Change Details

Extend firewall rule packet modification `set tcp-mss` to accept both an explicit MSS value and `clamp-mss-to-pmtu`. Previously, `set tcp-mss` only accepted numeric values and rendered: `tcp option maxseg size set <value>`. With this change, `clamp-mss-to-pmtu` is also accepted and rendered as: `tcp option maxseg size set rt mtu`. Changes: - Update CLI schema for `set tcp-mss` to allow `clamp-mss-to-pmtu` alongside numeric range 500-1460. - Update nftables rule rendering in firewall parser: - numeric MSS -> `tcp option maxseg size set <value>` - clamp-mss-to-pmtu -> `tcp option maxseg size set rt mtu` - Add smoketest coverage for IPv4/IPv6 prerouting raw rules using `set tcp-mss clamp-mss-to-pmtu`. Files: - interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i - python/vyos/firewall.py - smoketest/scripts/cli/test_firewall.py

Add CLI support for Discovery of Network-designated Resolvers (DNR) under DHCP option trees and render it to Kea option-data. - Add new DNR nodes for DHCPv4 and DHCPv6 option config: - priority - authentication-domain-name - address (v4/v6) - service-parameter (alpn/port/dohpath/raw) - Map DNR config in python/vyos/kea.py: - DHCPv4: emit a single v4-dnr option with instances joined by "|" - DHCPv6: emit one v6-dnr option per instance - Add smoke tests for DHCPv4 and DHCPv6 DNR rendering. Note: SLAAC/RA DNR is not part of this commit; current router-advert backend (radvd) does not expose RFC9463 DNR option support.

Extend firewall rule packet modification `set tcp-mss` to accept both anAdd CLI support for Discovery of Network-designated Resolvers (DNR) explicit MSS value and `clamp-mss-to-pmtu`under DHCP option trees and render it to Kea option-data. Previously, `set tcp-mss` only accepted numeric values and rendered: `tcp option maxseg size set <value>`. With this change, `clamp-mss-to-pmtu` is also accepted and rendered as: `tcp option maxseg size set rt mtu`. Changes: - Update CLI schema for `set tcp-mss` to allow `clamp-mss-to-pmtu`- Add new DNR nodes for DHCPv4 and DHCPv6 option config: alongside numeric range 500-1460.- priority - Update nftables rule rendering in firewall parser: - authentication-domain-name - numeric MSS -> `tcp option maxseg size set <value>`- address (v4/v6) - clamp-mss-to-pmtu -> `tcp option maxseg size set rt mtu`- service-parameter (alpn/port/dohpath/raw) - Add smoketest coverage for IPv4/IPv6 prerouting raw rules using- Map DNR config in python/vyos/kea.py: `set tcp-mss clamp-mss-to-pmtu`. Files:- DHCPv4: emit a single v4-dnr option with instances joined by "|" - interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i - DHCPv6: emit one v6-dnr option per instance - python/vyos/firewall.py- Add smoke tests for DHCPv4 and DHCPv6 DNR rendering. Note: SLAAC/RA DNR is not part of this commit; current router-advert - smoketest/scripts/cli/test_firewall.pybackend (radvd) does not expose RFC9463 DNR option support.