diff options
Diffstat (limited to 'interface-definitions')
273 files changed, 8283 insertions, 2781 deletions
diff --git a/interface-definitions/container.xml.in b/interface-definitions/container.xml.in index 3dd1b3249..8a0da46a4 100644 --- a/interface-definitions/container.xml.in +++ b/interface-definitions/container.xml.in @@ -31,7 +31,7 @@ <properties> <help>Grant individual Linux capability to container instance</help> <completionHelp> - <list>net-admin net-bind-service net-raw setpcap sys-admin sys-module sys-nice sys-time</list> + <list>net-admin net-bind-service net-raw mknod setpcap sys-admin sys-module sys-nice sys-time</list> </completionHelp> <valueHelp> <format>net-admin</format> @@ -46,12 +46,16 @@ <description>Permission to create raw network sockets</description> </valueHelp> <valueHelp> + <format>mknod</format> + <description>Permission to create special files</description> + </valueHelp> + <valueHelp> <format>setpcap</format> <description>Capability sets (from bounded or inherited set)</description> </valueHelp> <valueHelp> <format>sys-admin</format> - <description>Administation operations (quotactl, mount, sethostname, setdomainame)</description> + <description>Administration operations (quotactl, mount, sethostname, setdomainname)</description> </valueHelp> <valueHelp> <format>sys-module</format> @@ -66,11 +70,17 @@ <description>Permission to set system clock</description> </valueHelp> <constraint> - <regex>(net-admin|net-bind-service|net-raw|setpcap|sys-admin|sys-module|sys-nice|sys-time)</regex> + <regex>(net-admin|net-bind-service|net-raw|mknod|setpcap|sys-admin|sys-module|sys-nice|sys-time)</regex> </constraint> <multi/> </properties> </leafNode> + <leafNode name="privileged"> + <properties> + <help>Grant root capabilities to the container</help> + <valueless/> + </properties> + </leafNode> <node name="sysctl"> <properties> <help>Configure namespaced kernel parameters of the container</help> @@ -131,7 +141,7 @@ <properties> <help>Add custom environment variables</help> <constraint> - <regex>[-_a-zA-Z0-9]+</regex> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> </constraint> <constraintErrorMessage>Environment variable name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> </properties> @@ -275,6 +285,7 @@ </properties> <defaultValue>64</defaultValue> </leafNode> + #include <include/name-server-ipv4-ipv6.xml.i> <tagNode name="network"> <properties> <help>Attach user defined network to container</help> @@ -301,6 +312,24 @@ <multi/> </properties> </leafNode> + <leafNode name="mac"> + <properties> + <help>Media Access Control (MAC) address</help> + <valueHelp> + <format>macaddr</format> + <description>Hardware (MAC) address</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Generate a random MAC address for the container</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + <regex>(auto)</regex> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> </children> </tagNode> <tagNode name="port"> @@ -411,6 +440,35 @@ </constraint> </properties> </leafNode> + <tagNode name="tmpfs"> + <properties> + <help>Mount a tmpfs filesystem into the container</help> + </properties> + <children> + <leafNode name="destination"> + <properties> + <help>Destination container directory</help> + <valueHelp> + <format>txt</format> + <description>Destination container directory</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="size"> + <properties> + <help>tmpfs filesystem size in MB</help> + <valueHelp> + <format>u32:1-65536</format> + <description>tmpfs filesystem size in MB</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Container tmpfs size must be between 1 and 65535 MB</constraintErrorMessage> + </properties> + </leafNode> + </children> + </tagNode> <tagNode name="volume"> <properties> <help>Mount a volume into the container</help> @@ -492,6 +550,90 @@ </leafNode> </children> </tagNode> + <leafNode name="log-driver"> + <properties> + <help>Configure container log driver</help> + <completionHelp> + <list>k8s-file journald none</list> + </completionHelp> + <valueHelp> + <format>k8s-file</format> + <description>Logs to plain-text file</description> + </valueHelp> + <valueHelp> + <format>journald</format> + <description>Logs to systemd's journal</description> + </valueHelp> + <valueHelp> + <format>none</format> + <description>Disable logging for the container</description> + </valueHelp> + <constraint> + <regex>(k8s-file|journald|none)</regex> + </constraint> + </properties> + <defaultValue>journald</defaultValue> + </leafNode> + <node name="health-check"> + <properties> + <help>Configure container health checks</help> + </properties> + <children> + <leafNode name="command"> + <properties> + <help>Health check command to run for the container</help> + </properties> + </leafNode> + <leafNode name="interval"> + <properties> + <help>Overwrite related health check configuration from the image</help> + <completionHelp> + <list>disable</list> + </completionHelp> + <valueHelp> + <format>disable</format> + <description>No automatic timer setup</description> + </valueHelp> + <valueHelp> + <format>u32:1-16384</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16384"/> + <regex>(disable)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Timeout for the health check to complete</help> + <valueHelp> + <format>u32:1-16384</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="retry"> + <properties> + <help>The number of retries before container is consider unhealthy</help> + <valueHelp> + <format>0</format> + <description>No retry</description> + </valueHelp> + <valueHelp> + <format>u32:1-255</format> + <description>Number of retries</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <tagNode name="network"> @@ -501,6 +643,25 @@ </properties> <children> #include <include/generic-description.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="gateway"> + <properties> + <help>Gateway address to use for this network</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 gateway address</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 gateway address</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="ipv6-address"/> + </constraint> + <multi/> + </properties> + </leafNode> <leafNode name="prefix"> <properties> <help>Prefix which allocated to that network</help> @@ -525,6 +686,62 @@ <valueless/> </properties> </leafNode> + <node name="type"> + <properties> + <help>Network type (default: bridge)</help> + </properties> + <children> + <leafNode name="bridge"> + <properties> + <help>Bridge network</help> + <valueless/> + </properties> + </leafNode> + <node name="macvlan"> + <properties> + <help>MACVLAN network</help> + </properties> + <children> + <leafNode name="mode"> + <properties> + <help>MACVLAN mode</help> + <completionHelp> + <list>bridge private vepa</list> + </completionHelp> + <valueHelp> + <format>bridge</format> + <description>Containers act as separate hosts on the parent network</description> + </valueHelp> + <valueHelp> + <format>private</format> + <description>Containers are isolated from the host and each other</description> + </valueHelp> + <valueHelp> + <format>vepa</format> + <description>Containers send all traffic through the parent switch for forwarding</description> + </valueHelp> + <constraint> + <regex>bridge|private|vepa</regex> + </constraint> + <constraintErrorMessage>Invalid mode</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="parent"> + <properties> + <help>Parent network interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --type ethernet --type bonding --type bridge</script> + </completionHelp> + <constraint> + <regex>((bond|br|eth)[0-9]+(\.[0-9]+)?)</regex> + </constraint> + <constraintErrorMessage>Invalid parent interface</constraintErrorMessage> + </properties> + </leafNode> + </children> + </node> + </children> + </node> #include <include/interface/vrf.xml.i> </children> </tagNode> @@ -536,6 +753,54 @@ <children> #include <include/interface/authentication.xml.i> #include <include/generic-disable-node.xml.i> + <leafNode name="insecure"> + <properties> + <help>Allow registry access over unencrypted HTTP or TLS connections with untrusted certificates</help> + <valueless/> + </properties> + </leafNode> + <node name="mirror"> + <properties> + <help>Registry mirror, use host-name|address[:port][/path]</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IP address of container registry mirror</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address of container registry mirror</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address of container registry mirror</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="ipv6-link-local"/> + </constraint> + </properties> + </leafNode> + <leafNode name="host-name"> + <properties> + <help>Hostname of container registry mirror</help> + <valueHelp> + <format>hostname</format> + <description>FQDN of container registry mirror</description> + </valueHelp> + <constraint> + <validator name="fqdn"/> + </constraint> + </properties> + </leafNode> + #include <include/port-number.xml.i> + <leafNode name="path"> + <properties> + <help>Path of container registry mirror, optional, must be start with '/' if not empty</help> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> </children> diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 07c88f799..f5986164a 100755..100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -16,15 +16,7 @@ </properties> <children> #include <include/generic-description.xml.i> - <leafNode name="interface"> - <properties> - <help>Interfaces to use this flowtable</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <multi/> - </properties> - </leafNode> + #include <include/generic-interface-multi.xml.i> <leafNode name="offload"> <properties> <help>Offloading method</help> @@ -146,6 +138,19 @@ </tagNode> </children> </node> + <tagNode name="remote-group"> + <properties> + <help>Firewall remote-group</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Name of firewall group can only contain alphanumeric letters, hyphen, underscores and dot</constraintErrorMessage> + </properties> + <children> + #include <include/url-http-https.xml.i> + #include <include/generic-description.xml.i> + </children> + </tagNode> <tagNode name="interface-group"> <properties> <help>Firewall interface-group</help> @@ -155,15 +160,7 @@ <constraintErrorMessage>Name of firewall group can only contain alphanumeric letters, hyphen, underscores and dot</constraintErrorMessage> </properties> <children> - <leafNode name="interface"> - <properties> - <help>Interface-group member</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <multi/> - </properties> - </leafNode> + #include <include/generic-interface-multi.xml.i> <leafNode name="include"> <properties> <help>Include another interface-group</help> @@ -431,6 +428,29 @@ </properties> <defaultValue>drop</defaultValue> </leafNode> + <node name="default-firewall"> + <properties> + <help>Default firewall rules for traffic coming into this zone</help> + </properties> + <children> + <leafNode name="ipv6-name"> + <properties> + <help>IPv6 firewall ruleset</help> + <completionHelp> + <path>firewall ipv6 name</path> + </completionHelp> + </properties> + </leafNode> + <leafNode name="name"> + <properties> + <help>IPv4 firewall ruleset</help> + <completionHelp> + <path>firewall ipv4 name</path> + </completionHelp> + </properties> + </leafNode> + </children> + </node> <tagNode name="from"> <properties> <help>Zone from which to filter traffic</help> @@ -464,24 +484,27 @@ </node> </children> </tagNode> - <leafNode name="interface"> + <node name="member"> <properties> <help>Interface associated with zone</help> - <valueHelp> - <format>txt</format> - <description>Interface associated with zone</description> - </valueHelp> - <valueHelp> - <format>vrf</format> - <description>VRF associated with zone</description> - </valueHelp> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - <path>vrf name</path> - </completionHelp> - <multi/> </properties> - </leafNode> + <children> + #include <include/generic-interface-multi-wildcard.xml.i> + <leafNode name="vrf"> + <properties> + <help>VRF associated with zone</help> + <valueHelp> + <format>vrf</format> + <description>VRF associated with zone</description> + </valueHelp> + <completionHelp> + <path>vrf name</path> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> <node name="intra-zone-filtering"> <properties> <help>Intra-zone filtering</help> diff --git a/interface-definitions/high-availability.xml.in b/interface-definitions/high-availability.xml.in index 7108aa06c..11ea91309 100644 --- a/interface-definitions/high-availability.xml.in +++ b/interface-definitions/high-availability.xml.in @@ -12,12 +12,19 @@ <help>Virtual Router Redundancy Protocol settings</help> </properties> <children> - <leafNode name="snmp"> + <node name="snmp"> <properties> - <valueless/> <help>Enable SNMP</help> </properties> - </leafNode> + <children> + <leafNode name="trap"> + <properties> + <valueless/> + <help>Enable SNMP traps</help> + </properties> + </leafNode> + </children> + </node> <node name="global-parameters"> <properties> <help>VRRP global parameters</help> @@ -163,6 +170,18 @@ </constraint> </properties> </leafNode> + <leafNode name="timeout"> + <properties> + <help>Health check script timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--positive"/> + </constraint> + </properties> + </leafNode> </children> </node> <leafNode name="hello-source-address"> @@ -247,22 +266,7 @@ <help>Disable track state of main interface</help> </properties> </leafNode> - <leafNode name="interface"> - <properties> - <help>Interface name state check</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces --broadcast</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - <multi/> - </properties> - </leafNode> + #include <include/generic-interface-multi-broadcast.xml.i> </children> </node> #include <include/vrrp-transition-script.xml.i> @@ -401,6 +405,18 @@ </constraint> </properties> </leafNode> + <leafNode name="timeout"> + <properties> + <help>Health check script timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--positive"/> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/vrrp-transition-script.xml.i> @@ -497,11 +513,15 @@ <properties> <help>Timeout for persistent connections</help> <valueHelp> + <format>u32:0</format> + <description>Disable persistent connections</description> + </valueHelp> + <valueHelp> <format>u32:1-86400</format> <description>Timeout for persistent connections</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-86400"/> + <validator name="numeric" argument="--range 0-86400"/> </constraint> </properties> <defaultValue>300</defaultValue> diff --git a/interface-definitions/include/accel-ppp/auth-mode.xml.i b/interface-definitions/include/accel-ppp/auth-mode.xml.i index ccaed6f04..476cf7b62 100644 --- a/interface-definitions/include/accel-ppp/auth-mode.xml.i +++ b/interface-definitions/include/accel-ppp/auth-mode.xml.i @@ -8,7 +8,7 @@ </valueHelp> <valueHelp> <format>radius</format> - <description>Use RADIUS server for user autentication</description> + <description>Use RADIUS server for user authentication</description> </valueHelp> <valueHelp> <format>noauth</format> diff --git a/interface-definitions/include/accel-ppp/idle-timeout.xml.i b/interface-definitions/include/accel-ppp/idle-timeout.xml.i new file mode 100644 index 000000000..98af5aa85 --- /dev/null +++ b/interface-definitions/include/accel-ppp/idle-timeout.xml.i @@ -0,0 +1,15 @@ +<!