summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-07-19ipsec: T1210: split out pool from remote-access configurationChristian Poessinger
Remote access IP pools can now be defined at a global level and referenced in IPSec remote-access connections. To defined a pool use: set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1' set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24' set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1' set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64' A connection can then reference the pool: set vpn ipsec remote-access connection foo pool 'global-ipv4' set vpn ipsec remote-access connection foo pool 'global-ipv6'
2021-07-18ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixesChristian Poessinger
... this enables a dual-stack IKEv2 VPN deployment.
2021-07-18ipsec: T2816: limit remote-access nameservers to two IPv4 and two for IPv6Christian Poessinger
2021-07-18ipsec: l2tp: T2816: use common if 'key' in dict patternChristian Poessinger
2021-07-18Revert "T3641: fastnetmon package is not available for Debian Bullseye"Christian Poessinger
This reverts commit 70f7f06e778efa4bd3c2ad127d66c080e1db80c5.
2021-07-18smoketest: ospf: extend passive-interface debugging with kernel logChristian Poessinger
2021-07-18bridge: remove obsolete helper scriptChristian Poessinger
2021-07-17ipsec: T2816: add missing +x permission on Python helperChristian Poessinger
2021-07-17Merge pull request #927 from zdc/T3655-sagittaChristian Poessinger
VRF: T3655: proper connection tracking for VRFs
2021-07-17VRF: T3655: proper connection tracking for VRFszsdc
Currently, all VRFs share the same connection tracking table, which can lead to problems: - traffic leaks to a wrong VRF - improper NAT rules handling when multiple VRFs contain the same IP networks - stateful firewall rules issues The commit implements connection tracking zones support. Each VRF utilizes its own zone, so connections will never mix up. It also adds some restrictions to VRF names and assigned table numbers, because of nftables and conntrack requirements: - VRF name should always start from a letter (interfaces that start from numbers are not supported in nftables rules) - table number must be in the 100-65535 range because conntrack supports only 65535 zones
2021-07-17ipsec: T2816: restore erroneous deleted fileChristian Poessinger
Commit 22739144 ('ipsec: T2816: migrate "ipsec interfaces" to "interface"') by accident deleted the vpn_ipsec.py Python handler. Handler was restored.
2021-07-17Revert "openvpn: T56: remove strict checks for tls cert-file and key-file"Christian Poessinger
This reverts commit c414479fdf1d5ad77170f977481fb9197c9559ae. This commit broke the smoketests and also OpenVPN complains: Options error: You must define certificate file (--cert) or PKCS#12 file (--pkcs12)
2021-07-17vxlan: T3683: bugfix on MTU calculation for IPv6 underlayChristian Poessinger
2021-07-17ipsec: T2816: migrate "ipsec interfaces" to "interface"Christian Poessinger
2021-07-17xml: provide common "pre-shared-secret" include blockChristian Poessinger
2021-07-17xml: provide common "dhcp-interface" include blockChristian Poessinger
2021-07-17Merge pull request #924 from sarthurdev/ipsec_l2tp_pkiChristian Poessinger
pki: ipsec: l2tp: T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and update to use PKI.
2021-07-15pki: ipsec: l2tp: T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and ↵sarthurdev
update to use PKI.
2021-07-15vyos-1x-vmware: T3682: remove dhclient from ether-resume.pyYun Zheng Hu
dhclient is already handled by netplug so it's removed to avoid double renewing of dhcp leases.
2021-07-14Merge pull request #922 from jack9603301/containerChristian Poessinger
container: T3662: Set its priority to 1280
2021-07-14Merge pull request #920 from yunzheng/currentChristian Poessinger
vyos-1x-vmware: T3681: don't bytecompile ether-resume.py
2021-07-15container: T3662: Set its priority to 1280jack9603301
Set its priority to 1280 to prevent its configuration failure from affecting the underlying network services
2021-07-14vyos-1x-vmware: T3681: don't bytecompile ether-resume.pyYun Zheng Hu
Exclude /vmware-tools/scripts/ from bytecompilation to avoid the `__pycache__` directory being created.
