| Age | Commit message (Collapse) | Author |
|---|
|
T5957: fix removal of interface in firewall rules. (backport #2873)
|
|
(cherry picked from commit 0a436e1fce66391311799bc970f05f6f4ba880ad)
|
|
QoS policy shaper-hfsc was not implemented after rewriting the
traffic-policy to qos policy. We had CLI but it does not use the
correct class. Add a basic implementation of policy shaper-hfsc.
Write the class `TrafficShaperHFS`
(cherry picked from commit f6b6ee636e34f98d336ee53599666afd1f395d78)
|
|
firewall: T5729: T5681: T5217: backport subsystem from current branch
|
|
This is a combined backport for all accumulated changes done to the firewall
subsystem on the current branch.
|
|
If we have QoS policy shaper class match `vif` (VLAN) we have to
use `basic match "meta(vlan mask 0xfff eq xxx)` instead of
`action policy`
Actual incorrect TC filter:
tc filter add dev eth1 parent 1: protocol all prio 1 action police rate 100000000 burst 15k flowid 1:64
The correct TC filter after fix:
tc filter add dev eth1 parent 1: protocol all prio 1 basic match "meta(vlan mask 0xfff eq 100)" flowid 1:64
(cherry picked from commit bb532f7f65930f8bc42e3bf3ebbcc690bffcfd0a)
|
|
It is impossible to detect interface speed for some devices
for exmaple virtio interfaces:
```
vyos@r4:~$ cat /sys/class/net/eth1/speed
-1
```
It causes wrong negative calcultaions like:
- bandwidth: -1000000
- 4% of bandwidth: -40000
tc class replace dev eth1 parent 1: classid 1:1 htb rate -1000000
tc class replace dev eth1 parent 1:1 classid 1:a htb rate -40000
Fix this with checking negative value.
Add default interface speed to 1000 Mbit if we cannot detect the
interface speed, the current default value 10 Mbit is too low
for nowadays
(cherry picked from commit a7fe02e989cf7034609cb833c86143660eb609d5)
|
|
(cherry picked from commit 844e35dea0500c48ff942ef4542dbb7a25b9dc7d)
|
|
Backport of the conntrack system from current branch.
(cherry picked from commit fd0bcaf12)
(cherry picked from commit 5acf5aced)
(cherry picked from commit 42ff4d8a7)
(cherry picked from commit 24a1a7059)
|
|
(cherry picked from commit 7ba47f027f3a9441125c13a927eb23cee2de041b)
|
|
Add util function to set serial console speed in accordance with revised
GRUB file structure; in keeping with the intentions of the config_mode
script, adjust the GRUB var 'console_speed' to only modify ttyS0.
(cherry picked from commit 5ceaff2ef970cb9c567ac317bafbffca5b073f4a)
|
|
This uses a more common pattern froma base class while the original code from
0a1c9bc38 ("T5791: DNS dynamic exclude check for dynamic interfaces PPPoE") is
still retained.
(cherry picked from commit e5ce4222c6e9b24d276625678db7339ada0c54ef)
|
|
interface: T5550: Interface source-validation priority over global value (backport)
|
|
We have not seen the adoption of the https virtual-host CLI option.
What it did?
* Create multiple webservers each listening on a different IP/port
(but in the same VRF)
* All webservers shared one common document root
* All webservers shared the same SSL certificates
* All webservers could have had individual allow-client configurations
* API could be enabled for a particular virtual-host but was always enabled on
the default host
This configuration tried to provide a full webserver via the CLI but VyOS is a
router and the Webserver is there for an API or to serve files for a local-ui.
Changes
Remove support for virtual-hosts as it's an incomplete and thus mostly useless
"thing". Migrate all allow-client statements to one top-level allow statement.
(cherry picked from commit d0d3071e99eb65edb888c26ef2fdc9e038438887)
|
|
The "idea" of this PR is to add new CLI nodes under the pki subsystem to
activate ACME for any given certificate.
vyos@vyos# set pki certificate NAME acme
Possible completions:
+ domain-name Domain Name
email Email address to associate with certificate
listen-address Local IPv4 addresses to listen on
rsa-key-size Size of the RSA key (default: 2048)
url Remote URL (default:
https://acme-v02.api.letsencrypt.org/directory)
Users choose if the CLI based custom certificates are used
set pki certificate EXAMPLE acme certificate <base64>
or if it should be generated via ACME.