-- include start from accel-ppp/idle-timeout.xml.i --> +<leafNode name="idle-timeout"> + <properties> + <help>Disconnect idle sessions after the specified time (in seconds)</help> + <valueHelp> + <format>u32:0-86400</format> + <description>Idle timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-86400"/> + </constraint> + <constraintErrorMessage>Idle timeout must be in range 0 to 86400</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i b/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i index f6ef41019..20b40f60e 100644 --- a/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i +++ b/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i @@ -9,7 +9,7 @@ <constraint> <validator name="numeric" argument="--allow-range --range 0-65535"/> </constraint> - <constraintErrorMessage>Maximum concurent sessions must be in range 0-65535</constraintErrorMessage> + <constraintErrorMessage>Maximum concurrent sessions must be in range 0-65535</constraintErrorMessage> </properties> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/accel-ppp/radius-additions.xml.i b/interface-definitions/include/accel-ppp/radius-additions.xml.i index 5222ba864..b6c88c6e8 100644 --- a/interface-definitions/include/accel-ppp/radius-additions.xml.i +++ b/interface-definitions/include/accel-ppp/radius-additions.xml.i @@ -133,17 +133,8 @@ </valueHelp> </properties> </leafNode> + #include <include/port-number.xml.i> <leafNode name="port"> - <properties> - <help>Port for Dynamic Authorization Extension server (DM/CoA)</help> - <valueHelp> - <format>u32:1-65535</format> - <description>TCP port</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-65535"/> - </constraint> - </properties> <defaultValue>1700</defaultValue> </leafNode> <leafNode name="key"> diff --git a/interface-definitions/include/accel-ppp/thread-count.xml.i b/interface-definitions/include/accel-ppp/thread-count.xml.i new file mode 100644 index 000000000..84d9224d0 --- /dev/null +++ b/interface-definitions/include/accel-ppp/thread-count.xml.i @@ -0,0 +1,27 @@ +<!-- include start from accel-ppp/thread-count.xml.i --> +<leafNode name="thread-count"> + <properties> + <help>Number of working threads</help> + <completionHelp> + <list>all half</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>Use all available CPU cores</description> + </valueHelp> + <valueHelp> + <format>half</format> + <description>Use half of available CPU cores</description> + </valueHelp> + <valueHelp> + <format>u32:1-512</format> + <description>Thread count</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-512"/> + <regex>(all|half)</regex> + </constraint> + </properties> + <defaultValue>all</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/auth-mode-pre-shared-secret.xml.i b/interface-definitions/include/auth-mode-pre-shared-secret.xml.i new file mode 100644 index 000000000..cf1003917 --- /dev/null +++ b/interface-definitions/include/auth-mode-pre-shared-secret.xml.i @@ -0,0 +1,14 @@ +<!-- include start from auth-mode-pre-shared-secret.xml.i --> +<leafNode name="mode"> + <properties> + <help>Authentication mode</help> + <completionHelp> + <list>pre-shared-secret</list> + </completionHelp> + <valueHelp> + <format>pre-shared-secret</format> + <description>Use a pre-shared secret key</description> + </valueHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/auth-psk-id.xml.i b/interface-definitions/include/auth-psk-id.xml.i new file mode 100644 index 000000000..ab2451045 --- /dev/null +++ b/interface-definitions/include/auth-psk-id.xml.i @@ -0,0 +1,11 @@ +<!-- include start from auth-psk-id.xml.i --> +<leafNode name="id"> + <properties> + <help>ID for authentication</help> + <valueHelp> + <format>txt</format> + <description>ID used for authentication</description> + </valueHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/auth-psk-secret.xml.i b/interface-definitions/include/auth-psk-secret.xml.i new file mode 100644 index 000000000..4577d2ac1 --- /dev/null +++ b/interface-definitions/include/auth-psk-secret.xml.i @@ -0,0 +1,15 @@ +<!-- include start from auth-psk-secret.xml.i --> +<leafNode name="secret"> + <properties> + <help>pre-shared secret key</help> + <valueHelp> + <format>txt</format> + <description>16byte pre-shared-secret key (32 character hexadecimal key)</description> + </valueHelp> + <constraint> + <validator name="psk-secret"/> + </constraint> + <constraintErrorMessage>Pre-Shared-Keys must be at least 16 bytes long, which implies at least 32 characters</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/babel/redistribute-common.xml.i b/interface-definitions/include/babel/redistribute-common.xml.i new file mode 100644 index 000000000..e988cc0d0 --- /dev/null +++ b/interface-definitions/include/babel/redistribute-common.xml.i @@ -0,0 +1,44 @@ +<!-- include start from babel/redistribute-common.xml.i --> +<leafNode name="bgp"> + <properties> + <help>Border Gateway Protocol (BGP)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="connected"> + <properties> + <help>Connected routes (directly attached subnet or host)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="isis"> + <properties> + <help>Intermediate System to Intermediate System (IS-IS)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="kernel"> + <properties> + <help>Redistribute Kernel routes (not installed via the zebra RIB)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="nhrp"> + <properties> + <help>Redistribute NHRP routes</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="openfabric"> + <properties> + <help>OpenFabric Routing Protocol</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="static"> + <properties> + <help>Statically configured routes</help> + <valueless/> + </properties> + </leafNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-redistribute-common-protocols.xml.i b/interface-definitions/include/bgp/afi-redistribute-common-protocols.xml.i new file mode 100644 index 000000000..3f6517d03 --- /dev/null +++ b/interface-definitions/include/bgp/afi-redistribute-common-protocols.xml.i @@ -0,0 +1,62 @@ +<!-- include start from bgp/afi-redistribute-common-protocols.xml.i --> +<node name="babel"> + <properties> + <help>Redistribute Babel routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<node name="connected"> + <properties> + <help>Redistribute connected routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<node name="isis"> + <properties> + <help>Redistribute IS-IS routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<node name="kernel"> + <properties> + <help>Redistribute kernel routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<node name="nhrp"> + <properties> + <help>Redistribute NHRP routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<node name="static"> + <properties> + <help>Redistribute static routes into BGP</help> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</node> +<tagNode name="table"> + <properties> + <help>Redistribute non-main Kernel Routing Table</help> + <completionHelp> + <path>protocols static table</path> + </completionHelp> + #include <include/constraint/protocols-static-table.xml.i> + </properties> + <children> + #include <include/bgp/afi-redistribute-metric-route-map.xml.i> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-route-map-export-import.xml.i b/interface-definitions/include/bgp/afi-route-map-export-import.xml.i deleted file mode 100644 index 388991241..000000000 --- a/interface-definitions/include/bgp/afi-route-map-export-import.xml.i +++ /dev/null @@ -1,34 +0,0 @@ -<!-- include start from bgp/afi-route-map.xml.i --> -<leafNode name="export"> - <properties> - <help>Route-map to filter outgoing route updates</help> - <completionHelp> - <path>policy route-map</path> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Route map name</description> - </valueHelp> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Name of route-map can only contain alpha-numeric letters, hyphen and underscores</constraintErrorMessage> - </properties> -</leafNode> -<leafNode name="import"> - <properties> - <help>Route-map to filter incoming route updates</help> - <completionHelp> - <path>policy route-map</path> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Route map name</description> - </valueHelp> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Name of route-map can only contain alpha-numeric letters, hyphen and underscores</constraintErrorMessage> - </properties> -</leafNode> -<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-route-map-export.xml.i b/interface-definitions/include/bgp/afi-route-map-export.xml.i new file mode 100644 index 000000000..94d77caf2 --- /dev/null +++ b/interface-definitions/include/bgp/afi-route-map-export.xml.i @@ -0,0 +1,18 @@ +<!-- include start from bgp/afi-route-map-export.xml.i --> +<leafNode name="export"> + <properties> + <help>Route-map to filter outgoing route updates</help> + <completionHelp> + <path>policy route-map</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Route map name</description> + </valueHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Route map names can only contain alphanumeric characters, hyphens, and underscores</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-route-map-import.xml.i b/interface-definitions/include/bgp/afi-route-map-import.xml.i new file mode 100644 index 000000000..a1b154fcd --- /dev/null +++ b/interface-definitions/include/bgp/afi-route-map-import.xml.i @@ -0,0 +1,18 @@ +<!-- include start from bgp/afi-route-map-import.xml.i --> +<leafNode name="import"> + <properties> + <help>Route-map to filter incoming route updates</help> + <completionHelp> + <path>policy route-map</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Route map name</description> + </valueHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Name of route-map can only contain alpha-numeric letters, hyphen and underscores</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-route-map-vpn.xml.i b/interface-definitions/include/bgp/afi-route-map-vpn.xml.i index e6be113c5..ac7b55af6 100644 --- a/interface-definitions/include/bgp/afi-route-map-vpn.xml.i +++ b/interface-definitions/include/bgp/afi-route-map-vpn.xml.i @@ -9,7 +9,8 @@ <help>Between current address-family and VPN</help> </properties> <children> - #include <include/bgp/afi-route-map-export-import.xml.i> + #include <include/bgp/afi-route-map-export.xml.i> + #include <include/bgp/afi-route-map-import.xml.i> </children> </node> </children> diff --git a/interface-definitions/include/bgp/afi-route-map-vrf.xml.i b/interface-definitions/include/bgp/afi-route-map-vrf.xml.i new file mode 100644 index 000000000..5c1783bda --- /dev/null +++ b/interface-definitions/include/bgp/afi-route-map-vrf.xml.i @@ -0,0 +1,17 @@ +<!-- include start from bgp/afi-route-map-vrf.xml.i --> +<node name="route-map"> + <properties> + <help>Route-map to filter route updates to/from this peer</help> + </properties> + <children> + <node name="vrf"> + <properties> + <help>Between current address-family and VRF</help> + </properties> + <children> + #include <include/bgp/afi-route-map-import.xml.i> + </children> + </node> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/bgp/afi-route-map.xml.i b/interface-definitions/include/bgp/afi-route-map.xml.i index 0b6178176..f8e1d7033 100644 --- a/interface-definitions/include/bgp/afi-route-map.xml.i +++ b/interface-definitions/include/bgp/afi-route-map.xml.i @@ -4,7 +4,8 @@ <help>Route-map to filter route updates to/from this peer</help> </properties> <children> - #include <include/bgp/afi-route-map-export-import.xml.i> + #include <include/bgp/afi-route-map-export.xml.i> + #include <include/bgp/afi-route-map-import.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i b/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i index 261d60232..d4bb0093e 100644 --- a/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i +++ b/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i @@ -1,4 +1,10 @@ <!-- include start from bgp/bmp-monitor-afi-policy.xml.i --> +<leafNode name="local-rib"> + <properties> + <help>Enable BMP monitoring of local RIB</help> + <valueless/> + </properties> +</leafNode> <leafNode name="pre-policy"> <properties> <help>Send state before policy and filter processing</help> diff --git a/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i b/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i new file mode 100644 index 000000000..fa31f5c46 --- /dev/null +++ b/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i @@ -0,0 +1,8 @@ +<!