summaryrefslogtreecommitdiff
path: root/src/conf_mode
AgeCommit message (Collapse)Author
2021-09-14openvpn: T3822: fix certificate permissionsChristian Poessinger
Commit b8bb9f586 ("T3822: set the OpenVPN key file owner to openvpn:openvpn") changed the permissions only for file present in the "fix_permissions" list. The list did not contain all required certificates - this has been fixed.
2021-09-12T3822: set the OpenVPN key file owner to openvpn:openvpnDaniil Baturin
2021-09-11Merge pull request #1001 from erkin/equuleusDaniil Baturin
T3275: conntrack: Backport XML/Python implementation of conntrack CLI
2021-09-10T3275: conntrack: Backport XML/Python implementation of conntrack CLIerkin
2021-09-10ethernet: T3802: use only one implementation for get_driver_name()Christian Poessinger
Move the two implementations to get the driver name of a NIC from ethernet.py and ethtool.py to only ethtool.py.
2021-09-09openvpn: T3805: drop privileges using systemd - required for rtnetlinkChristian Poessinger
(cherry picked from commit 2647edc30f1e02840cae62fde8b44345d35ac720)
2021-09-09openvpn: T3805: use vyos.util.makedir() to create system directoriesChristian Poessinger
(cherry picked from commit 84e912ab2f583864e637c2df137f62f3d4cbeb14)
2021-09-07login: T971 allow quoting in public-keys optionsPaul Lettington
This patch allows the use of `"` in ssh public-key options which unlocks the ability to set the `from` option in a way that sshd will accept to limit what hosts a user can connect from. (cherry picked from commit 6b52387190f8213e7e02060e894c6ddd4fb7cb3d)
2021-09-06Merge pull request #999 from sever-sever/T2920-equChristian Poessinger
tunnel: T2920: Add checks tun with same source addr and keys
2021-09-06ifconfig: T3806: "ipv6 address no_default_link_local" required for MTU < 1280Christian Poessinger
This commit also extends the smoketest to verify that the exception for this error is raised. (cherry picked from commit 84a429b41175b95634ec9492e0cf3a564a47abdd)
2021-09-06tunnel: T2920: Add checks tun with same source addr and keysViacheslav
2 tunnels with the same local-address should has different keys Check existing tunnels (source-address key) with new tunnel.
2021-09-05name-server: T3804: merge "system name-servers-dhcp" into "system name-server"Christian Poessinger
We have "set system name-server <ipv4|ipv6>" to specify a name-server IP address we wan't to use. We also have "set system name-servers-dhcp <interface>" which does the same, but the name-server in question is retrieved via DHCP. Both CLI nodes are combined under "set system name-server <ipv4|ipv6|interface>" to keep things as they are in real life - we need a name-server.
2021-09-04T3697: do not try to restart charon if it's not requiredDaniil Baturin
The root cause is that the ipsec-settings.py script is run _twice_: first from "vpn ipsec options", then from the top level "vpn" node. The case when it's not required is when: * "vpn ipsec" configuration doesn't exist yet * user configured it with "vpn ipsec options" * the ipsec-settings.py script is run first time, from "vpn ipsec options" Trying to restart charon at that stage leads to a deadlock.
2021-09-02tunnel: T3788: Add check keys for ipip and sitViacheslav
Keys are not allowed with ipip and sit tunnels (cherry picked from commit 7e84566dedfdc532ffe05b404005daa6f21df567)
2021-09-02Merge pull request #990 from sever-sever/T3093Christian Poessinger
nipsec: T3093: Delete temporarily generated code
2021-09-02nipsec: T3093: Delete temporarily generated codeViacheslav
This code was generated before to rewrite IPSec to XML style And this was rewriten/fixed and used in the next 1.4 releases So we realy don't need it in 1.3 as we use old nodes for it.
2021-09-02login: T3792: bugfix for usernames containing a hyphenChristian Poessinger
While migrating to get_config_dict() in commit e8a1c291b1 ("login: radius: T3192: migrate to get_config_dict()") the user-name was not excluded from mangling (no_tag_node_value_mangle=True). This resulted in a username "vyos-user" from CLI to be actually created as "vyos_user" on the system. This commit also adds respective Smoketests to prevent this in the future. (cherry picked from commit 658de9ea0fbe91e593f9cf0a8c434791282af100)
2021-09-02sstp-server: T2661: Delete CA certificate redundancy checkDmitriyEshenko
2021-08-31vyos.ethtool: T3163: purify code to read and change flow-control settingsChristian Poessinger
It makes no sense to have a parser for the ethtool values in ethtool.py and ethernet.py - one instance ios more then enough! (cherry picked from commit 0229645c8248decb5664056df8aa5cd5dff41802)
2021-08-31ethernet: T3163: only change ring-buffer settings if requiredChristian Poessinger
Only update the RX/TX ring-buffer settings if they are different from the ones currently programmed to the hardware. There is no need to write the same value to the hardware again - this could cause traffic disruption on some NICs. (cherry picked from commit 29082959e0efc02462fba8560d6726096e8743e9)
2021-08-31ethernet: T2241: check if interface supports changing speed/duplex settingsChristian Poessinger
Not all interface drivers have the ability to change the speed and duplex settings. Known drivers with this limitation are vmxnet3, virtio_net and xen_netfront. If this driver is detected, an error will be presented to the user. (cherry picked from commit cc742d48579e4f76e5d3230d87e22f71f76f9301)
2021-08-31ethernet: T3514: bail out early on invalid adapter speed/duplex settingChristian Poessinger
Ethernet adapters have a discrete set of available speed and duplex settings. Instead of passing every value down to ethtool and let it decide, we can do this early in the VyOS verify() function for ethernet interfaces. (cherry picked from commit 91892e431349ca0edb5e3e3023e4f340ab9b777f)
2021-08-30tunnel: T3786: Add checks for source any and not keyViacheslav
(cherry picked from commit 5c29377fa91595088118419275f6d05b1fbfbd1d)
2021-08-25isis: T3779: backport entire 1.4 (current) featuresetChristian Poessinger
As IS-IS is a new feature and the CLI configuration changed from 1.3 -> 1.4 (required by T3417) it makes sense to synchronize the CLI configuration for both versions. This means backporting the CLI from 1.4 -> 1.3 to not confuse the userbase already with a brand new feature. As 1.3.0-epa1 is on the way and should not contain any CLI changes afterwards, this is the perfect time.