The ACME server URL defaults to LetsEncrypt but can be changed to their staging
API for testing to not get blacklisted.
set pki certificate EXAMPLE acme url https://acme-staging-v02.api.letsencrypt.org/directory
Certificate retrieval has a certbot --dry-run stage in verify() to see if it
can be generated.
After successful generation, the certificate is stored in under
/config/auth/letsencrypt. Once a certificate is referenced in the CLI (e.g. set
interfaces ethernet eth0 eapol certificate EXAMPLE) we call
vyos.config.get_config_dict() which will (if with_pki=True is set) blend in the
base64 encoded certificate into the JSON data structure normally used when
using a certificate set by the CLI.
Using this "design" does not need any change to any other code referencing the
PKI system, as the base64 encoded certificate is already there.
certbot renewal will call the PKI python script to trigger dependency updates.
(cherry picked from commit b8db1a9d7baf91b70c1b735e58710f1e2bc9fc7a)
# Conflicts:
# debian/control
|
|
This fix moves from partprobe to partx to rescan the partition table on an affected disk.
(cherry picked from commit f883455d9a3081780c43426ab26de9d26f24c9aa)
|
|
Commit ad9bdfc24 ("T5195: add timeout argument to process_named_running()")
added a 2*10 seconds penalty for every interface test (dhcp and dhcpv6).
This leads to long runs of "make test" after an ISO build.
There is no need to wait 10 seconds for a test that checks for a process
not running. The timeout is there to give the process some time to startup.
(cherry picked from commit 041db49533d57cabfccd319492b85ee0bafdd40c)
|
|
Smoketests heavily rely on process_named_running() so in order to "relax"
system constraints during a test we will add a timeout of 10 seconds for
every testcase provided by base_interfaces_test.py
(cherry picked from commit ad9bdfc248cf47b3361bd0e5d7371d56131160a0)
|
|
deployments in cgnat. (#2694)
(cherry picked from commit 3fc76505d0642c32a3eae9c0ce6ab3dd2ec32dbd)
|
|
VyOS has several services relaying on the PKI CLI tree to retrieve certificates.
Consuming services like ethernet, openvpn or ipsec all re-implemented the same
code to retrieve the certificates from the CLI.
This commit extends the signature of get_config_dict() with a new option with_pki
that defaults to false. If this option is set, the PKI CLI tree will be blended
into the resulting dictionary.
(cherry picked from commit b152b52023ba0cf0d4919eae39e92de28a458917)
|
|
This extends commit 4ee406470 ("configdict: T5837: add support to return added
nodes when calling node_changed()") so no duplicate list elements get returned.
(cherry picked from commit 301312b293238d3041c8912af6fdb86b506d7ab4)
|
|
T5880: verify_source_interface() should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces (backport #2728)
|
|
(cherry picked from commit 3a9688ddb07f6bac1eb92aa13c20e897129e8958)
|
|
interfaces
Interfaces matching the following regex (ppp|pppoe|sstpc|l2tp|ipoe)[0-9]+ can
not be used as source-interface for e.g. a tunnel.
The main reason is that these are dynamic interfaces which come and go from a
kernel point of view, thus it's not possible to bind an interface to them.
(cherry picked from commit 5062f5d313548d6ebb9c07fee6b6d6be25b8f8f0)
|
|
We will use _ as CLI level divider. The XML definition filename and also
the Python helper should match the CLI node.
Example:
set interfaces ethernet -> interfaces_ethernet.xml.in
set interfaces bond -> interfaces_bond.xml.in
set service dhcp-server -> service_dhcp-server-xml.in
(cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)
|
|
Rename chain level defaults log option from `enable-default-log` to
`default-log` for consistency.
(cherry picked from commit 245e758aa2ea8779186d0c92d79d33170d036992)
|
|
vyos.template: T5869: first_host_address() does not honor RFC4291 section 2.6.1 (backport #2704)
|
|
After deleting a user account and working with a newly added account, we see
that after rebooting in the previously saved configuration, the user is
re-added but it's home directory might have an old UID set on the filesystem.
This is due to the fact that vyos config does not store UIDs. When adding a
user account to the system we now check if the home directory already exists
and adjust the ownership to the new UID.
(cherry picked from commit 3c990f49e2bf9347bd2cc478995baa995ee822fd)
|
|
The subnet router anycast address is predefined. Its format is as follows:
| n bits | 128-n bits |
+------------------------------------------------+----------------+
| subnet prefix | 00000000000000 |
+------------------------------------------------+----------------+
The "subnet prefix" in an anycast address is the prefix that identifies a
specific link. This anycast address is syntactically the same as a unicast
address for an interface on the link with the interface identifier set to zero.
