summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2021-09-10ethernet: T3802: use only one implementation for get_driver_name()Christian Poessinger
Move the two implementations to get the driver name of a NIC from ethernet.py and ethtool.py to only ethtool.py.
2021-09-09openvpn: T3805: drop privileges using systemd - required for rtnetlinkChristian Poessinger
(cherry picked from commit 2647edc30f1e02840cae62fde8b44345d35ac720)
2021-09-09openvpn: T3805: use vyos.util.makedir() to create system directoriesChristian Poessinger
(cherry picked from commit 84e912ab2f583864e637c2df137f62f3d4cbeb14)
2021-09-07login: T971 allow quoting in public-keys optionsPaul Lettington
This patch allows the use of `"` in ssh public-key options which unlocks the ability to set the `from` option in a way that sshd will accept to limit what hosts a user can connect from. (cherry picked from commit 6b52387190f8213e7e02060e894c6ddd4fb7cb3d)
2021-09-06Merge pull request #999 from sever-sever/T2920-equChristian Poessinger
tunnel: T2920: Add checks tun with same source addr and keys
2021-09-06ifconfig: T3806: "ipv6 address no_default_link_local" required for MTU < 1280Christian Poessinger
This commit also extends the smoketest to verify that the exception for this error is raised. (cherry picked from commit 84a429b41175b95634ec9492e0cf3a564a47abdd)
2021-09-06tunnel: T2920: Add checks tun with same source addr and keysViacheslav
2 tunnels with the same local-address should has different keys Check existing tunnels (source-address key) with new tunnel.
2021-09-06T3803: add source-address option to the op mode ping CLI.Daniil Baturin
(cherry picked from commit e211cdbb375dba13af33d6ad6c3addab707f2870)
2021-09-06wwan: T3620: op-mode: not all commands supported by all modems - add info ↵Christian Poessinger
message (cherry picked from commit 10814c4d3360598262e991e4b20768dfcde91d75)
2021-09-05name-server: T3804: merge "system name-servers-dhcp" into "system name-server"Christian Poessinger
We have "set system name-server <ipv4|ipv6>" to specify a name-server IP address we wan't to use. We also have "set system name-servers-dhcp <interface>" which does the same, but the name-server in question is retrieved via DHCP. Both CLI nodes are combined under "set system name-server <ipv4|ipv6|interface>" to keep things as they are in real life - we need a name-server.
2021-09-04Merge pull request #992 from dmbaturin/ipsec-settings-fixJohn Estabrook
T3697: fix the deadlock in IPsec options script
2021-09-04T3697: do not try to restart charon if it's not requiredDaniil Baturin
The root cause is that the ipsec-settings.py script is run _twice_: first from "vpn ipsec options", then from the top level "vpn" node. The case when it's not required is when: * "vpn ipsec" configuration doesn't exist yet * user configured it with "vpn ipsec options" * the ipsec-settings.py script is run first time, from "vpn ipsec options" Trying to restart charon at that stage leads to a deadlock.
2021-09-04op-mode: T3619: bugfix "show interfaces X detail"Christian Poessinger
Commit 27e53fbc ("op-mode: T3619: bugfix "show interfaces" for VLANs") fixed the op-mode command for the "show interfaces" operation, but if a user was interested in all the ethernet or bridge interfaces, the command "show interfaces <type> detail" did not yield any output. The filtered_interfaces() function was further generalized to only operate on base components and call itself recusively if required. (cherry picked from commit 5e1f76d16332a917bfd99c6f2bffcd73e61d934d)
2021-09-04op-mode: T3619: bugfix "show interfaces" for VLANsChristian Poessinger
Commit 31169fa8a7 ("vyos.ifconfig: T3619: only set offloading options if supported by NIC") always instantiated an object of the Ethtool class for an ethernet object - this is right as a real ethernet interface is managed by Ethtool. Unfortunately the script used for "show interface" determindes the "base class" for an interface by its name, so eth0 -> Ethernet, eth0.10 -> Ethernet. This assumption is incorrect as a VLAN interface can not have the physical parameters changed of its underlaying interface. This can only be done for eth0. There is no need for the op-mode script to determine the implementation class for an interface at this level, as we are only interested in the state of the interface and it's IP addresses - which is a common operation valid for every interface on VyOS. (cherry picked from commit 27e53fbcd843c3aad27db9e97f9060ae6dfcc5ee)
2021-09-04op-mode: import cleanup in "show interfaces" scriptChristian Poessinger
(cherry picked from commit 5bde11aceffd3d7fca99e582b16555fc0c584410)
2021-09-02tunnel: T3788: Add check keys for ipip and sitViacheslav
Keys are not allowed with ipip and sit tunnels (cherry picked from commit 7e84566dedfdc532ffe05b404005daa6f21df567)
2021-09-02configd: T3694: always set script.argvBrandon Stepler
Several scripts imported by vyos-configd (including src/conf_mode/protocols_static.py) rely on argv for operating on VRFs. Always setting script.argv in src/services/vyos-configd ensures those scripts will operate on the default VRF when called with no arguments. Otherwise, a stale argv might cause those scripts to operate on the last modified VRF instead of the default VRF. (cherry picked from commit 3341c591ad1190f39ff3ffd475eddf5d95aef763)
2021-09-02Merge pull request #990 from sever-sever/T3093Christian Poessinger
nipsec: T3093: Delete temporarily generated code
2021-09-02nipsec: T3093: Delete temporarily generated codeViacheslav
This code was generated before to rewrite IPSec to XML style And this was rewriten/fixed and used in the next 1.4 releases So we realy don't need it in 1.3 as we use old nodes for it.
