summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-10-08Merge pull request #2347 from c-po/equuleusDaniil Baturin
pppoe: T5630: allow to specify MRU in addition to already configurable MTU (backport #2335)
2023-10-08scripts: T4269: node.def generator should automatically add default valuesChristian Breunig
Since introducing the XML <defaultValue> node it was common, but redundant, practice to also add a help string indicating which value would be used as default if the node is unset. This makes no sense b/c it's duplicated code/value/characters and prone to error. The node.def scripts should be extended to automatically render the appropriate default value into the CLI help string. For e.g. SSH the current PoC renders: $ cat templates-cfg/service/ssh/port/node.def multi: type: txt help: Port for SSH service (default: 22) val_help: u32:1-65535; Numeric IP port ... Not all subsystems are already migrated to get_config_dict() and make use of the defaults() call - those subsystems need to be migrated, first before the new default is added to the CLI help. (cherry picked from commit a68c9238111c6caee78bb28f8054b8f0cfa0e374)
2023-10-08pppoe: T5630: verify MRU is less or equal then MTUChristian Breunig
(cherry picked from commit e357258e645cf85de0035d4ecfbf99db4dd90f7e)
2023-10-08pppoe: T5630: allow to specify MRU in addition to already configurable MTUChristian Breunig
Set the MRU (Maximum Receive Unit) value to n. PPPd will ask the peer to send packets of no more than n bytes. The value of n must be between 128 and 16384, the default was always 1492 to match PPPoE MTU. A value of 296 works well on very slow links (40 bytes for TCP/IP header + 256 bytes of data). Note that for the IPv6 protocol, the MRU must be at least 1280. CLI: set interfaces pppoe pppoe0 mru 1280 (cherry picked from commit e062a8c11856f213983f5b41f50d4f9dbc0dde0f)
2023-10-03T5213: Add accounting-interim-interval option for PPPoE-serverViacheslav Hletenko
Add accounting-interim-interval option for PPPoE-server set service pppoe-server authentication radius accounting-interim-interval '60'
2023-09-26T5586: Disable by default SNMP for Keeplived VRRP serviceViacheslav Hletenko
AgentX does not work stable. From time to time we see the system service crashing/degrading if something is wrong with SNMP from util net-snmp. We should disable it by default and enable it only if configured. set high-availability vrrp snmp
2023-09-19Merge pull request #2282 from nicolas-fort/T5594-equuleusChristian Breunig
T5594: vrrp: extend function is_ipv6_tentative
2023-09-18T5594: vrrp: extend function is_ipv6_tentativeNicolas Fort
2023-09-07Merge pull request #2219 from sarthurdev/T5555_equuleusChristian Breunig
system: T5555: Fix time-zone migrator changing valid time-zones to UTC
2023-09-07system: T5555: Fix time-zone migrator changing valid time-zones to UTCsarthurdev
2023-09-05Merge pull request #2200 from sever-sever/T5533-eqDaniil Baturin
T5533: Fix VRRP IPv6 FAULT state due to IPv6 tentative state
2023-09-05Merge pull request #2198 from mlk-89/equuleusChristian Breunig
T5545: fix sflow configuration
2023-09-04T5533: Fix VRRP IPv6 FAULT state due to IPv6 tentative stateViacheslav Hletenko
Checks if an IPv6 address on a specific network interface is in the tentative state. IPv6 tentative addresses are not fully configured and are undergoing Duplicate Address Detection (DAD) to ensure they are unique on the network. inet6 2001:db8::3/125 scope global tentative It tentative state the group enters in FAULT state. Fix it.
