Code

support IPv6#42

Code

Open

jasonwee wants to merge 158 commits intorfxn:masterrfxn/advanced-policy-firewall:masterfrom jasonwee:masterjasonwee/advanced-policy-firewall:masterCopy head branch name to clipboard

+3,754-882

Commits

Commits on Jan 29, 2021

• indentation

  jasonwee

  committed
  339f30f

  Copy full SHA for 339f30f

• initial support for ipv6 firewall rules

  jasonwee

  committed
  a093f25

  Copy full SHA for a093f25

• indentation so easier to read

  jasonwee

  committed
  2a2bf7e

  Copy full SHA for 2a2bf7e

• added chain TALLOW, TGALLOW, TDENY and TGDENY to ip6tables

  jasonwee

  committed
  be0ac9c

  Copy full SHA for be0ac9c

• tested work okay

  jasonwee

  committed
  d40f57c

  Copy full SHA for d40f57c

• ignoring ipv4 address when setup rules for ipv6

  jasonwee

  committed
  b9fee24

  Copy full SHA for b9fee24

• rearrange ordering

  jasonwee

  committed
  fb58ad9

  Copy full SHA for fb58ad9

• when vnet is enable, make it support ipv6 network

  jasonwee

  committed
  8635ddc

  Copy full SHA for 8635ddc

• spacing

  jasonwee

  committed
  31bdabd

  Copy full SHA for 31bdabd

• when allow or deny network is a subnet, then we have to check if it is ipv4 subnet

  jasonwee

  committed
  cf5cf64

  Copy full SHA for cf5cf64

• dont hardcode untrusted iface

  jasonwee

  committed
  21c6730

  Copy full SHA for 21c6730

• spelling

  jasonwee

  committed
  09906fb

  Copy full SHA for 09906fb

• should be IP6T

  jasonwee

  committed
  816732a

  Copy full SHA for 816732a

• tested work for ipv6 hostname but not address, need sometime to change to make it work due to colon in ipv6 address

  jasonwee

  committed
  2779ca1

  Copy full SHA for 2779ca1

• sync with upstream

  jasonwee

  committed
  3e60c7e

  Copy full SHA for 3e60c7e

• repatch ipv6

  jasonwee

  committed
  08e5448

  Copy full SHA for 08e5448

Commits on May 24, 2021

• merge from upstream

  jasonwee

  committed
  c104863

  Copy full SHA for c104863

• Merge branch 'rfxn:master' into master

  jasonwee

  committed
  f98e9bb

  Copy full SHA for f98e9bb

Commits on Jun 25, 2021

• cherry pick but only selected files from roberto patched

  jasonwee

  committed
  80830c9

  Copy full SHA for 80830c9

Commits on Feb 9, 2022

• Implementation as specified in rfxn#38 (comment) but don't really work. Commit it here for the work done

  jasonwee

  committed
  6e79b63

  Copy full SHA for 6e79b63

• removed empty space

  jasonwee

  committed
  48123b7

  Copy full SHA for 48123b7

• just restart

  jasonwee

  committed
  85302df

  Copy full SHA for 85302df

• not required

  jasonwee

  committed
  4cc879c

  Copy full SHA for 4cc879c

• Merge pull request #5 from jasonwee/support-docker

  Show description for b3e733c
  jasonwee

  authored
  b3e733c

  Copy full SHA for b3e733c

Commits on Feb 15, 2022

• load iptable_nat module so when cat /proc/net/ip_tables_names, nat will be shown and table nat is flushed correctly

  jasonwee

  committed
  8498f58

  Copy full SHA for 8498f58

• Merge pull request #6 from jasonwee/support-iptable-nat-in-almalinux8

  Show description for 0f32694
  jasonwee

  authored
  0f32694

  Copy full SHA for 0f32694

Commits on Mar 1, 2022

• support customized docker rules

  jasonwee

  committed
  b590cdb

  Copy full SHA for b590cdb

• Merge pull request #7 from jasonwee/support-docker

  Show description for aeb9aa7
  jasonwee

  authored
  aeb9aa7

  Copy full SHA for aeb9aa7

Commits on Mar 2, 2022

• in almalinux8, ip6_tables is not loaded, so load now. but even if ti loaded, in almalinux8, it is empty, so now check if NFT is executable, try to list chains via nft api

