@dmbaturin Just to confirm/clarify, does this mean the public sagitta branches will cease to receive public updates? It will now be impossible to inspect the LTS source code (or, in the case of 1.4 / sagitta, any future updates) without a subscription?

Since the --vyos-mirror string is copied directly, you can simply prepend it with [trusted=yes]; a new flag isn't really necessary:

I've been testing this for a few weeks now at home and haven't noticed any issues. That said, while I have 6 network zones and a few public services running, my home network isn't very complicated and doesn't have any "exotic" firewall rules. Since the changes are fairly minor and the smoketests pass, I don't think there should be any issues, though.

I'm not sure if wildcard-address fits. The address and the mask together combine to create the wildcard.

I implemented address-mask as described above as well: https://github.com/Rain/vyos-1x/commit/ca6b7340714c6161337f508978b9834722be58dc

On second thought, maybe instead of supporting the ::beef/::ffff syntax we add an address-mask field to source and destination?

I'd like to see this feature added so I went ahead and implemented it: https://github.com/Rain/vyos-1x/commit/975f4fc358f0073f1ad825ea209169766dc2fa51