| Age | Commit message (Collapse) | Author |
|---|
|
pki: T3642: Add support for signing and revoking subordinate CAs
|
|
Renamed CLI from "logging log-modes" to "log subsystem" and "logging log-level"
to "log level". THat is more human firendly.
|
|
|
|
* 'ipsec-ikev2-remote-access' of github.com:c-po/vyos-1x:
ipsec: T2816: remove default values from Jinja2 template and place them in XML
ipsec: T2816: rework IKE and ESP key assignment
ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string
ipsec: T2816: adjust Jinja2 template to coding style
xml: provide building block for a generic description node
|
|
VyOS has a known to work mechanism in supplying CLI default values into the
Python configuration scripts. This commit removes hardcoded default values from
the Jinja2 template and places them into the appropriate XML definitions.
The big advantage is that the default value itself and the corresponding help
string are located in the exact same file.
|
|
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to
string") added a Jinja2 helper function which can be used to transform VyOS CLI
ESP and IKE key proposals into a strongSwan compatible string cipher.
This commit changes the IPSec implementation to make use of this new Jinja2
filter fubction/Python helper. This is required base work for better automated
tests (smoketests) but also for an IKEv2 road-warrior setup.
|
|
|
|
|
|
|
|
* use indent = 2
* prefer 'if foo.bar is defined' over 'if "bar" in foo'
|
|
|
|
|
|
|
|
|
|
|
|
ipsec: T3656: T3659: Fix passthrough with ipv6. Fix op-mode ipsec commands. Remove python3-crypto dependency.
|
|
Remove python3-crypto dependency.
|
|
The IPSec ceritifcate handling is now done by storing the CA key inside the
running configuration.
|
|
* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x:
pki: ipsec: T3642: Update migration script to account for file permission issues
pki: ipsec: T3642: Migrate IPSec to use PKI configuration
pki: T3642: New PKI config and management
|
|
Commit a6b526fd982 ("ipsec: T3643: us vyos.util.copy_file() over raw UNIX cp
command") used a new helper to copy the x509 certificate files, but it also
added a bug where the certificate key file was copied to the wrong location.
This has been fixed and the corect path is used again.
|
|
Commit 5303ec39 ("vyos.util: add new helper copy_file()") added a new helper
function to copy a file from A -> B and create the destination directory if
required. It did also throw an excpetion if the destination file already
existed and consisted of the same file - this is now ignored and we always
copy the source to the destination.
|
|
|
|
|
|
dhcpdv6: T3658: add support for dhcpdv6 fixed-prefix6
|
|
|
|
|
|
|
|
|
|
|
|
|
|
XFRM interfaces are similar to VTI devices in their basic functionality but
offer several advantages:
* No tunnel endpoint addresses have to be configured on the interfaces.
Compared to VTIs, which are layer 3 tunnel devices with mandatory endpoints,
this resolves issues with wildcard addresses (only one VTI with wildcard
endpoints is supported), avoids a 1:1 mapping between SAs and interfaces, and
easily allows SAs with multiple peers to share the same interface.
* Because there are no endpoint addresses, IPv4 and IPv6 SAs are supported on
the same interface (VTI devices only support one address family).
* IPsec modes other than tunnel are supported (VTI devices only support
tunnel mode).
* No awkward configuration via GRE keys and XFRM marks. Instead, a new identifier
(XFRM interface ID) links policies and SAs with XFRM interfaces.
|
|
The "v6only" CLI tree was not taken into account during validation.
vyos@vyos:~$ show configuration commands | grep bgp
set protocols bgp local-as '200'
set protocols bgp neighbor eth0.204 address-family ipv6-unicast
set protocols bgp neighbor eth0.204 interface v6only remote-as '100'
vyos@vyos:~$ show bgp ipv6 sum
IPv6 Unicast Summary:
BGP router identifier 172.18.254.201, local AS number 200 vrf-id 0
BGP table version 0
RIB entries 0, using 0 bytes of memory
Peers 1, using 21 KiB of memory
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt
eth0.204 4 100 99 99 0 0 0 01:35:07 0 0
Total number of neighbors 1
|
|
Add implementation with XML and Python.
|
|
|
|
|
|
|
|
|
|
|
|
This is already done in systemd service disable hook from vyos-build.
|
|
|
|
|
|
Commit 166d44b3 ("nat: T1083: add translation options for persistent/random
mapping of address and port") added support for persistent IP address and port
mappings for NAT.
Unfortunately one if clause got lost in translation.
|
|
and port
Tested using:
set destination rule 100 inbound-interface 'eth0'
set destination rule 100 translation address '19.13.23.42'
set destination rule 100 translation options address-mapping 'random'
set destination rule 100 translation options port-mapping 'none'
set source rule 1000 outbound-interface 'eth0'
set source rule 1000 translation address '122.233.231.12'
set source rule 1000 translation options address-mapping 'persistent'
set source rule 1000 translation options port-mapping 'fully-random'
|
|
WARNING: Using --genkey --secret filename is DEPRECATED.
Use --genkey secret filename instead.
|
|
|
|
Copy a file from A -> B but also support adjusting Bs file permissions
and creation of Bs base directory if required.
|
|
|
|
This reverts commit 95bbbb8bed92a60a320ff255c8b8656145f3c540.
|
|
nat: nat66: T3648: Fix script logic errors and missing logic handling
|
|
|
