summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-09-17wireguard: T4702: actively revoke peer if it gets disabledChristian Poessinger
When any configured peer is set to `disable` while the Wireguard tunnel is up and running it does not get actively revoked and removed. This poses a security risk as connections keep beeing alive. Whenever any parameter of a peer changes we actively remove the peer and fully recreate it on the fly.
2022-09-17smoketest: accel-ppp: revise base class to reduce amout of redundant codeChristian Poessinger
2022-09-17pppoe-server: T4703: combine vlan-id and vlan-range into single CLI nodeChristian Poessinger
The initial Accel-PPP PPPoE implementation used: set service pppoe-server interface <name> vlan-id <id> set service pppoe-server interface <name> vlan-range <start-stop> This is actually a duplicated CLI node.
2022-09-16firewall: T2199: enable "auto-merge" on setsChristian Poessinger
vyos@vyos# show firewall +name foo { + rule 1 { + action accept + packet-length 100 + packet-length 105 + packet-length 200-300 + packet-length 220-250 + } +} will report a nftables error upon load: Error: conflicting intervals specified With nftables 1.0.3 there is an "auto-merge" option which corrects this: https://lwn.net/Articles/896732/
2022-09-16Merge pull request #1463 from sever-sever/T4118Daniil Baturin
ipsec: T4118: Change vpn ipsec syntax for IKE ESP and peer
2022-09-16T4699: Firewall: Add jump action in firewall rulestNicolas Fort
2022-09-16ipsec: T4118: Change vpn ipsec syntax for IKE ESP and peerViacheslav Hletenko
Migration and Change boolean nodes "enable/disable" to disable-xxxx, enable-xxxx and just xxx for VPN IPsec configurations - IKE changes: - replace 'ipsec ike-group <tag> mobike disable' => 'ipsec ike-group <tag> disable-mobike' - replace 'ipsec ike-group <tag> ikev2-reauth yes|no' => 'ipsec ike-group <tag> ikev2-reauth' - ESP changes: - replace 'ipsec esp-group <tag> compression enable' => 'ipsec esp-group <tag> compression' - PEER changes: - replace: 'peer <tag> id xxx' => 'peer <tag> local-id xxx' - replace: 'peer <tag> force-encapsulation enable' => 'peer <tag> force-udp-encapsulation' - add option: 'peer <tag> remote-address x.x.x.x' Add 'peer <name> remote-address <name>' via migration script
2022-09-16Merge pull request #1544 from sever-sever/T4697Christian Poessinger
policy-route: T4697: Add missing rule_id for verify_rule func
2022-09-16ocserv: T4656: use "0.0.0.0" defaultValue via XML definition"Christian Poessinger
2022-09-16ocserv: openconnect: T4656: add listen-address CLI optionDemon_H
This will set the listen-host ocserv configuration option.
2022-09-16xml: T4698: drop validator name="range" and replace it with numericChristian Poessinger
After T4669 added support for range validation to the OCaml validator there is no need to keep the slow Python validator in place. Raplace all occurances of <validator name="range" argument="--min=1 --max=65535"/> with <validator name="numeric" argument="--range 1-65535"/>.
2022-09-16policy-route: T4697: Add missing rule_id for verify_rule funcViacheslav Hletenko
There is a missing 'rule_id' in verify_rule() function We call it from the loop but don't provide argument 'rule_id' It cause "NameError: name 'rule_id' is not defined" Fix it
2022-09-15Merge pull request #1477 from sempervictus/feature/ocserv_groupsViacheslav Hletenko
T3896(adjacent): Fix ocserv local user requirement, add groupconfig
2022-09-15bgp: T4696: add support for "bestpath peer-type multipath-relax"Christian Poessinger
Add new VyOS CLI command: set protocols bgp parameters bestpath peer-type multipath-relax This command specifies that BGP decision process should consider paths from all peers for multipath computation. If this option is enabled, paths learned from any of eBGP, iBGP, or confederation neighbors will be multipath if they are otherwise considered equal cost. [1] [1]: http://docs.frrouting.org/en/stable-8.3/bgp.html#clicmd-bgp-bestpath-peer-type-multipath-relax
2022-09-15smoketest: ethernet: rfs: T4689: also test default "0" caseChristian Poessinger
In addition to verify the queue lengths when CLI option is set, we also need to verify that all values are resetted back to "0" which is the Kernel default.
