| Age | Commit message (Collapse) | Author |
|---|
|
bgp: T2387: Fix XML sheme for new bgp and bgp.py handler
|
|
accel: T2631: Add option for radius disable-accounting
|
|
|
|
|
|
The CLI node was read in incorrect (wrong path). In addtition the list was not
reset to [] when authentication was specified on the CLI.
|
|
|
|
A lot of VyOS code requires the Kernel interface to be present in order to
properly work and adjust the interface to the users CLI intends (alias, ipv6,
vrf - just to name a few).
OpenVPN - when run in client mode - only creates the interface (e.g. vtun1) when
the connection to the OpenVPN server was successful. This can't be always the
case due to e.g. software-updates or routing issues to the remote side. This
will in the end result in a zombie OpenVPN client interface where some config
items might not have been set when the interface finally comes up - imagine a
wrong assigned VRF instance.
By always creating the OpenVPN interface manuall we ensure that all the CLI
settings are properly configured in the OS kernel.
|
|
The current implementation for bridge based interfaces has an issue which is
caused by priority inheritance. We always assumed that the bridge interface will
be created last, but this may not be true in all cases, where some interfaces
will be created "on demand" - e.g. OpenVPN or late (VXLAN, GENEVE).
As we already have a bunch of verify steps in place we should not see a bridge
interface leak to the underlaying infrastructure code. This means, whenever an
interface will be member of a bridge, and the bridge does yet not exist, we will
create it in advance in the interface context, as the bridge code will be run
in the same commit but maybe sooner or later.
This will also be the solution for T2924.
|
|
|
|
|
|
|
|
|
|
|
|
The mandatory colon for separating the IPv6 address and port was missing.
|
|
|
|
|
|
pdns_recursor: T2964: Expose query-local-address to dns config.
|
|
In certain split DNS configurations, there is a need for more
fine-grained control over the local address DNS forwarding uses to
issue queries. The current pdns_recursor configuration allows the
recursor to send queries from any available address on the interface
the OS selects for the query, with no option to limit queries to a
particular address or set of addresses.
This commit exposes the `query-local-address` option in
`recursor.conf` to users via the `service` `dns` `forwarding`
`source-address` config node.
If the parameter is unspecified, the default value of 0.0.0.0 (any
IPv4 address) and :: (any IPv6 address) are used to match current
behavior.
Users who want more control can specify one or more IPv4 and IPv6
addresses to issue queries from. Per pdns_recursor docs, the recursor
will load balance queries between any available addresses in the
pools. Since IPv4 and IPv6 are different pools, note that specifying
only one type of address will disable issuing queries for the other
address family.
|
|
|
|
Required to not trigger the "Misssing WPA key or RADIUS server" exception due
to the new default value added in commit 2a0428bf ("wireless: T2963: set default
'both' on 'security wpa mode'").
|
|
dhcpv6: T2961: support stateless dhcpv6 clients
|
|
This commit adds support for configuring the DHCPv6 server to serve
"stateless" DHCPv6 clients (those that send an information-request
message and do not request an address).
The change introduces a `common-options` node at the
`shared-network-name` level, which allows specifying options
applicable to clients regardless of subnet assigned (or in the case of
stateless clients, when no subnet is assigned). Parameters specified
at the subnet level take precedence over those set at the
shared-network level.
Presently, only parameters that are meaningful to stateless clients
have been exposed under `common-options`, as there is no precedent of
exposing parameters at multiple levels under the current DHCPv4 or
DHCPv6 configuration syntax. If desired, additional parameters could
certainly be added with relative ease.
|
|
|
|
|
|
Required to get a common CLI for all services provided by Accel-PPP. Once the
CLI for each service is consitent - Jinja2 templates can be reused together
with get_config_dict().
|
|
* move "network-settings gateway-address" to "gateway-address"
* move "network-settings client-ip-settings" to "client-ip-pool"
|
|
Preparation before using get_config_dict() and common Jinja2 templates.
|
|
|
|
In order to reuse as much as possible before migrationg to get_config_dict()
and re-use Jinja2 snippets the name-server node must be moved one level up to
'set vpn sstp name-server'.
|
|
|
|
|
|
|
|
Commit ba050937 ("accel-ppp: T2953: drop redundant CLI definitions ") dropped
the defaultValue of 'prefer' for MPPE making the smoketests fail. This has been
corrected.
|
|
|
|
With commit 38ae3032 ("pppoe-server: T2936: move to get_config_dict()") there
are now RADIUS default values present in the XML definitions - those must be
proberly mangled for the WiFi interface.
|
|
|
|
The config path is altered in get_interface_dict() to the base of the interface
in question, e.g. 'interfaces macsec macsec1' - this must be reflected when
calling othe methods of Config().
|
|
For easier configuration read in (CLI) validation and also template rendering
it makes sense to drop the old, single implementation and move to the new,
generic get_config_dict() approach.
Recurring configuration parts like ip-pool, ipv6-pool and nameservers have
also been split our into individual templates which will be included through
Jinja2 - leading to a single-source of the template sections, too.
|
|
When individual peers that have been removed got determined they have been
added to the config dict as list instead of string - which broke the system
plumbing commands as they can not handle a Python list.
|
|
If for whatever reason the macsec interface dropped out of the Kernel - only
call .remove() when it still exists to avoid any exceptions at all.
|
|
|
|
|
|
accel-ppp: T2918: Add accounting interim jitter option
|
|
|
|
Introduced in commit 818a75c024e ("ifconfig: T2653: get_mtu() should return
int() for easier comparison") where the variable used in the formatted string
has not been adjusted.
|
|
|
|
|
|
Using an MTU less then the required 1280 bytes (as per RFC) on an interface
where IPv6 is not explicitly disabled by:
- set interfaces ethernet eth1 ipv6 address no-default-link-local
- not having any other IPv6 address configured
Will now trigger a commit error via verify() instead of raising
FileNotFoundError!
|
|
|
|
Check the hardware if MTU value is supported at all.
|
