fc949288d9da2bd027T5729: firewall: switch to valueless in order to remove unnecessary <enable|disable> commands; log and state moved to new syntax.2023-11-10T19:26:35+00:00Nicolas Fortnicolasfort1988@gmail.com2023-11-10T19:26:35+00:00urn:sha1:c4409d6a4e11bf2acc7b5b96888e2c471c4559e5T5681: firewall: bump firewall cli version to 12, which was missed in last change.2023-11-07T22:02:07+00:00Nicolas Fortnicolasfort1988@gmail.com2023-11-07T22:02:07+00:00urn:sha1:e65d73ac2be1c9899bbb67857187470385fb2555T5160: firewall refactor: new cli structure. Update only all xml2023-08-11T13:41:30+00:00Nicolas Fortnicolasfort1988@gmail.com2023-05-23T17:48:15+00:00urn:sha1:1c2209c1dc84993d0f766f3d14df1fb3adf9dda2