2022-09-15ethernet: rfs: T4689: remove redundant codeChristian Poessinger
2022-09-15Merge branch 'T4689' of https://github.com/jack9603301/vyos-1x into currentChristian Poessinger
* 'T4689' of https://github.com/jack9603301/vyos-1x: rfs: T4689: Support RFS(Receive Flow Steering)
2022-09-15smoketest: nhrp: T2199: fix nftables rule/chain namesChristian Poessinger
2022-09-15rfs: T4689: Support RFS(Receive Flow Steering)jack9603301
2022-09-15conntrack: T4691: lower "tcp max-retrans" upper limitChristian Poessinger
Kernel 5.15.y and newer only support an upper boundary of 255. vyos@vyos:~$ sudo sysctl -w net.netfilter.nf_conntrack_tcp_max_retrans=255 net.netfilter.nf_conntrack_tcp_max_retrans = 255 vyos@vyos:~$ sudo sysctl -w net.netfilter.nf_conntrack_tcp_max_retrans=256 sysctl: setting key "net.netfilter.nf_conntrack_tcp_max_retrans": Invalid argument
2022-09-15smoketest: conntrack: T4691: lower test value for nf_conntrack_tcp_max_retransChristian Poessinger
The old value of 1024 is no longer supported by the most recent Kernel
2022-09-15system login: T874: add libpam-google-authenticator package to provide 2FA ↵goodNETnick
support
2022-09-14Merge pull request #1540 from sever-sever/T4695Christian Poessinger
keymap: T4695: Add Spain 'es' and Japan 'jp106' keymaps
2022-09-14keymap: T4695: Add Spain 'es' and Japan 'jp106' keymapsViacheslav Hletenko
Add Spain (es) and Japan (jp106) keymaps set system option keyboard-layout es|jp106
2022-09-14Merge pull request #1530 from sever-sever/T4679Christian Poessinger
openvpn: T4679: Fix incorrect verify local and remote address
2022-09-14Merge pull request #1538 from sarthurdev/nftables1_testsChristian Poessinger
firewall: nat66: policy: T2199: Fix smoketests for nftables updated output
2022-09-14openvpn: T4679: Fix incorrect verify local and remote addressViacheslav Hletenko
In the OpenVPN site-to-site config we can use IPv6 peers without IPv4 configurations but "verify()" checks also local and remote IPv4 addresses that in this case will be empty lists For example: set interfaces openvpn vtun2 local-address 2001:db8::1 set interfaces openvpn vtun2 remote-address 2001:db8::2 Check in the commit (v4loAddr == v4remAddr) <= both empty lists commit DEBUG: [] == [] or ['2001:db8::2'] == [] So we should also check v4loAddr, v4remAddr, v6loAddr, v6remAddr are not empty
2022-09-14firewall: nat66: policy: T2199: Fix smoketests for nftables updated outputsarthurdev
2022-09-14Merge pull request #1537 from sarthurdev/nhrp_nftablesChristian Poessinger
nhrp: T2199: Use separate table in nftables for NHRP rules
2022-09-14nhrp: T2199: Use separate table in nftables for NHRP rulessarthurdev
2022-09-14Merge pull request #1534 from sarthurdev/firewall_interfacesChristian Poessinger
firewall: zone-policy: T2199: T4605: Refactor firewall, migrate zone-policy
2022-09-14Merge pull request #1536 from Cheeze-It/currentChristian Poessinger
isis: T4693: Fix ISIS segment routing configurations
2022-09-13isis: T4693: Fix ISIS segment routing configurationsCheeze_It
This change is to fix a bug in which ISIS segment routing was broken due to a refactor. This change also is going to introduce a smoketest to make sure this is caught in the future.
2022-09-13zone-policy: T2199: Migrate zone-policy to firewall nodesarthurdev
2022-09-13policy: T2199: Typo in policy route smoketest teardownsarthurdev
2022-09-13firewall: T4605: Rename filter tables to vyos_filtersarthurdev
2022-09-13firewall: T2199: Move initial firewall tables to datasarthurdev
2022-09-13firewall: T2199: Refactor firewall + zone-policy, move interfaces under ↵sarthurdev
firewall node * Refactor firewall and zone-policy rule creation and cleanup * Migrate interface firewall values to `firewall interfaces <name> <direction> name/ipv6-name <name>` * Remove `firewall-interface.py` conf script
2022-09-12Revert "rfs: T4689: Support RFS(Receive Flow Steering)"Christian Poessinger
This reverts commit 53355271a2864d844daca89a064c21e514e10adb.
2022-09-12graphql: T4690: update resolver for 'SystemStatus' after 'uptime' updateJohn Estabrook
2022-09-12telegraf: T4617: add Restart=always to systemd unitChristian Poessinger
2022-09-12Merge pull request #1526 from roedie/T4665-2Christian Poessinger
T4665: Keepalived: Fix interface names
2022-09-12Merge pull request #1533 from jack9603301/T4689Christian Poessinger
rfs: T4689: Support RFS(Receive Flow Steering)
2022-09-11T4665: Keepalived: Fix interface namesSander Klein
When applying the same VRID for IPv4 and IPv6 with RFC3768 compatibility enabled, the IPv6 interfaces came back with the wrong name. For example: Name Interface VRID State Priority Last Transition ------ ----------- ------ ------- ---------- ----------------- v4-10 eth1v10 10 MASTER 100 21s v6-10 vrrpv10 10 MASTER 100 21s Because of this, the IPv6 interface didn't show up in `show int`. This change suffixes the interface with the IP version so `show int` works again. Name Interface VRID State Priority Last Transition ------ ----------- ------ ------- ---------- ----------------- v4-10 eth1v10v4 10 MASTER 100 21s v6-10 eth1v10v6 10 MASTER 100 21s vyos@vyos:~$ show interfaces Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address S/L Description --------- ---------- --- ----------- [....] eth1v10v4 192.168.10.60/24 u/u eth1v10v6 2001:ffff::1/64 u/u [....]
2022-09-12rfs: T4689: Support RFS(Receive Flow Steering)jack9603301
2022-09-10Merge pull request #1532 from initramfs/current-local-policy-priorityChristian Poessinger
policy: T4685: fix non-existent inbound-interface in local-policy(6)
2022-09-10policy: T4685: fix non-existent inbound-interface on commitinitramfs
The local-policy and local-policy6 nodes were missing their priority property causing an ordering issue between the creation of dynamic interfaces (like VLAN/Bonding) and referencing said interface in PBR rules. Add a priority value to order local-policy(6) to be after all interface definitions.
2022-09-09Merge pull request #1531 from sever-sever/T4684John Estabrook
route: T4684: Set execution flag to op-mode route.py
2022-09-09route: T4684: Set execution flag to op-mode route.pyViacheslav Hletenko
Set execution flag to route.py op-mode
2022-09-09Merge pull request #1529 from jestabro/standardize-show-system-storageChristian Poessinger
system: T4682: standardize op-mode 'show system storage'
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 04:14:47 +0000