| Age | Commit message (Collapse) | Author |
|---|
|
vrf: T5973: module is now statically compiled into the kernel (backport #2952)
|
|
bgp: T6024: add additional missing FRR features (backport #2957)
|
|
init: T2044: only start rpki if cache is configured (backport #2959)
|
|
This extends commit 9199c87cf ("init: T2044: always start/stop rpki during
system boot") to check the bootup configuration if an RPKI cache is defined.
Only start RPKI if this is the case.
(cherry picked from commit 9b8e11e078c42e3ae86ebfa45fec57336f25a0af)
|
|
Always enable VRF strict_mode
(cherry picked from commit 117fbcd6237b59f54f2c1c66986a8ce073808c84)
|
|
* set protocols bgp parameters labeled-unicast <explicit-null | ipv4-explicit-null | ipv6-explicit-null>
* set protocols bgp parameters allow-martian-nexthop
* set protocols bgp parameters no-hard-administrative-reset"
(cherry picked from commit fff6004d46c5b939800fc3e61fe2102224625c0d)
|
|
xml: T302: replace references to Quagga with FRRouting (backport #2960)
|
|
vpn: T3843: l2tp configuration not cleared after delete (backport #2944)
|
|
(cherry picked from commit 1c882769cc0627cfc1ebf5ab7c338c6c474456da)
|
|
vpn: T5926: IPSEC does not apply after l2tp configuration was changed
added dependency between l2tp and ipsec conf
added test for apply config to swanctl
(cherry picked from commit e697ed1e7fd5c33f8082b2f4f96c42fc822ec9a5)
|
|
T6021: Fix QoS shaper r2q calculation (backport #2953)
|
|
The current calculation `r2q` is wrong as it uses `Floor division`
but expecting `division`
This way `math.ceil` calculate wrong value as we expect
round a number upward to its nearest integer
For example for speed 710 mbits expected value `444` but we get `443`
```
from math import ceil
MAXQUANTUM = 200000
speed = 710000000
speed_bps = int(speed) // 8
>>> speed_bps // MAXQUANTUM
443
>>> speed_bps / MAXQUANTUM
443.75
>>>
>>>
>>> ceil(speed_bps // MAXQUANTUM)
443
>>> ceil(speed_bps / MAXQUANTUM)
444
>>>
```
(cherry picked from commit ce1035e1e8642bf740e2a21693a72fe2127b8f72)
|
|
image-tools: T6016: wait for umount in cleanup function (backport #2941)
|
|
T5921: Fix OpenConnect verify for local users (backport #2946)
|
|
(cherry picked from commit d80530c48a78dfeb55293494a257f6234b0ef76d)
|
|
Fix verify error for the VPN OpenConnect configuration with
local authentication and without any user
File "/usr/libexec/vyos/conf_mode/vpn_openconnect.py", line 94, in verify
if not ocserv["authentication"]["local_users"]:
KeyError: 'local_users'
(cherry picked from commit 71644dfed63f6248525db3c3bc9493c059707a2a)
|
|
op-mode:T6015:Fix for charon file generated by ipsec debug script
|
|
|
|
rpki: T6011: known-hosts-file is no longer supported by FRR (backport #2936)
|
|
(cherry picked from commit 586863bf3a9cb1dd1c0d74b628d00096b905740f)
|
|
T6018: adjust smoketest for update to FastAPI web framework (backport #2937)
|
|
(cherry picked from commit e1b63b9b1704a55ccbf75e7131651c85dd318107)
|
|
ipsec: T5998: add replay-windows setting (backport #2932)
|
|
The replay_window for child SA will always be 32 (hence enabled). Add a CLI node
to explicitly change this.
* set vpn ipsec site-to-site peer <name> replay-window <0-2040>
(cherry picked from commit 4d943d8fbf1253154897179b0e3ea2d93b898197)
|
|
configdict: T5894: preserve old behavior when dealing with PKI (backport #2931)
|
|
Commit b152b5202 ("configdict: T5894: add get_config_dict() flag with_pki")
added the generic PKI flag but if there was no PKI subsystem available
in the configuration, no pki dict key ever manifested in the resulting
dictionary requested by the caller.