  jasonwee

  committed
  458f4e0

  Copy full SHA for 458f4e0

• Merge pull request #8 from jasonwee/support-load-ip6-tables-almalinux8

  Show description for fbab1fa
  jasonwee

  authored
  fbab1fa

  Copy full SHA for fbab1fa

Commits on Mar 4, 2022

• upstream fix

  jasonwee

  committed
  88afed8

  Copy full SHA for 88afed8

• added differences with upstream

  jasonwee

  committed
  c5e7d47

  Copy full SHA for c5e7d47

Commits on Mar 7, 2022

• update doc for netfilter support

  jasonwee

  committed
  577a810

  Copy full SHA for 577a810

• added configuration use_iptables for fallback

  jasonwee

  committed
  adc4ea9

  Copy full SHA for adc4ea9

• nft docs

  jasonwee

  committed
  ea19ba1

  Copy full SHA for ea19ba1

Commits on Mar 11, 2022

• sync to the main conf.apf

  jasonwee

  committed
  70d5255

  Copy full SHA for 70d5255

• added nft example

  jasonwee

  committed
  e466dd2

  Copy full SHA for e466dd2

• added executor to select between iptables or nft

  jasonwee

  committed
  e3b2f8b

  Copy full SHA for e3b2f8b

• initial identify all spots for all nft patch

  jasonwee

  committed
  f39afa6

  Copy full SHA for f39afa6

Commits on Mar 13, 2022

• implement nft in log.rules

  jasonwee

  committed
  51f89a2

  Copy full SHA for 51f89a2

Commits on Sep 17, 2022

• initial patch

  jasonwee

  committed
  6b4e9eb

  Copy full SHA for 6b4e9eb

Commits on Sep 27, 2022

• commit work done

  jasonwee

  committed
  45bf70f

  Copy full SHA for 45bf70f

• commit work done

  jasonwee

  committed
  2d67bf0

  Copy full SHA for 2d67bf0

• just symlink functions as it is called by apf.init

  jasonwee

  committed
  c2731f9

  Copy full SHA for c2731f9

• copied from almalinux

  jasonwee

  committed
  2ce95a4

  Copy full SHA for 2ce95a4

• Merge pull request #9 from jasonwee/support-debian

  Show description for 0f6ad9e
  jasonwee

  authored
  0f6ad9e

  Copy full SHA for 0f6ad9e

Commits on Oct 31, 2022

• support header in wget gd and ga

  jasonwee

  committed
  87db424

  Copy full SHA for 87db424

• Merge pull request #10 from jasonwee/support-http-basic-auth-glob-allow-deny

  Show description for 26ccad6
  jasonwee

  authored
  26ccad6

  Copy full SHA for 26ccad6

Commits on Jan 3, 2023

• use helper_ssh_port

  jasonwee

  committed
  f68de38

  Copy full SHA for f68de38

• patch to support nft

  jasonwee

  committed
  d1edd62

  Copy full SHA for d1edd62

Commits on Jan 17, 2023

• exclude curly brackets and empty lines aka newline

  jasonwee

  committed
  d49e60a

  Copy full SHA for d49e60a

• dont need double specify nft

  jasonwee

  committed
  d922d8b

  Copy full SHA for d922d8b

• indentation

  jasonwee

  committed
  1202415

  Copy full SHA for 1202415

• tested, dont hardcode and before jump to the input chain, need to create the chain first

