| Age | Commit message (Collapse) | Author |
|---|
|
|
|
A network namespace can have VRFs assigned, thus we need to get the priorities
right. This lowers both priorities in general as a VRF or NETNS needs to be
available very early as services can run on top of them.
|
|
ddclient: T5574: Support per-service cache management for providers
|
|
T5600: firewall: change constraints for inbound|outbound interface-name
|
|
Add support for per-service cache management for ddclient providers
via `wait-time` and `expiry-time` options. This allows for finer-grained
control over how often a service is updated and how long the hostname
will be cached before being marked expired in ddclient's cache.
More specifically, `wait-time` controls how often ddclient will attempt
to check for a change in the hostname's IP address, and `expiry-time`
controls how often ddclient to a forced update of the hostname's IP
address.
These options intentionally don't have any default values because they
are provider-specific. They get treated similar to the other provider-
specific options in that they are only used if defined.
|
|
T5165: Migrate policy local-route rule x destination to address
|
|
ddclient: T5612: Miscellaneous improvements and fixes for dynamic DNS
|
|
T5497: Add ability to resequence rule numbers for firewall
|
|
T5616: firewall and policy: add option to be able to match firewall marks
|
|
Migrate policy local-route <destination|source> to node address
replace 'policy local-route{v6} rule <tag> destination|source <x.x.x.x>'
=> 'policy local-route{v6} rule <tag> destination|source address <x.x.x.x>'
|
|
conntrack: T5376: Fix conntrack-sync vyos.configdep issues
|
|
Updated spacing.
|
|
filter and in policy route.
|
|
Fixes `KeyError: 'conntrack_sync'`
Ignore `ConfigError("ConfigError('Interface eth1 requires an IP address!')")` due to calling conntrack-sync too early
|
|
|
|
T5577: Optimized PAM configs for RADIUS/TACACS+
|
|
firewall: T5217: Synproxy bugfix and ct state conflict checking
|
|
|
|
mdns: T5615: Allow controlling IP version to use for mDNS repeater
|
|
Rename avahi-daemon config file to avahi-daemon.conf.j2 to match the
convention used by other config files.
|
|
This commit adds a new configuration option to the mDNS repeater service
to allow controlling which IP version to use for mDNS repeater.
Additionally, publishing AAAA record over IPv4 and A record over IPv6 is
disabled as suggested.
See:
- https://github.com/lathiat/avahi/issues/117#issuecomment-1651475104
- https://bugzilla.redhat.com/show_bug.cgi?id=669627#c2
|
|
T5217: Add firewall synproxy
|
|
conntrack: T5376: T5598: Restore kernel conntrack helpers
|
|
firewall: T5614: Add support for matching on conntrack helper
|
|
ipsec: T5606: Add support for whole CA chains
|
|
T5165: Add option protocol for policy local-route
|
|
Add option `protocol` for policy local-route
set policy local-route rule 100 destination '192.0.2.12'
set policy local-route rule 100 protocol 'tcp'
set policy local-route rule 100 set table '100'
|
|
firewall: T5160: Remove zone policy op-mode
|
|
|
|
|
|
`nf_conntrack_helper` that auto-assigned helpers is removed from the kernel
|
|
|
|
Also includes an update to smoketest to verify
|
|
Additional cleanup and refactoring for ddclient scripts including the
smotektests.
|
|
Some porvides (like 'namecheap') allow to use '@' or '*' as hostname
prefix for apex and wildcard records. This commit relaxes the hostname
validation to allow these prefixes.
|
|
Adjust the validator and completion for ddclient to remove unsupported
or superfluous protocols.
Specifically,
- remove 'nsupdate' protocol from the list because there is a separate
config path for that protocol (rfc2136)
- remove 'cloudns' protocol from the list because it has non standard
configuration and is not supported by our configurator at this time
|
|
Enable TTL support for web-service based protocols in addition to
RFC2136 based (nsupdate) protocol.
Since TTL is not supported by all protocols, and thus cannot have a
configuration default, the existing XML snippet `include/dns/time-to-live.xml.i`
does not have common `<defaultValue>300</defaultValue>` anymore and is
instead added explicitly whenever necessary.
|
|
Refactor zone configuration to use shared XML snippet for all cases.
|
|
Adjust the jinja template to avoid generating incorrect ddclient.conf in
some cases. The template is reformatted to guarantee whitespacing and
empty line separation.
|
|
dyndns2 protocol in ddclient honors dual stack for selective servers
because of the way it is implemented in ddclient.
We formalize the well known servers that support dual stack in a list
and check against it when validating the configuration.
|
|
Fix VRF support interface definition and configuration mode for ddclient
to actually capture the VRF name and pass it to the template.
|
|
T5497: op-mode: Add generate firewall rule-resequence
|
|
Add op-mode command `generate firewall rule-resequence`
Generates output with new sequences for firewall rules
set firewall ipv4 input filter rule 1 action 'accept'
set firewall ipv4 input filter rule 1 description 'Allow loopback'
$ generate firewall rule-resequence start 10 step 10
set firewall ipv4 input filter rule 10 action 'accept'
set firewall ipv4 input filter rule 10 description 'Allow loopback'
|
|
smoketest: T5607: support getting SCSI device by drive-id
|
|
Add ability to SYNPROXY connections
It is useful to protect against TCP SYN flood attacks and port-scanners
set firewall global-options syn-cookies 'enable'
set firewall ipv4 input filter rule 10 action 'synproxy'
set firewall ipv4 input filter rule 10 destination port '22'
set firewall ipv4 input filter rule 10 inbound-interface interface-name 'eth1'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
|
|
user can use VRF, and negated VRF, and configuration wonn't be broken after reboot.
|
|
|
|
|
|
T5602: Reverse-proxy add option backup for backend server
|
|
|