-- include start from bgp/neighbor-afi-link-state.xml.i --> +<leafNode name="link-state"> + <properties> + <help>Link State BGP address family</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/neighbor-bfd.xml.i b/interface-definitions/include/bgp/neighbor-bfd.xml.i index fac2a1166..6de4c9373 100644 --- a/interface-definitions/include/bgp/neighbor-bfd.xml.i +++ b/interface-definitions/include/bgp/neighbor-bfd.xml.i @@ -11,6 +11,25 @@ <valueless/> </properties> </leafNode> + <node name="strict"> + <properties> + <help>Strict mode</help> + </properties> + <children> + <leafNode name="hold-time"> + <properties> + <help>BFD hold time</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>BFD hold time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/bgp/neighbor-local-role.xml.i b/interface-definitions/include/bgp/neighbor-local-role.xml.i index 6ddb4908f..472e5ab8b 100644 --- a/interface-definitions/include/bgp/neighbor-local-role.xml.i +++ b/interface-definitions/include/bgp/neighbor-local-role.xml.i @@ -33,7 +33,7 @@ <children> <leafNode name="strict"> <properties> - <help>Neighbor must send this exact capability, otherwise a role missmatch notification will be sent</help> + <help>Neighbor must send this exact capability, otherwise a role mismatch notification will be sent</help> <valueless/> </properties> </leafNode> diff --git a/interface-definitions/include/bgp/protocol-common-config.xml.i b/interface-definitions/include/bgp/protocol-common-config.xml.i index 0f05625a7..f342402bb 100644 --- a/interface-definitions/include/bgp/protocol-common-config.xml.i +++ b/interface-definitions/include/bgp/protocol-common-config.xml.i @@ -119,6 +119,7 @@ </tagNode> #include <include/bgp/afi-rd.xml.i> #include <include/bgp/afi-route-map-vpn.xml.i> + #include <include/bgp/afi-route-map-vrf.xml.i> #include <include/bgp/afi-route-target-vpn.xml.i> #include <include/bgp/afi-nexthop-vpn-export.xml.i> <node name="redistribute"> @@ -126,30 +127,7 @@ <help>Redistribute routes from other protocols into BGP</help> </properties> <children> - <node name="connected"> - <properties> - <help>Redistribute connected routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <node name="isis"> - <properties> - <help>Redistribute IS-IS routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <node name="kernel"> - <properties> - <help>Redistribute kernel routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> + #include <include/bgp/afi-redistribute-common-protocols.xml.i> <node name="ospf"> <properties> <help>Redistribute OSPF routes into BGP</help> @@ -166,27 +144,6 @@ #include <include/bgp/afi-redistribute-metric-route-map.xml.i> </children> </node> - <node name="babel"> - <properties> - <help>Redistribute Babel routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <node name="static"> - <properties> - <help>Redistribute static routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <leafNode name="table"> - <properties> - <help>Redistribute non-main Kernel Routing Table</help> - </properties> - </leafNode> </children> </node> #include <include/bgp/afi-sid.xml.i> @@ -503,22 +460,7 @@ <help>Redistribute routes from other protocols into BGP</help> </properties> <children> - <node name="connected"> - <properties> - <help>Redistribute connected routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <node name="kernel"> - <properties> - <help>Redistribute kernel routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> + #include <include/bgp/afi-redistribute-common-protocols.xml.i> <node name="ospfv3"> <properties> <help>Redistribute OSPFv3 routes into BGP</help> @@ -535,27 +477,6 @@ #include <include/bgp/afi-redistribute-metric-route-map.xml.i> </children> </node> - <node name="babel"> - <properties> - <help>Redistribute Babel routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <node name="static"> - <properties> - <help>Redistribute static routes into BGP</help> - </properties> - <children> - #include <include/bgp/afi-redistribute-metric-route-map.xml.i> - </children> - </node> - <leafNode name="table"> - <properties> - <help>Redistribute non-main Kernel Routing Table</help> - </properties> - </leafNode> </children> </node> #include <include/bgp/afi-sid.xml.i> @@ -721,15 +642,7 @@ <help>Apply local policy routing to interface</help> </properties> <children> - <leafNode name="interface"> - <properties> - <help>Interface</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <multi/> - </properties> - </leafNode> + #include <include/generic-interface-multi.xml.i> </children> </node> </children> @@ -1123,6 +1036,8 @@ <validator name="ip-address"/> #include <include/constraint/interface-name.xml.i> </constraint> + <constraintSilenceOutput/> + <constraintErrorMessage>BGP neighbor must be one of: IP address, IPv6 address, or interface name</constraintErrorMessage> </properties> <children> <node name="address-family"> @@ -1141,6 +1056,7 @@ #include <include/bgp/neighbor-afi-ipv4-multicast.xml.i> #include <include/bgp/neighbor-afi-ipv6-multicast.xml.i> #include <include/bgp/neighbor-afi-l2vpn-evpn.xml.i> + #include <include/bgp/neighbor-afi-link-state.xml.i> </children> </node> <leafNode name="advertisement-interval"> @@ -1190,12 +1106,7 @@ #include <include/bgp/peer-group.xml.i> #include <include/bgp/remote-as.xml.i> #include <include/bgp/neighbor-shutdown.xml.i> - <leafNode name="solo"> - <properties> - <help>Do not send back prefixes learned from the neighbor</help> - <valueless/> - </properties> - </leafNode> + #include <include/bgp/solo.xml.i> <leafNode name="enforce-first-as"> <properties> <help>Ensure the first AS in the AS path matches the peer AS</help> @@ -1243,6 +1154,25 @@ <help>BGP parameters</help> </properties> <children> + <leafNode name="as-notation"> + <properties> + <help>BGP AS-notation output format</help> + <completionHelp> + <list>asdot asdot+</list> + </completionHelp> + <valueHelp> + <format>asdot</format> + <description>Use asdot notation only for 4 byte AS numbers</description> + </valueHelp> + <valueHelp> + <format>asdot+</format> + <description>Use asdot notation for all AS numbers</description> + </valueHelp> + <constraint> + <regex>(asdot\+|asdot)</regex> + </constraint> + </properties> + </leafNode> <leafNode name="allow-martian-nexthop"> <properties> <help>Allow Martian nexthops to be received in the NLRI from a peer</help> @@ -1683,6 +1613,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="no-ipv6-auto-ra"> + <properties> + <help>Disable IPv6 automatic router advertisement</help> + <valueless/> + </properties> + </leafNode> <leafNode name="no-suppress-duplicates"> <properties> <help>Disable suppress duplicate updates if the route actually not changed</help> @@ -1751,6 +1687,41 @@ </leafNode> </children> </node> + <node name="update-delay"> + <properties> + <help>BGP update-delay read-only mode</help> + </properties> + <children> + <leafNode name="max-delay"> + <properties> + <help>Maximum delay before exiting read-only mode</help> + <valueHelp> + <format>u32:0</format> + <description>Disable feature</description> + </valueHelp> + <valueHelp> + <format>u32:1-3600</format> + <description>Delay in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-3600"/> + </constraint> + </properties> + </leafNode> + <leafNode name="establish-wait"> + <properties> + <help>Time to wait for peers to reach Established state before determining expected peers</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Wait time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <tagNode name="peer-group"> @@ -1773,6 +1744,7 @@ #include <include/bgp/neighbor-afi-ipv6-labeled-unicast.xml.i> #include <include/bgp/neighbor-afi-ipv6-vpn.xml.i> #include <include/bgp/neighbor-afi-l2vpn-evpn.xml.i> + #include <include/bgp/neighbor-afi-link-state.xml.i> </children> </node> #include <include/generic-description.xml.i> @@ -1782,7 +1754,6 @@ #include <include/bgp/neighbor-disable-connected-check.xml.i> #include <include/bgp/neighbor-ebgp-multihop.xml.i> #include <include/bgp/neighbor-graceful-restart.xml.i> - #include <include/bgp/neighbor-graceful-restart.xml.i> #include <include/bgp/neighbor-local-as.xml.i> #include <include/bgp/neighbor-local-role.xml.i> #include <include/bgp/neighbor-override-capability.xml.i> @@ -1794,6 +1765,7 @@ #include <include/bgp/neighbor-update-source.xml.i> #include <include/bgp/remote-as.xml.i> #include <include/port-number.xml.i> + #include <include/bgp/solo.xml.i> </children> </tagNode> <node name="srv6"> diff --git a/interface-definitions/include/bgp/remote-as.xml.i b/interface-definitions/include/bgp/remote-as.xml.i index 79d3b95a9..4c622b831 100644 --- a/interface-definitions/include/bgp/remote-as.xml.i +++ b/interface-definitions/include/bgp/remote-as.xml.i @@ -3,13 +3,17 @@ <properties> <help>Neighbor BGP AS number</help> <completionHelp> - <list>external internal</list> + <list>auto external internal</list> </completionHelp> <valueHelp> <format>u32:1-4294967294</format> <description>Neighbor AS number</description> </valueHelp> <valueHelp> + <format>auto</format> + <description>Automatically detect remote AS</description> + </valueHelp> + <valueHelp> <format>external</format> <description>Any AS different from the local AS</description> </valueHelp> @@ -19,7 +23,7 @@ </valueHelp> <constraint> <validator name="numeric" argument="--range 1-4294967294"/> - <regex>(external|internal)</regex> + <regex>(auto|external|internal)</regex> </constraint> <constraintErrorMessage>Invalid AS number</constraintErrorMessage> </properties> diff --git a/interface-definitions/include/bgp/solo.xml.i b/interface-definitions/include/bgp/solo.xml.i new file mode 100644 index 000000000..2b26b5af3 --- /dev/null +++ b/interface-definitions/include/bgp/solo.xml.i @@ -0,0 +1,8 @@ +<!-- include start from bgp/solo.xml.i --> +<leafNode name="solo"> + <properties> + <help>Do not send back prefixes learned from the neighbor</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i index adff530b6..aa40017e9 100644 --- a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i +++ b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i @@ -1,4 +1,5 @@ <!-- include start from constraint/interface-name-with-wildcard.xml.i --> -<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vpptap|vpptun|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(pod-[-_a-zA-Z0-9]{1,11})</regex> <validator name="file-path --lookup-path /sys/class/net --directory"/> <!-- include end --> diff --git a/interface-definitions/include/constraint/interface-name.xml.i b/interface-definitions/include/constraint/interface-name.xml.i index 3e7c4e667..f64ea86f5 100644 --- a/interface-definitions/include/constraint/interface-name.xml.i +++ b/interface-definitions/include/constraint/interface-name.xml.i @@ -1,4 +1,4 @@ <!-- include start from constraint/interface-name.xml.i --> -<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|lo</regex> +<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vpptap|vpptun|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|pod-[-_a-zA-Z0-9]{1,11}|lo</regex> <validator name="file-path --lookup-path /sys/class/net --directory"/> <!-- include end --> diff --git a/interface-definitions/include/constraint/protocols-static-table.xml.i b/interface-definitions/include/constraint/protocols-static-table.xml.i new file mode 100644 index 000000000..2d8b067a4 --- /dev/null +++ b/interface-definitions/include/constraint/protocols-static-table.xml.i @@ -0,0 +1,9 @@ +<!-- include start from constraint/host-name.xml.i --> +<valueHelp> + <format>u32:1-200</format> + <description>Policy route table number</description> +</valueHelp> +<constraint> + <validator name="numeric" argument="--range 1-200"/> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/constraint/vrf.xml.i b/interface-definitions/include/constraint/vrf.xml.i index a1922bb6d..fa0518dad 100644 --- a/interface-definitions/include/constraint/vrf.xml.i +++ b/interface-definitions/include/constraint/vrf.xml.i @@ -2,5 +2,5 @@ <constraint> <validator name="vrf-name"/> </constraint> -<constraintErrorMessage>VRF instance name must be 15 characters or less and can not\nbe named as regular network interfaces.\nA name must starts from a letter.\n</constraintErrorMessage> +<constraintErrorMessage>VRF instance name must be 15 characters or less and can not be named as a\nregular network interfaces. VRF name must start with a letter.\n</constraintErrorMessage> <!-- include end --> diff --git a/interface-definitions/include/constraint/wireguard-keys.xml.i b/interface-definitions/include/constraint/wireguard-keys.xml.i new file mode 100644 index 000000000..f59c86087 --- /dev/null +++ b/interface-definitions/include/constraint/wireguard-keys.xml.i @@ -0,0 +1,6 @@ +<!-- include start from constraint/wireguard-keys.xml.i --> +<constraint> + <validator name="base64" argument="--decoded-len 32"/> +</constraint> +<constraintErrorMessage>Key must be Base64-encoded with 32 bytes in length</constraintErrorMessage> +<!-- include end --> diff --git a/interface-definitions/include/dhcp-interface-multi.xml.i b/interface-definitions/include/dhcp-interface-multi.xml.i index 0db11cf79..5f5c54cfd 100644 --- a/interface-definitions/include/dhcp-interface-multi.xml.i +++ b/interface-definitions/include/dhcp-interface-multi.xml.i @@ -1,18 +1,8 @@ <!-- include start from dhcp-interface-multi.xml.i --> -<leafNode name="dhcp-interface"> - <properties> - <help>DHCP interface supplying next-hop IP address</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>DHCP interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - <multi/> - </properties> + <leafNode name="dhcp-interface"> + <properties> + #include <include/dhcp-interface-properties.xml.i> + <multi/> + </properties> </leafNode> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/dhcp-interface-properties.xml.i b/interface-definitions/include/dhcp-interface-properties.xml.i new file mode 100644 index 000000000..b184b8f0a --- /dev/null +++ b/interface-definitions/include/dhcp-interface-properties.xml.i @@ -0,0 +1,13 @@ +<!-- include end --> + <help>DHCP interface supplying next-hop IP address</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>DHCP interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> +<!-- include end --> diff --git a/interface-definitions/include/dhcp-interface.xml.i b/interface-definitions/include/dhcp-interface.xml.i index b5c94cb24..e056b3fe1 100644 --- a/interface-definitions/include/dhcp-interface.xml.i +++ b/interface-definitions/include/dhcp-interface.xml.i @@ -1,15 +1,7 @@ +<!-- include start from dhcp-interface.xml.i --> <leafNode name="dhcp-interface"> <properties> - <help>DHCP interface supplying next-hop IP address</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>DHCP interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> + #include <include/dhcp-interface-properties.xml.i> </properties> </leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/ddns-dns-server.xml.i b/interface-definitions/include/dhcp/ddns-dns-server.xml.i new file mode 100644 index 000000000..ba9f186d0 --- /dev/null +++ b/interface-definitions/include/dhcp/ddns-dns-server.xml.i @@ -0,0 +1,19 @@ +<!-- include start from dhcp/ddns-dns-server.xml.i --> +<tagNode name="dns-server"> + <properties> + <help>DNS server specification</help> + <valueHelp> + <format>u32:1-999999</format> + <description>Number for this DNS server</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-999999"/> + </constraint> + <constraintErrorMessage>DNS server number must be between 1 and 999999</constraintErrorMessage> + </properties> + <children> + #include <include/address-ipv4-ipv6-single.xml.i> + #include <include/port-number.xml.i> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/ddns-settings.xml.i b/interface-definitions/include/dhcp/ddns-settings.xml.i new file mode 100644 index 000000000..3e202685e --- /dev/null +++ b/interface-definitions/include/dhcp/ddns-settings.xml.i @@ -0,0 +1,172 @@ +<!