summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-07-30T6572: trigger remote pr only for circinus pr merge (#3899)Vijayakumar A
2024-07-30Merge pull request #3883 from c-po/vrf-conntrackChristian Breunig
vrf: T6603: conntrack ct_iface_map must only contain one entry for iifname/oifname
2024-07-30Merge pull request #3740 from talmakion/feature/T6430-vrf-directChristian Breunig
pbr: T6430: Allow forwarding into VRFs by name as well as route table IDs
2024-07-30pbr: T6430: refactor to use vyos.utils.network.get_vrf_tableid()Christian Breunig
Commit 452068ce78 ("interfaces: T6592: moving an interface between VRF instances failed") added a similar but more detailed implementation of get_vrf_table_id() that was added in commit adeac78ed of this PR. Move to the common available implementation.
2024-07-30pbr: T6430: Allow forwarding into VRFs by name as well as route table IDsAndrew Topp
* PBR can only target table IDs up to 200 and the previous PR to extend the range was rejected * PBR with this PR can now also target VRFs directly by name, working around targeting problems for VRF table IDs outside the overlapping 100-200 range * Validation ensures rules can't target both a table ID and a VRF name (internally they are handled the same) * Added a simple accessor (get_vrf_table_id) for runtime mapping a VRF name to table ID, based on vyos.ifconfig.interface._set_vrf_ct_zone(). It does not replace that usage, as it deliberately does not handle non-VRF interface lookups (would fail with a KeyError). * Added route table ID lookup dict, global route table and VRF table defs to vyos.defaults. Table ID references have been updated in code touched by this PR. * Added a simple smoketest to validate 'set vrf' usage in PBR rules
2024-07-29Merge pull request #3898 from dmbaturin/T6620Christian Breunig
vyos.configtree: T6620: allow list_nodes() to work on non-existent paths
2024-07-29vyos.configtree: T6620: allow list_nodes() to work on non-existent pathsDaniil Baturin
and return an empty list in that case (handy for migration scripts and the like)
2024-07-29Merge pull request #3804 from HollyGurza/T6362Daniil Baturin
T6362: Create conntrack logger daemon
2024-07-29Merge pull request #3823 from srividya0208/T6571Daniil Baturin
OpenVPN CLI-option: T6571: rename ncp-ciphers with data-ciphers
2024-07-29Merge pull request #3895 from talmakion/bugfix/T4694/outbound-ipsec-migscriptDaniil Baturin
firewall: T4694: incomplete node checks in migration script
2024-07-30firewall: T4694: incomplete node checks in migration scriptAndrew Topp
This patch on #3616 will only attempt to fix ipsec matches in rules if the firewall config tree passed to migrate_chain() has rules attached.
2024-07-29Merge pull request #3897 from indrajitr/typo-fixChristian Breunig
T6349: Fix typo in file name
2024-07-29T6349: Fix typo in file nameIndrajit Raychaudhuri
2024-07-28Merge pull request #3874 from c-po/unused-importChristian Breunig
smoketest: T6592: remove unused "import os"
2024-07-28Merge pull request #3888 from c-po/op-mode-smoketestChristian Breunig
smoketest: T6614: initial support for op-mode command testing
2024-07-28Merge pull request #3889 from c-po/syslog-smoketestChristian Breunig
smoketest: T5705: use locally connected remote syslog servers
2024-07-28ipsec: T6148: Fixed reset command by adding init after terminating (#3763)aapostoliuk
Strongswan does not initiate session after termination via vici. Added an CHILD SAs initialization on the initiator side of the tunnel.
2024-07-28firewall: T4694: Adding rt ipsec exists/missing match to firewall configs ↵talmakion
(#3616) * Change ipsec match-ipsec/none to match-ipsec-in and match-none-in for fw rules * Add ipsec match-ipsec-out and match-none-out * Change all the points where the match-ipsec.xml.i include was used before, making sure the new includes (match-ipsec-in/out.xml.i) are used appropriately. There were a handful of spots where match-ipsec.xml.i had snuck back in for output hooked chains already (the common-rule-* includes) * Add the -out generators to rendered templates * Heavy modification to firewall config validators: * I needed to check for ipsec-in matches no matter how deeply nested under an output-hook chain(via jump-target) - this always generates an error. * Ended up retrofitting the jump-targets validator from root chains and for named custom chains. It checks for recursive loops and improper IPsec matches. * Added "test_ipsec_metadata_match" and "test_cyclic_jump_validation" smoketests
2024-07-28smoketest: T5705: use locally connected remote syslog serversChristian Breunig
As there has been no route to the configured syslog servers, smoketests produced: rsyslogd: omfwd: socket 8: error 101 sending via udp: Network is unreachable Rather use some fake syslog servers from 127.0.0.0/8 which are directly connected and we do not need to look up a route, which will suppress the above error message.
