summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-01-25Updates to Kea DHCPv6 PD route hook (#6)Chris Buechler
* Fix route deletion errors when interface is missing. Clarify variable names.
2024-01-25Merge pull request #2894 from vyos/mergify/bp/current/pr-2619Daniil Baturin
T5817: Fix for show openvpn server (backport #2619)
2024-01-25T4839: firewall: Add dynamic address group in firewall configuration, and ↵Nicolas Fort
appropiate commands to populate such groups using source and destination address of the packet.
2024-01-25T5817: Fix for show openvpn serverViacheslav Hletenko
In some cases we can get error: ``` Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_openvpn.py", line 173, in <module> data = get_status(args.mode, intf) File "/usr/libexec/vyos/op_mode/show_openvpn.py", line 130, in get_status client["tunnel"] = get_vpn_tunnel_address(client['remote'], interface) File "/usr/libexec/vyos/op_mode/show_openvpn.py", line 66, in get_vpn_tunnel_address tunnel_ip = lst[0].split(',')[0] IndexError: list index out of range ``` (cherry picked from commit 58683a2444877bb989929625ad40a7d76259075d)
2024-01-25Merge pull request #2893 from jestabro/fix-regression-version-filesDaniil Baturin
image-tools: T5983: fix regression in prune_vyos_versions
2024-01-24image-tools: T5983: fix regression in prune_vyos_versionsJohn Estabrook
2024-01-24dhcp: T3316: Change help text on `listen-interface` to be genericsarthurdev
2024-01-24dhcp: T3316: Fix header on scriptsarthurdev
2024-01-24dhcpv6: T3316: Add support for excluded-prefix in prefix delegationsarthurdev
2024-01-24dhcpv6: T3771: Allow installation of routes for delegated prefixessarthurdev
2024-01-24T5941: Migration QoS delete orphaned interface traffic-policyViacheslav Hletenko
We can get an orphaned interface traffic-policy when the traffic-policy name is removed from the interface, but the node `trffic-policy` is still attached to the interface For exmaple we have orphaned node traffic-policy on an interface: ``` set interfaces bonding bond0 vif 995 traffic-policy ``` This causes of incorrect migration and we do not see VLANs on the bonding interface after update. Delete traffic-policy from all interfaces if traffic-policy does not exist
2024-01-24T5941: Migration policy delete orphaned interface policyViacheslav Hletenko
We can get orphaned interface policy when the policy name was removed from the interface but the node `policy` still attached to the interface For exmaple we have orphaned node policy on interface: ``` set interfaces bonding bond0 vif 995 policy ``` This causes of incorrect migration and we do not see VLANs on the bonding interface after update. Delete policy from all interfaces if policy does not exist
2024-01-23Merge pull request #2886 from jestabro/add-kernel-boot-optionsDaniil Baturin
system-option: T5979: Add configurable kernel boot options
2024-01-23T5977: firewall: remove ipsec options in output chain rule definitions, ↵Nicolas Fort
since it's not supported.
2024-01-23T5979: add configurable kernel boot option 'disable-mitigations'Christian Breunig
2024-01-23image-tools: T5980: add support for configurable kernel boot optionsJohn Estabrook
2024-01-23Merge pull request #2884 from c-po/bfd-T5967Christian Breunig
bfd: T5967: add minimum-ttl option
2024-01-23bfd: T5967: add minimum-ttl optionChristian Breunig
* set protocols bfd peer <x.x.x.x> minimum-ttl <1-254> * set protocols bfd profile <name> minimum-ttl <1-254>
2024-01-23T5974: Fix QoS shape bandwidth and ceil calculation for defaultViacheslav Hletenko
The default `bandwidth` and `ceiling` should calculate values based on <tag> bandwidth but currently it gets the value from qos.base `/sys/class/net/{self._interface}/speed` ``` set qos policy shaper SHAPER bandwidth '20mbit' set qos policy shaper SHAPER default bandwidth '95%' set qos policy shaper SHAPER default ceiling '100%' ``` It causes wrong calculations for class `default` i.e 950Mbit for bandwidth (expected 95% of bandwidth, 19Mbit) 1Gbit for ceil (expected 100% of bandwidth, 20Mbit) Gets incorrect values ``` r4# tc class show dev eth1 class htb 1:1 root rate 20Mbit ceil 20Mbit burst 1600b cburst 1600b class htb 1:a parent 1:1 leaf 8053: prio 0 rate 200Kbit ceil 200Kbit burst 1Mb cburst 1600b class htb 1:b parent 1:1 leaf 8054: prio 7 rate 950Mbit ceil 1Gbit burst 15200b cburst 1375b ``` Fix this
2024-01-23Merge pull request #2881 from c-po/ethernet-gso-T5978Christian Breunig
ethernet: T5978: hw-tc-offload does not actually get enabled on the NIC
2024-01-23ethernet: T5978: hw-tc-offload does not actually get enabled on the NICChristian Breunig
Typo (missaligned -/_) in the code causes hw-tc-offload to never be enabled in the underlaying hardware via ethtool.
