Age | Commit message (Collapse) | Author |
|
During system startup the system-login.py script is invoked by vyos-router
systemd service. As there is no complete configuration available at this
point in time - and the sole purpose of this call is to reset/re-render
the system NSS/PAM configs back to default - it accidently also deleted the
local useraccounts.
Once the VyOS configuration got mounted, users got recreated in alphabetical
order and thus UIDs flipped and the /home suddenely belonged to a different
account.
This commit prevents any mangling with the local userdatabase during VyOS
bootup phase.
(cherry picked from commit 64d323299586da646ca847e78255ff2cd8464578)
|
|
T5436: Add missing preconfig-script (backport #2326)
|
|
(cherry picked from commit 646f08fc5a302e08aad90af3fa0ee32e138ee585)
|
|
login: T5628: fix spwd deprecation warning (backport #2328)
|
|
vyos@vyos:~$ show system login users
Username Type Locked Tty From Last login
---------- ------ -------- ----- ------------- ------------------------
vyos vyos False pts/0 172.16.33.139 Mon Oct 2 20:42:24 2023
(cherry picked from commit 80f08af76db0ccee4d6dc1a99b6d8d90884fa33f)
|
|
T5165: Migrate policy local-route rule x destination to address (backport #2325)
|
|
Migrate policy local-route <destination|source> to node address
replace 'policy local-route{v6} rule <tag> destination|source <x.x.x.x>'
=> 'policy local-route{v6} rule <tag> destination|source address <x.x.x.x>'
(cherry picked from commit 9f7a5f79200782f7849cab72f55a39dedf45f214)
|
|
mdns: T5615: Allow controlling IP version to use for mDNS repeater (backport #2307)
|
|
Rename avahi-daemon config file to avahi-daemon.conf.j2 to match the
convention used by other config files.
(cherry picked from commit 3a3123485f2ea7b253caa1c49f19c82a0eaa0b37)
|
|
This commit adds a new configuration option to the mDNS repeater service
to allow controlling which IP version to use for mDNS repeater.
Additionally, publishing AAAA record over IPv4 and A record over IPv6 is
disabled as suggested.
See:
- https://github.com/lathiat/avahi/issues/117#issuecomment-1651475104
- https://bugzilla.redhat.com/show_bug.cgi?id=669627#c2
(cherry picked from commit e66f7075ee12ae3107d29efaf683442c3535e8b9)
|
|
T5165: Add option protocol for policy local-route (backport #2313)
|
|
firewall: T5614: Add support for matching on conntrack helper (backport #2306)
|
|
(cherry picked from commit 81dee963a9ca3224ddbd54767a36efae5851a001)
|
|
Add option `protocol` for policy local-route
set policy local-route rule 100 destination '192.0.2.12'
set policy local-route rule 100 protocol 'tcp'
set policy local-route rule 100 set table '100'
(cherry picked from commit 96b8b38a3c17aa08fa964eef9141cf89f1c1d442)
|
|
ipsec: T5606: Add support for whole CA chains (backport #2305)
|
|
Also includes an update to smoketest to verify
(cherry picked from commit 1ac230548c86d3308ff5b479b79b0e64b75a0e8a)
|
|
T5412: Add support for extending config-mode dependencies in add-on packages (backport #2216)
|
|
(cherry picked from commit 12440ea1af8e60482a6a91c1cb04dcb86d7f4a68)
|
|
(cherry picked from commit 0869b91c0b15ddedd72b4d0e1475c52eb45994f0)
|
|
Add support for defining config-mode dependencies in add-on packages.
