summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authoropswill <root@opswill.com>2024-12-13 11:25:01 +0800
committeropswill <root@opswill.com>2024-12-13 15:50:06 +0800
commitc94dabede31447f3d1eaded08b448f944087539d (patch)
tree3e150b9627e64e009470cacaab755058d5aaf0c4
parent4221687fc7a0482b13a79358f9b0d085ec0835f6 (diff)
downloadvyos-1x-c94dabede31447f3d1eaded08b448f944087539d.tar.gz
vyos-1x-c94dabede31447f3d1eaded08b448f944087539d.zip
T6918: Accept invalid PPPoE Session in stateful bridge firewall.
-rwxr-xr-xdata/templates/firewall/nftables.j23
-rw-r--r--interface-definitions/include/firewall/global-options.xml.i2
-rwxr-xr-xsmoketest/scripts/cli/test_firewall.py1
3 files changed, 4 insertions, 2 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index 034328400..a35143870 100755
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -382,6 +382,7 @@ table bridge vyos_filter {
{% if 'invalid_connections' in global_options.apply_to_bridged_traffic %}
ct state invalid udp sport 67 udp dport 68 counter accept
ct state invalid ether type arp counter accept
+ ct state invalid ether type 0x8864 counter accept
{% endif %}
{% endif %}
{% if global_options.state_policy is vyos_defined %}
@@ -445,4 +446,4 @@ table bridge vyos_filter {
return
}
{% endif %}
-} \ No newline at end of file
+}
diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
index 05fdd75cb..51c6b1efd 100644
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -51,7 +51,7 @@
<children>
<leafNode name="invalid-connections">
<properties>
- <help>Accept ARP and DHCP despite they are marked as invalid connection</help>
+ <help>Accept ARP DHCP and PPPoE despite they are marked as invalid connection</help>
<valueless/>
</properties>
</leafNode>
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index 2d18f0495..6420afa38 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -765,6 +765,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
['type filter hook output priority filter; policy accept;'],
['ct state invalid', 'udp sport 67', 'udp dport 68', 'accept'],
['ct state invalid', 'ether type arp', 'accept'],
+ ['ct state invalid', 'ether type 0x8864', 'accept'],
['chain VYOS_PREROUTING_filter'],
['type filter hook prerouting priority filter; policy accept;'],
['ip6 daddr @A6_AGV6', 'notrack'],