-- include start from dhcp/ddns-settings.xml.i --> +<leafNode name="send-updates"> + <properties> + <help>Enable or disable updates for this scope</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Enable updates for this scope</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Disable updates for this scope</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="override-client-update"> + <properties> + <help>Always update both forward and reverse DNS data, regardless of the client's request</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Force update both forward and reverse DNS records</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Respect client request settings</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="override-no-update"> + <properties> + <help>Perform a DDNS update, even if the client instructs the server not to</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Force DDNS updates regardless of client request</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Respect client request settings</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="replace-client-name"> + <properties> + <help>Replace client name mode</help> + <completionHelp> + <list>never always when-present when-not-present</list> + </completionHelp> + <valueHelp> + <format>never</format> + <description>Use the name the client sent. If the client sent no name, do not generate + one</description> + </valueHelp> + <valueHelp> + <format>always</format> + <description>Replace the name the client sent. If the client sent no name, generate one + for the client</description> + </valueHelp> + <valueHelp> + <format>when-present</format> + <description>Replace the name the client sent. If the client sent no name, do not + generate one</description> + </valueHelp> + <valueHelp> + <format>when-not-present</format> + <description>Use the name the client sent. If the client sent no name, generate one for + the client</description> + </valueHelp> + <constraint> + <regex>(never|always|when-present|when-not-present)</regex> + </constraint> + <constraintErrorMessage>Invalid replace client name mode</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="generated-prefix"> + <properties> + <help>The prefix used in the generation of an FQDN</help> + <constraint> + <validator name="fqdn" /> + </constraint> + <constraintErrorMessage>Invalid generated prefix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="qualifying-suffix"> + <properties> + <help>The suffix used when generating an FQDN, or when qualifying a partial name</help> + <constraint> + <validator name="fqdn" /> + </constraint> + <constraintErrorMessage>Invalid qualifying suffix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="update-on-renew"> + <properties> + <help>Update DNS record on lease renew</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Update DNS record on lease renew</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Do not update DNS record on lease renew</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="conflict-resolution"> + <properties> + <help>DNS conflict resolution behavior</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Enable DNS conflict resolution</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Disable DNS conflict resolution</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="ttl-percent"> + <properties> + <help>Calculate TTL of the DNS record as a percentage of the lease lifetime</help> + <constraint> + <validator name="numeric" argument="--range 1-100" /> + </constraint> + <constraintErrorMessage>Invalid qualifying suffix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="hostname-char-set"> + <properties> + <help>A regular expression describing the invalid character set in the host name</help> + </properties> +</leafNode> +<leafNode name="hostname-char-replacement"> + <properties> + <help>A string of zero or more characters with which to replace each invalid character in + the host name</help> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i b/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i new file mode 100644 index 000000000..64f9707f7 --- /dev/null +++ b/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i @@ -0,0 +1,393 @@ +<!-- include start from dhcp/dhcp-server-common-config.xml.i --> +<tagNode name="client-class"> + <properties> + <help>Client class name</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Client class name may only contain letters, numbers, dots, underscores, and hyphens</constraintErrorMessage> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + <node name="relay-agent-information"> + <properties> + <help>Match DHCP Option 82 (relay agent information)</help> + </properties> + <children> + <leafNode name="circuit-id"> + <properties> + <help>Filters on the contents of the circuit-id sub option</help> + <valueHelp> + <format>hex</format> + <description>Values that start with 0x are interpreted as raw hex. This must only be hexadecimal characters e.g. 0x1234567890ABCDEF</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Any other text string is interpreted as ASCII text</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="remote-id"> + <properties> + <help>Filters on the contents of the remote-id sub option</help> + <valueHelp> + <format>hex</format> + <description>Values that start with 0x are interpreted as raw hex. This must only be hexadecimal characters e.g. 0x1234567890ABCDEF</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Any other text string is interpreted as ASCII text</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> + </children> +</tagNode> +#include <include/generic-disable-node.xml.i> +<node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + <tagNode name="tsig-key"> + <properties> + <help>TSIG key definition for DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + <children> + <leafNode name="algorithm"> + <properties> + <help>TSIG key algorithm</help> + <completionHelp> + <list>md5 sha1 sha224 sha256 sha384 sha512</list> + </completionHelp> + <valueHelp> + <format>md5</format> + <description>MD5 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha1</format> + <description>SHA1 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha224</format> + <description>SHA224 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha256</format> + <description>SHA256 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha384</format> + <description>SHA384 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha512</format> + <description>SHA512 HMAC algorithm</description> + </valueHelp> + <constraint> + <regex>(md5|sha1|sha224|sha256|sha384|sha512)</regex> + </constraint> + <constraintErrorMessage>Invalid TSIG key algorithm</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="secret"> + <properties> + <help>TSIG key secret (base64-encoded)</help> + <constraint> + <validator name="base64"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="forward-domain"> + <properties> + <help>Forward DNS domain name</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid forward DNS domain name</constraintErrorMessage> + </properties> + <children> + <leafNode name="key-name"> + <properties> + <help>TSIG key name for forward DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + </leafNode> + #include <include/dhcp/ddns-dns-server.xml.i> + </children> + </tagNode> + <tagNode name="reverse-domain"> + <properties> + <help>Reverse DNS domain name</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid reverse DNS domain name</constraintErrorMessage> + </properties> + <children> + <leafNode name="key-name"> + <properties> + <help>TSIG key name for reverse DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + </leafNode> + #include <include/dhcp/ddns-dns-server.xml.i> + </children> + </tagNode> + </children> +</node> +<node name="high-availability"> + <properties> + <help>DHCP high availability configuration</help> + </properties> + <children> + #include <include/source-address-ipv4.xml.i> + <leafNode name="mode"> + <properties> + <help>Configure high availability mode</help> + <completionHelp> + <list>active-active active-passive</list> + </completionHelp> + <valueHelp> + <format>active-active</format> + <description>Both server attend DHCP requests</description> + </valueHelp> + <valueHelp> + <format>active-passive</format> + <description>Only primary server attends DHCP requests</description> + </valueHelp> + <constraint> + <regex>(active-active|active-passive)</regex> + </constraint> + <constraintErrorMessage>Invalid DHCP high availability mode</constraintErrorMessage> + </properties> + <defaultValue>active-active</defaultValue> + </leafNode> + <leafNode name="remote"> + <properties> + <help>IPv4 remote address used for connection</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address of high availability peer</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="name"> + <properties> + <help>Peer name used to identify connection</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid failover peer name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="status"> + <properties> + <help>High availability hierarchy</help> + <completionHelp> + <list>primary secondary</list> + </completionHelp> + <valueHelp> + <format>primary</format> + <description>Configure this server to be the primary node</description> + </valueHelp> + <valueHelp> + <format>secondary</format> + <description>Configure this server to be the secondary node</description> + </valueHelp> + <constraint> + <regex>(primary|secondary)</regex> + </constraint> + <constraintErrorMessage>Invalid DHCP high availability peer status</constraintErrorMessage> + </properties> + </leafNode> + #include <include/pki/ca-certificate.xml.i> + #include <include/pki/certificate.xml.i> + </children> +</node> +<leafNode name="hostfile-update"> + <properties> + <help>Updating /etc/hosts file (per client lease)</help> + <valueless/> + </properties> +</leafNode> +#include <include/dhcp/log-level.xml.i> +#include <include/listen-address-ipv4.xml.i> +#include <include/listen-interface-multi-broadcast.xml.i> +<tagNode name="shared-network-name"> + <properties> + <help>Name of DHCP shared network</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + <children> + <node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + </children> + </node> + <leafNode name="authoritative"> + <properties> + <help>Option to make DHCP server authoritative for this physical network</help> + <valueless/> + </properties> + </leafNode> + #include <include/dhcp/option-v4.xml.i> + #include <include/dhcp/ping-check.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + <tagNode name="subnet"> + <properties> + <help>DHCP subnet for shared network</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + <constraintErrorMessage>Invalid IPv4 subnet definition</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + #include <include/dhcp/ping-check.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + <leafNode name="client-class"> + <properties> + <help>DHCP client class</help> + <completionHelp> + <path>service dhcp-server client-class</path> + </completionHelp> + </properties> + </leafNode> + <node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + </children> + </node> + <leafNode name="exclude"> + <properties> + <help>IP address to exclude from DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address to exclude from lease range</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="ignore-client-id"> + <properties> + <help>Ignore client identifier for lease lookups</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="lease"> + <properties> + <help>Lease timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>DHCP lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + <constraintErrorMessage>DHCP lease time must be between 0 and 4294967295 (49 days)</constraintErrorMessage> + </properties> + <defaultValue>86400</defaultValue> + </leafNode> + <tagNode name="range"> + <properties> + <help>DHCP lease range</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + <leafNode name="client-class"> + <properties> + <help>DHCP client class</help> + <completionHelp> + <path>service dhcp-server client-class</path> + </completionHelp> + </properties> + </leafNode> + <leafNode name="start"> + <properties> + <help>First IP address for DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 start address of pool</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stop"> + <properties> + <help>Last IP address for DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 end address of pool</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="static-mapping"> + <properties> + <help>Hostname for static mapping reservation</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + #include <include/ip-address.xml.i> + #include <include/interface/mac.xml.i> + #include <include/interface/duid.xml.i> + </children> + </tagNode> + #include <include/dhcp/subnet-id.xml.i> + </children> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i b/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i new file mode 100644 index 000000000..6e40fbcd4 --- /dev/null +++ b/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i @@ -0,0 +1,268 @@ +<!