From 8e0e1a99e5510c7575ab8a09145d6b4354692d55 Mon Sep 17 00:00:00 2001
From: Nicolas Fort <nicolasfort1988@gmail.com>
Date: Mon, 26 Aug 2024 18:10:01 +0000
Subject: T6647: firewall. Introduce patch for accepting ARP and DHCP replies
 on stateful bridge firewall. This patch is needed because ARP and DHCP are
 marked as invalid connections. Also, add ehternet-type matcher in bridge
 firewall.

---
 .../include/firewall/common-rule-bridge.xml.i      |  1 +
 .../include/firewall/global-options.xml.i          |  6 +++++
 .../include/firewall/match-ether-type.xml.i        | 30 ++++++++++++++++++++++
 3 files changed, 37 insertions(+)
 mode change 100644 => 100755 interface-definitions/include/firewall/common-rule-bridge.xml.i
 mode change 100644 => 100755 interface-definitions/include/firewall/global-options.xml.i
 create mode 100755 interface-definitions/include/firewall/match-ether-type.xml.i

(limited to 'interface-definitions/include/firewall')

diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i
old mode 100644
new mode 100755
index 9ae28f7be..80088bbec
--- a/interface-definitions/include/firewall/common-rule-bridge.xml.i
+++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i
@@ -10,6 +10,7 @@
 #include <include/firewall/limit.xml.i>
 #include <include/firewall/log.xml.i>
 #include <include/firewall/log-options.xml.i>
+#include <include/firewall/match-ether-type.xml.i>
 #include <include/firewall/match-ipsec.xml.i>
 #include <include/firewall/match-vlan.xml.i>
 #include <include/firewall/nft-queue.xml.i>
diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
old mode 100644
new mode 100755
index cee8f1854..05fdd75cb
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -49,6 +49,12 @@
         <help>Apply configured firewall rules to traffic switched by bridges</help>
       </properties>
       <children>
+        <leafNode name="invalid-connections">
+          <properties>
+            <help>Accept ARP and DHCP despite they are marked as invalid connection</help>
+            <valueless/>
+          </properties>
+        </leafNode>
         <leafNode name="ipv4">
           <properties>
             <help>Apply configured IPv4 firewall rules</help>
diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i
new file mode 100755
index 000000000..abfa9034d
--- /dev/null
+++ b/interface-definitions/include/firewall/match-ether-type.xml.i
@@ -0,0 +1,30 @@
+<!-- include start from firewall/match-ether-type.xml.i -->
+<leafNode name="ethernet-type">
+  <properties>
+    <help>Ethernet type</help>
+    <completionHelp>
+      <list>802.1q 802.1ad arp ipv4 ipv6</list>
+    </completionHelp>
+    <valueHelp>
+      <format>802.1q</format>
+      <description>Customer VLAN tag type</description>
+    </valueHelp>
+    <valueHelp>
+      <format>802.1ad</format>
+      <description>Service VLAN tag type</description>
+    </valueHelp>
+    <valueHelp>
+      <format>arp</format>
+      <description>Adress Resolution Protocol</description>
+    </valueHelp>
+    <valueHelp>
+      <format>_ipv4</format>
+      <description>Internet Protocol version 4</description>
+    </valueHelp>
+    <valueHelp>
+      <format>_ipv6</format>
+      <description>Internet Protocol version 6</description>
+    </valueHelp>
+  </properties>
+</leafNode>
+<!-- include end -->
-- 
cgit v1.2.3