2021-09-02login: T3792: bugfix for usernames containing a hyphenChristian Poessinger
While migrating to get_config_dict() in commit e8a1c291b1 ("login: radius: T3192: migrate to get_config_dict()") the user-name was not excluded from mangling (no_tag_node_value_mangle=True). This resulted in a username "vyos-user" from CLI to be actually created as "vyos_user" on the system. This commit also adds respective Smoketests to prevent this in the future. (cherry picked from commit 658de9ea0fbe91e593f9cf0a8c434791282af100)
2021-09-02Merge pull request #989 from DmitriyEshenko/1x-equuleus-02092021-03Christian Poessinger
sstp-server: T2661: Delete CA certificate redundancy check
2021-09-02op-mode: T1376: speed up tab-completion for DHCP pool listingChristian Poessinger
Commit 9f20bee81c ("T1376: improve show_dhcp and show_dhcpv6") added the tab completion helper to list the availbale IP pools to query. This was done by calling a python script which then called cli-shell-api which resulted in a penalty by the Python interpreter startup. This can be solved by directly using the cli-shell-api wrapper available as <path> in op-mode - as also seen for DHCPv6. (cherry picked from commit b1ff7baaf3c52c8c364955632fcece2da7033b10)
2021-09-02sstp-server: T2661: Delete CA certificate redundancy checkDmitriyEshenko
2021-08-31vyos.ethtool: T3163: purify code to read and change flow-control settingsChristian Poessinger
It makes no sense to have a parser for the ethtool values in ethtool.py and ethernet.py - one instance ios more then enough! (cherry picked from commit 0229645c8248decb5664056df8aa5cd5dff41802)
2021-08-31ethernet: T3163: only change ring-buffer settings if requiredChristian Poessinger
Only update the RX/TX ring-buffer settings if they are different from the ones currently programmed to the hardware. There is no need to write the same value to the hardware again - this could cause traffic disruption on some NICs. (cherry picked from commit 29082959e0efc02462fba8560d6726096e8743e9)
2021-08-31ethernet: T2241: check if interface supports changing speed/duplex settingsChristian Poessinger
Not all interface drivers have the ability to change the speed and duplex settings. Known drivers with this limitation are vmxnet3, virtio_net and xen_netfront. If this driver is detected, an error will be presented to the user. (cherry picked from commit cc742d48579e4f76e5d3230d87e22f71f76f9301)
2021-08-31ethernet: T3514: bail out early on invalid adapter speed/duplex settingChristian Poessinger
Ethernet adapters have a discrete set of available speed and duplex settings. Instead of passing every value down to ethtool and let it decide, we can do this early in the VyOS verify() function for ethernet interfaces. (cherry picked from commit 91892e431349ca0edb5e3e3023e4f340ab9b777f)
2021-08-31ssh: T3789: add custom validator for base64 encoded CLI dataChristian Poessinger
SSH keys used for remote login are supplied as base64 encoded data on the CLI. The key is not validated, thus an invalid copy/pasted key will render the login useless. This commit adds a custom and re-usable validator which check if the data is properly base64 encoded. (cherry picked from commit 00efce716912680354d47a2dca9769cd8c5c89ae)
2021-08-30tunnel: T3786: Add checks for source any and not keyViacheslav
(cherry picked from commit 5c29377fa91595088118419275f6d05b1fbfbd1d)
2021-08-30ethernet: T3787: remove deprecated UDP fragmentation offloading optionChristian Poessinger
Deprecated in the Linux Kernel by commit 08a00fea6de277df12ccfadc21 ("net: Remove references to NETIF_F_UFO from ethtool.").