2021-07-13Merge branch 'current' of github.com:/vyos/vyos-1x into currentDaniil Baturin
2021-07-13T3663: remove some unused sleep imports.Daniil Baturin
2021-07-13Merge pull request #918 from erkin/currentChristian Poessinger
T3679: Update the unexpected exception message
2021-07-13T3679: Update the unexpected exception messageerkin
2021-07-13T3663: use inotify-based watching for the IPsec process restart.Daniil Baturin
2021-07-13T3663: add a small sleep between polling for a new inotify event.Daniil Baturin
2021-07-13T3663: use inotify-based watching in "show vrrp".Daniil Baturin
2021-07-13Merge pull request #917 from yunzheng/currentChristian Poessinger
openvpn: T56: remove strict checks for tls cert-file and key-file
2021-07-13openvpn: T56: remove strict checks for tls cert-file and key-fileYun Zheng Hu
This makes the tls cert-file and key-file optional and allows for more advanced configurations via "openvpn-option", such as pkcs11 or pkcs12 options.
2021-07-12vrf: T31: remove supefluous new-lines for each VRF instanceChristian Poessinger
2021-07-12vrf: route: static: T2450: we also need to migrate the interface based routesChristian Poessinger
Previously during migration if one had used interface routes, the VRF based ones got not migrated. The following "old" VyOS 1.3 configuration did not get migrated: set protocols static interface-route 10.20.0.0/24 next-hop-interface eth2 next-hop-vrf 'blue' set protocols static interface-route 10.30.0.0/24 next-hop-interface br10 next-hop-vrf 'red' set protocols vrf blue static interface-route 10.0.0.0/24 next-hop-interface eth1 next-hop-vrf 'default' set protocols vrf red static interface-route 10.0.0.0/24 next-hop-interface eth1 next-hop-vrf 'default' set vrf name blue table '3000' set vrf name mgmt table '1000' set vrf name red table '2000' It must get migrated to: set protocols static route 10.20.0.0/24 interface eth2 vrf 'blue' set protocols static route 10.30.0.0/24 interface br10 vrf 'red' set vrf name blue protocols static route 10.0.0.0/24 interface eth1 vrf 'default' set vrf name blue table '3000' set vrf name mgmt table '1000' set vrf name red protocols static route 10.0.0.0/24 interface eth1 vrf 'default' set vrf name red table '2000'
2021-07-12op-mode: T427: add "summary" command for WireGuard interface informationChristian Poessinger
2021-07-11ipsec: T2816: use common "if key in dict:" patternChristian Poessinger
2021-07-11ipsec: T2816: fix NameErrorChristian Poessinger
Commit a5cd877a0a ("ipsec: T2816: Migrate ipsec-settings.xml.in and charon.conf to vpn_ipsec.py") unfortunately removed the dictionary definition for "data" which is required when running the l2tp handler script.
2021-07-11vxlan: T3665: add VRF supportChristian Poessinger
2021-07-11smoketest: ospf: change passive-interface debuggingChristian Poessinger
2021-07-10Merge pull request #916 from jack9603301/T3667Christian Poessinger
bridge: op-mode: T3667: Moving VLANs and modifying XML errors
2021-07-10bridge: op-mode: T3667: Fix command line errorsjack9603301
2021-07-10bridge: op-mode: T3667: Moving `vlan` to better locationsjack9603301
2021-07-09Merge pull request #915 from jack9603301/T3667Christian Poessinger
bridge: op-mode: T3667: Fix command line errors
2021-07-10bridge: op-mode: T3667: Fix command line errorsjack9603301
2021-07-09Merge pull request #913 from jack9603301/T3667Christian Poessinger
op-mode: brctl: T3667: Using bridge command structure instead of brctl
2021-07-09op-mode: brctl: T3667: Using `bridge` command structure instead of `brctl`jack9603301
2021-07-08T3663: add pre_hook argument to util.wait_for_inotifyDaniil Baturin
When waiting for processes that don't take long, we need add an inotify watcher _before_ starting that process. The pre-hook arguments allows the user to pass a () -> () anonymous function to be called before adding a watch.
2021-07-08T3663: fix the call to time.time() to match the new import scheme.Daniil Baturin
2021-07-07Merge pull request #912 from sarthurdev/pki_ipsec_rsaChristian Poessinger
pki: T3642: Migrate rsa-keys to PKI configuration
2021-07-07pki: T3642: Migrate rsa-keys to PKI configurationsarthurdev
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 11:14:26 +0000