From bfdba4079b0a76a8c578277adae3f36add832b41 Mon Sep 17 00:00:00 2001 From: opswill Date: Thu, 5 Jun 2025 12:04:10 +0800 Subject: T7523: firewall: Accepting invalid traffic for pppoe discovery and wol --- data/templates/firewall/nftables.j2 | 2 ++ interface-definitions/include/firewall/global-options.xml.i | 2 +- smoketest/scripts/cli/test_firewall.py | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index f5cd801e4..bf051bb57 100755 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -416,7 +416,9 @@ table bridge vyos_filter { ct state invalid ether type arp counter accept ct state invalid ether type 8021q counter accept ct state invalid ether type 8021ad counter accept + ct state invalid ether type 0x8863 counter accept ct state invalid ether type 0x8864 counter accept + ct state invalid ether type 0x0842 counter accept {% endif %} {% endif %} {% if global_options.state_policy is vyos_defined %} diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 01ea16bc6..794da4f9d 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -51,7 +51,7 @@ - Accept ARP, 802.1q, 802.1ad, DHCP and PPPoE despite being marked as invalid connections + Accept ARP, 802.1q, 802.1ad, DHCP, PPPoE and WoL despite being marked as invalid connections diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 0b2287f74..2d850dfdf 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -785,7 +785,9 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['ct state invalid', 'ether type arp', 'accept'], ['ct state invalid', 'ether type 8021q', 'accept'], ['ct state invalid', 'ether type 8021ad', 'accept'], + ['ct state invalid', 'ether type 0x8863', 'accept'], ['ct state invalid', 'ether type 0x8864', 'accept'], + ['ct state invalid', 'ether type 0x0842', 'accept'], ['chain VYOS_PREROUTING_filter'], ['type filter hook prerouting priority filter; policy accept;'], ['ip6 daddr @A6_AGV6', 'notrack'], -- cgit v1.2.3