summaryrefslogtreecommitdiff
path: root/python/vyos
AgeCommit message (Collapse)Author
2024-01-22T5957: fix removal of interface in firewall rules.Nicolas Fort
(cherry picked from commit 0a436e1fce66391311799bc970f05f6f4ba880ad)
2024-01-22Merge pull request #2856 from c-po/firewall-backportsChristian Breunig
firewall: T5729: T5681: T5217: backport subsystem from current branch
2024-01-22firewall: T5729: T5681: T5217: backport subsystem from current branchChristian Breunig
This is a combined backport for all accumulated changes done to the firewall subsystem on the current branch.
2024-01-21T5961: Fix QoS policy shaper class match vifViacheslav Hletenko
If we have QoS policy shaper class match `vif` (VLAN) we have to use `basic match "meta(vlan mask 0xfff eq xxx)` instead of `action policy` Actual incorrect TC filter: tc filter add dev eth1 parent 1: protocol all prio 1 action police rate 100000000 burst 15k flowid 1:64 The correct TC filter after fix: tc filter add dev eth1 parent 1: protocol all prio 1 basic match "meta(vlan mask 0xfff eq 100)" flowid 1:64 (cherry picked from commit bb532f7f65930f8bc42e3bf3ebbcc690bffcfd0a)
2024-01-20T5963: Fix QoS shaper rate calculations and set defaul 1GbitViacheslav Hletenko
It is impossible to detect interface speed for some devices for exmaple virtio interfaces: ``` vyos@r4:~$ cat /sys/class/net/eth1/speed -1 ``` It causes wrong negative calcultaions like: - bandwidth: -1000000 - 4% of bandwidth: -40000 tc class replace dev eth1 parent 1: classid 1:1 htb rate -1000000 tc class replace dev eth1 parent 1:1 classid 1:a htb rate -40000 Fix this with checking negative value. Add default interface speed to 1000 Mbit if we cannot detect the interface speed, the current default value 10 Mbit is too low for nowadays (cherry picked from commit a7fe02e989cf7034609cb833c86143660eb609d5)
2024-01-19T5964: add missing imports for is_wwan_connected()Adam Smith
(cherry picked from commit 844e35dea0500c48ff942ef4542dbb7a25b9dc7d)
2024-01-18conntrack: T5376: T5779: backport from currentChristian Breunig
Backport of the conntrack system from current branch. (cherry picked from commit fd0bcaf12) (cherry picked from commit 5acf5aced) (cherry picked from commit 42ff4d8a7) (cherry picked from commit 24a1a7059)
2024-01-18ethernet: T4638: deleting parent interface does not delete underlying VIFsChristian Breunig
(cherry picked from commit 7ba47f027f3a9441125c13a927eb23cee2de041b)
2024-01-17image-tools: T5923: update system_console.py for new GRUB file structureJohn Estabrook
Add util function to set serial console speed in accordance with revised GRUB file structure; in keeping with the intentions of the config_mode script, adjust the GRUB var 'console_speed' to only modify ttyS0. (cherry picked from commit 5ceaff2ef970cb9c567ac317bafbffca5b073f4a)
2024-01-11dns: T5791: use common pattern for exclude check of dynamic interfacesChristian Breunig
This uses a more common pattern froma base class while the original code from 0a1c9bc38 ("T5791: DNS dynamic exclude check for dynamic interfaces PPPoE") is still retained. (cherry picked from commit e5ce4222c6e9b24d276625678db7339ada0c54ef)
2024-01-11Merge pull request #2793 from sarthurdev/T5550_sagittaChristian Breunig
interface: T5550: Interface source-validation priority over global value (backport)
2024-01-10https: T5902: remove virtual-host configurationChristian Breunig
We have not seen the adoption of the https virtual-host CLI option. What it did? * Create multiple webservers each listening on a different IP/port (but in the same VRF) * All webservers shared one common document root * All webservers shared the same SSL certificates * All webservers could have had individual allow-client configurations * API could be enabled for a particular virtual-host but was always enabled on the default host This configuration tried to provide a full webserver via the CLI but VyOS is a router and the Webserver is there for an API or to serve files for a local-ui. Changes Remove support for virtual-hosts as it's an incomplete and thus mostly useless "thing". Migrate all allow-client statements to one top-level allow statement. (cherry picked from commit d0d3071e99eb65edb888c26ef2fdc9e038438887)
2024-01-08pki: T5886: add support for ACME protocol (LetsEncrypt)Christian Breunig