-- include start from dhcp/dhcpv6-server-common-config.xml.i --> +#include <include/generic-disable-node.xml.i> +#include <include/listen-interface-multi-broadcast.xml.i> +<leafNode name="disable-route-autoinstall"> + <properties> + <help>Do not install routes for delegated prefixes</help> + <valueless/> + </properties> +</leafNode> +<node name="global-parameters"> + <properties> + <help>Additional global parameters for DHCPv6 server</help> + </properties> + <children> + #include <include/name-server-ipv6.xml.i> + </children> +</node> +<leafNode name="preference"> + <properties> + <help>Preference of this DHCPv6 server compared with others</help> + <valueHelp> + <format>u32:0-255</format> + <description>DHCPv6 server preference (0-255)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + <constraintErrorMessage>Preference must be between 0 and 255</constraintErrorMessage> + </properties> +</leafNode> +#include <include/dhcp/log-level.xml.i> +<tagNode name="shared-network-name"> + <properties> + <help>DHCPv6 shared network name</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-interface.xml.i> + #include <include/dhcp/option-v6.xml.i> + <tagNode name="subnet"> + <properties> + <help>IPv6 DHCP subnet for this shared network</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + #include <include/generic-interface.xml.i> + <tagNode name="range"> + <properties> + <help>Parameters setting ranges for assigning IPv6 addresses</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + <leafNode name="prefix"> + <properties> + <help>IPv6 prefix defining range of addresses to assign</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + </leafNode> + <leafNode name="start"> + <properties> + <help>First in range of consecutive IPv6 addresses to assign</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stop"> + <properties> + <help>Last in range of consecutive IPv6 addresses</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <node name="lease-time"> + <properties> + <help>Parameters relating to the lease time</help> + </properties> + <children> + <leafNode name="default"> + <properties> + <help>Default time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>DHCPv6 valid lifetime</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="maximum"> + <properties> + <help>Maximum time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="minimum"> + <properties> + <help>Minimum time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Minimum lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="prefix-delegation"> + <properties> + <help>Parameters relating to IPv6 prefix delegation</help> + </properties> + <children> + <tagNode name="prefix"> + <properties> + <help>IPv6 prefix to be used in prefix delegation</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 prefix used in prefix delegation</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + <children> + <leafNode name="prefix-length"> + <properties> + <help>Length in bits of prefix</help> + <valueHelp> + <format>u32:32-64</format> + <description>Prefix length (32-64)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 32-64"/> + </constraint> + <constraintErrorMessage>Prefix length must be between 32 and 64</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="delegated-length"> + <properties> + <help>Length in bits of prefixes to be delegated</help> + <valueHelp> + <format>u32:32-64</format> + <description>Delegated prefix length (32-64)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 32-96"/> + </constraint> + <constraintErrorMessage>Delegated prefix length must be between 32 and 96</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="excluded-prefix"> + <properties> + <help>IPv6 prefix to be excluded from prefix delegation</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 prefix excluded from prefix delegation</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="excluded-prefix-length"> + <properties> + <help>Length in bits of excluded prefix</help> + <valueHelp> + <format>u32:33-64</format> + <description>Excluded prefix length (33-128)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 33-128"/> + </constraint> + <constraintErrorMessage>Prefix length must be between 33 and 128</constraintErrorMessage> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <tagNode name="static-mapping"> + <properties> + <help>Hostname for static mapping reservation</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + #include <include/generic-disable-node.xml.i> + #include <include/interface/mac.xml.i> + #include <include/interface/duid.xml.i> + <leafNode name="ipv6-address"> + <properties> + <help>Client IPv6 address for this static mapping</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address for this static mapping</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="ipv6-prefix"> + <properties> + <help>Client IPv6 prefix for this static mapping</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix for this static mapping</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </tagNode> + #include <include/dhcp/subnet-id.xml.i> + </children> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/log-level.xml.i b/interface-definitions/include/dhcp/log-level.xml.i new file mode 100644 index 000000000..d9a9e9931 --- /dev/null +++ b/interface-definitions/include/dhcp/log-level.xml.i @@ -0,0 +1,34 @@ +<!-- include start from dhcp/log-level.xml.i --> +<leafNode name="log-level"> + <properties> + <help>Logging level</help> + <completionHelp> + <list>fatal error warn info debug</list> + </completionHelp> + <valueHelp> + <format>fatal</format> + <description>Fatal log level</description> + </valueHelp> + <valueHelp> + <format>error</format> + <description>Error log level</description> + </valueHelp> + <valueHelp> + <format>warn</format> + <description>Warning log level</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational log level</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug log level</description> + </valueHelp> + <constraint> + <regex>(fatal|error|warn|info|debug)</regex> + </constraint> + </properties> + <defaultValue>info</defaultValue> +</leafNode> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/dhcp/option-v4.xml.i b/interface-definitions/include/dhcp/option-v4.xml.i index bd6fc6043..0f446c9a9 100644 --- a/interface-definitions/include/dhcp/option-v4.xml.i +++ b/interface-definitions/include/dhcp/option-v4.xml.i @@ -59,6 +59,18 @@ <constraintErrorMessage>DHCP client prefix length must be 0 to 32</constraintErrorMessage> </properties> </leafNode> + <leafNode name="capwap-controller"> + <properties> + <help>IP address of CAPWAP access controller (Option 138)</help> + <valueHelp> + <format>ipv4</format> + <description>CAPWAP AC controller</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> <leafNode name="default-router"> <properties> <help>IP address of default router</help> @@ -71,6 +83,18 @@ </constraint> </properties> </leafNode> + <leafNode name="interface-mtu"> + <properties> + <help>Interface MTU</help> + <valueHelp> + <format>u16:576-9000</format> + <description>Client interface MTU</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 576-9000"/> + </constraint> + </properties> + </leafNode> <leafNode name="ip-forwarding"> <properties> <help>Enable IP forwarding on client</help> diff --git a/interface-definitions/include/dhcp/option-v6.xml.i b/interface-definitions/include/dhcp/option-v6.xml.i index e1897f52d..c97d652b6 100644 --- a/interface-definitions/include/dhcp/option-v6.xml.i +++ b/interface-definitions/include/dhcp/option-v6.xml.i @@ -7,6 +7,18 @@ #include <include/dhcp/captive-portal.xml.i> #include <include/dhcp/domain-search.xml.i> #include <include/name-server-ipv6.xml.i> + <leafNode name="capwap-controller"> + <properties> + <help>IP address of CAPWAP access controller (Option 52)</help> + <valueHelp> + <format>ipv6</format> + <description>CAPWAP AC controller</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> <leafNode name="nis-domain"> <properties> <help>NIS domain name for client to use</help> @@ -90,6 +102,17 @@ </constraint> </properties> </leafNode> + <leafNode name="time-zone"> + <properties> + <help>Time zone to send to clients. Uses RFC4833 options 41 and 42</help> + <completionHelp> + <script>timedatectl list-timezones</script> + </completionHelp> + <constraint> + <validator name="timezone" argument="--validate"/> + </constraint> + </properties> + </leafNode> <node name="vendor-option"> <properties> <help>Vendor Specific Options</help> diff --git a/interface-definitions/include/dhcp/ping-check.xml.i b/interface-definitions/include/dhcp/ping-check.xml.i new file mode 100644 index 000000000..a506f68e4 --- /dev/null +++ b/interface-definitions/include/dhcp/ping-check.xml.i @@ -0,0 +1,8 @@ +<!-- include start from dhcp/ping-check.xml.i --> +<leafNode name="ping-check"> + <properties> + <help>Sends ICMP Echo request to the address being assigned</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/subnet-id.xml.i b/interface-definitions/include/dhcp/subnet-id.xml.i new file mode 100644 index 000000000..c7e88250d --- /dev/null +++ b/interface-definitions/include/dhcp/subnet-id.xml.i @@ -0,0 +1,14 @@ +<!-- include start from dhcp/subnet-id.xml.i --> +<leafNode name="subnet-id"> + <properties> + <help>Unique ID mapped to leases in the lease file</help> + <valueHelp> + <format>u32:1-4294967294</format> + <description>Unique subnet ID</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967294"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/failover/common-failover.xml.i b/interface-definitions/include/failover/common-failover.xml.i new file mode 100644 index 000000000..b147a0f8d --- /dev/null +++ b/interface-definitions/include/failover/common-failover.xml.i @@ -0,0 +1,105 @@ +<!-- include start from include/failover/common-failover.xml.i --> +<children> + <node name="check"> + <properties> + <help>Check target options</help> + </properties> + <children> + <leafNode name="policy"> + <properties> + <help>Policy for check targets</help> + <completionHelp> + <list>any-available all-available</list> + </completionHelp> + <valueHelp> + <format>all-available</format> + <description>All targets must be alive</description> + </valueHelp> + <valueHelp> + <format>any-available</format> + <description>Any target must be alive</description> + </valueHelp> + <constraint> + <regex>(all-available|any-available)</regex> + </constraint> + </properties> + <defaultValue>any-available</defaultValue> + </leafNode> + #include <include/port-number.xml.i> + <tagNode name="target"> + <properties> + <help>Check target address</help> + <valueHelp> + <format>ipv4</format> + <description>Address to check</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + <children> + #include <include/interface/vrf.xml.i> + #include <include/generic-interface.xml.i> + </children> + </tagNode> + <leafNode name="timeout"> + <properties> + <help>Timeout between checks</help> + <valueHelp> + <format>u32:1-300</format> + <description>Timeout in seconds between checks</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + <defaultValue>10</defaultValue> + </leafNode> + <leafNode name="type"> + <properties> + <help>Check type</help> + <completionHelp> + <list>arp icmp tcp</list> + </completionHelp> + <valueHelp> + <format>arp</format> + <description>Check target by ARP</description> + </valueHelp> + <valueHelp> + <format>icmp</format> + <description>Check target by ICMP</description> + </valueHelp> + <valueHelp> + <format>tcp</format> + <description>Check target by TCP</description> + </valueHelp> + <constraint> + <regex>(arp|icmp|tcp)</regex> + </constraint> + </properties> + <defaultValue>icmp</defaultValue> + </leafNode> + </children> + </node> + #include <include/generic-interface.xml.i> + <leafNode name="metric"> + <properties> + <help>Route metric for this gateway</help> + <valueHelp> + <format>u32:1-255</format> + <description>Route metric</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + <defaultValue>1</defaultValue> + </leafNode> + <leafNode name="onlink"> + <properties> + <help>The next hop is directly connected to the interface, even if it does not match interface prefix</help> + <valueless/> + </properties> + </leafNode> +</children> +<!-- include end --> diff --git a/interface-definitions/include/failover/protocol-common-config.xml.i b/interface-definitions/include/failover/protocol-common-config.xml.i new file mode 100644 index 000000000..56c9d8f90 --- /dev/null +++ b/interface-definitions/include/failover/protocol-common-config.xml.i @@ -0,0 +1,35 @@ +<!-- include start from failover/protocol-common-config.xml.i --> +<tagNode name="route"> + <properties> + <help>Failover IPv4 route</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 failover route</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + <children> + <tagNode name="next-hop"> + <properties> + <help>Next-hop IPv4 router address</help> + <valueHelp> + <format>ipv4</format> + <description>Next-hop router address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + #include <include/failover/common-failover.xml.i> + </tagNode> + <tagNode name="dhcp-interface"> + <properties> + #include <include/dhcp-interface-properties.xml.i> + </properties> + #include <include/failover/common-failover.xml.i> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i index fcc981925..03ac26cf6 100644 --- a/interface-definitions/include/firewall/bridge-hook-forward.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i @@ -32,6 +32,12 @@ #include <include/firewall/state.xml.i> #include <include/firewall/inbound-interface.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/bridge-hook-output.xml.i b/interface-definitions/include/firewall/bridge-hook-output.xml.i index 38b8b08ca..853315989 100644 --- a/interface-definitions/include/firewall/bridge-hook-output.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-output.xml.i @@ -31,6 +31,12 @@ #include <include/firewall/connection-status.xml.i> #include <include/firewall/state.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i index ea567644f..7a45f5cd1 100644 --- a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i @@ -28,6 +28,11 @@ #include <include/firewall/common-rule-bridge.xml.i> #include <include/firewall/action-and-notrack.xml.i> #include <include/firewall/inbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i index e8da1a0e1..85f1071a6 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -27,7 +27,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> <node name="source"> @@ -41,7 +46,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i index 803b94b06..b6c1b13b3 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i @@ -14,8 +14,14 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> <leafNode name="jump-target"> @@ -37,8 +43,14 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i index bb176fe71..65ec415fb 100644 --- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i @@ -16,6 +16,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> <leafNode name="jump-target"> @@ -39,6 +40,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/disable-conntrack.xml.i b/interface-definitions/include/firewall/disable-conntrack.xml.i new file mode 100644 index 000000000..96a692166 --- /dev/null +++ b/interface-definitions/include/firewall/disable-conntrack.xml.i @@ -0,0 +1,8 @@ +<!-- include start from firewall/disable-conntrack.xml.i --> +<leafNode name="disable-conntrack"> + <properties> + <help>Disable conntrack within this chain</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/domain-group.xml.i b/interface-definitions/include/firewall/domain-group.xml.i new file mode 100644 index 000000000..46e00ce09 --- /dev/null +++ b/interface-definitions/include/firewall/domain-group.xml.i @@ -0,0 +1,10 @@ +<!