| Age | Commit message (Collapse) | Author |
|---|
|
login: T4790: Added check of the sum of radius timeouts
|
|
T5258: git Actions use ubuntu-22.04 for PR conflicts checker
|
|
git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04
for PR conflicts checker
https://github.com/actions/runner-images/issues/6002
|
|
Added check of the sum of login radius timeouts.
It has to be less or eq 50 sec.
Added check of a number of login radius servers.
It has to be less or eq 8
Otherwise, log in to the device can be discarded.
Backported from 1.4
|
|
sshguard: T5354: Add service ssh dynamic-protection
|
|
remote: T4412: fixed upload via SSH
|
|
- added timeout to socket creating
- added skipping SSH fingerprint check with a negative result if a
console is not interactive
- replaced tracebacks with human-readable error messages
- suppressed warnings from `cryptography` used by `paramiko`
|
|
Sshguard protects hosts from brute-force attacks
It can inspect logs and block "bad" addresses by threshold
Auto-generates own tables and rules for nftables, so they are not
intercept with VyOS firewall rules.
When service stops, all generated tables are deleted.
set service ssh dynamic-protection
set service ssh dynamic-protection allow-from '192.0.2.1'
set service ssh dynamic-protection block-time '120'
set service ssh dynamic-protection detect-time '1800'
set service ssh dynamic-protection threshold '30'
|
|
bcast-relay: T5313: verify() relay interfaces have IPv4 address configured
|
|
(cherry picked from commit a409b255acc3dc0a67058593e31b3614e20714f0)
|
|
vrrp: T5315: add support to explicitly specify version (backport)
|
|
(cherry picked from commit 90c0c2c4c81cdbf2ec3f928499f3e1719bfd6f9a)
|
|
set high-availability vrrp group <name> version 2|3
(cherry picked from commit 6ca308182a7891e600a2e8749f7b12b566005576)
|
|
(cherry picked from commit ca7c063666c038d104082542f04ead6062e79246)
|
|
router-advert: T5240: verify() that no more then 3 IPv6 name-servers configured
|
|
This is a radvd limitation.
(cherry picked from commit 8ef017a3496467433c311af63116af7657c58037)
|
|
syslog: T2769: add VRF support (backport)
|
|
Allow syslog messages to be sent through a VRF (e.g. management).
(cherry picked from commit 46d2bcdb0b500b4d1b9d973ab5b9ca3c6cf44e51)
|
|
cloud-init: T5190: Added Cloud-init pre-configurator
|
|
vyos.ifconfig: T2104: support adding and removing VLANs in one call.
|
|
Users might add the podman network interface to a zone based firewall. This
could cuase breaking configs on upgrades to 1.4.
As container support is not yet released for 1.3 LTS version (will be 1.3.3),
we once rename the network interface to match the schema in VyOS 1.4.
|
|
VLANIf('eth0.10').remove() will create and remove the VLAN in one command.
Thus one can ensure when calling remove() on a VLAN it will always
succeed.
(cherry picked from commit 7700da10b8d1d1b3d0db914ab48aebf8ff536da1)
|
|
Added a new service that starts before Cloud-init, waits for all network
interfaces initialization, and if requested by config, checks which interfaces
can get configuration via DHCP server and creates a corresponding Cloud-init
network configuration.
This protects from two situations:
* when Cloud-init tries to get meta-data via eth0 (default and fallback variant
for any data source which depends on network), but the real network is connected
to another interface
* when Cloud-init starts simultaneously with udev and initializes the first
interface to get meta-data before it is renamed to eth0 by udev
|
|
http-api: T5175: check value of attribute for FastAPI>=0.91.0
|
|
FastAPI v0.92.0 (starlette v0.24.0) sets default attribute
Request._form; check for value == None instead of existence when
overriding Request class.
(cherry picked from commit cac55a066e1f7d7d4c0eec5ada76570a326b5ac9)
|
|
T4727: Add RADIUS rate-limit attribute for vpn pptp
|
|
T5152: Get default hostname for telegraf from FQDN or hostname
|
|
T4939: backport VRRP startup delay
|
|
Fix for Telegraf agent hostname isn't qualified
Try to get the hostname from FQDN and then from the hostname
Used for metrics
You may have more than one machine with different domain names
r1 domain-name foo.local, hostname myhost
r2 domain-name bar.local, hostname myhost
It helps to detect from which exactly host we get metrics for
InfluxDB2
|
|
|
|
Add rate-limit attribute, multiplier, vendor specific attribute
for the [shaper] section
|
|
|
|
T4959: Add container registry authentication config for containers (backport)
|
|
Container registry CLI node changed from leafNode to tagNode with the same
defaults. In addition we can now configure an authentication option per
registry.
(cherry picked from commit fe82d86d3e87cb8d92ebc9d0652c08e3dd79a12c)
|
|
(cherry picked from commit b4af532dd531c23bc1ad84cca290916be55357bf)
|
|
container: T5047: restart only containers that changed (backport)
|
|
Commit 52e51ffb ("container: T5047: restart only containers that changed")
started to iterate over a NoneType which is invalid. This happened when a
network description was changed but no container was due for restart.
(cherry picked from commit 86d7b8d1d2b53b9fa93bd456abb4ea1b4f2949b6)
|
|
op-mode: T5097: show interfaces should reflect cleared counters
|
|
By default VyOS used to restart all containers it managed. This makes no sense
as it will be service disrupting. Instead only restart the containers that had
changes on the CLI beeing made.
(cherry picked from commit 52e51ffbb84996aee9d5b94eebf64589ead31225)
|
|
'show interfaces counters' correctly displays counter stats after a call
to 'clear interfaces counters', however, 'show interfaces detail' does
not. Add missing update to counter stats.
|
|
T5105: dhcp-server: Fix error message from dhcp-server (backport)
|
|
(cherry picked from commit 05e00b986a563681b038b226c86c83a29d6da820)
|
|
T2516: Exclude veth interfaces from duplex and speed check
|
|
T5058: Fix IPoE regex Jinja2 for interface
|
|
T3083: Add service event-handler
|
|
Event-handler allows executing a custom script when detects
some configured "pattern regex"
set service event-handler event first filter pattern '.*ssh2.*'
set service event-handler event first script arguments '192.0.2.5'
set service event-handler event first script environment interface value 'eth0'
set service event-handler event first script path '/config/scripts/hello.sh'
It is the backport from 1.4
|
|
Exclude interfaces with 'veth' driver from duplex and speed check
|
|
Fix incorrect regex '\d+' when used vlan ranges
For example 'ipoe-server interface eth1 vlan 2000-3000'
- replace 'interface=re:eth1\.\d+'
=> 'interface=re:^eth1\.(200\d|20[1-9]\d|2[1-9]\d{2}|3000)$'
|
|
Add template filter 'range_to_regex'
Convert range of numbers or list of ranges to regex
% range_to_regex('11-12')
'(1[1-2])'
% range_to_regex(['11-12', '14-15'])
'(1[1-2]|1[4-5])'
|
|
T5033: Ability to generate muliple keys from a file or link
|