This is different to the old behavior (which each caller implementing the call
itself) where there always was a pki key present - even if it was empty.
This triggered a bug in the IPSec script
Traceback (most recent call last):
File "/usr/libexec/vyos/conf_mode/vpn_ipsec.py", line 600, in <module>
verify(ipsec)
File "/usr/libexec/vyos/conf_mode/vpn_ipsec.py", line 372, in verify
verify_pki_rsa(ipsec['pki'], rsa)
~~~~~^^^^^^^
KeyError: 'pki'
As it wanted to verify keys, but there was no pki dictionary key available.
This commit restores the previous behavior.
(cherry picked from commit 9b56a86def674886721a367c02371f9da65c3fd3)
|
|
qos: T5848: Add triple-isolate option to CAKE policy config (backport #2748)
|
|
(cherry picked from commit 762be96f45bb1d9705e45ff554ad483c9d4e10ff)
|
|
(cherry picked from commit 61342083d7db8c30d015474fae5cb71f480487d8)
|
|
container: T5955: add uid/gid settings (backport #2927)
|
|
(cherry picked from commit faa4c87d93c7808c6a4edd8eddd29049ec8ec3fa)
|
|
(cherry picked from commit 52e9707a43290f5f826766e2c42c5f0db3c9adec)
|
|
T5971: Rewritten ppp options in accel-ppp services (backport #2891)
|
|
dns forwarding: T5687: Implement ECS settings for PowerDNS recursor (backport #2903)
|
|
ddclient: T5966: Adjust dynamic dns config address subpath (manual backport #2860)
|
|
Rewritten 'ppp-options' to the same view in all accel-ppp services.
Adding IPv6 support to PPTP.
(cherry picked from commit d9e57fe65dd538c6ea80637f4f6f23cf11dc583d)
|
|
Since, we don't have op-mode operation for 'dns dynamic' anymore, we need
to add a top level property to avoid empty `templates-op/update/node.def`.
|
|
Update op-mode for dynamic dns to standardize on `vyos.opmode`. All
methods of `op_mode/dns_dynamic.py` are now available in standardized
`op_mode/dns.py`.
Move op-mode command `update dns dynamic` to `reset dns dynamic` to
reflect that it is not an update but a reset of the dynamic dns service.
Also, make the help texts more consistent for all op-mode commands for
`dns dynamic` and `dns forwarding`.
|
|
|
|
|
|
|
|
Modify the dynamic dns configuration 'address' subpath for better
clarity on how the address is obtained.
Additionally, remove `web-options` and fold those options under the
path `address web`.
|
|
T5989 fix: Add ipv4-prefix as a valid option for UPnP ACLs. (backport #2897)
|
|
T4839: firewall: Add dynamic address group in firewall configuration (backport #2756)
|
|
Commit eb76729d6324 ("dns forwarding: T5687: Implement ECS settings for PowerDNS
recursor") added a helper "_set_required_options()" method to reduce duplicate
code when setting up the base interface test.
This refactors the test class to call this code always in setUp() so we have
it written only once.
(cherry picked from commit 112376a4ccb96ceee647a4cba5c4f131597b0ea4)
|
|
Completion help suggests only IPv4 and IPv6 prefixes are supported, thus add a
proper constraint enforcing this.
(cherry picked from commit 049560725b93de49ec2d5a779e391e61d568ceb6)
|
|
Fix option descriptions
(cherry picked from commit c4b6c156549ea03262793c78532c2456e8713b81)
|
|
(cherry picked from commit eb76729d63245e2e8f06f4d6d52d2fd4aab4fb1f)
|
|
dns: T5959: Streamline dns forwarding service (backport #2854)
|
|
(cherry picked from commit 0307801b8928bbaaa20caf5bd10b928bae459490)
|