-- include start from firewall/domain-group.xml.i --> +<leafNode name="domain-group"> + <properties> + <help>Group of domains</help> + <completionHelp> + <path>firewall group domain-group</path> + </completionHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/geoip.xml.i b/interface-definitions/include/firewall/geoip.xml.i index 9fb37a574..09b2da663 100644 --- a/interface-definitions/include/firewall/geoip.xml.i +++ b/interface-definitions/include/firewall/geoip.xml.i @@ -7,12 +7,15 @@ <leafNode name="country-code"> <properties> <help>GeoIP country code</help> + <completionHelp> + <list>ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bl bm bn bo bq br bs bt bv bw by bz ca cc cd cf cg ch ci ck cl cm cn co cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg eh er es et fi fj fk fm fo fr ga gb gd ge gf gg gh gi gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in io iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mf mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sj sk sl sm sn so sr ss st sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tv tw tz ua ug um us uy uz va vc ve vg vi vn vu wf ws ye yt za zm zw</list> + </completionHelp> <valueHelp> <format><country></format> - <description>Country code (2 characters)</description> + <description>Country code (2 characters, lowercase)</description> </valueHelp> <constraint> - <regex>^(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)$</regex> + <regex>(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)</regex> </constraint> <multi /> </properties> diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 05fdd75cb..5ff5acfd8 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -49,12 +49,53 @@ <help>Apply configured firewall rules to traffic switched by bridges</help> </properties> <children> - <leafNode name="invalid-connections"> + <node name="accept-invalid"> <properties> - <help>Accept ARP and DHCP despite they are marked as invalid connection</help> - <valueless/> + <help>Accept connections despite they are marked as invalid</help> </properties> - </leafNode> + <children> + <leafNode name="ethernet-type"> + <properties> + <help>Ethernet type</help> + <completionHelp> + <list>arp dhcp pppoe 802.1q 802.1ad pppoe-discovery wol</list> + </completionHelp> + <valueHelp> + <format>arp</format> + <description>Address Resolution Protocol (ARP)</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Dynamic Host Configuration Protocol (DHCP)</description> + </valueHelp> + <valueHelp> + <format>pppoe</format> + <description>Point to Point over Ethernet (PPPoE) Session</description> + </valueHelp> + <valueHelp> + <format>pppoe-discovery</format> + <description>PPPoE Discovery</description> + </valueHelp> + <valueHelp> + <format>802.1q</format> + <description>Customer VLAN tag type (802.1Q)</description> + </valueHelp> + <valueHelp> + <format>802.1ad</format> + <description>Service VLAN tag type (802.1ad)</description> + </valueHelp> + <valueHelp> + <format>wol</format> + <description>Wake-on-LAN magic packet</description> + </valueHelp> + <constraint> + <regex>(arp|dhcp|pppoe|pppoe-discovery|802.1q|802.1ad|wol)</regex> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ipv4"> <properties> <help>Apply configured IPv4 firewall rules</help> @@ -89,6 +130,49 @@ </properties> <defaultValue>enable</defaultValue> </leafNode> + <node name="geoip"> + <properties> + <help>GeoIP options</help> + </properties> + <children> + <leafNode name="provider"> + <properties> + <help>GeoIP database provider</help> + <completionHelp> + <list>db-ip maxmind</list> + </completionHelp> + <valueHelp> + <format>db-ip</format> + <description>Use GeoIP database by DB-IP.com</description> + </valueHelp> + <valueHelp> + <format>maxmind</format> + <description>Use GeoIP database by MaxMind (Requires API key)</description> + </valueHelp> + <constraint> + <regex>(db-ip|maxmind)</regex> + </constraint> + </properties> + <defaultValue>db-ip</defaultValue> + </leafNode> + <leafNode name="maxmind-account-id"> + <properties> + <help>Account ID for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-license-key"> + <properties> + <help>License key for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-lite"> + <properties> + <help>Use MaxMind GeoLite2 database</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ip-src-route"> <properties> <help>Policy for handling IPv4 packets with source route option</help> @@ -217,6 +301,14 @@ <help>Global firewall state-policy</help> </properties> <children> + <node name="offload"> + <properties> + <help>All stateful forward traffic is offloaded to a flowtable</help> + </properties> + <children> + #include <include/firewall/offload-target.xml.i> + </children> + </node> <node name="established"> <properties> <help>Global firewall policy for packets part of an established connection</help> @@ -279,7 +371,7 @@ </node> <leafNode name="twa-hazards-protection"> <properties> - <help>RFC1337 TCP TIME-WAIT assasination hazards protection</help> + <help>RFC1337 TCP TIME-WAIT assassination hazards protection</help> <completionHelp> <list>enable disable</list> </completionHelp> diff --git a/interface-definitions/include/firewall/icmpv6.xml.i b/interface-definitions/include/firewall/icmpv6.xml.i index c0118626e..9631f0012 100644 --- a/interface-definitions/include/firewall/icmpv6.xml.i +++ b/interface-definitions/include/firewall/icmpv6.xml.i @@ -6,7 +6,7 @@ <children> <leafNode name="code"> <properties> - <help>ICMPv6 code</help> + <help>ICMPv6 code field - depends on the message type</help> <valueHelp> <format>u32:0-255</format> <description>ICMPv6 code (0-255)</description> @@ -18,10 +18,14 @@ </leafNode> <leafNode name="type"> <properties> - <help>ICMPv6 type</help> + <help>ICMPv6 message type</help> <valueHelp> - <format>u32:0-255</format> - <description>ICMPv6 type (0-255)</description> + <format>u32:0-127</format> + <description>ICMPv6 error message</description> + </valueHelp> + <valueHelp> + <format>u32:128-255</format> + <description>ICMPv6 information message</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> diff --git a/interface-definitions/include/firewall/ipv4-custom-name.xml.i b/interface-definitions/include/firewall/ipv4-custom-name.xml.i index 8046b2d6c..b08262e2d 100644 --- a/interface-definitions/include/firewall/ipv4-custom-name.xml.i +++ b/interface-definitions/include/firewall/ipv4-custom-name.xml.i @@ -36,6 +36,12 @@ #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/offload-target.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> + </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i index b0e240a03..8f04d6739 100644 --- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> @@ -31,6 +32,11 @@ #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/offload-target.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i index 491d1a9f3..64366eac0 100644 --- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i index ee9157592..14ea1073b 100644 --- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> @@ -28,6 +29,11 @@ #include <include/firewall/common-rule-ipv4.xml.i> #include <include/firewall/match-ipsec-out.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> </children> </tagNode> </children> @@ -56,6 +62,11 @@ #include <include/firewall/common-rule-ipv4-raw.xml.i> #include <include/firewall/match-ipsec-out.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i index b431303ae..6f9fe6842 100644 --- a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i @@ -35,6 +35,10 @@ #include <include/firewall/common-rule-ipv4-raw.xml.i> #include <include/firewall/match-ipsec-in.xml.i> #include <include/firewall/inbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-ttl.xml.i> <leafNode name="jump-target"> <properties> <help>Set jump target. Action jump must be defined to use this setting</help> diff --git a/interface-definitions/include/firewall/ipv6-custom-name.xml.i b/interface-definitions/include/firewall/ipv6-custom-name.xml.i index fb8740c38..d49267b52 100644 --- a/interface-definitions/include/firewall/ipv6-custom-name.xml.i +++ b/interface-definitions/include/firewall/ipv6-custom-name.xml.i @@ -36,6 +36,11 @@ #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/offload-target.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i index 7efc2614e..0319c915a 100644 --- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> @@ -31,6 +32,11 @@ #include <include/firewall/match-ipsec.xml.i> #include <include/firewall/offload-target.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i index 154b10259..ae78f8910 100644 --- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i index d3c4c1ead..96976b4a8 100644 --- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> @@ -28,6 +29,11 @@ #include <include/firewall/common-rule-ipv6.xml.i> #include <include/firewall/match-ipsec-out.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> @@ -56,6 +62,11 @@ #include <include/firewall/common-rule-ipv6-raw.xml.i> #include <include/firewall/match-ipsec-out.xml.i> #include <include/firewall/outbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-conn-mark.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i index 21f8de6f9..15454bbbf 100644 --- a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i @@ -35,6 +35,10 @@ #include <include/firewall/common-rule-ipv6-raw.xml.i> #include <include/firewall/match-ipsec-in.xml.i> #include <include/firewall/inbound-interface.xml.i> + #include <include/firewall/set-packet-modifications-dscp.xml.i> + #include <include/firewall/set-packet-modifications-mark.xml.i> + #include <include/firewall/set-packet-modifications-tcp-mss.xml.i> + #include <include/firewall/set-packet-modifications-hop-limit.xml.i> <leafNode name="jump-target"> <properties> <help>Set jump target. Action jump must be defined to use this setting</help> diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i index abfa9034d..536e59bb3 100644 --- a/interface-definitions/include/firewall/match-ether-type.xml.i +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -15,7 +15,7 @@ </valueHelp> <valueHelp> <format>arp</format> - <description>Adress Resolution Protocol</description> + <description>Address Resolution Protocol</description> </valueHelp> <valueHelp> <format>_ipv4</format> diff --git a/interface-definitions/include/firewall/port-group.xml.i b/interface-definitions/include/firewall/port-group.xml.i new file mode 100644 index 000000000..297f0d781 --- /dev/null +++ b/interface-definitions/include/firewall/port-group.xml.i @@ -0,0 +1,10 @@ + <!-- include start from firewall/port-group.xml.i --> + <leafNode name="port-group"> + <properties> + <help>Group of ports</help> + <completionHelp> + <path>firewall group port-group</path> + </completionHelp> + </properties> + </leafNode> + <!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i b/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i new file mode 100644 index 000000000..dff95d324 --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-conn-mark.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="connection-mark"> + <properties> + <help>Set connection mark</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Connection mark</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i b/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i new file mode 100644 index 000000000..5082806fb --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-dscp.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="dscp"> + <properties> + <help>Set DSCP (Packet Differentiated Services Codepoint) bits</help> + <valueHelp> + <format>u32:0-63</format> + <description>DSCP number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-63"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i b/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i new file mode 100755 index 000000000..8a6e5347a --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-hop-limit.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="hop-limit"> + <properties> + <help>Set hop limit</help> + <valueHelp> + <format>u32:0-255</format> + <description>Hop limit number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i b/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i new file mode 100644 index 000000000..b229d0579 --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-mark.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="mark"> + <properties> + <help>Set packet mark</help> + <valueHelp> + <format>u32:1-2147483647</format> + <description>Packet mark</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-2147483647"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i b/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i new file mode 100644 index 000000000..5eb1984a5 --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i @@ -0,0 +1,31 @@ +<!-- include start from firewall/set-packet-modifications-table-and-vrf.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="table"> + <properties> + <help>Set the routing table for matched packets</help> + <valueHelp> + <format>u32:1-200</format> + <description>Table number</description> + </valueHelp> + <valueHelp> + <format>main</format> + <description>Main table</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-200"/> + <regex>(main)</regex> + </constraint> + <completionHelp> + <list>main</list> + <path>protocols static table</path> + </completionHelp> + </properties> + </leafNode> + #include <include/firewall/vrf.xml.i> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i b/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i new file mode 100644 index 000000000..06ffdfede --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-tcp-mss.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="tcp-mss"> + <properties> + <help>Set TCP Maximum Segment Size</help> + <valueHelp> + <format>u32:500-1460</format> + <description>Explicitly set TCP MSS value</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 500-1460"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i b/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i new file mode 100755 index 000000000..e2f14050b --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i @@ -0,0 +1,21 @@ +<!-- include start from firewall/set-packet-modifications-ttl.xml.i --> +<node name="set"> + <properties> + <help>Packet modifications</help> + </properties> + <children> + <leafNode name="ttl"> + <properties> + <help>Set TTL (time to live)</help> + <valueHelp> + <format>u32:0-255</format> + <description>TTL number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/set-packet-modifications.xml.i b/interface-definitions/include/firewall/set-packet-modifications.xml.i deleted file mode 100644 index ee019b64e..000000000 --- a/interface-definitions/include/firewall/set-packet-modifications.xml.i +++ /dev/null @@ -1,96 +0,0 @@ -<!