vyos-1x.git/interface-definitions/include, branch yevhen-secretsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=yevhen-secrets2024-09-12T13:18:01+00:00Merge pull request #4021 from natali-rs1985/T6652-current2024-09-12T13:18:01+00:00Daniil Baturindaniil@vyos.io2024-09-12T13:18:01+00:00urn:sha1:ad611f4c70b7f9cc9781cd7d350e261dbae8c077
openfabric: T6652: Add support for OpenFabric protocolT6698: firewall: add matcher for vlan type. (#4027)2024-09-10T06:56:18+00:00Nicolás Fort95703796+nicolas-fort@users.noreply.github.com2024-09-10T06:56:18+00:00urn:sha1:ec3ebe8890c60bbb6f657335c212ac7078dc731copenfabric: T6652: Add support for OpenFabric protocol2024-09-04T10:49:13+00:00Nataliia Solomkonatalirs1985@gmail.com2024-08-27T10:50:16+00:00urn:sha1:c9c37a56cdee45dfa7d4b2e677e88a19afde8ac7
OpenFabric is a routing protocol providing link-state routing with efficient flooding for topologies like spine-leaf networks.
FRR implements OpenFabric in a daemon called fabricd
T6647: firewall. Introduce patch for accepting ARP and DHCP replies on stateful bridge firewall. This patch is needed because ARP and DHCP are marked as invalid connections. Also, add ehternet-type matcher in bridge firewall.2024-08-28T12:19:19+00:00Nicolas Fortnicolasfort1988@gmail.com2024-08-26T18:10:01+00:00urn:sha1:8e0e1a99e5510c7575ab8a09145d6b4354692d55T6649: Accel-ppp separate vlan-mon from listen interfaces2024-08-15T16:12:37+00:00Nataliia Solomkonatalirs1985@gmail.com2024-08-15T10:20:31+00:00urn:sha1:663e468de2b431f771534b4e3a2d00a5924b98feT6648: dhcpv6-server: align stateless DHCPv6 options with stateful2024-08-12T20:23:52+00:00Lucas Christianlucas@lucasec.com2024-08-11T22:18:38+00:00urn:sha1:a2b6098e6f9c1915a61a9aebc8f9852bd897387cfirewall: T4694: fix GRE key include path in XML2024-08-05T05:44:29+00:00Christian Breunigchristian@breunig.cc2024-08-05T05:44:29+00:00urn:sha1:6e910723ed9bd7f510f39379298bd98375608bfafirewall: T4694: Adding GRE flags & fields matches to firewall rules2024-08-04T07:52:57+00:00Andrew Toppandrewt@telekinetica.net2024-08-04T07:52:57+00:00urn:sha1:60b0614296874c144665417130d4881461114db0
* Only matching flags and fields used by modern RFC2890 "extended GRE" -
this is backwards-compatible, but does not match all possible flags.
* There are no nftables helpers for the GRE key field, which is critical
to match individual tunnel sessions (more detail in the forum post)
* nft expression syntax is not flexible enough for multiple field
matches in a single rule and the key offset changes depending on flags.
* Thus, clumsy compromise in requiring an explicit match on the "checksum"
flag if a key is present, so we know where key will be. In most cases,
nobody uses the checksum, but assuming it to be off or automatically
adding a "not checksum" match unless told otherwise would be confusing
* The automatic "flags key" check when specifying a key doesn't have similar
validation, I added it first and it makes sense. I would still like
to find a workaround to the "checksum" offset problem.
* If we could add 2 rules from 1 config definition, we could match
both cases with appropriate offsets, but this would break existing
FW generation logic, logging, etc.
* Added a "test_gre_match" smoketest
T4072: change same helpers in xml definitions; add notrack action for prerouting chain; re introduce <set vrf> in policy; change global options for passing traffic to IPvX firewall; update smoketest2024-08-02T12:50:26+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-31T12:42:25+00:00urn:sha1:c33cd6157ebc5c08dc1e3ff1aa36f2d2fbb9ca83T6570: firewall: add global-option to configure sysctl parameter for enabling/disabling sending traffic from bridge layer to ipvX layer2024-08-01T16:25:39+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-24T17:40:28+00:00urn:sha1:a8a9cfe750da719605ab90ce8c83c42276ab07f3