summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-09-18smoketest: ipsec: only delete nhrp path where it is usedChristian Poessinger
2021-09-18ipsec: vti: T3831: avoid usinf xfrm if_id 0 - implement shift by oneChristian Poessinger
The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. This means that a vti0 named interface will pull in all traffic and others will stop working. Thus we simply shift the key by one to also support a vti0 interface.
2021-09-18validator: T2417: bugfix on Python3 f'ormat stringsChristian Poessinger
Commit 3639a5610b590a ("validator: T2417: try to make the code clearer") introduced Python3 f'ormatted strings but missed the "f" keyword.
2021-09-17Merge pull request #1007 from erkin/currentChristian Poessinger
T3823: Stop strip-private regexp from swallowing quotes
2021-09-17T3823: Stop strip-private regexp from swallowing quoteserkin
2021-09-15ipsec: T3830: "authentication id|use-x509-id" are mutually exclusiveChristian Poessinger
Manually set peer id and use-x509-id are mutually exclusive!
2021-09-15ipsec: T3830: set connections.<conn>.remote<suffix>.id to "peer" if undefinedChristian Poessinger
Restore "default" behavior from ipsec.conf
2021-09-15xml: remove unnecessary "i" from help in source-address-ipv4 building block Christian Poessinger
2021-09-15typo: remove unnecessary 'i' from helpJavinator9889
2021-09-14dhcpv6-pd: T421: disable wide dhcpv6 client debug messagesChristian Poessinger
2021-09-14Merge pull request #1005 from sarthurdev/T3828Christian Poessinger
ipsec: T3828: Update interface definitions for new behaviour
2021-09-14ipsec: T3828: Update interface definitions for new behavioursarthurdev
2021-09-13Merge pull request #1004 from sarthurdev/T3828Christian Poessinger
ipsec: T3828: Use IKE dh-group when ESP dh-group is set to `enable`
2021-09-13ipsec: T3828: Use IKE dh-group when ESP dh-group is set to `enable`sarthurdev
2021-09-12pki: T3642: listing all CRLs show be doen using a leafNodeChristian Poessinger
2021-09-12pki: T3642: show only requested certificate in op-modeChristian Poessinger
2021-09-12pki: T3642: show only requested certificate in op-modeChristian Poessinger
2021-09-12pki: T3642: show only requested CA in op-modeChristian Poessinger
2021-09-11Fix inconsistent capitalization in the show version outputDaniil Baturin
2021-09-10wireguard: T3642: directly import keys to CLI when run in config modeChristian Poessinger
vyos@vyos# run generate pki wireguard key-pair install interface wg10 "generate" CLI command executed from config session. Generated private-key was imported to CLI! Use the following command to verify: show interfaces wireguard wg10 Corresponding public-key to use on peer system is: 'hGaWcoG7f+5sPAUY/MNQH1JFhsYdsGTecYA9S2J8xGs=' vyos@vyos# run generate pki wireguard preshared-key install interface wg10 peer vyos "generate" CLI command executed from config session. Generated preshared-key was imported to CLI! Use the following command to verify: show interfaces wireguard wg10 vyos@vyos# show interfaces wireguard wg10 +peer vyos { + preshared-key OwTALZy8w6VIBMxUwbOv6Ys7QMyhrtY4aw+0cUjmmCw= +} +private-key 0Pu95CejvCUCCwrTW39TCYnitESWAdIIFTVJb7UgxVU= [edit]
2021-09-10frr: T1514: refactor restart script and drop duplicated codeChristian Poessinger
2021-09-10Merge pull request #1000 from sever-sever/T3810Christian Poessinger
squid: squidguard: T3810: Fix template for sourcre-group and rule
2021-09-10squid: squidguard: T3810: Fix template for sourcre-group and ruleViacheslav
Modify template for squid Replace old directives to actual
2021-09-10squidguard: T3810: Set DB directory rigths 755Viacheslav
2021-09-10squid: T3810: Node source-group address should be multiViacheslav
2021-09-10squid: T3810: Remove build in acl vars localost and to_localhostViacheslav
2021-09-10ethtool: T3802: extend check_speed_duplex() implementation to support 'auto'Christian Poessinger
(cherry picked from commit 3037661951d0e5d1f6264f886781b7ddc019329e)
2021-09-10ethernet: T3802: not all NICs support reading speed/duplex settings in all ↵Christian Poessinger
states Turns out an AX88179 USB 3.0 NIC does not support reading back the speed and duplex settings in every operating state. While the NIC is beeing initialized, reading the speed setting will return: $ cat /sys/class/net/eth6/speed cat: /sys/class/net/eth6/speed: Invalid argument Thus if this happens, we simply tell the system that the current NIC speed matches the requested speed and nothing is changed at this point in time. (cherry picked from commit e2b7e1766cc22c5cd718a5001be6336bdca92eec)
2021-09-10ethernet: T3802: use only one implementation for get_driver_name()Christian Poessinger
Move the two implementations to get the driver name of a NIC from ethernet.py and ethtool.py to only ethtool.py. (cherry picked from commit 07840977834816b69fa3b366817d90f44b5dc7a7)
2021-09-10ethernet: T3802: check if driver supports changing flow-control settingsChristian Poessinger
(cherry picked from commit 1572edd2cef355710d1129907d3e49451a6c31d4)
2021-09-09wireguard: T3642: improve "set" commands for generated key-pairsChristian Poessinger
2021-09-09wireguard: T3642: add deprecation notice to old commands for key generationChristian Poessinger
2021-09-09pki: T3642: use f'ormated strings in print()Christian Poessinger
2021-09-09policy: T3812: FRR bgpd also knows about route-maps because of rpkiChristian Poessinger
In order to alter rpki configuration we must also process the route-map nodes with/for bgpd.