2023-09-04T5545: fix sflow configurationMaxime.L
2023-09-02Merge pull request #2191 from c-po/equuleusChristian Breunig
T5428: fix DHCP client running in VRF context
2023-09-01container: T4353: capitalize ascii -> ASCIIChristian Breunig
(cherry picked from commit 8daf7f95d832550cc31ab22a65aabe969ecae813)
2023-09-01container: T578: fix XML build warning about 'Christian Breunig
2023-08-31Merge pull request #2181 from sever-sever/T738-eqChristian Breunig
T738: add CLI option for PowerDNS local-port
2023-08-31Merge pull request #2168 from sever-sever/T3546Christian Breunig
T3546: PPPoE-server add extended scripts for RADIUS attributes
2023-08-31Merge pull request #2166 from sever-sever/T5506-eqChristian Breunig
T5506: Add link-local IPv6 address for container interfaces
2023-08-30Merge pull request #2187 from sever-sever/T4933-eqViacheslav Hletenko
vyos.util: T4933: informative error for bad colon-separated lines
2023-08-30vyos.util: T4933: informative error for bad colon-separated linesDaniil Baturin
in vyos.util.colon_separated_to_dict (cherry picked from commit fb7f162f61522127ca72adffd6802797b136a99a)
2023-08-29T738: add CLI option for PowerDNS local-portViacheslav Hletenko
set service dns forwarding allow-from '192.0.2.0/24' set service dns forwarding listen-address '192.0.2.11' set service dns forwarding port '5353'
2023-08-28T5428: fix DHCP address renewal/release when running in VRFChristian Breunig
2023-09-01vrf: T5428: stop DHCP processes on VRF removalChristian Breunig
This is a workaround for the priority inversion from T5492 ("CLI node priority is not inversed on node deletion"). As this is a corner case bug that's only triggered if an interface is removed from a VRF and also the VRF is removed in one commit, priorities are not honored. Thus we implement this workaround which stop the DHCP(v6) client processes on the VRF associated interfaces to get out the DHCP RELEASE message before interfaces are shut down. (cherry picked from commit 005151f77be5cf999689cfd03620bbc39df59018)
2023-08-25Merge pull request #2170 from sever-sever/T4825-eqChristian Breunig
T4825: Add interface type veth
2023-08-25T4825: Add interface type vethViacheslav Hletenko
Add interface type veth (Virtual ethernet) One of the usecases it's interconnect different vrf's and default vrf via bridge set interfaces virtual-ethernet veth0 peer-name 'veth1010' set interfaces virtual-ethernet veth1010 address '10.0.0.10/24' set interfaces virtual-ethernet veth1010 peer-name 'veth0' set interfaces virtual-ethernet veth1010 vrf 'foo' set interfaces bridge br0 address '10.0.0.1/24' set interfaces bridge br0 member interface veth0 vyos@r1:~$ ping 10.0.0.10 count 1 PING 10.0.0.10 (10.0.0.10) 56(84) bytes of data. 64 bytes from 10.0.0.10: icmp_seq=1 ttl=64 time=0.082 ms
2023-08-25T3546: PPPoE-server add extended scripts for RADIUS attributesViacheslav Hletenko
Ability to get and parse RADIUS attributes via a shell script and then execute commands Ane of the usecases is to create a custom shaper with some smart Extended scripts receive from PPPoE daemon the following variables: $1 - Interface name $4 - Tunnel GW IP address $5 - Delegated IP address to the client $6 - Calling Station ID (MAC) if [ -f /run/accel-pppd/radattr.$1 ]; then true fi
2023-08-24Merge pull request #2167 from jestabro/eq-T5006Christian Breunig
http-api: T5006: add explicit async to retrieve operation
2023-08-24http-api: T5006: add explicit async to retrieve operationJohn Estabrook
2023-08-24T5506: Add link-local IPv6 address for container interfacesViacheslav Hletenko
Fix for adding IPv6 link-local address for container interfaces set container network NET01 prefix '10.0.0.0/24' set container network NET01 prefix '2001:db8:2222::/64' % ip -6 addr show scope link dev pod-NET01 17: pod-NET01: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 inet6 fe80::d89c:dfff:fe1a:8689/64 scope link
2023-08-19Merge pull request #2158 from c-po/t5470-wifi-equuleusViacheslav Hletenko
wifi: T5470: improve error message
2023-08-19wifi: T5470: improve error messageChristian Breunig
(cherry picked from commit ffb798b4678f3b1bd0a40cc42b1f0477470346dc)
2023-08-17Merge pull request #2154 from sever-sever/T5486Christian Breunig
T5486: smoketest: adjust to new process_named_running() implementation
2023-08-17Merge pull request #2153 from sever-sever/T5223Daniil Baturin
T5223: Fix removing key id for GRE tunnel
2023-08-17T5486: smoketest: adjust to new process_named_running() implementationViacheslav Hletenko