2024-07-27smoketest: T6614: initial support for op-mode command testingChristian Breunig
2024-07-27Merge pull request #3879 from natali-rs1985/T5744-currentChristian Breunig
op_mode: T5744: PKI import OpenVPN shared key includess unexpected BEGIN and END
2024-07-26vrf: T6603: improve code runtime when retrieving info from nftables vrf zoneChristian Breunig
2024-07-26vrf: T6603: conntrack ct_iface_map must only contain one entry for ↵Christian Breunig
iifname/oifname When any of the following features NAT, NAT66 or Firewall is enabled, for every VRF on the CLI we install one rule into nftables for conntrack: chain vrf_zones_ct_in { type filter hook prerouting priority raw; policy accept; counter packets 3113 bytes 32227 ct original zone set iifname map @ct_iface_map counter packets 8550 bytes 80739 ct original zone set iifname map @ct_iface_map counter packets 5644 bytes 67697 ct original zone set iifname map @ct_iface_map } This is superfluous.
2024-07-25op_mode: T5744: PKI import OpenVPN shared key includess unexpected BEGIN and ENDNataliia Solomko
2024-07-25OpenVPN CLI-option: T6571: rename ncp-ciphers with data-cipherssrividya0208
2024-07-25Merge pull request #3873 from c-po/podmanChristian Breunig
Debian: T6598: depend on podman version >=4.9.5
2024-07-25smoketest: T6592: remove unused "import os"Christian Breunig
2024-07-25Debian: T6598: depend on podman version >=4.9.5Christian Breunig
2024-07-25T6605: restore configd error formatting to be consistent with CLI (#3868)John Estabrook
2024-07-25Merge pull request #3857 from c-po/vrf-interface-part-2Christian Breunig
interface: T6592: remove interface from conntrack ct_iface_map on deletion
2024-07-24Merge pull request #3856 from c-po/verify-vrfChristian Breunig
vrf: T6602: verify supplied VRF name on all interface types
2024-07-24smoketest: T6592: verify no interface stalls in conntrack ct_iface_map on ↵Christian Breunig
deletion Now that interfaces are deleted from ct_iface_map during deletion it's time to also add a smoketest ensuring there is no entry in the ct_iface_map once an interface was deleted from the CLI.
2024-07-24Merge pull request #3861 from natali-rs1985/T6593-currentChristian Breunig
op_mode: T6593: Release DHCP interface does not work
2024-07-24Merge pull request #3860 from natali-rs1985/T6596-currentChristian Breunig
op_mode: T6596: pppoe operation command failed
2024-07-24Merge pull request #3853 from natali-rs1985/T5552-currentChristian Breunig
system_option: T5552: Apply IPv4 and IPv6 options after reapplying sysctls by TuneD
2024-07-24op_mode: T6593: Release DHCP interface does not workNataliia Solomko
2024-07-24op_mode: T6596: pppoe operation command failedNataliia Solomko
2024-07-23vrf: T6602: verify supplied VRF name on all interface typesChristian Breunig
Only some (e.g. ethernet or wireguard) interfaces validate if the supplied VRF actually exists. If this is not validated, one can pass an invalid VRF to the system which generates an OSError exception. To reproduce set interfaces vxlan vxlan1 vni 1000 set interfaces vxlan vxlan1 remote 1.2.3.4 set interfaces vxlan vxlan1 vrf smoketest results in OSError: [Errno 255] failed to run command: ip link set dev vxlan1 master smoketest_mgmt This commit adds the missing verify_vrf() call to the missing interface types and an appropriate smoketest for all interfaces supporting VRF assignment.
2024-07-23interface: T6592: remove interface from conntrack ct_iface_map on deletionChristian Breunig
We always have had stale interface entries in the ct_iface_map of nftables/ conntrack for any interface that once belonged to a VRF. This commit will always clean the nftables interface map when the interface is deleted from the system.
2024-07-23system_option: T5552: Apply IPv4 and IPv6 options after reapplying sysctls ↵Nataliia Solomko
by TuneD
2024-07-22Merge pull request #3840 from HollyGurza/T6589Christian Breunig
T6589: Return a dict when querying information about a single interface
2024-07-22Merge pull request #3827 from HollyGurza/T6525Christian Breunig
T6525: Add default dir for ext-scripts without absolute path
2024-07-22Merge pull request #3850 from c-po/openvpn-totp-T3834Christian Breunig
openvpn: T3834: verify() is not allowed to change anything on the system
2024-07-22Merge pull request #3832 from sever-sever/T6594Christian Breunig
T6594: Add missed pppd_compat module
2024-07-22Merge pull request #3839 from c-po/unused-importsChristian Breunig
vrf: T6592: remove unused import get_interface_config
2024-07-22T6587: Raise an error when trying to get information about network ↵khramshinr
interfaces that don't exist
2024-07-22openvpn: T3834: verify() is not allowed to change anything on the systemChristian Breunig
Commit e3c71af1466 ("remove secrets file if the tunnel is deleted and fix opmode commands") added a code path into verify() which removed files on the system if TOTP was not defined. This commit moves the code path to the appropriate generate() function.
2024-07-22Merge pull request #3833 from c-po/wifi-fixChristian Breunig
wireless: T6597: improve hostapd startup and corresponding smoketests
2024-07-22Merge pull request #3841 from lucasec/t6599Christian Breunig
T6599: ipsec: support disabling rekey of CHILD_SA, converge and fix defaults
2024-07-22T6599: ipsec: fix incorect default behavior for dead-peer-detectionLucas Christian