vyos-1x.git/interface-definitions/system-conntrack.xml.in, branch feature/T9082-codeql-cpp

T5474: establish common file name pattern for XML conf mode commands

2023-12-31T22:49:48+00:00

We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in

T5779: conntrack: Apply fixes to . Remove what was not working on 1.3, migrate what was working to new syntax and extend feature for ipv6.

2023-12-05T10:44:19+00:00

conntrack: T5217: Add tcp flag matching to `system conntrack ignore`

2023-09-18T18:26:51+00:00

- Moves MSS node out of `tcp-flags.xml.i` and into `tcp-mss.xml.i` - Update smoketest to verify TCP flag matching

T4502: firewall: Add software flow offload using flowtable

2023-09-09T08:16:04+00:00

The following commands will enable nftables flowtable offload on interfaces eth0 eth1: ``` set firewall global-options flow-offload software interface set firewall global-options flow-offload hardware interface ``` Generated nftables rules: ``` table inet vyos_offload { flowtable VYOS_FLOWTABLE_software { hook ingress priority filter - 1; devices = { eth0, eth1, eth2, eth3 }; counter } chain VYOS_OFFLOAD_software { type filter hook forward priority filter - 1; policy accept; ct state { established, related } meta l4proto { tcp, udp } flow add @VYOS_FLOWTABLE_software } } ``` Use this option to count packets and bytes for each offloaded flow: ``` set system conntrack flow-accounting ``` To verify a connection is offloaded, run ``` cat /proc/net/nf_conntrack|grep OFFLOAD ``` This PR follows firewalld's implementation: https://github.com/firewalld/firewalld/blob/e748b97787d685d0ca93f58e8d4292e87d3f0da6/src/firewall/core/nftables.py#L590 A good introduction to nftables flowtable: https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath

conntrack: T4309: T4903: Refactor `system conntrack ignore` rule generation, add IPv6 support and firewall groups

2023-09-04T10:36:11+00:00

xml: T4952: improve interface completion helper CLI experience

2023-03-09T18:40:00+00:00

conntrack: T4691: lower "tcp max-retrans" upper limit

2022-09-15T06:46:51+00:00

Kernel 5.15.y and newer only support an upper boundary of 255. vyos@vyos:~$ sudo sysctl -w net.netfilter.nf_conntrack_tcp_max_retrans=255 net.netfilter.nf_conntrack_tcp_max_retrans = 255 vyos@vyos:~$ sudo sysctl -w net.netfilter.nf_conntrack_tcp_max_retrans=256 sysctl: setting key "net.netfilter.nf_conntrack_tcp_max_retrans": Invalid argument

xml: T4047: use full string match in the regex validator

2022-04-29T17:51:50+00:00

conntrack: T3579: make the timeout tree re-usable as XML include

2022-01-10T21:26:39+00:00

conntrack: T3579: migrate "conntrack ignore" tree to vyos-1x and nftables

2022-01-10T20:32:29+00:00