The "idea" of this PR is to add new CLI nodes under the pki subsystem to activate ACME for any given certificate. vyos@vyos# set pki certificate NAME acme Possible completions: + domain-name Domain Name email Email address to associate with certificate listen-address Local IPv4 addresses to listen on rsa-key-size Size of the RSA key (default: 2048) url Remote URL (default: https://acme-v02.api.letsencrypt.org/directory) Users choose if the CLI based custom certificates are used set pki certificate EXAMPLE acme certificate <base64> or if it should be generated via ACME. The ACME server URL defaults to LetsEncrypt but can be changed to their staging API for testing to not get blacklisted. set pki certificate EXAMPLE acme url https://acme-staging-v02.api.letsencrypt.org/directory Certificate retrieval has a certbot --dry-run stage in verify() to see if it can be generated. After successful generation, the certificate is stored in under /config/auth/letsencrypt. Once a certificate is referenced in the CLI (e.g. set interfaces ethernet eth0 eapol certificate EXAMPLE) we call vyos.config.get_config_dict() which will (if with_pki=True is set) blend in the base64 encoded certificate into the JSON data structure normally used when using a certificate set by the CLI. Using this "design" does not need any change to any other code referencing the PKI system, as the base64 encoded certificate is already there. certbot renewal will call the PKI python script to trigger dependency updates. (cherry picked from commit b8db1a9d7baf91b70c1b735e58710f1e2bc9fc7a) # Conflicts: # debian/control
2024-01-08image: T5898: fix kernel-level partition rescanMatt Clauson
This fix moves from partprobe to partx to rescan the partition table on an affected disk. (cherry picked from commit f883455d9a3081780c43426ab26de9d26f24c9aa)
2024-01-07smoketest: T5195: fix BasicInterfaceTest tearDown() timeout penaltyChristian Breunig
Commit ad9bdfc24 ("T5195: add timeout argument to process_named_running()") added a 2*10 seconds penalty for every interface test (dhcp and dhcpv6). This leads to long runs of "make test" after an ISO build. There is no need to wait 10 seconds for a test that checks for a process not running. The timeout is there to give the process some time to startup. (cherry picked from commit 041db49533d57cabfccd319492b85ee0bafdd40c)
2024-01-07T5195: add timeout argument to process_named_running()Christian Breunig
Smoketests heavily rely on process_named_running() so in order to "relax" system constraints during a test we will add a timeout of 10 seconds for every testcase provided by base_interfaces_test.py (cherry picked from commit ad9bdfc248cf47b3361bd0e5d7371d56131160a0)
2024-01-04T5159: nat: add option to map network and ports. Feature used for large ↵Nicolás Fort
deployments in cgnat. (#2694) (cherry picked from commit 3fc76505d0642c32a3eae9c0ce6ab3dd2ec32dbd)
2024-01-04configdict: T5894: add get_config_dict() flag with_pkiChristian Breunig
VyOS has several services relaying on the PKI CLI tree to retrieve certificates. Consuming services like ethernet, openvpn or ipsec all re-implemented the same code to retrieve the certificates from the CLI. This commit extends the signature of get_config_dict() with a new option with_pki that defaults to false. If this option is set, the PKI CLI tree will be blended into the resulting dictionary. (cherry picked from commit b152b52023ba0cf0d4919eae39e92de28a458917)
2024-01-04configdict: T5837: node_changed() shall not return duplicate list itemsChristian Breunig
This extends commit 4ee406470 ("configdict: T5837: add support to return added nodes when calling node_changed()") so no duplicate list elements get returned. (cherry picked from commit 301312b293238d3041c8912af6fdb86b506d7ab4)
2024-01-03Merge pull request #2732 from vyos/mergify/bp/sagitta/pr-2728Christian Breunig
T5880: verify_source_interface() should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces (backport #2728)
2024-01-01image-tools: T5885: relax restriction on image-name len from 32 to 64John Estabrook
(cherry picked from commit 3a9688ddb07f6bac1eb92aa13c20e897129e8958)
2024-01-01configverify: T5880: raise exception if interfaces sourced form dynamic ↵Christian Breunig
