From b71702f64c417c2fcb8a1f967b40c24b4e425bbc Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Wed, 31 Jul 2024 12:42:25 +0000 Subject: [PATCH] T4072: change same helpers in xml definitions; add notrack action for prerouting chain; re introduce in policy; change global options for passing traffic to IPvX firewall; update smoketest --- .../firewall/sysctl-firewall.conf.j2 | 6 ++-- .../include/firewall/bridge-custom-name.xml.i | 1 + .../firewall/bridge-hook-forward.xml.i | 1 + .../include/firewall/bridge-hook-input.xml.i | 1 + .../include/firewall/bridge-hook-output.xml.i | 1 + .../firewall/bridge-hook-prerouting.xml.i | 3 +- .../include/firewall/common-rule-bridge.xml.i | 1 - .../include/firewall/global-options.xml.i | 2 +- .../firewall/set-packet-modifications.xml.i | 32 +++++++++++++++---- smoketest/scripts/cli/test_firewall.py | 7 ++-- 10 files changed, 38 insertions(+), 17 deletions(-) diff --git a/data/templates/firewall/sysctl-firewall.conf.j2 b/data/templates/firewall/sysctl-firewall.conf.j2 index ae6a8969c00..6c33ffdc85d 100644 --- a/data/templates/firewall/sysctl-firewall.conf.j2 +++ b/data/templates/firewall/sysctl-firewall.conf.j2 @@ -13,9 +13,9 @@ net.ipv4.conf.*.send_redirects = {{ 1 if global_options.send_redirects == 'enabl net.ipv4.tcp_syncookies = {{ 1 if global_options.syn_cookies == 'enable' else 0 }} net.ipv4.tcp_rfc1337 = {{ 1 if global_options.twa_hazards_protection == 'enable' else 0 }} -{% if global_options.apply_for_bridge is vyos_defined %} -net.bridge.bridge-nf-call-iptables = {{ 1 if global_options.apply_for_bridge.ipv4 is vyos_defined else 0 }} -net.bridge.bridge-nf-call-ip6tables = {{ 1 if global_options.apply_for_bridge.ipv6 is vyos_defined else 0 }} +{% if global_options.apply_to_bridged_traffic is vyos_defined %} +net.bridge.bridge-nf-call-iptables = {{ 1 if global_options.apply_to_bridged_traffic.ipv4 is vyos_defined else 0 }} +net.bridge.bridge-nf-call-ip6tables = {{ 1 if global_options.apply_to_bridged_traffic.ipv6 is vyos_defined else 0 }} {% else %} net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-ip6tables = 0 diff --git a/interface-definitions/include/firewall/bridge-custom-name.xml.i b/interface-definitions/include/firewall/bridge-custom-name.xml.i index 48d48949e12..9a2a829d069 100644 --- a/interface-definitions/include/firewall/bridge-custom-name.xml.i +++ b/interface-definitions/include/firewall/bridge-custom-name.xml.i @@ -32,6 +32,7 @@ #include + #include #include #include #include diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i index 0bc1fc357b8..fcc9819254f 100644 --- a/interface-definitions/include/firewall/bridge-hook-forward.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i @@ -26,6 +26,7 @@ #include + #include #include #include #include diff --git a/interface-definitions/include/firewall/bridge-hook-input.xml.i b/interface-definitions/include/firewall/bridge-hook-input.xml.i index 32de14d5417..f6a11f8dac2 100644 --- a/interface-definitions/include/firewall/bridge-hook-input.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-input.xml.i @@ -26,6 +26,7 @@ #include + #include #include #include #include diff --git a/interface-definitions/include/firewall/bridge-hook-output.xml.i b/interface-definitions/include/firewall/bridge-hook-output.xml.i index da0c02470c0..38b8b08cad7 100644 --- a/interface-definitions/include/firewall/bridge-hook-output.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-output.xml.i @@ -26,6 +26,7 @@ #include + #include #include #include #include diff --git a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i index b6c1fe87a7b..74e67f0ae94 100644 --- a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i @@ -14,7 +14,7 @@ #include - Bridge Firewall prerouting filter rule number + Bridge firewall prerouting filter rule number u32:1-999999 Number for this firewall rule @@ -26,6 +26,7 @@ #include + #include #include #include diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i index b47408aa83d..9ae28f7bee1 100644 --- a/interface-definitions/include/firewall/common-rule-bridge.xml.i +++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i @@ -1,7 +1,6 @@ #include #include -#include #include #include #include diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 1f289967256..cee8f1854d6 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -44,7 +44,7 @@ disable - + Apply configured firewall rules to traffic switched by bridges diff --git a/interface-definitions/include/firewall/set-packet-modifications.xml.i b/interface-definitions/include/firewall/set-packet-modifications.xml.i index eda568a0ebe..ee019b64ee7 100644 --- a/interface-definitions/include/firewall/set-packet-modifications.xml.i +++ b/interface-definitions/include/firewall/set-packet-modifications.xml.i @@ -6,10 +6,10 @@ - Connection marking + Set connection mark u32:0-2147483647 - Connection marking + Connection mark @@ -18,7 +18,7 @@ - Packet Differentiated Services Codepoint (DSCP) + Set DSCP (Packet Differentiated Services Codepoint) bits u32:0-63 DSCP number @@ -30,10 +30,10 @@ - Packet marking + Set packet mark u32:1-2147483647 - Packet marking + Packet mark @@ -42,7 +42,7 @@ - Routing table to forward packet with + Set the routing table for matched packets u32:1-200 Table number @@ -61,9 +61,27 @@ + + + VRF to forward packet with + + txt + VRF instance name + + + default + Forward into default global VRF + + + default + vrf name + + #include + + - TCP Maximum Segment Size + Set TCP Maximum Segment Size u32:500-1460 Explicitly set TCP MSS value diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 2287577c707..9184a4cfcaa 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -708,7 +708,7 @@ def test_bridge_firewall(self): self.cli_set(['firewall', 'group', 'ipv6-address-group', 'AGV6', 'address', '2001:db1::1']) self.cli_set(['firewall', 'global-options', 'state-policy', 'established', 'action', 'accept']) - self.cli_set(['firewall', 'global-options', 'apply-for-bridge', 'ipv4']) + self.cli_set(['firewall', 'global-options', 'apply-to-bridged-traffic', 'ipv4']) self.cli_set(['firewall', 'bridge', 'name', name, 'default-action', 'accept']) self.cli_set(['firewall', 'bridge', 'name', name, 'default-log']) @@ -731,10 +731,9 @@ def test_bridge_firewall(self): self.cli_set(['firewall', 'bridge', 'input', 'filter', 'rule', '1', 'source', 'address', '192.0.2.2']) self.cli_set(['firewall', 'bridge', 'input', 'filter', 'rule', '1', 'state', 'new']) - self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'action', 'drop']) + self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'action', 'notrack']) self.cli_set(['firewall', 'bridge', 'prerouting', 'filter', 'rule', '1', 'destination', 'group', 'ipv6-address-group', 'AGV6']) - self.cli_commit() nftables_search = [ @@ -755,7 +754,7 @@ def test_bridge_firewall(self): ['ct state new', 'ip saddr 192.0.2.2', f'iifname "{interface_in}"', 'accept'], ['chain VYOS_PREROUTING_filter'], ['type filter hook prerouting priority filter; policy accept;'], - ['ip6 daddr @A6_AGV6', 'drop'] + ['ip6 daddr @A6_AGV6', 'notrack'] ] self.verify_nftables(nftables_search, 'bridge vyos_filter')