From b47adae7a3e963bfca3b775f4b84d5121907c76d Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Sun, 1 Jun 2025 23:32:13 -0500 Subject: T7512: firewall: Modify accepting invalid traffic for VLAN aware bridge Allow accepting invalid packets for ethernet types `8021q` and `8021ad` in addition to ARP and UDP types so that stateful bridge firewall works for VLAN-aware bridges in addition to regular bridges. --- data/templates/firewall/nftables.j2 | 2 ++ interface-definitions/include/firewall/global-options.xml.i | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index a78119a80..f5cd801e4 100755 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -414,6 +414,8 @@ table bridge vyos_filter { {% if 'invalid_connections' in global_options.apply_to_bridged_traffic %} ct state invalid udp sport 67 udp dport 68 counter accept ct state invalid ether type arp counter accept + ct state invalid ether type 8021q counter accept + ct state invalid ether type 8021ad counter accept ct state invalid ether type 0x8864 counter accept {% endif %} {% endif %} diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 7393ff5c9..01ea16bc6 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -51,7 +51,7 @@ - Accept ARP, DHCP and PPPoE despite they are marked as invalid connection + Accept ARP, 802.1q, 802.1ad, DHCP and PPPoE despite being marked as invalid connections -- cgit v1.2.3 From ba6f88830e3075c32438787fa897116e0233e086 Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Sun, 1 Jun 2025 23:49:26 -0500 Subject: T7512: Update smoketest for invalid traffic for VLAN aware bridge --- smoketest/scripts/cli/test_firewall.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index bbe4de9df..0b2287f74 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -783,6 +783,8 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['type filter hook output priority filter; policy accept;'], ['ct state invalid', 'udp sport 67', 'udp dport 68', 'accept'], ['ct state invalid', 'ether type arp', 'accept'], + ['ct state invalid', 'ether type 8021q', 'accept'], + ['ct state invalid', 'ether type 8021ad', 'accept'], ['ct state invalid', 'ether type 0x8864', 'accept'], ['chain VYOS_PREROUTING_filter'], ['type filter hook prerouting priority filter; policy accept;'], -- cgit v1.2.3