2024-01-22Merge pull request #2879 from sarthurdev/T5787_disabledChristian Breunig
dhcp: T5787: Allow disabled duplicates on static-mapping
2024-01-22vrf: T5973: fix has_rule() to check for l3mdev ruleChristian Breunig
A code path was missing to check if only priority is available in the result of "ip --json -4 rule show", in the case of l3mdev it's a dedicated key!
2024-01-22vrf: T5973: move initial conntrack firewall table to startupChristian Breunig
There is no need to add and remove this table during runtime - it can lurk in the standard firewall init code.
2024-01-22dhcp: T5787: Allow disabled duplicates on static-mappingsarthurdev
2024-01-22vrf: T5973: ensure Kernel module is loadedChristian Breunig
This prevents the following error when configuring the first VRF: sysctl: cannot stat /proc/sys/net/vrf/strict_mode: No such file or directory
2024-01-22Merge pull request #2871 from c-po/multicast-T5969Christian Breunig
op-mode: T5969: list multicast group membership
2024-01-22Merge pull request #2867 from c-po/ethernet-T4638Christian Breunig
ethernet: T4638: add smoketests verifying there are no stale VLAN interfaces left
2024-01-22Merge pull request #2873 from nicolas-fort/T5957Christian Breunig
T5957: fix removal of interface in firewall rules.
2024-01-22op-mode: T5969: list multicast group membershipChristian Breunig
cpo@LR1.wue3:~$ show ip multicast group interface eth0.201 Interface Family Address ----------- -------- --------- eth0.201 inet 224.0.0.6 eth0.201 inet 224.0.0.5 eth0.201 inet 224.0.0.1 cpo@LR1.wue3:~$ show ipv6 multicast group interface eth0 Interface Family Address ----------- -------- ----------------- eth0 inet6 ff02::1:ff00:0 eth0 inet6 ff02::1:ffbf:c56d eth0 inet6 ff05::2 eth0 inet6 ff01::2 eth0 inet6 ff02::2 eth0 inet6 ff02::1 eth0 inet6 ff01::1
2024-01-22T5957: fix removal of interface in firewall rules.Nicolas Fort
2024-01-22Merge pull request #2869 from c-po/sflow-t5968Viacheslav Hletenko
sflow: T5968: add VRF support
2024-01-22sflow: T5968: add VRF supportChristian Breunig
Add support to run hsflowd in a dedicated (e.g. management) VRF. Command will be "set system sflow vrf <name>" like with any other service
2024-01-22op-mode: T5966: Ensure top level property to avoid empty nodeIndrajit Raychaudhuri
Since, we don't have op-mode operation for 'dns dynamic' anymore, we need to add a top level property to avoid empty `templates-op/update/node.def`.
2024-01-22ddclient: T5966: Streamline dynamic dns op-mode configurationIndrajit Raychaudhuri
Update op-mode for dynamic dns to standardize on `vyos.opmode`. All methods of `op_mode/dns_dynamic.py` are now available in standardized `op_mode/dns.py`. Move op-mode command `update dns dynamic` to `reset dns dynamic` to reflect that it is not an update but a reset of the dynamic dns service. Also, make the help texts more consistent for all op-mode commands for `dns dynamic` and `dns forwarding`.
