Page MenuHomeVyOS Platform

Refactoring firewall ipv6 rule icmpv6
Closed, ResolvedPublicFEATURE REQUEST

Description

In the current firewall implementation, rule icmpv6 "type" node includes all codes/types/type-name that seems a wrong design.
For ipv4 it looks more correct.

ipv4

vyos@r6-roll# set firewall name FOO rule 10 icmp 
Possible completions:
   code         ICMP code (0-255)
   type         ICMP type (0-255)
   type-name    ICMP type-name

      
[edit]

ipv6

vyos@r6-roll# set firewall ipv6-name FOO rule 10 icmpv6 
Possible completions:
   type         ICMPv6 type/code

      
[edit]

As we don't configure "type" only

vyos@r6-roll# set firewall ipv6-name FOO rule 10 icmpv6 type 
Possible completions:
...
...
   ping         ICMPv6 type/code name
   echo-reply   ICMPv6 type/code name
   pong         ICMPv6 type/code name
   router-solicitation
                ICMPv6 type/code name
   router-advertisement
                ICMPv6 type/code name
   neighbour-solicitation
                ICMPv6 type/code name
   neighbor-solicitation
                ICMPv6 type/code name
   neighbour-advertisement
                ICMPv6 type/code name
   neighbor-advertisement
                ICMPv6 type/code name
   redirect     ICMPv6 type/code name
   <0-255>      ICMPv6 type number
   <0-255>/<0-255>
                ICMPv6 type and code numbers
   address-unreachable
                
   bad-header   
   communication-prohibited
...
...

Consider the possibility of migrating/rewriting to the correct node format. Where "type" and "code" are separate nodes/parameters.

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Related Objects