From c94dabede31447f3d1eaded08b448f944087539d Mon Sep 17 00:00:00 2001
From: opswill <root@opswill.com>
Date: Fri, 13 Dec 2024 11:25:01 +0800
Subject: [PATCH 1/2] T6918: Accept invalid PPPoE Session in stateful bridge
 firewall.

---
 data/templates/firewall/nftables.j2                         | 3 ++-
 interface-definitions/include/firewall/global-options.xml.i | 2 +-
 smoketest/scripts/cli/test_firewall.py                      | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index 034328400f..a351438709 100755
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -382,6 +382,7 @@ table bridge vyos_filter {
 {%                 if 'invalid_connections' in global_options.apply_to_bridged_traffic %}
         ct state invalid udp sport 67 udp dport 68 counter accept
         ct state invalid ether type arp counter accept
+        ct state invalid ether type 0x8864 counter accept
 {%                 endif %}
 {%             endif %}
 {%             if global_options.state_policy is vyos_defined %}
@@ -445,4 +446,4 @@ table bridge vyos_filter {
         return
     }
 {% endif %}
-}
\ No newline at end of file
+}
diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
index 05fdd75cbf..51c6b1efd0 100644
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -51,7 +51,7 @@
       <children>
         <leafNode name="invalid-connections">
           <properties>
-            <help>Accept ARP and DHCP despite they are marked as invalid connection</help>
+            <help>Accept ARP DHCP and PPPoE despite they are marked as invalid connection</help>
             <valueless/>
           </properties>
         </leafNode>
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index 2d18f04956..6420afa382 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -765,6 +765,7 @@ def test_bridge_firewall(self):
             ['type filter hook output priority filter; policy accept;'],
             ['ct state invalid', 'udp sport 67', 'udp dport 68', 'accept'],
             ['ct state invalid', 'ether type arp', 'accept'],
+            ['ct state invalid', 'ether type 0x8864', 'accept'],
             ['chain VYOS_PREROUTING_filter'],
             ['type filter hook prerouting priority filter; policy accept;'],
             ['ip6 daddr @A6_AGV6', 'notrack'],

From 833d5866b69dc346d8127845f32ebdcf9b647e59 Mon Sep 17 00:00:00 2001
From: opswill <will@nixops.org>
Date: Tue, 17 Dec 2024 11:03:53 +0800
Subject: [PATCH 2/2] T6918: Fix punctuation

Co-authored-by: Daniil Baturin <daniil@baturin.org>
---
 interface-definitions/include/firewall/global-options.xml.i | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
index 51c6b1efd0..355b41fded 100644
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -51,7 +51,7 @@
       <children>
         <leafNode name="invalid-connections">
           <properties>
-            <help>Accept ARP DHCP and PPPoE despite they are marked as invalid connection</help>
+            <help>Accept ARP, DHCP and PPPoE despite they are marked as invalid connection</help>
             <valueless/>
           </properties>
         </leafNode>