2024-01-22T2719: Add 'update' in standard op-mode function listIndrajit Raychaudhuri
2024-01-21ddclient: T5966: Update smoketest for dynamic dns config subpath changeIndrajit Raychaudhuri
2024-01-21ddclient: T5966: Migration script for dynamic dns config subpath changeIndrajit Raychaudhuri
2024-01-21ddclient: T5966: Adjust dynamic dns config address subpathIndrajit Raychaudhuri
Modify the dynamic dns configuration 'address' subpath for better clarity on how the address is obtained. Additionally, remove `web-options` and fold those options under the path `address web`.
2024-01-21Merge pull request #2854 from indrajitr/simplify-pdns-recursorChristian Breunig
dns: T5959: Streamline dns forwarding service
2024-01-21dns: T5959: Avoid using reserved ports for testingIndrajit Raychaudhuri
For example, port 5353 is reserved for multicast DNS, this means tests will fail if the host running the tests is also running a mDNS server.
2024-01-21dns: T5959: Streamline dns forwarding serviceIndrajit Raychaudhuri
Streamline configuration and operation of dns forwarding service in following ways: - Remove `dns_forwarding_reset.py` as its functionality is now covered by `dns.py` - Adjust function names in `dns.py` to disambiguate between DNS forwarding and dynamic DNS - Remove `dns_forwarding_restart.sh` as its functionality is inlined in `dns-forwarding.xml` - Templatize systemd override for `pdns-recursor.service` and move the generated override files in /run. This ensures that the override files are always generated afresh after boot - Simplify the systemd override file by removing the redundant overrides - Relocate configuration path for pdns-recursor to `/run/pdns-recursor` and utilize the `RuntimeDirectory` default that pdns-recursor expects - We do not need to use custom `--socket-dir` path anymore, the default path (viz., `/run/pdns-recursor` is fine)
2024-01-21dns: T4578: Remove unnecessary dns forwarding statistics scriptIndrajit Raychaudhuri
2024-01-21ethernet: T4638: add smoketests verifying there are no stale VLAN interfaces ↵Christian Breunig
left This extends commit 7ba47f027 ("ethernet: T4638: deleting parent interface does not delete underlying VIFs") with a smoketests ensure no VIFs are left behind.
2024-01-21Merge pull request #2863 from c-po/ntp-T5692Christian Breunig
ntp: T5692: add support to configure leap second behavior
2024-01-21Merge pull request #2852 from sever-sever/T5958Viacheslav Hletenko
T5958: QoS add basic implementation of policy shaper-hfsc
2024-01-21ntp: T5692: add support to configure leap second behaviorChristian Breunig
* set service ntp leap-second [ignore|smear|system|timezone] Where timezone is the new and old default resulting in adding "leapsectz right/UTC" to chrony.conf. The most prominent new option is "smear" which will add leapsecmode slew maxslewrate 1000 smoothtime 400 0.001 leaponly to chrony. See https://chrony-project.org/doc/4.3/chrony.conf.html leapsecmode for additional information
2024-01-20Merge pull request #2862 from sever-sever/T5961Christian Breunig
T5961: Fix QoS policy shaper class match vif
2024-01-20T5961: Fix QoS policy shaper class match vifViacheslav Hletenko
If we have QoS policy shaper class match `vif` (VLAN) we have to use `basic match "meta(vlan mask 0xfff eq xxx)` instead of `action policy` Actual incorrect TC filter: tc filter add dev eth1 parent 1: protocol all prio 1 action police rate 100000000 burst 15k flowid 1:64 The correct TC filter after fix: tc filter add dev eth1 parent 1: protocol all prio 1 basic match "meta(vlan mask 0xfff eq 100)" flowid 1:64
2024-01-19Merge pull request #2858 from yzguy/yzguy/T5964Christian Breunig
T5964: add missing imports for is_wwan_connected()
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-26 11:51:35 +0000