  jasonwee

  committed
  d8c7324

  Copy full SHA for d8c7324

Commits on Feb 14, 2023

• fix range

  jasonwee

  committed
  2b6401b

  Copy full SHA for 2b6401b

• put to else block

  jasonwee

  committed
  dad8c8b

  Copy full SHA for dad8c8b

• need if else so vnet for ipv6 wont break on nft on filter ip

  jasonwee

  committed
  26bbf89

  Copy full SHA for 26bbf89

• fix mistakes

  jasonwee

  committed
  7cda89d

  Copy full SHA for 7cda89d

• do the TODO

  jasonwee

  committed
  d220997

  Copy full SHA for d220997

• implements ipv6 nftable

  jasonwee

  committed
  6dfbc2f

  Copy full SHA for 6dfbc2f

• implements ipv6 nftable

  jasonwee

  committed
  5f243b8

  Copy full SHA for 5f243b8

• implement limit

  jasonwee

  committed
  83152ad

  Copy full SHA for 83152ad

• fix mistake on ICMP_EARGS. also, dont enable icmp, but respect the variable icmp port specified in IG_ICMP_TYPES

  jasonwee

  committed
  ab476ce

  Copy full SHA for ab476ce

• added documentation

  jasonwee

  committed
  8b4bb45

  Copy full SHA for 8b4bb45

• fix mistakes

  jasonwee

  committed
  a7be126

  Copy full SHA for a7be126

• complete todo

  jasonwee

  committed
  5081a52

  Copy full SHA for 5081a52

• added limit

  jasonwee

  committed
  0792b69

  Copy full SHA for 0792b69

• full implementation

  jasonwee

  committed
  881c52f

  Copy full SHA for 881c52f

• full implementation

  jasonwee

  committed
  d000f0b

  Copy full SHA for d000f0b

• full implementation

  jasonwee

  committed
  b5f7b59

  Copy full SHA for b5f7b59

• fix bug

  jasonwee

  committed
  9280417

  Copy full SHA for 9280417

• bugs fixes

  jasonwee

  committed
  d69d104

  Copy full SHA for d69d104

Commits on Mar 1, 2023

• fix mistake

  jasonwee

  committed
  71ed591

  Copy full SHA for 71ed591

Commits on Mar 7, 2023

• indentation

  jasonwee

  committed
  1a5fad5

  Copy full SHA for 1a5fad5

• need quote

  jasonwee

  committed
  74d6d46

  Copy full SHA for 74d6d46

• fixed typo

  jasonwee

  committed
  1625223

  Copy full SHA for 1625223

• forget filter TDENY

  jasonwee

  committed
  22490f7

  Copy full SHA for 22490f7

• no recent module in nftable

  jasonwee

  committed
  8f77f25

  Copy full SHA for 8f77f25

• fix mistakes

  jasonwee

  committed
  eb4b3d2

  Copy full SHA for eb4b3d2

• fix mistakes

  jasonwee

  committed
  39ffc9e

  Copy full SHA for 39ffc9e

• fix mistake and identation

  jasonwee

  committed
  efa4e16

  Copy full SHA for efa4e16

• indentation

  jasonwee

  committed
  2f8f187

  Copy full SHA for 2f8f187

• fix mistake

  jasonwee

  committed
  2953294

  Copy full SHA for 2953294

• idnetation and fixes

  jasonwee

  committed
  02ad602

  Copy full SHA for 02ad602

• added log_target for nftable

  jasonwee

  committed
  42cbd77

  Copy full SHA for 42cbd77

• identation and fix small mistake

  jasonwee

  committed
  e902843

  Copy full SHA for e902843

• no need jump, just set the stop action

  jasonwee

  committed
  d875e55

  Copy full SHA for d875e55

• fix mistakes and indentation

  jasonwee

  committed
  c956094

  Copy full SHA for c956094

• fix mistakes and indentation

  jasonwee

  committed
  9c43951

  Copy full SHA for 9c43951

• fix mistakes

  jasonwee

  committed
  ae92731

  Copy full SHA for ae92731

• fix mistakes

  jasonwee

  committed
  be0a557

  Copy full SHA for be0a557

• fix mistakes and implemented todo

  jasonwee

  committed
  b498122

  Copy full SHA for b498122

• TODO, need to autotranslate

  jasonwee

  committed
  8af158b

  Copy full SHA for 8af158b

• fixed mistakes

  jasonwee

  committed
  447650d

  Copy full SHA for 447650d

• fixed mistakes

  jasonwee

  committed
  5f06a55

  Copy full SHA for 5f06a55

• fixed mistakes

  jasonwee

