unkin/tomswall
4
0
Fork 0
Code Issues 5 Pull Requests 3 Actions Packages Projects Releases 4 Wiki Activity

Accept DHCP on dhcp interfaces as shorewall does #27

Merged
benvin merged 2 commits from benvin/dhcp-option into main 2026-10-04 15:21:52 +11:00
Conversation 2 Commits 2 Files Changed 2
+86 -53
unkin-agent commented 2026-10-04 15:06:13 +11:00
Member
Copy Link
Copy Source

The dhcp interface option emitted an input rule without a verdict and only partial output rules, so DHCP to/from the firewall fell through to policy and bridged DHCP was never forwarded.

  • accept IPv4 udp dport 67:68 in and out on each dhcp interface
  • accept forwarded IPv4 udp dport 67:68 back out the same interface when bridge is set
  • drop the separate per-direction sport/dport rules
The `dhcp` interface option emitted an input rule without a verdict and only partial output rules, so DHCP to/from the firewall fell through to policy and bridged DHCP was never forwarded. - accept IPv4 udp dport 67:68 in and out on each `dhcp` interface - accept forwarded IPv4 udp dport 67:68 back out the same interface when `bridge` is set - drop the separate per-direction sport/dport rules
unkin-agent added 1 commit 2026-10-04 15:06:13 +11:00
Accept DHCP on dhcp interfaces as shorewall does
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
e48e9079bd
unkin-agent commented 2026-10-04 15:06:57 +11:00
Author
Member
Copy Link
Copy Source
  • internal/nftables/compiler.go:134 — rule is not scoped to IPv4 and the table is inet by default, so udp 67:68 is also accepted over IPv6 while DHCPv6 (udp 546:547, which shorewall6 uses) is still not accepted → add matchNFProto(IPv4) for 67:68 and a 546:547 variant for IPv6 (honouring address_family), or scope the PR/body to IPv4 only.
  • internal/nftables/compiler_test.go:1064 — test never asserts proto udp or the iif/oif match (rule on wrong interface/direction would pass) → assert the udp proto compare and the iifname/oifname data per tag.
- internal/nftables/compiler.go:134 — rule is not scoped to IPv4 and the table is `inet` by default, so udp 67:68 is also accepted over IPv6 while DHCPv6 (udp 546:547, which shorewall6 uses) is still not accepted → add `matchNFProto(IPv4)` for 67:68 and a 546:547 variant for IPv6 (honouring `address_family`), or scope the PR/body to IPv4 only. - internal/nftables/compiler_test.go:1064 — test never asserts proto udp or the iif/oif match (rule on wrong interface/direction would pass) → assert the udp proto compare and the iifname/oifname data per tag.
unkin-agent added 1 commit 2026-10-04 15:07:43 +11:00
Scope DHCP accept rules to IPv4
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
0551120eec
unkin-agent commented 2026-10-04 15:08:14 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 599c483cd8 into main 2026-10-04 15:21:52 +11:00
benvin deleted branch benvin/dhcp-option 2026-10-04 15:21:52 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/tomswall#27
Delete Branch "benvin/dhcp-option"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?