-- include start from firewall/set-packet-modifications.xml.i --> -<node name="set"> - <properties> - <help>Packet modifications</help> - </properties> - <children> - <leafNode name="connection-mark"> - <properties> - <help>Set connection mark</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Connection mark</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - </leafNode> - <leafNode name="dscp"> - <properties> - <help>Set DSCP (Packet Differentiated Services Codepoint) bits</help> - <valueHelp> - <format>u32:0-63</format> - <description>DSCP number</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-63"/> - </constraint> - </properties> - </leafNode> - <leafNode name="mark"> - <properties> - <help>Set packet mark</help> - <valueHelp> - <format>u32:1-2147483647</format> - <description>Packet mark</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-2147483647"/> - </constraint> - </properties> - </leafNode> - <leafNode name="table"> - <properties> - <help>Set the routing table for matched packets</help> - <valueHelp> - <format>u32:1-200</format> - <description>Table number</description> - </valueHelp> - <valueHelp> - <format>main</format> - <description>Main table</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-200"/> - <regex>(main)</regex> - </constraint> - <completionHelp> - <list>main</list> - <path>protocols static table</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="vrf"> - <properties> - <help>VRF to forward packet with</help> - <valueHelp> - <format>txt</format> - <description>VRF instance name</description> - </valueHelp> - <valueHelp> - <format>default</format> - <description>Forward into default global VRF</description> - </valueHelp> - <completionHelp> - <list>default</list> - <path>vrf name</path> - </completionHelp> - #include <include/constraint/vrf.xml.i> - </properties> - </leafNode> - <leafNode name="tcp-mss"> - <properties> - <help>Set TCP Maximum Segment Size</help> - <valueHelp> - <format>u32:500-1460</format> - <description>Explicitly set TCP MSS value</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 500-1460"/> - </constraint> - </properties> - </leafNode> - </children> -</node> -<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/firewall/source-destination-group-inet.xml.i b/interface-definitions/include/firewall/source-destination-group-inet.xml.i index 174051624..775fda9b3 100644 --- a/interface-definitions/include/firewall/source-destination-group-inet.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-inet.xml.i @@ -20,7 +20,6 @@ </completionHelp> </properties> </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="ipv4-network-group"> <properties> <help>Group of IPv4 networks</help> @@ -37,14 +36,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i index 8c34fb933..ccee5b247 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i @@ -12,14 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -28,14 +20,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i index 2a42d236c..43a9e9cf5 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i @@ -12,15 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -29,14 +20,9 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i deleted file mode 100644 index 6ebee356c..000000000 --- a/interface-definitions/include/firewall/source-destination-group.xml.i +++ /dev/null @@ -1,42 +0,0 @@ -<!-- include start from firewall/source-destination-group.xml.i --> -<node name="group"> - <properties> - <help>Group</help> - </properties> - <children> - <leafNode name="address-group"> - <properties> - <help>Group of addresses</help> - <completionHelp> - <path>firewall group address-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> - <leafNode name="network-group"> - <properties> - <help>Group of networks</help> - <completionHelp> - <path>firewall group network-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-remote-group.xml.i b/interface-definitions/include/firewall/source-destination-remote-group.xml.i new file mode 100644 index 000000000..16463c8eb --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-remote-group.xml.i @@ -0,0 +1,17 @@ +<!-- include start from firewall/source-destination-remote-group.xml.i --> +<node name="group"> + <properties> + <help>Group</help> + </properties> + <children> + <leafNode name="remote-group"> + <properties> + <help>Group of remote addresses</help> + <completionHelp> + <path>firewall group remote-group</path> + </completionHelp> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/firewall/vrf.xml.i b/interface-definitions/include/firewall/vrf.xml.i new file mode 100644 index 000000000..af8ce3ab4 --- /dev/null +++ b/interface-definitions/include/firewall/vrf.xml.i @@ -0,0 +1,20 @@ +<!-- include start from firewall/vrf.xml.i --> +<leafNode name="vrf"> + <properties> + <help>VRF to forward packet with</help> + <valueHelp> + <format>txt</format> + <description>VRF instance name</description> + </valueHelp> + <valueHelp> + <format>default</format> + <description>Forward into default global VRF</description> + </valueHelp> + <completionHelp> + <list>default</list> + <path>vrf name</path> + </completionHelp> + #include <include/constraint/vrf.xml.i> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/generic-interface-broadcast.xml.i b/interface-definitions/include/generic-interface-broadcast.xml.i index e37e75012..52a4a2717 100644 --- a/interface-definitions/include/generic-interface-broadcast.xml.i +++ b/interface-definitions/include/generic-interface-broadcast.xml.i @@ -1,7 +1,7 @@ <!-- include start from generic-interface-broadcast.xml.i --> <leafNode name="interface"> <properties> - <help>Interface to use</help> + <help>Interface</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces --broadcast</script> </completionHelp> diff --git a/interface-definitions/include/generic-interface-multi-broadcast.xml.i b/interface-definitions/include/generic-interface-multi-broadcast.xml.i index ed13cf2cf..65ca1ffab 100644 --- a/interface-definitions/include/generic-interface-multi-broadcast.xml.i +++ b/interface-definitions/include/generic-interface-multi-broadcast.xml.i @@ -1,7 +1,7 @@ <!-- include start from generic-interface-multi-broadcast.xml.i --> <leafNode name="interface"> <properties> - <help>Interface to use</help> + <help>Interface</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces --broadcast</script> </completionHelp> diff --git a/interface-definitions/include/generic-interface-multi-wildcard.xml.i b/interface-definitions/include/generic-interface-multi-wildcard.xml.i index 6c846a795..cd65028ac 100644 --- a/interface-definitions/include/generic-interface-multi-wildcard.xml.i +++ b/interface-definitions/include/generic-interface-multi-wildcard.xml.i @@ -1,7 +1,7 @@ <!-- include start from generic-interface-multi-wildcard.xml.i --> <leafNode name="interface"> <properties> - <help>Interface to use</help> + <help>Interface</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> diff --git a/interface-definitions/include/generic-interface-multi.xml.i b/interface-definitions/include/generic-interface-multi.xml.i index cfc77af3a..a4329cba7 100644 --- a/interface-definitions/include/generic-interface-multi.xml.i +++ b/interface-definitions/include/generic-interface-multi.xml.i @@ -1,7 +1,7 @@ <!-- include start from generic-interface-multi.xml.i --> <leafNode name="interface"> <properties> - <help>Interface to use</help> + <help>Interface</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> diff --git a/interface-definitions/include/generic-interface.xml.i b/interface-definitions/include/generic-interface.xml.i index 65f5bfbb8..cf6fb9151 100644 --- a/interface-definitions/include/generic-interface.xml.i +++ b/interface-definitions/include/generic-interface.xml.i @@ -1,7 +1,7 @@ <!-- include start from generic-interface.xml.i --> <leafNode name="interface"> <properties> - <help>Interface to use</help> + <help>Interface</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> diff --git a/interface-definitions/include/generic-password.xml.i b/interface-definitions/include/generic-password.xml.i index 76d5f12d8..0048e5173 100644 --- a/interface-definitions/include/generic-password.xml.i +++ b/interface-definitions/include/generic-password.xml.i @@ -7,9 +7,9 @@ <description>Password</description> </valueHelp> <constraint> - <regex>[[:ascii:]]{1,128}</regex> + <regex>[[:ascii:]]{1,512}</regex> </constraint> - <constraintErrorMessage>Password is limited to ASCII characters only, with a total length of 128</constraintErrorMessage> + <constraintErrorMessage>Password is limited to ASCII characters only, with a total length of 512</constraintErrorMessage> </properties> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/haproxy/listen-address.xml.i b/interface-definitions/include/haproxy/listen-address.xml.i new file mode 100644 index 000000000..785b46117 --- /dev/null +++ b/interface-definitions/include/haproxy/listen-address.xml.i @@ -0,0 +1,30 @@ +<!-- include start from haproxy/listen-address.xml.i --> +<tagNode name="listen-address"> + <properties> + <help>Local IP addresses to listen on</help> + <completionHelp> + <script>${vyos_completion_dir}/list_local_ips.sh --both</script> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address to listen for incoming connections</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address to listen for incoming connections</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="ipv6-link-local"/> + </constraint> + </properties> + <children> + <leafNode name="accept-proxy"> + <properties> + <help>Accept PROXY protocol</help> + <valueless/> + </properties> + </leafNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/logging.xml.i b/interface-definitions/include/haproxy/logging.xml.i index e0af54fa4..315c959bf 100644 --- a/interface-definitions/include/haproxy/logging.xml.i +++ b/interface-definitions/include/haproxy/logging.xml.i @@ -4,7 +4,137 @@ <help>Logging parameters</help> </properties> <children> - #include <include/syslog-facility.xml.i> + <tagNode name="facility"> + <properties> + <help>Facility for logging</help> + <completionHelp> + <list>auth cron daemon kern lpr mail news syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7</list> + </completionHelp> + <constraint> + <regex>(auth|cron|daemon|kern|lpr|mail|news|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7)</regex> + </constraint> + <constraintErrorMessage>Invalid facility type</constraintErrorMessage> + <valueHelp> + <format>auth</format> + <description>Authentication and authorization</description> + </valueHelp> + <valueHelp> + <format>cron</format> + <description>Cron daemon</description> + </valueHelp> + <valueHelp> + <format>daemon</format> + <description>System daemons</description> + </valueHelp> + <valueHelp> + <format>kern</format> + <description>Kernel</description> + </valueHelp> + <valueHelp> + <format>lpr</format> + <description>Line printer spooler</description> + </valueHelp> + <valueHelp> + <format>mail</format> + <description>Mail subsystem</description> + </valueHelp> + <valueHelp> + <format>news</format> + <description>USENET subsystem</description> + </valueHelp> + <valueHelp> + <format>syslog</format> + <description>Authentication and authorization</description> + </valueHelp> + <valueHelp> + <format>user</format> + <description>Application processes</description> + </valueHelp> + <valueHelp> + <format>uucp</format> + <description>UUCP subsystem</description> + </valueHelp> + <valueHelp> + <format>local0</format> + <description>Local facility 0</description> + </valueHelp> + <valueHelp> + <format>local1</format> + <description>Local facility 1</description> + </valueHelp> + <valueHelp> + <format>local2</format> + <description>Local facility 2</description> + </valueHelp> + <valueHelp> + <format>local3</format> + <description>Local facility 3</description> + </valueHelp> + <valueHelp> + <format>local4</format> + <description>Local facility 4</description> + </valueHelp> + <valueHelp> + <format>local5</format> + <description>Local facility 5</description> + </valueHelp> + <valueHelp> + <format>local6</format> + <description>Local facility 6</description> + </valueHelp> + <valueHelp> + <format>local7</format> + <description>Local facility 7</description> + </valueHelp> + </properties> + <children> + <leafNode name="level"> + <properties> + <help>Logging level</help> + <completionHelp> + <list>emerg alert crit err warning notice info debug</list> + </completionHelp> + <valueHelp> + <format>emerg</format> + <description>Emergency messages</description> + </valueHelp> + <valueHelp> + <format>alert</format> + <description>Urgent messages</description> + </valueHelp> + <valueHelp> + <format>crit</format> + <description>Critical messages</description> + </valueHelp> + <valueHelp> + <format>err</format> + <description>Error messages</description> + </valueHelp> + <valueHelp> + <format>warning</format> + <description>Warning messages</description> + </valueHelp> + <valueHelp> + <format>notice</format> + <description>Messages for further investigation</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational messages</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug messages</description> + </valueHelp> + <constraint> + <regex>(emerg|alert|crit|err|warning|notice|info|debug)</regex> + </constraint> + <constraintErrorMessage>Invalid loglevel</constraintErrorMessage> + </properties> + <defaultValue>err</defaultValue> + </leafNode> + </children> + </tagNode> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/haproxy/rule-backend.xml.i b/interface-definitions/include/haproxy/rule-backend.xml.i index b2be4fde4..20263c23c 100644 --- a/interface-definitions/include/haproxy/rule-backend.xml.i +++ b/interface-definitions/include/haproxy/rule-backend.xml.i @@ -12,19 +12,7 @@ <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage> </properties> <children> - <leafNode name="domain-name"> - <properties> - <help>Domain name to match</help> - <valueHelp> - <format>txt</format> - <description>Domain address to match</description> - </valueHelp> - <constraint> - <validator name="fqdn"/> - </constraint> - <multi/> - </properties> - </leafNode> + #include <include/haproxy/rule-match-domain.xml.i> <node name="set"> <properties> <help>Proxy modifications</help> @@ -38,7 +26,7 @@ <description>Set URL location</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> </properties> @@ -47,7 +35,7 @@ <properties> <help>Server name</help> <constraint> - <regex>[-_a-zA-Z0-9]+</regex> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> </constraint> <constraintErrorMessage>Server name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> </properties> @@ -90,7 +78,7 @@ <description>Begin URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -104,7 +92,7 @@ <description>End URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -118,7 +106,7 @@ <description>Exactly URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]*$</regex> + <regex>\/[\w\-.