  committed
  f44838f

  Copy full SHA for f44838f

• fixed mistakes

  jasonwee

  committed
  26eb1f6

  Copy full SHA for 26eb1f6

• implement real stuff

  jasonwee

  committed
  10fd53a

  Copy full SHA for 10fd53a

Commits on Mar 8, 2023

• load module in the correct path

  jasonwee

  committed
  9c77424

  Copy full SHA for 9c77424

Commits on Mar 14, 2023

• no need load multiple times

  jasonwee

  committed
  310d6b7

  Copy full SHA for 310d6b7

• actual implementation

  jasonwee

  committed
  945d95d

  Copy full SHA for 945d95d

• ident properly so easier to read

  jasonwee

  committed
  6cc3ec9

  Copy full SHA for 6cc3ec9

• tested

  jasonwee

  committed
  2033583

  Copy full SHA for 2033583

• it is okay

  jasonwee

  committed
  bd6ab45

  Copy full SHA for bd6ab45

• change echo

  jasonwee

  committed
  13beeb4

  Copy full SHA for 13beeb4

• identation

  jasonwee

  committed
  212eadf

  Copy full SHA for 212eadf

Commits on Mar 22, 2023

• ignore curly brackets and blank lines

  jasonwee

  committed
  06a19fa

  Copy full SHA for 06a19fa

• not ip6 but ip. also port range is different.

  jasonwee

  committed
  aa5454d

  Copy full SHA for aa5454d

• identation

  jasonwee

  committed
  ec320f4

  Copy full SHA for ec320f4

• not ip6 but ip. also port range is different.

  jasonwee

  committed
  d964f31

  Copy full SHA for d964f31

• identation

  jasonwee

  committed
  1635803

  Copy full SHA for 1635803

• not ip6 but ip. also port range is different.

  jasonwee

  committed
  8e72080

  Copy full SHA for 8e72080

• identation

  jasonwee

  committed
  b671d2c

  Copy full SHA for b671d2c

Commits on Mar 29, 2023

• not ip6 but ip. also port range is different.

  jasonwee

  committed
  5965548

  Copy full SHA for 5965548

• identation

  jasonwee

  committed
  8a1c357

  Copy full SHA for 8a1c357

Commits on Apr 4, 2023

• implement todo for ipv6

  jasonwee

  committed
  6cc7e17

  Copy full SHA for 6cc7e17

• identation

  jasonwee

  committed
  44fe7fe

  Copy full SHA for 44fe7fe

• implement todo for ipv6 and fix broken rules

  jasonwee

  committed
  9003d25

  Copy full SHA for 9003d25

• TODO, need to autotranslate

  jasonwee

  committed
  6e5f280

  Copy full SHA for 6e5f280

• implement todo for ipv6 and fix broken rules

  jasonwee

  committed
  c483581

  Copy full SHA for c483581

• implement todo for ipv6 and fix broken rules

  jasonwee

  committed
  183c28e

  Copy full SHA for 183c28e

• identation

  jasonwee

  committed
  558dbab

  Copy full SHA for 558dbab

Commits on Apr 12, 2023

• indentation and fix mistakes

  jasonwee

  committed
  7345a62

  Copy full SHA for 7345a62

• identation

  jasonwee

  committed
  742fc43

  Copy full SHA for 742fc43

• fixed

  jasonwee

  committed
  ad8128c

  Copy full SHA for ad8128c

Commits on Apr 19, 2023

• identation and fixed

  jasonwee

  committed
  5209b81

  Copy full SHA for 5209b81

• identation

  jasonwee

  committed
  22c1e52

  Copy full SHA for 22c1e52

Commits on Apr 20, 2023

• auto convert

  jasonwee

  committed
  c8cc97b

  Copy full SHA for c8cc97b

Commits on Apr 26, 2023

• fixed

  jasonwee

  committed
  7a18359

  Copy full SHA for 7a18359

• implemented auto convert to nftable equivalent

  jasonwee

  committed
  590a816

  Copy full SHA for 590a816

• change to 1

  jasonwee

  committed
  39a094a

  Copy full SHA for 39a094a

• updated

  jasonwee

  committed
  2f92bdb

  Copy full SHA for 2f92bdb

• updated

  jasonwee

  committed
  f4c4377

  Copy full SHA for f4c4377

Commits on May 1, 2023

• icmp type type and icmpv6 type type for nftables

  jasonwee

  committed
  e1fc8f0

  Copy full SHA for e1fc8f0

• need to explicitly add table mangle and its chain (PREROUTING or POSTROUTING)