Packets sent to the Subnet-Router anycast address will be delivered to one
router on the subnet. All routers are required to support the Subnet-Router
anycast addresses for the subnets to which they have interfaces.
The Subnet-Router anycast address is intended to be used for applications where
a node needs to communicate with any one of the set of routers.
Our code as of now returns the subnet router anycast address as the
first_host_address().
(cherry picked from commit cc4ce81ece57faca8ce111b8f3748389ecb40202)
|
|
Standardized pool configuration for all accel-ppp services.
1. Only named pools are used now.
2. Allows all services to use range in x.x.x.x/mask
and x.x.x.x-x.x.x.y format
3. next-pool can be used in all services
2. Allows to use in ipoe gw-ip-address without pool configuration
which allows to use Fraimed-IP-Address attribute by radius.
3. Default pool name should be explicidly configured
with default-pool.
4. In ipoe netmask and range subnet can be different.
(cherry picked from commit 422eb463d413da812eabc28706e507a9910d7b53)
|
|
VyOS is a routing (packet pushing) platform, thus supporting EEE which
potentially causes issues is not a good idea. Some recent Intel drivers enable
EEE by default, thus we will disable this for every NIC supporting EEE.
(cherry picked from commit ab30509b25d54dac99294b76ba03fd49c3d2c946)
|
|
In the past, node_changed() suggested it would also return nodes that got added
(function comment) but in reality only deleted keys got accounted for.
This commit changes the signature and adds an argument expand_nodes to specify
the users interest of a node was deleted (default), added (expand_nodes=Diff.ADD)
or even both (expand_nodes=Diff.ADD|Diff.DELETE).
(cherry picked from commit 4ee4064705ebd1e1a6a59be0c6df3b96755a067e)
|
|
node_changed() will return a list of changed keys under "path". We are not
always interested what changed, sometimes we are only interested if something
changed at all, that what vyos.configdict.is_node_changed() is for.
(cherry picked from commit 5e7a8288d06a6d6beee5e1abd2e06698ab778650)
|
|
(cherry picked from commit f19b2acb34e77baeae34aa156ea96d0580a61725)
|
|
Add the ability to rollback configs without rebooting
```
sudo /usr/bin/config-mgmt rollback_soft --rev 1
rollback-soft 1
```
(cherry picked from commit f208e9b9acaec45468295e33b113bbef6c0309a1)
|
|
(cherry picked from commit d01aba1f5055cdaa43c8429a2c13580679ec12f7)
|
|
(cherry picked from commit e3cd779d0bd8dd8be6231c7b2028326a03e6a06c)
|
|
(cherry picked from commit cf83979636c686a459d6dc75dcd98e342c70b1b3)
|
|
(cherry picked from commit ea30fc962049226e869171f69c6ab1879f9e7085)
|
|
Restore scanning previous installations for config data and ssh host
keys on install.
(cherry picked from commit 32551842bb0f710f590e8c030395a3a7902aa1df)
|
|
(cherry picked from commit 2ccb567bba6dba69a1523daf9096ba39a18b35d1)
|
|
(cherry picked from commit 35f69340ef189e27b380074bb687ad58f29e9433)
|
|
(cherry picked from commit 0b97bde2cb04cf5e23350798f972abcee4bfe4ee)
|
|
(cherry picked from commit e036f783bc85e4d2bad5f5cbfd688a03a352223e)
|
|
(cherry picked from commit bd701768796d6ebb03ca943faf96d1dbea030edd)
|
|
(cherry picked from commit 9ffa3e82d951756696367578dd5e82ef0f690065)
|
|
This commit allows management of system images with either new or legacy
tools: 'add/delete/rename system image' and 'set default' are translated
appropriately on booting between images with the old and new tools.
Consequently, the warning of the initial commit of T4516 is dropped.
(cherry picked from commit 96b65e90fbfa1fe63d97929ac86fc910abb0caa9)
|
|
(cherry picked from commit 8efab9ee8cdb0e65dddb9d3ba97de8ddcf3666dc)
|
|
(cherry picked from commit fcded7930b5426193e8490c6df2a70e300a60e31)
|
|
(cherry picked from commit 9e3b769f8402a816f6c7fa80ff12c9579c3f5243)
|