(cherry picked from commit d9ad551816e34f38280534ad75d267697e4f096f)
|
|
firewall: T5160: Remove zone policy op-mode (backport #2308)
|
|
rpki: T2044: add to daemons Jinja2 template
|
|
T5497: op-mode: Add generate firewall rule-resequence (backport #2302)
|
|
This is a combined backport of commits:
* a4aad1120 - frr: T5591: hint about daemons that always run and can't be disabled
* d9d2b2b96 - frr: T5591: cleanup of daemons file
* 40503a9d7 - T2044: RPKI doesn't boot properly
|
|
(cherry picked from commit 9b9b37e9cbb225eaacac2ad8cb03bef735fed117)
|
|
Add op-mode command `generate firewall rule-resequence`
Generates output with new sequences for firewall rules
set firewall ipv4 input filter rule 1 action 'accept'
set firewall ipv4 input filter rule 1 description 'Allow loopback'
$ generate firewall rule-resequence start 10 step 10
set firewall ipv4 input filter rule 10 action 'accept'
set firewall ipv4 input filter rule 10 description 'Allow loopback'
(cherry picked from commit 7ad1e8c7d3440046dce2ffa7bcb70a38bfddc298)
|
|
smoketest: T5607: support getting SCSI device by drive-id (backport #2298)
|
|
(cherry picked from commit 2d3f3297b575f88662495e14a7c7324ff73b6bfc)
|
|
(cherry picked from commit 42736111facf08ac37b86e6fc3cbd395aab166bc)
|
|
(cherry picked from commit ede0b5b1a19c37547c19d875743e78b0278628d4)
|
|
bgp: T5596: add new features from FRR 9 (backport #2284)
|
|
T5602: Reverse-proxy add option backup for backend server (backport #2294)
|
|
init: T5239: configure system hostname prior to FRR startup (backport #2289)
|
|
A `backup` server can be defined to take over in the case of all other
backends failing
set load-balancing reverse-proxy backend <tag> server <tag> address '192.0.2.3'
set load-balancing reverse-proxy backend <tag> server <tag> port '8883'
set load-balancing reverse-proxy backend <tag> server <tag> backup
(cherry picked from commit cb297aea56da91144c53be1f396b64a26a8e5b04)
|
|
openvpn: T5269: add a deprecation warning for shared-secret (backport #2296)
|
|
(cherry picked from commit 4bbbaab60d56bfd6f3a145378027642b4c47adee)
|
|
On first boot after an upgrade /etc/hostname and FRR configuration is not
populated. FRR determines the system hostname once during startup and does not
repect changes of the hostname CLI value.
Thus after an upgrade of VyOS FRR started with a hostname of debian that was
propagated to peers.
The commit retrieves the hostname from the CLI and presets this before FRR is
initially started.
(cherry picked from commit ac21a4e69fac27504b62927a20d0a6a273abb034)
|
|
(cherry picked from commit 56d3f75de487c1dcfd075cf7b65cb16b6501d0ca)
|
|
isis: T5597: add new features from FRR 9 (backport #2285)
|
|
* Add BGP Software Version capability (draft-abraitis-bgp-version-capability)
set protocols bgp neighbor 192.0.2.1 capability software-version
* Add BGP neighbor path-attribute treat-as-withdraw command
set protocols bgp neighbor 192.0.2.1 path-attribute treat-as-withdraw
(cherry picked from commit d285355716708a46767c18661976906812da8a3c)
|
|
* Add support for IS-IS advertise-high-metrics
set protocols isis advertise-high-metrics
* Add support for IS-IS advertise-passive-only
set protocols isis advertise-passive-only
(cherry picked from commit f7d35c15256ea74ab32c9b978a5c6fdbd659a7a0)
|
|
T5594: vrrp: extend function is_ipv6_tentative (backport #2281)
|
|
address, and not only global ipv6 address. This allows to configure ipv6 link local address on vrrp hello-source-address parameter.
(cherry picked from commit b6ae59354b5d69751cc7ea75e0aa4ac0070afa47)
|
|
T5561: nat: inbound|outbound interface should not be mandatory (backport #2253)
|
|
frr: T2472: disable EIGRP daemon
|
|
There is no EIGRP support in VyOS 1.4/sagitta
|
|
ddclient: T5585: Fix file access mode for dynamic dns configuration (backport #2270)
|
|
T5575: ARP/NDP table-size isnt set properly (backport #2255)
|
|
op mode: T5582: Add 'force ntp synchronization' (backport #2262)
|
|
T5586: Disable by default SNMP for Keeplived VRRP service (backport #2273)
|