  jasonwee

  committed
  640fe51

  Copy full SHA for 640fe51

• except itable recent module

  jasonwee

  committed
  31e1f3a

  Copy full SHA for 31e1f3a

• Merge pull request #11 from jasonwee/support-nft

  Show description for 1cf6252
  jasonwee

  authored
  1cf6252

  Copy full SHA for 1cf6252

Commits on May 16, 2023

• extra modules

  jasonwee

  committed
  d6b3a46

  Copy full SHA for d6b3a46

• Merge pull request #12 from jasonwee/support-nft

  Show description for d685b70
  jasonwee

  authored
  d685b70

  Copy full SHA for d685b70

• identation

  jasonwee

  committed
  6eacc85

  Copy full SHA for 6eacc85

• Merge pull request #13 from jasonwee/support-nft

  Show description for 33efcc1
  jasonwee

  authored
  33efcc1

  Copy full SHA for 33efcc1

Commits on Sep 25, 2023

• ipv4 rules must always set

  jasonwee

  committed
  42ef2e9

  Copy full SHA for 42ef2e9

• Merge pull request #14 from jasonwee/fix-1

  Show description for d8339fd
  jasonwee

  authored
  d8339fd

  Copy full SHA for d8339fd

Commits on Oct 9, 2023

• check if hostname is resolvable to ipv6 address before actually run the ip6tables commands

  jasonwee

  committed
  a56b898

  Copy full SHA for a56b898

• Merge pull request #15 from jasonwee/support-check-hostname-resolvable-to-ipv6-address

  Show description for 2100b39
  jasonwee

  authored
  2100b39

  Copy full SHA for 2100b39

Commits on Oct 23, 2023

• tested

  jasonwee

  committed
  516003c

  Copy full SHA for 516003c

• Merge pull request #16 from jasonwee/support-check-hostname-resolvable-to-ipv6-address-1

  Show description for 0cfaa2d
  jasonwee

  authored
  0cfaa2d

  Copy full SHA for 0cfaa2d

Commits on Jan 31, 2024

• require create table first.. then chain inside table

  jasonwee

  authored
  54371b1

  Copy full SHA for 54371b1

• Update firewall

  jasonwee

  authored
  5c4cb26

  Copy full SHA for 5c4cb26

Commits on Feb 6, 2024

• Update firewall

  jasonwee

  authored
  cc4b2be

  Copy full SHA for cc4b2be

• Update functions.apf

  jasonwee

  authored
  7be8191

  Copy full SHA for 7be8191

• Update preroute.rules

  jasonwee

  authored
  3d58e29

  Copy full SHA for 3d58e29

• first round identation

  jasonwee

  committed
  e802304

  Copy full SHA for e802304

• second round identation

  jasonwee

  committed
  38709b5

  Copy full SHA for 38709b5

• Merge pull request #17 from jasonwee/review-icmp-block

  Show description for 9684a4b
  jasonwee

  authored
  9684a4b

  Copy full SHA for 9684a4b

Commits on Feb 20, 2024

• identation

  jasonwee

  committed
  3ab8cd3

  Copy full SHA for 3ab8cd3

• nft ip6 ig icmp types code does not really work, use types instead

  jasonwee

  committed
  769d4b3

  Copy full SHA for 769d4b3

• if ipv6 and nft executor are enabled, then set correclty for ig icmp types. this is require so ipv6 slaac default gw will work

  jasonwee

  committed
  a3b1b33

  Copy full SHA for a3b1b33