interfaces Interfaces matching the following regex (ppp|pppoe|sstpc|l2tp|ipoe)[0-9]+ can not be used as source-interface for e.g. a tunnel. The main reason is that these are dynamic interfaces which come and go from a kernel point of view, thus it's not possible to bind an interface to them. (cherry picked from commit 5062f5d313548d6ebb9c07fee6b6d6be25b8f8f0)
2024-01-01T5474: establish common file name pattern for XML conf mode commandsChristian Breunig
We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in (cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)
2023-12-30firewall: T5834: Rename 'enable-default-log' to 'default-log'Indrajit Raychaudhuri
Rename chain level defaults log option from `enable-default-log` to `default-log` for consistency. (cherry picked from commit 245e758aa2ea8779186d0c92d79d33170d036992)
2023-12-30Merge pull request #2714 from vyos/mergify/bp/sagitta/pr-2704Christian Breunig
vyos.template: T5869: first_host_address() does not honor RFC4291 section 2.6.1 (backport #2704)
2023-12-30login: T5875: restore home directory permissions when re-adding user accountChristian Breunig
After deleting a user account and working with a newly added account, we see that after rebooting in the previously saved configuration, the user is re-added but it's home directory might have an old UID set on the filesystem. This is due to the fact that vyos config does not store UIDs. When adding a user account to the system we now check if the home directory already exists and adjust the ownership to the new UID. (cherry picked from commit 3c990f49e2bf9347bd2cc478995baa995ee822fd)
2023-12-29vyos.template: T5869: first_host_address() does not honor RFC4291 section 2.6.1Christian Breunig
The subnet router anycast address is predefined. Its format is as follows: | n bits | 128-n bits | +------------------------------------------------+----------------+ | subnet prefix | 00000000000000 | +------------------------------------------------+----------------+ The "subnet prefix" in an anycast address is the prefix that identifies a specific link. This anycast address is syntactically the same as a unicast address for an interface on the link with the interface identifier set to zero. Packets sent to the Subnet-Router anycast address will be delivered to one router on the subnet. All routers are required to support the Subnet-Router anycast addresses for the subnets to which they have interfaces. The Subnet-Router anycast address is intended to be used for applications where a node needs to communicate with any one of the set of routers. Our code as of now returns the subnet router anycast address as the first_host_address(). (cherry picked from commit cc4ce81ece57faca8ce111b8f3748389ecb40202)
2023-12-28accel-ppp: T5688: Standardized pool configuration in accel-pppaapostoliuk
Standardized pool configuration for all accel-ppp services. 1. Only named pools are used now. 2. Allows all services to use range in x.x.x.x/mask and x.x.x.x-x.x.x.y format 3. next-pool can be used in all services 2. Allows to use in ipoe gw-ip-address without pool configuration which allows to use Fraimed-IP-Address attribute by radius. 3. Default pool name should be explicidly configured with default-pool. 4. In ipoe netmask and range subnet can be different. (cherry picked from commit 422eb463d413da812eabc28706e507a9910d7b53)
2023-12-25ethernet: T5566: disable energy efficient ethernet (EEE) for interfacesChristian Breunig
VyOS is a routing (packet pushing) platform, thus supporting EEE which potentially causes issues is not a good idea. Some recent Intel drivers enable EEE by default, thus we will disable this for every NIC supporting EEE. (cherry picked from commit ab30509b25d54dac99294b76ba03fd49c3d2c946)
2023-12-24configdict: T5837: add support to return added nodes when calling node_changed()Christian Breunig
In the past, node_changed() suggested it would also return nodes that got added (function comment) but in reality only deleted keys got accounted for. This commit changes the signature and adds an argument expand_nodes to specify the users interest of a node was deleted (default), added (expand_nodes=Diff.ADD) or even both (expand_nodes=Diff.ADD|Diff.DELETE). (cherry picked from commit 4ee4064705ebd1e1a6a59be0c6df3b96755a067e)
