| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2022-02-17 | openvpn: T4230: globally enable ip_nonlocal_bind | Christian Poessinger | |
| 2022-02-17 | Merge pull request #1211 from sever-sever/T4230-cur | Christian Poessinger | |
| openvpn: T4230: Delete checks if local-host address assigned | |||
| 2022-02-15 | conntrack-sync: T4237: Fix checks for listen-address list to str | Viacheslav Hletenko | |
| Verify section conntrack_sync.py funciton 'is_addr_assigned' should checks address as string not as list (cherry picked from commit c41c51e4ed7ceb293161014a73bdd350162c3300) | |||
| 2022-02-14 | pki: eapol: T4244: Fix KeyError when CA cert name differs from client cert name | Andrew Gunnerson | |
| This commit fixes a small typo where the client cert name was being used to index the CA configuration dict. Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com> | |||
| 2022-02-14 | tunnel: T4154: import cleanup | Christian Poessinger | |
| 2022-02-14 | tunnel: T4154: verify() no more then one GRE tunnel is used w/o "ip key" per ↵ | Christian Poessinger | |
| interface It is impossible for the OS kernel to distinguish multiple GRE tunnels when no "gre key" is configured when sourcing tunnels from the same interface. | |||
| 2022-02-13 | vrf: T4191: bugfix for "ip rule" when VRFs are created | Christian Poessinger | |
| We always mangled and worked on the "ip rule" singleton even when nothing needed to be changed. This resulted in a VRF hickup when the same VRF was added and removed multiple times. set interfaces ethernet eth1 vrf foo set vrf name foo table '1000' commit delete interfaces ethernet eth1 vrf delete vrf commit set interfaces ethernet eth1 vrf foo set vrf name foo table '1000' commit broke reachability on eth1 - a reboot was required. This change will now only alter the ip rule tables once when VRF instances are created for the first time and will not touch the Kernel "ip rule" representation afterwards. | |||
| 2022-02-12 | policy: T2199: bugfix verify_rule() on negated groups | Christian Poessinger | |
| Related to #1215 | |||
| 2022-02-09 | openvpn: T3686: Fix for check local-address in script and tmpl | Viacheslav Hletenko | |
| Local-address should be checked/executed only if it exists in the openvpn configuration, dictionary, jinja2 template | |||
| 2022-02-09 | openvpn: T4230: Delete checks if local-host address assigned | Viacheslav Hletenko | |
| OpenVPN can't start if it depends on VRRP virtual-address as virtual-address is not yet assigned by HA (openvpn and ha in one commit) as we have checks "if address assigned" It depends on commit priorities: 460 interfaces/openvpn 800 high-availability Replace check if local-host address assigned from raise ConfigError to print (just notification) Allow to bind OpenVPN service to nonlocal address | |||
| 2022-02-05 | Merge pull request #1206 from sarthurdev/T4209 | Christian Poessinger | |
| firewall: T4209: Fix support for rule `recent` matches | |||
| 2022-02-04 | policy: T4151: Delete unexpected print added in commit c501ae0f | Viacheslav Hletenko | |
| 2022-02-04 | firewall: T4209: Fix support for rule `recent` matches | sarthurdev | |
| 2022-01-31 | upnpd: T3420: code cleanup | Christian Poessinger | |
| 2022-01-31 | Merge pull request #1196 from hensur/current-ipv6-local-route-iif | Christian Poessinger | |
| policy: T4219: add local-route(6) inbound-interface support | |||
| 2022-01-31 | firewall: T2199: Fix errors when referencing an empty chain | sarthurdev | |
| 2022-01-30 | policy: T4219: add local-route(6) incoming-interface | Henning Surmeier | |
| 2022-01-30 | policy: T4213: Fix duplicate commands from multiple rules with single table | sarthurdev | |
| 2022-01-29 | firewall: T4216: Add support for negated firewall groups | sarthurdev | |
| 2022-01-29 | firewall: T4218: Adds a prefix to all user defined chains | sarthurdev | |
| 2022-01-29 | Merge pull request #1195 from hensur/current-ipv6-local-route | Christian Poessinger | |
| policy: T4151: bugfix multiple commits and smoketest | |||
| 2022-01-30 | Merge pull request #789 from jack9603301/T3420 | Daniil Baturin | |
| upnpd: T3420: Support UPNP protocol | |||
| 2022-01-28 | policy: T4151: remove all previous rules on edit | Henning Surmeier | |
| 2022-01-27 | Merge pull request #1194 from sarthurdev/T4213 | Christian Poessinger | |
| policy: T4213: Fix rule creation/deletion for IPv6 policy routes | |||
| 2022-01-27 | policy: T4213: Fix rule creation/deletion for IPv6 policy routes | sarthurdev | |
| 2022-01-25 | policy: T4194: Add prefix-list duplication checks | Viacheslav Hletenko | |
| Prefix-list should not be duplicatied as FRR doesn't accept it One option when it can be duplicated when it uses "le" or "ge" | |||
