vyos-1x.git/src/migration-scripts/firewall, branch T6732-reusable-build-imageVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=T6732-reusable-build-image2024-07-29T15:05:21+00:00firewall: T4694: incomplete node checks in migration script2024-07-29T15:05:21+00:00Andrew Toppandrewt@telekinetica.net2024-07-29T15:05:21+00:00urn:sha1:3d42009c0e3cf5ea7ea0ed167b4d8f655667edd8
This patch on #3616 will only attempt to fix ipsec matches in rules if the
firewall config tree passed to migrate_chain() has rules attached.
firewall: T4694: Adding rt ipsec exists/missing match to firewall configs (#3616)2024-07-28T11:47:07+00:00talmakionandrewt@telekinetica.net2024-07-28T11:47:07+00:00urn:sha1:e2bf8812f73a75356f56274968be8859a2186d73
* Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for
fw rules
* Add ipsec match-ipsec-out and match-none-out
* Change all the points where the match-ipsec.xml.i include was used
before, making sure the new includes (match-ipsec-in/out.xml.i) are
used appropriately. There were a handful of spots where match-ipsec.xml.i
had snuck back in for output hooked chains already
(the common-rule-* includes)
* Add the -out generators to rendered templates
* Heavy modification to firewall config validators:
* I needed to check for ipsec-in matches no matter how deeply nested
under an output-hook chain(via jump-target) - this always generates
an error.
* Ended up retrofitting the jump-targets validator from root chains
and for named custom chains. It checks for recursive loops and improper
IPsec matches.
* Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation"
smoketestsT6536: change wildcard character from + to * - extend fix to interfaces defined in zone policy.2024-07-03T13:05:35+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-03T12:53:56+00:00urn:sha1:66ec278393dbabe71f320c543816f27797d51140migration: T6007: convert all migration scripts to load as module2024-06-26T20:38:41+00:00John Estabrookjestabro@vyos.io2024-06-20T01:16:05+00:00urn:sha1:26740a8d583f64dc0a27b59dd4ae303056972c0bfirewall: T3900: fix migration and smoketests2024-06-11T07:51:15+00:00Christian Breunigchristian@breunig.cc2024-06-11T07:49:11+00:00urn:sha1:2cbc4eb005fc936e37a34a1ef539d164f21f90b5
Commit 770edf016838523 ("T3900: T6394: extend functionalities in firewall")
changed the position in the CLI for conntrack timeout. This lead to failing
smoketests because of a regression in the migrator.
T3900: T6394: extend functionalities in firewall; move netfilter sysctl timeout parameters defined in conntrack to firewall global-opton section.2024-06-04T13:22:24+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-24T16:44:41+00:00urn:sha1:770edf016838523c248e3c8a36c5f327a0b98415T5535: firewall: migrate command <set system ip disable-directed-broadcast> to firewall global-optinos2024-04-15T14:15:14+00:00Nicolas Fortnicolasfort1988@gmail.com2024-04-15T14:15:14+00:00urn:sha1:76dcecafca977b640dd16d8e68c4a050ca1af4fbT6216: firewall: add patch while migrating from 1.3 to 1.4 in order to avoid errors when using character <+> in 1.3 in firewall groups and custom firewall chains.2024-04-11T12:12:14+00:00Nicolas Fortnicolasfort1988@gmail.com2024-04-10T13:44:07+00:00urn:sha1:36baf771b8ea52487bf6c913d2019f926acbc4f3T6199: remove unused Python imports from migration scripts2024-04-06T08:46:30+00:00Christian Breunigchristian@breunig.cc2024-04-06T08:46:30+00:00urn:sha1:489e6fababa60d9c0fbfdb421305cbe563432499firewall: T6071: truncate rule description field to 255 characters2024-03-10T13:14:51+00:00Christian Breunigchristian@breunig.cc2024-03-10T11:51:56+00:00urn:sha1:259ef4740413b39da9b122db19c549eeec88114c