summaryrefslogtreecommitdiff
path: root/interface-definitions/include
diff options
context:
space:
mode:
authorDaniil Baturin <daniil@vyos.io>2024-09-02 12:01:50 +0100
committerGitHub <noreply@github.com>2024-09-02 12:01:50 +0100
commitc78c5bd7e65b19e0e50ef6944dc74fb33660ff71 (patch)
tree8662a3ade15426575ed0280902b566c2b4c204a2 /interface-definitions/include
parent497863bb45cf9a20ce9e055c8b09f31c75754941 (diff)
parent8e0e1a99e5510c7575ab8a09145d6b4354692d55 (diff)
downloadvyos-1x-c78c5bd7e65b19e0e50ef6944dc74fb33660ff71.tar.gz
vyos-1x-c78c5bd7e65b19e0e50ef6944dc74fb33660ff71.zip
Merge pull request #4018 from nicolas-fort/T6647
T6647: firewall. Introduce patch for accepting invalid ARP and DHCP
Diffstat (limited to 'interface-definitions/include')
-rwxr-xr-x[-rw-r--r--]interface-definitions/include/firewall/common-rule-bridge.xml.i1
-rwxr-xr-x[-rw-r--r--]interface-definitions/include/firewall/global-options.xml.i6
-rwxr-xr-xinterface-definitions/include/firewall/match-ether-type.xml.i30
3 files changed, 37 insertions, 0 deletions
diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i
index 9ae28f7be..80088bbec 100644..100755
--- a/interface-definitions/include/firewall/common-rule-bridge.xml.i
+++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i
@@ -10,6 +10,7 @@
#include <include/firewall/limit.xml.i>
#include <include/firewall/log.xml.i>
#include <include/firewall/log-options.xml.i>
+#include <include/firewall/match-ether-type.xml.i>
#include <include/firewall/match-ipsec.xml.i>
#include <include/firewall/match-vlan.xml.i>
#include <include/firewall/nft-queue.xml.i>
diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
index cee8f1854..05fdd75cb 100644..100755
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -49,6 +49,12 @@
<help>Apply configured firewall rules to traffic switched by bridges</help>
</properties>
<children>
+ <leafNode name="invalid-connections">
+ <properties>
+ <help>Accept ARP and DHCP despite they are marked as invalid connection</help>
+ <valueless/>
+ </properties>
+ </leafNode>
<leafNode name="ipv4">
<properties>
<help>Apply configured IPv4 firewall rules</help>
diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i
new file mode 100755
index 000000000..abfa9034d
--- /dev/null
+++ b/interface-definitions/include/firewall/match-ether-type.xml.i
@@ -0,0 +1,30 @@
+<!-- include start from firewall/match-ether-type.xml.i -->
+<leafNode name="ethernet-type">
+ <properties>
+ <help>Ethernet type</help>
+ <completionHelp>
+ <list>802.1q 802.1ad arp ipv4 ipv6</list>
+ </completionHelp>
+ <valueHelp>
+ <format>802.1q</format>
+ <description>Customer VLAN tag type</description>
+ </valueHelp>
+ <valueHelp>
+ <format>802.1ad</format>
+ <description>Service VLAN tag type</description>
+ </valueHelp>
+ <valueHelp>
+ <format>arp</format>
+ <description>Adress Resolution Protocol</description>
+ </valueHelp>
+ <valueHelp>
+ <format>_ipv4</format>
+ <description>Internet Protocol version 4</description>
+ </valueHelp>
+ <valueHelp>
+ <format>_ipv6</format>
+ <description>Internet Protocol version 6</description>
+ </valueHelp>
+ </properties>
+</leafNode>
+<!-- include end -->