2023-12-24T5837: cleanup use of calls to vyos.configdict.node_changed()Christian Breunig
node_changed() will return a list of changed keys under "path". We are not always interested what changed, sometimes we are only interested if something changed at all, that what vyos.configdict.is_node_changed() is for. (cherry picked from commit 5e7a8288d06a6d6beee5e1abd2e06698ab778650)
2023-12-18image-tools: T5831: show system image reverse ordered by dateJohn Estabrook
(cherry picked from commit f19b2acb34e77baeae34aa156ea96d0580a61725)
2023-12-18T5249: Add rollback-soft featureViacheslav Hletenko
Add the ability to rollback configs without rebooting ``` sudo /usr/bin/config-mgmt rollback_soft --rev 1 rollback-soft 1 ``` (cherry picked from commit f208e9b9acaec45468295e33b113bbef6c0309a1)
2023-12-16T5827: moved sys image sort to grub version_listTrae Santiago
(cherry picked from commit d01aba1f5055cdaa43c8429a2c13580679ec12f7)
2023-12-16image-tools: T5806: deactive raid arraysJohn Estabrook
(cherry picked from commit e3cd779d0bd8dd8be6231c7b2028326a03e6a06c)
2023-12-16image-tools: T5819: do not echo password on image installJohn Estabrook
(cherry picked from commit cf83979636c686a459d6dc75dcd98e342c70b1b3)
2023-12-16image-tools: T5806: remove partition and disk signatures in cleanupJohn Estabrook
(cherry picked from commit ea30fc962049226e869171f69c6ab1879f9e7085)
2023-12-16image-tools: T5758: restore saving previous data on installJohn Estabrook
Restore scanning previous installations for config data and ssh host keys on install. (cherry picked from commit 32551842bb0f710f590e8c030395a3a7902aa1df)
2023-12-16image-tools: T5751: use revised image tools in configsessionJohn Estabrook
(cherry picked from commit 2ccb567bba6dba69a1523daf9096ba39a18b35d1)
2023-12-16image-tools: T5751: restore arg raise_error for non-interactive useJohn Estabrook
(cherry picked from commit 35f69340ef189e27b380074bb687ad58f29e9433)
2023-12-16image-tools: T4516: exit grub-update service if running in dockerJohn Estabrook
(cherry picked from commit 0b97bde2cb04cf5e23350798f972abcee4bfe4ee)
2023-12-16image: T4516: add raid-1 install supportJohn Estabrook
(cherry picked from commit e036f783bc85e4d2bad5f5cbfd688a03a352223e)
2023-12-16image: T4516: ensure compatibility with legacy RAID 1 installsJohn Estabrook
(cherry picked from commit bd701768796d6ebb03ca943faf96d1dbea030edd)
2023-12-16image: T4516: restore select entry to set/delete imageJohn Estabrook
(cherry picked from commit 9ffa3e82d951756696367578dd5e82ef0f690065)
2023-12-16image: T4516: support for interoperability of legacy/new image toolsJohn Estabrook
This commit allows management of system images with either new or legacy tools: 'add/delete/rename system image' and 'set default' are translated appropriately on booting between images with the old and new tools. Consequently, the warning of the initial commit of T4516 is dropped. (cherry picked from commit 96b65e90fbfa1fe63d97929ac86fc910abb0caa9)
2023-12-16image: T4516: improve format of 'show system image details'John Estabrook
(cherry picked from commit 8efab9ee8cdb0e65dddb9d3ba97de8ddcf3666dc)
2023-12-16image: T5195: vyos.util -> vyos.utils package refactoringJohn Estabrook
(cherry picked from commit fcded7930b5426193e8490c6df2a70e300a60e31)
2023-12-16image: T4516: remove unused file, replaced by vyos/system/image.pyJohn Estabrook
(cherry picked from commit 9e3b769f8402a816f6c7fa80ff12c9579c3f5243)
2023-12-16image: T4516: correct permissions on creation of config directoryJohn Estabrook
(cherry picked from commit 74b00c1f6961d1bd3a59768021f154bdb64c154e)
2023-12-16image: T4516: Added system image toolszsdc
This commit adds the whole set of system image tools written from the scratch in Python that allows performing all the operations on images: * check information * perform installation and deletion * versions management Also, it contains a new service that will update the GRUB menu and keep tracking its version in the future. WARNING: The commit contains non-reversible changes. Because of boot menu changes, it will not be possible to manage images from older VyOS versions after an update. (cherry picked from commit 8f94262e8fa2477700c50303ea6e2c6ddad72adb)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 04:09:49 +0000