2021-08-25frr: T3217: Abbility to save routing configsChristian Poessinger
(cherry picked from commit d9d923ea4e0bbe0cc154dc2fbdd626585b5d7449)
2021-08-22bridge: T3137: backport vlan features from 1.4 currentChristian Poessinger
2021-08-18isis: T3417: last byte of IS-IS network entity title must always be 0Christian Poessinger
(cherry picked from commit 19b16986515dcb58955e153025b24dc012faa574)
2021-08-14openvpn: T3738: Disable authentication option for server modeViacheslav
(cherry picked from commit 655876f4c22c0f4ea839a81f4af09d6016e19197)
2021-08-12T3697: check config.exists rather than exists_effectiveDaniil Baturin
2021-08-09T3695: reword the ocserv fail message.Daniil Baturin
2021-08-09openconnect: T3695: Add systemd service checker on commitDmitriyEshenko
2021-08-03isis: T1316: rename Jinja2 template to match other FRR daemonsChristian Poessinger
(cherry picked from commit d77a2f56ea7e76158c07f5829397be4555473e3d)
2021-08-02T3697: explicitly wait for the charon process to respond to strokesDaniil Baturin
2021-07-27T3697: wait for charon to get started before trying to restart it.Daniil Baturin
2021-07-25vrf: T31: add missind import for cmd()Christian Poessinger
2021-07-25vrf: T31: ignore iproute2 errorsChristian Poessinger
Re-issuing the same iproute2 commands can lead to errors, simply ignore them and not raise a Python exception. (cherry-picked from commit 9920f7340d60b51d32bad9dbd24a907718f72837)
2021-07-25ifconfig: T2653: obey conding styleChristian Poessinger
(cherry-picked from commit 08614557b679c59495b3bf629f763f9a4cc0ed25)
2021-07-25ifconfig: backport ifconfig framework from 1.4 to support new tunnel optionsChristian Poessinger
It is easier to backport the entire vyos.ifconfig library from 1.4 instead of backporting single pieces which are required to add new feature to the tunnel interface section. In addition that both libraries are now back in sync it will become much easier to backport any other new feature introduced in VyOS 1.4!
2021-07-24openvpn: T65: Fix auth-user-pass authentication onlyYun Zheng Hu
2021-07-24T3697: fix a conditional.Daniil Baturin
2021-07-24T3697: hopefully complete fix for checking whether IPsec should start.Daniil Baturin
2021-07-23T3697: return an empty dict when IPsec isn't fully configuredDaniil Baturin
to avoid trying to wait for a daemon that shouldn't even be running.
2021-07-23login: T3699: verify system username does not conflict with Linux base usersChristian Poessinger
2021-07-22T3697: check if strongswan should be running before attempting to restart it.Daniil Baturin
2021-07-17vxlan: T3683: bugfix on MTU calculation for IPv6 underlayChristian Poessinger
(cherry picked from commit eb8cd3af91bac01a3f7f99b362c8105d69bb3c55)
2021-07-13T3663: use inotify-based watching for the IPsec process restart.Daniil Baturin
2021-07-11vrf: T3637: bind-to-all didn't work properlyDate Huang
because of typo change from `bind_to_all` to `bind-to-all` refer: interface-definitions/vrf.xml.in (cherry picked from commit 8a78c790c1239eef533c7bbe12911aaeec4dc90f)
2021-07-02conntrack-sync: T3535: Rewrite conf and op modes to XML python styleViacheslav
2021-06-25openvpn: T1704: drop deprecated disable-ncp optionChristian Poessinger
(cherry picked from commit 6b7b19c93f90839549dd668116c4da2f38cfdc66) VyOS 1.3 will ship OpenVPN 2.5.1 and thus it is the perfect timing to still remove this option before introducing it in a new LTS release.
2021-06-13wwan: T3620: auto detect IP protocol based on requested addressesChristian Poessinger
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 08:48:44 +0000