diff options
| author | Daniil Baturin <daniil@vyos.io> | 2024-12-18 11:17:33 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-12-18 11:17:33 +0000 |
| commit | 60743702bf2f2c4bdbf7402baa4e66a1e4f8ec38 (patch) | |
| tree | 1cda798f6d3f22c0e3f37710683ab0988fe71a9a | |
| parent | e0c6262a7e564f1be54020606ae32de74e9b016a (diff) | |
| parent | 833d5866b69dc346d8127845f32ebdcf9b647e59 (diff) | |
| download | vyos-1x-60743702bf2f2c4bdbf7402baa4e66a1e4f8ec38.tar.gz vyos-1x-60743702bf2f2c4bdbf7402baa4e66a1e4f8ec38.zip | |
Merge pull request #4236 from opswill/current
T6918: Accept invalid PPPoE Session in stateful bridge firewall.
| -rwxr-xr-x | data/templates/firewall/nftables.j2 | 3 | ||||
| -rw-r--r-- | interface-definitions/include/firewall/global-options.xml.i | 2 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 1 |
3 files changed, 4 insertions, 2 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 034328400..a35143870 100755 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -382,6 +382,7 @@ table bridge vyos_filter { {% if 'invalid_connections' in global_options.apply_to_bridged_traffic %} ct state invalid udp sport 67 udp dport 68 counter accept ct state invalid ether type arp counter accept + ct state invalid ether type 0x8864 counter accept {% endif %} {% endif %} {% if global_options.state_policy is vyos_defined %} @@ -445,4 +446,4 @@ table bridge vyos_filter { return } {% endif %} -}
\ No newline at end of file +} diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 05fdd75cb..355b41fde 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -51,7 +51,7 @@ <children> <leafNode name="invalid-connections"> <properties> - <help>Accept ARP and DHCP despite they are marked as invalid connection</help> + <help>Accept ARP, DHCP and PPPoE despite they are marked as invalid connection</help> <valueless/> </properties> </leafNode> diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 2d18f0495..6420afa38 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -765,6 +765,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['type filter hook output priority filter; policy accept;'], ['ct state invalid', 'udp sport 67', 'udp dport 68', 'accept'], ['ct state invalid', 'ether type arp', 'accept'], + ['ct state invalid', 'ether type 0x8864', 'accept'], ['chain VYOS_PREROUTING_filter'], ['type filter hook prerouting priority filter; policy accept;'], ['ip6 daddr @A6_AGV6', 'notrack'], |