2021-08-30ethernet: T3619: fix VyOS 1.2 -> 1.3 performance degradationChristian Poessinger
An analysis of the code base from VyOS 1.2 -> 1.3 -> 1.4 revealed the following "root-cause" VyOS 1.2 uses the "old" node.def file format for: * Generic Segmentation Offloading * Generic Receive Offloading So if any of the above settings is available on the configuration CLI, the node.def file will be executed - this is how it works. By default, this CLI option is not enabled in VyOS 1.2 - but the Linux Kernel enables offloading "under the hood" by default for GRO, GSO... which will boost the performance for users magically. With the rewrite in VyOS 1.3 of all the interface related code T1579, and especially T1637 this was moved to a new approach. There is now only one handler script which is called whenever a user changes something under the interfaces ethernet tree. The Full CLI configuration is assembled by get_interface_dict() - a wrapper for get_config_dict() which abstracts and works for all of our interface types - single source design. The problem now comes into play when the gathered configuration is actually written to the hardware, as there is no GSO, GRO or foo-offloading setting defined - we behave as instructed and disable the offloading. So the real bug originates from VyOS 1.2 and the old Vyatta codebase, but the recent XML Python rewrites brought that one up to light. Solution: A configuration migration script will be provided starting with VyOS 1.3 which will read in the CLI configuration of the ethernet interfaces and if not enabled, will query the adapter if offloading is supported at all, and if so, will enable the CLI nodes. One might say that this will "blow" the CLI configuration but it only represents the truth - which was masked in VyOS 1.2.
2021-08-26Merge pull request #978 from c-po/t3776-frr-restartChristian Poessinger
FRR: op-mode: T3776: rename "restart frr <daemon>" to "restart <daemon>"
2021-08-25isis: T3779: backport entire 1.4 (current) featuresetChristian Poessinger
As IS-IS is a new feature and the CLI configuration changed from 1.3 -> 1.4 (required by T3417) it makes sense to synchronize the CLI configuration for both versions. This means backporting the CLI from 1.4 -> 1.3 to not confuse the userbase already with a brand new feature. As 1.3.0-epa1 is on the way and should not contain any CLI changes afterwards, this is the perfect time.
2021-08-25frr: T3217: Abbility to save routing configsChristian Poessinger
(cherry picked from commit d9d923ea4e0bbe0cc154dc2fbdd626585b5d7449)
2021-08-25T3773: delete the original "show system integrity" commandDaniil Baturin
(cherry picked from commit 059307f924c604eb2bdeab19a2db8ce6d8e09f90)
2021-08-25op-mode: frr: T1514: add possibility to restart isis daemonChristian Poessinger
2021-08-22bridge: T3137: backport vlan features from 1.4 currentChristian Poessinger
2021-08-18isis: T3417: last byte of IS-IS network entity title must always be 0Christian Poessinger
(cherry picked from commit 19b16986515dcb58955e153025b24dc012faa574)
2021-08-15wireguard: T3756: fix generated qr code headerBoris Manojlovic
(cherry picked from commit d3ae6304a3eabcddba36452e9519ca7b56bb38af)
2021-08-14openvpn: T3738: Disable authentication option for server modeViacheslav
(cherry picked from commit 655876f4c22c0f4ea839a81f4af09d6016e19197)
2021-08-14op-mode: ipsec: T3745: "show vpn ipse sa" improve sortingChristian Poessinger
(cherry picked from commit 1229665d353a070e14ee9cceafbfdb107d669745)
2021-08-12login: T3746: inform users about pending rebootsChristian Poessinger
(cherry picked from commit 7e52a7079afb522d1456833023ad58fa8b05e880)
2021-08-12T3697: check config.exists rather than exists_effectiveDaniil Baturin
2021-08-12dns: T3744: fixed dns fwd statistics formattingFileGo
(cherry picked from commit 0f7833483c0fe4982747bbbace45a83fae793257)
2021-08-09dhcp-server: T2432: Run dhcpd in group vyattacfg to allow recreate lease filesDmitriyEshenko
2021-08-09T3695: reword the ocserv fail message.Daniil Baturin
2021-08-09openconnect: T3695: Add systemd service checker on commitDmitriyEshenko
2021-08-08ping: T3634: Fixing do not fragment to PingCheeze_It
In this commit we fix the do not fragment capability for ping commands. Sorry for messing it up earlier :( (cherry picked from commit d012c732a8902d4848e29f37fcede66a060e3c7f)
2021-08-05bgp: T548: Migrate maximum-paths to afi ipv4 maximum-pathsViacheslav
2021-08-03isis: T1316: rename Jinja2 template to match other FRR daemonsChristian Poessinger
(cherry picked from commit d77a2f56ea7e76158c07f5829397be4555473e3d)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-21 13:25:41 +0000