2021-09-09pki: wireguard: T3815: do not bail out early so keys can be written to fileChristian Poessinger
2021-09-09vyos.configdict: T3814: use no_tag_node_value_mangle in get_interface_dict()Christian Poessinger
This change is required and currently only impacts WireGuards peer configuration, so that the peers name is not mangled.
2021-09-08openvpn: T3805: fix bool logic in verify_pki() for client modeChristian Poessinger
Add support for OpenVPN client mode with only the CA certificate of the server installed.
2021-09-08openvpn: T3805: drop privileges using systemd - required for rtnetlinkChristian Poessinger
2021-09-08openvpn: T3805: use vyos.util.makedir() to create system directoriesChristian Poessinger
2021-09-08openvpn: T3805: use vyos.util.write_file() to store certificatesChristian Poessinger
2021-09-07scripts: op-mode: T3807: bugfix node.def generatorChristian Poessinger
process_node() processes the XML tree in a fixed order, "node" before "tagNode" before "leafNode". If the generator created a "node.def" file, it can no longer be overwritten - else we would have some stale "node.def" files with an empty help string (T2555). Without the fixed order this would resulted in a case where we get a node and a tagNode with the same name, e.g. "show interfaces ethernet" and "show interfaces ethernet eth0" that the node implementation was not callable from the CLI, rendering this command useless (T3807). This can be fixed by forcing the "node", "tagNode", "leafNode" order by sorting the input XML file automatically (sorting from https://stackoverflow.com/a/46128043) thus adding no additional overhead to the user.
2021-09-07op-mode: xml: improve "show interfaces <type>" help textChristian Poessinger
2021-09-06pki: eapol: T3642: only add "pki" key to interface dict if pki is configuredChristian Poessinger
2021-09-06pki: eapol: T3642: use write_file() to store certificatesChristian Poessinger
2021-09-06ifconfig: T3806: "ipv6 address no_default_link_local" required for MTU < 1280Christian Poessinger
This commit also extends the smoketest to verify that the exception for this error is raised.
2021-09-06Merge pull request #997 from c-po/nginx-tls-12-13John Estabrook
https: T2230: only support TLS1.2 and TLS1.3
2021-09-06pki: T3642: verify() that we can not delete certificates still referenced in CLIChristian Poessinger
2021-09-06vyos.util: add function to search a key recursively in a dictionaryChristian Poessinger
data = { 'interfaces': {'dummy': {'dum0': {'address': ['192.0.2.17/29']}}, 'ethernet': {'eth0': {'address': ['2001:db8::1/64', '192.0.2.1/29'], 'description': 'Test123', 'duplex': 'auto', 'hw_id': '00:00:00:00:00:01', 'speed': 'auto'}, 'eth1': {'address': ['192.0.2.9/29'], 'description': 'Test456', 'duplex': 'auto', 'hw_id': '00:00:00:00:00:02', 'speed': 'auto'}}} } dict_search_recursive(data, 'hw_id') will yield both '00:00:00:00:00:01' and '00:00:00:00:00:02' as generator object.
2021-09-06vyos.util: T2755: rename dict_search() function args to match other ↵Christian Poessinger
implementations
2021-09-06pki: xml: T3642: use "txt" as format identifierChristian Poessinger
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-24 07:55:07 +0000