After commit 9c677c8 ("vyos.util: extend process_named_running() signature with cmdline") we need an exact match for the process name. In the past we used a in b and now we test for a == b. Process name doesn't march 'ddclient' psutil.Process(pid=10987, name='ddclient - sleeping for 20 seconds', started='13:12:47' It cause smoketest fail
2023-08-17T5223: Fix removing key id for GRE tunnelViacheslav Hletenko
Fix for removing key id from GRE tunnel Before fix: del interfaces tunnel tun10 parameters ip key commit sudo ip tunnel show tun10 tun10: gre/ip remote 203.0.113.254 local 192.168.122.11 ttl 64 tos inherit key 1234 After the fix: sudo ip tunnel show tun10 tun10: gre/ip remote 203.0.113.254 local 192.168.122.11 ttl 64 tos inherit
2023-08-12Merge pull request #2127 from sever-sever/T2298-eqChristian Breunig
T2298: vyos.util: extend process_named_running() signature with cmdline
2023-08-10Merge pull request #2126 from sever-sever/T5329-eqChristian Breunig
T5329 : priority: tunnel config is committed before wireguard
2023-08-01vyos.util: extend process_named_running() signature with cmdlineChristian Breunig
process_named_running() was introduced in commit 16b2fc8fc4ca ("dns-forwarding: T2298: fix path to control file") and thus remained more or less unchanged. Smoketests use process_named_running() heavily and might spawn multiple processes with the same name but ifferent options (e.g. dhcp6c or dhclient) and it was yet not possible to properly filter on the "real-deal" like the process bound to a given interface. One can now optionally specify a string that is searched inside the command line argument list of the process. Example: >>> process_named_running('dhcp6c', 'veth0') ['/usr/sbin/dhcp6c', '-D', '-k', '/run/dhcp6c/dhcp6c.veth0.sock', '-c', '/run/dhcp6c/dhcp6c.veth0.conf', '-p', '/run/dhcp6c/dhcp6c.veth0.pid', 'veth0'] 4215 >>> process_named_running('dhcp6c', 'veth1') ['/usr/sbin/dhcp6c', '-D', '-k', '/run/dhcp6c/dhcp6c.veth1.sock', '-c', '/run/dhcp6c/dhcp6c.veth1.conf', '-p', '/run/dhcp6c/dhcp6c.veth1.pid', 'veth1'] 4253 Where the debug list returned is the commandline searched. (cherry picked from commit 9c677c81be6a6e62958c73b038c2a36f1f629108)
2023-08-01T5329 : priority: tunnel config is committed before wireguardsrividya0208
(cherry picked from commit 3d5aba0775ff0d858d6c75d6aa37183be73c15aa)
2023-07-31Merge pull request #2097 from aapostoliuk/T4790-equuleusChristian Breunig
login: T4790: Added check of the sum of radius timeouts
2023-07-27Merge pull request #2115 from sever-sever/T5258-eqDaniil Baturin
T5258: git Actions use ubuntu-22.04 for PR conflicts checker
2023-07-27T5258: git Actions use ubuntu-22.04 for PR conflicts checkerViacheslav Hletenko
git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR conflicts checker https://github.com/actions/runner-images/issues/6002
2023-07-25login: T4790: Added check of the sum of radius timeoutsaapostoliuk
Added check of the sum of login radius timeouts. It has to be less or eq 50 sec. Added check of a number of login radius servers. It has to be less or eq 8 Otherwise, log in to the device can be discarded. Backported from 1.4
2023-07-22Merge pull request #2101 from sever-sever/T5354Christian Breunig
sshguard: T5354: Add service ssh dynamic-protection
2023-07-22Merge pull request #2106 from zdc/T4412-equuleusDaniil Baturin
remote: T4412: fixed upload via SSH
2023-07-21remote: T4412: fixed upload via SSHzsdc
- added timeout to socket creating - added skipping SSH fingerprint check with a negative result if a console is not interactive - replaced tracebacks with human-readable error messages - suppressed warnings from `cryptography` used by `paramiko`
2023-07-19sshguard: T5354: Add service ssh dynamic-protectionViacheslav Hletenko
Sshguard protects hosts from brute-force attacks It can inspect logs and block "bad" addresses by threshold Auto-generates own tables and rules for nftables, so they are not intercept with VyOS firewall rules. When service stops, all generated tables are deleted. set service ssh dynamic-protection set service ssh dynamic-protection allow-from '192.0.2.1' set service ssh dynamic-protection block-time '120' set service ssh dynamic-protection detect-time '1800' set service ssh dynamic-protection threshold '30'
2023-06-30Merge pull request #2057 from c-po/t5313-backportChristian Breunig
bcast-relay: T5313: verify() relay interfaces have IPv4 address configured
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 09:03:03 +0000