vyos-1x.git/src/migration-scripts/firewall, branch T7065-pr-mirror-trigger-restrictVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=T7065-pr-mirror-trigger-restrict2025-01-06T11:05:22+00:00T6841: firewall: migrate existing VRF in zone based firewall2025-01-06T11:05:22+00:00Christian Breunigchristian@breunig.cc2025-01-06T10:56:53+00:00urn:sha1:dda428fc42c44decb3e661a7b6ba4e55b178dc4f
VRF support was introduced in VyOS 1.4.0. If a VRF is added as an interface in
the zone based firewall, it will be migrated to the new syntax.
OLD:
set firewall zone FOO interface RED
set firewall zone FOO interface eth0
NEW:
set firewall zone FOO member vrf RED
set firewall zone FOO member interface eth0
T6841: firewall: Fixed issues in ZBF when using VRFs2025-01-06T11:05:22+00:00aapostoliuka.apostoliuk@vyos.io2024-12-17T11:39:49+00:00urn:sha1:4a194b32509ffcd9574bb7571a5a6347f7dc4e42
Improve config parsing for ZBF when using VRFs and interfaces attached to VRFs
T6841: firewall: improve config parsing for ZBF when using VRFs and interfaces attached to VRFs2025-01-06T11:05:22+00:00Nicolas Fortnicolasfort1988@gmail.com2024-10-29T19:05:52+00:00urn:sha1:df176d9b9b4cc67ae509ae2ff17a02f2520cc881firewall: T4694: incomplete node checks in migration script2024-07-29T15:05:21+00:00Andrew Toppandrewt@telekinetica.net2024-07-29T15:05:21+00:00urn:sha1:3d42009c0e3cf5ea7ea0ed167b4d8f655667edd8
This patch on #3616 will only attempt to fix ipsec matches in rules if the
firewall config tree passed to migrate_chain() has rules attached.
firewall: T4694: Adding rt ipsec exists/missing match to firewall configs (#3616)2024-07-28T11:47:07+00:00talmakionandrewt@telekinetica.net2024-07-28T11:47:07+00:00urn:sha1:e2bf8812f73a75356f56274968be8859a2186d73
* Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for
fw rules
* Add ipsec match-ipsec-out and match-none-out
* Change all the points where the match-ipsec.xml.i include was used
before, making sure the new includes (match-ipsec-in/out.xml.i) are
used appropriately. There were a handful of spots where match-ipsec.xml.i
had snuck back in for output hooked chains already
(the common-rule-* includes)
* Add the -out generators to rendered templates
* Heavy modification to firewall config validators:
* I needed to check for ipsec-in matches no matter how deeply nested
under an output-hook chain(via jump-target) - this always generates
an error.
* Ended up retrofitting the jump-targets validator from root chains
and for named custom chains. It checks for recursive loops and improper
IPsec matches.
* Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation"
smoketestsT6536: change wildcard character from + to * - extend fix to interfaces defined in zone policy.2024-07-03T13:05:35+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-03T12:53:56+00:00urn:sha1:66ec278393dbabe71f320c543816f27797d51140migration: T6007: convert all migration scripts to load as module2024-06-26T20:38:41+00:00John Estabrookjestabro@vyos.io2024-06-20T01:16:05+00:00urn:sha1:26740a8d583f64dc0a27b59dd4ae303056972c0bfirewall: T3900: fix migration and smoketests2024-06-11T07:51:15+00:00Christian Breunigchristian@breunig.cc2024-06-11T07:49:11+00:00urn:sha1:2cbc4eb005fc936e37a34a1ef539d164f21f90b5
Commit 770edf016838523 ("T3900: T6394: extend functionalities in firewall")
changed the position in the CLI for conntrack timeout. This lead to failing
smoketests because of a regression in the migrator.
T3900: T6394: extend functionalities in firewall; move netfilter sysctl timeout parameters defined in conntrack to firewall global-opton section.2024-06-04T13:22:24+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-24T16:44:41+00:00urn:sha1:770edf016838523c248e3c8a36c5f327a0b98415T5535: firewall: migrate command <set system ip disable-directed-broadcast> to firewall global-optinos2024-04-15T14:15:14+00:00Nicolas Fortnicolasfort1988@gmail.com2024-04-15T14:15:14+00:00urn:sha1:76dcecafca977b640dd16d8e68c4a050ca1af4fb