| 2022-01-22 | Merge pull request #1184 from sarthurdev/firewall_icmp | Christian Poessinger | |
| firewall: T4130: T4186: ICMP/v6 updates, ipv6 state policy check fix | |||
| 2022-01-21 | firewall: T2199: Verify correct ICMP protocol for ipv4/ipv6 | sarthurdev | |
| 2022-01-21 | firewall: T4130: Use correct table to check for state policy rule | sarthurdev | |
| 2022-01-21 | policy: T4151: Bugfix policy ipv6-local-route | Henning Surmeier | |
| 2022-01-20 | Merge pull request #1144 from hensur/current-ipv6-local-route | Christian Poessinger | |
| policy: T4151: Add policy ipv6-local-route | |||
| 2022-01-18 | firewall: T2199: Raise ConfigError if deleted node is used in zone-policy | sarthurdev | |
| 2022-01-18 | firewall: policy: T1292: Clean up any rules required to delete a chain | sarthurdev | |
| 2022-01-17 | Merge pull request #1174 from sarthurdev/firewall | Christian Poessinger | |
| firewall: T4178: T3873: tcp flags syntax refactor, intra-zone-filtering fix | |||
| 2022-01-17 | firewall: policy: T4178: Migrate and refactor tcp flags | sarthurdev | |
| * Add support for ECN and CWR flags | |||
| 2022-01-14 | Merge pull request #1167 from sarthurdev/firewall | Christian Poessinger | |
| firewall: T4178: Use lowercase for TCP flags and add an validator | |||
| 2022-01-14 | firewall: T4178: Use lowercase for TCP flags and add an validator | sarthurdev | |
| 2022-01-14 | policy: T4151: Add policy ipv6-local-route | Henning Surmeier | |
| Adds support for `ip -6 rule` policy based routing. Also, extends the existing ipv4 implemenation with a `destination` key, which is translated as `ip rule add to x.x.x.x/x` rules. https://phabricator.vyos.net/T4151 | |||
| 2022-01-13 | monitoring: T3872: Add just required interfaces for ethtool | Viacheslav | |
| Telegraf ethtool input filter expected ethX interfaces and not other interfaces like vlans/tunnels/dummy Add "interface_include" option to telegraf template. | |||
| 2022-01-11 | policy: T2199: Refactor policy route script for better error handling | sarthurdev | |
| * Migrates all policy route references from `ipv6-route` to `route6` * Update test config `dialup-router-medium-vpn` to test migration of `ipv6-route` to `route6` | |||
| 2022-01-11 | firewall: T4159: Add warning when an empty group is applied to a rule | sarthurdev | |
| 2022-01-11 | firewall: policy: T2199: Reload policy route script if `firewall group` node ↵ | sarthurdev | |
| is changed | |||
| 2022-01-11 | firewall: policy: T4159: T4164: Fix empty firewall groups, create separate ↵ | sarthurdev | |
| file for group definitions. | |||
| 2022-01-11 | policy: T4170: rename "policy ipv6-route" -> "policy route6" | Christian Poessinger | |
| In order to have a consistent looking CLI we should rename this CLI node. There is: * access-list and access-list6 (policy) * prefix-list and prefix-list6 (policy) * route and route6 (static routes) | |||
| 2022-01-11 | containers: T2216: bugfix host networking on image upgrade | Mathew Inkson | |
| The bug was partially fixed with this commit: https://github.com/vyos/vyos-1x/commit/358f0b481d8620cad4954e3fe418054b9a8c3ecd The earlier commit introduced a startup retry (up to 10 times) to allow the OS to settle before the container is started. However, it only applies if host networking is NOT used. This change applies the same for containers where host networking is employed. Since the retry portion of the code (written in the earlier commit) is now referenced twice, it has been moved to its own function. | |||
| 2022-01-10 | nat: T2199: dry-run newly generated config before install | Christian Poessinger | |
| Before installing a new conntrack policy into the OS Kernel, the new policy should be verified by nftables if it can be loaded at all or if it will fail to load. There is no need to load a "bad" configuration if we can pre-test it. | |||
| 2022-01-10 | conntrack: T3579: dry-run newly generated config before install | Christian Poessinger | |
| Before installing a new conntrack policy into the OS Kernel, the new policy should be verified by nftables if it can be loaded at all or if it will fail to load. There is no need to load a "bad" configuration if we can pre-test it. | |||
| 2022-01-10 | conntrack: T3579: prepare for "conntrack timeout custom rule" CLI commands | Christian Poessinger | |
| 2022-01-10 | conntrack: T3579: migrate "conntrack ignore" tree to vyos-1x and nftables | Christian Poessinger | |
| 2022-01-10 | firewall: 4149: Fix verify steps being bypassed when base node is removed | sarthurdev | |
 |
index : vyos-1x.git | |
| VyOS command definitions, scripts, and utilities (mirror of https://github.com/marekm72/vyos-1x.git) |
| summaryrefslogtreecommitdiff |