\/]*</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> diff --git a/interface-definitions/include/haproxy/rule-frontend.xml.i b/interface-definitions/include/haproxy/rule-frontend.xml.i index 001ae2d80..6237fd44b 100644 --- a/interface-definitions/include/haproxy/rule-frontend.xml.i +++ b/interface-definitions/include/haproxy/rule-frontend.xml.i @@ -12,19 +12,7 @@ <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage> </properties> <children> - <leafNode name="domain-name"> - <properties> - <help>Domain name to match</help> - <valueHelp> - <format>txt</format> - <description>Domain address to match</description> - </valueHelp> - <constraint> - <validator name="fqdn"/> - </constraint> - <multi/> - </properties> - </leafNode> + #include <include/haproxy/rule-match-domain.xml.i> <node name="set"> <properties> <help>Proxy modifications</help> @@ -32,24 +20,27 @@ <children> <leafNode name="redirect-location"> <properties> - <help>Set URL location</help> + <help>Set path location</help> <valueHelp> <format>url</format> - <description>Set URL location</description> + <description>Set path location</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> - <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> + <constraintErrorMessage>Incorrect path format</constraintErrorMessage> </properties> </leafNode> <leafNode name="backend"> <properties> <help>Backend name</help> <constraint> - <regex>[-_a-zA-Z0-9]+</regex> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> </constraint> <constraintErrorMessage>Server name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> + <completionHelp> + <path>load-balancing haproxy backend</path> + </completionHelp> </properties> </leafNode> </children> @@ -90,7 +81,7 @@ <description>Begin URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -104,7 +95,7 @@ <description>End URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -118,7 +109,7 @@ <description>Exactly URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> diff --git a/interface-definitions/include/haproxy/rule-match-domain.xml.i b/interface-definitions/include/haproxy/rule-match-domain.xml.i new file mode 100644 index 000000000..2ec61a940 --- /dev/null +++ b/interface-definitions/include/haproxy/rule-match-domain.xml.i @@ -0,0 +1,21 @@ +<!-- include start from haproxy/rule-match-domain.xml.i --> +<leafNode name="domain-name"> + <properties> + <help>Domain name to match</help> + <valueHelp> + <format>txt</format> + <description>Domain address to match</description> + </valueHelp> + <constraint> + <validator name="fqdn"/> + </constraint> + <multi/> + </properties> +</leafNode> +<leafNode name="wildcard-domain"> + <properties> + <help>Match subdomains of specified domain(s)</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/timeout-check.xml.i b/interface-definitions/include/haproxy/timeout-check.xml.i new file mode 100644 index 000000000..d1217fac3 --- /dev/null +++ b/interface-definitions/include/haproxy/timeout-check.xml.i @@ -0,0 +1,14 @@ +<!-- include start from haproxy/timeout-check.xml.i --> +<leafNode name="check"> + <properties> + <help>Timeout in seconds for established connections</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Check timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/timeout-client.xml.i b/interface-definitions/include/haproxy/timeout-client.xml.i new file mode 100644 index 000000000..2250ccdef --- /dev/null +++ b/interface-definitions/include/haproxy/timeout-client.xml.i @@ -0,0 +1,14 @@ +<!-- include start from haproxy/timeout-client.xml.i --> +<leafNode name="client"> + <properties> + <help>Maximum inactivity time on the client side</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/timeout-connect.xml.i b/interface-definitions/include/haproxy/timeout-connect.xml.i new file mode 100644 index 000000000..da4f983af --- /dev/null +++ b/interface-definitions/include/haproxy/timeout-connect.xml.i @@ -0,0 +1,14 @@ +<!-- include start from haproxy/timeout-connect.xml.i --> +<leafNode name="connect"> + <properties> + <help>Set the maximum time to wait for a connection attempt to a server to succeed</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Connect timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/timeout-server.xml.i b/interface-definitions/include/haproxy/timeout-server.xml.i new file mode 100644 index 000000000..f27d415c1 --- /dev/null +++ b/interface-definitions/include/haproxy/timeout-server.xml.i @@ -0,0 +1,14 @@ +<!-- include start from haproxy/timeout-server.xml.i --> +<leafNode name="server"> + <properties> + <help>Set the maximum inactivity time on the server side</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Server timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/timeout.xml.i b/interface-definitions/include/haproxy/timeout.xml.i index 79e7303b1..a3a5a8a3e 100644 --- a/interface-definitions/include/haproxy/timeout.xml.i +++ b/interface-definitions/include/haproxy/timeout.xml.i @@ -4,42 +4,9 @@ <help>Timeout options</help> </properties> <children> - <leafNode name="check"> - <properties> - <help>Timeout in seconds for established connections</help> - <valueHelp> - <format>u32:1-3600</format> - <description>Check timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-3600"/> - </constraint> - </properties> - </leafNode> - <leafNode name="connect"> - <properties> - <help>Set the maximum time to wait for a connection attempt to a server to succeed</help> - <valueHelp> - <format>u32:1-3600</format> - <description>Connect timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-3600"/> - </constraint> - </properties> - </leafNode> - <leafNode name="server"> - <properties> - <help>Set the maximum inactivity time on the server side</help> - <valueHelp> - <format>u32:1-3600</format> - <description>Server timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-3600"/> - </constraint> - </properties> - </leafNode> + #include <include/haproxy/timeout-check.xml.i> + #include <include/haproxy/timeout-connect.xml.i> + #include <include/haproxy/timeout-server.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i b/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i index 5057ed9ae..6e96185e7 100644 --- a/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i +++ b/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i @@ -22,7 +22,7 @@ <description>Dynamic Host Configuration Protocol for IPv6</description> </valueHelp> <constraint> - <validator name="ip-host"/> + <validator name="interface-address"/> <regex>(dhcp|dhcpv6)</regex> </constraint> <multi/> diff --git a/interface-definitions/include/interface/address-ipv4-ipv6.xml.i b/interface-definitions/include/interface/address-ipv4-ipv6.xml.i index d689da5aa..48802c4dc 100644 --- a/interface-definitions/include/interface/address-ipv4-ipv6.xml.i +++ b/interface-definitions/include/interface/address-ipv4-ipv6.xml.i @@ -11,7 +11,7 @@ <description>IPv6 address and prefix length</description> </valueHelp> <constraint> - <validator name="ip-host"/> + <validator name="interface-address"/> </constraint> <multi/> </properties> diff --git a/interface-definitions/include/interface/arp-cache-timeout.xml.i b/interface-definitions/include/interface/arp-cache-timeout.xml.i index 06d7ffe96..f3cbac24d 100644 --- a/interface-definitions/include/interface/arp-cache-timeout.xml.i +++ b/interface-definitions/include/interface/arp-cache-timeout.xml.i @@ -4,7 +4,7 @@ <help>ARP cache entry timeout in seconds</help> <valueHelp> <format>u32:1-86400</format> - <description>ARP cache entry timout in seconds</description> + <description>ARP cache entry timeout in seconds</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 1-86400"/> diff --git a/interface-definitions/include/interface/default-route-distance.xml.i b/interface-definitions/include/interface/default-route-distance.xml.i index 6eda52c91..7a226a538 100644 --- a/interface-definitions/include/interface/default-route-distance.xml.i +++ b/interface-definitions/include/interface/default-route-distance.xml.i @@ -4,7 +4,7 @@ <help>Distance for installed default route</help> <valueHelp> <format>u32:1-255</format> - <description>Distance for the default route from DHCP server</description> + <description>Distance for the default route received from the server</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 1-255"/> diff --git a/interface-definitions/include/interface/dhcpv6-options.xml.i b/interface-definitions/include/interface/dhcpv6-options.xml.i index 68d1b172f..2dc0c0aaa 100644 --- a/interface-definitions/include/interface/dhcpv6-options.xml.i +++ b/interface-definitions/include/interface/dhcpv6-options.xml.i @@ -11,6 +11,18 @@ <valueless/> </properties> </leafNode> + <leafNode name="no-request-domain-name"> + <properties> + <help>Do not request domain name</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="no-request-dns"> + <properties> + <help>Do not request DNS servers</help> + <valueless/> + </properties> + </leafNode> <tagNode name="pd"> <properties> <help>DHCPv6 prefix delegation interface statement</help> @@ -42,6 +54,13 @@ <completionHelp> <script>${vyos_completion_dir}/list_interfaces --broadcast</script> </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> </properties> <children> <leafNode name="address"> diff --git a/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i b/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i new file mode 100644 index 000000000..d173dfdb8 --- /dev/null +++ b/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i @@ -0,0 +1,15 @@ +<!-- include start from interface/ipv6-address-interface-identifier.xml.i --> +<leafNode name="interface-identifier"> + <properties> + <help>SLAAC interface identifier</help> + <valueHelp> + <format>::h:h:h:h</format> + <description>Interface identifier</description> + </valueHelp> + <constraint> + <regex>::([0-9a-fA-F]{1,4}(:[0-9a-fA-F]{1,4}){0,3})</regex> + </constraint> + <constraintErrorMessage>Interface identifier format must start with :: and may contain up four hextets (::h:h:h:h)</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/interface/ipv6-address.xml.i b/interface-definitions/include/interface/ipv6-address.xml.i deleted file mode 100644 index e1bdf02fd..000000000 --- a/interface-definitions/include/interface/ipv6-address.xml.i +++ /dev/null @@ -1,12 +0,0 @@ -<!-- include start from interface/ipv6-address.xml.i --> -<node name="address"> - <properties> - <help>IPv6 address configuration modes</help> - </properties> - <children> - #include <include/interface/ipv6-address-autoconf.xml.i> - #include <include/interface/ipv6-address-eui64.xml.i> - #include <include/interface/ipv6-address-no-default-link-local.xml.i> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i b/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i index 3b9294dd0..82bf52876 100644 --- a/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i +++ b/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i @@ -4,7 +4,7 @@ <help>Number of NS messages to send while performing DAD</help> <valueHelp> <format>u32:0</format> - <description>Disable Duplicate Address Dectection (DAD)</description> + <description>Disable Duplicate Address Detection (DAD)</description> </valueHelp> <valueHelp> <format>u32:1-n</format> diff --git a/interface-definitions/include/interface/ipv6-options-with-nd.xml.i b/interface-definitions/include/interface/ipv6-options-with-nd.xml.i new file mode 100644 index 000000000..5894104b3 --- /dev/null +++ b/interface-definitions/include/interface/ipv6-options-with-nd.xml.i @@ -0,0 +1,9 @@ + <node name="ipv6"> + <children> + <node name="address"> + <children> + #include <include/interface/ipv6-address-interface-identifier.xml.i> + </children> + </node> + </children> + </node> diff --git a/interface-definitions/include/interface/ipv6-options.xml.i b/interface-definitions/include/interface/ipv6-options.xml.i index ec6ec64ee..f84a9f2cd 100644 --- a/interface-definitions/include/interface/ipv6-options.xml.i +++ b/interface-definitions/include/interface/ipv6-options.xml.i @@ -8,9 +8,18 @@ #include <include/interface/base-reachable-time.xml.i> #include <include/interface/disable-forwarding.xml.i> #include <include/interface/ipv6-accept-dad.xml.i> - #include <include/interface/ipv6-address.xml.i> #include <include/interface/ipv6-dup-addr-detect-transmits.xml.i> #include <include/interface/source-validation.xml.i> + <node name="address"> + <properties> + <help>IPv6 address configuration modes</help> + </properties> + <children> + #include <include/interface/ipv6-address-autoconf.xml.i> + #include <include/interface/ipv6-address-eui64.xml.i> + #include <include/interface/ipv6-address-no-default-link-local.xml.i> + </children> + </node> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/interface/vif-s.xml.i b/interface-definitions/include/interface/vif-s.xml.i index 02e7ab057..65ca10207 100644 --- a/interface-definitions/include/interface/vif-s.xml.i +++ b/interface-definitions/include/interface/vif-s.xml.i @@ -21,6 +21,7 @@ #include <include/interface/vlan-protocol.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> @@ -41,6 +42,7 @@ #include <include/interface/disable.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/include/interface/vif.xml.i b/interface-definitions/include/interface/vif.xml.i index ec3921bf6..87f91c5ce 100644 --- a/interface-definitions/include/interface/vif.xml.i +++ b/interface-definitions/include/interface/vif.xml.i @@ -46,6 +46,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/include/ip-address.xml.i b/interface-definitions/include/ip-address.xml.i new file mode 100644 index 000000000..6027e97ee --- /dev/null +++ b/interface-definitions/include/ip-address.xml.i @@ -0,0 +1,14 @@ +<!-- include start from ip-address.xml.i --> +<leafNode name="ip-address"> + <properties> + <help>Fixed IP address of static mapping</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address used in static mapping</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/ipsec/childless.xml.i b/interface-definitions/include/ipsec/childless.xml.i new file mode 100644 index 000000000..76ba8d548 --- /dev/null +++ b/interface-definitions/include/ipsec/childless.xml.i @@ -0,0 +1,29 @@ +<!-- include start from ipsec/childless.xml.i --> +<leafNode name="childless"> + <properties> + <help>Enable support for childless IKE SA initiation</help> + <completionHelp> + <list>allow prefer force never</list> + </completionHelp> + <valueHelp> + <format>allow</format> + <description>Accept childless IKE SA in responder mode. Create regular IKE SA in initiator mode</description> + </valueHelp> + <valueHelp> + <format>prefer</format> + <description>In both responder and initiator modes, accept and create childless IKE SA correspondingly</description> + </valueHelp> + <valueHelp> + <format>force</format> + <description>Require the use of childless IKE SA in both responder and initiator modes</description> + </valueHelp> + <valueHelp> + <format>never</format> + <description>Disable support for childless IKE SAs when acting as a responder</description> + </valueHelp> + <constraint> + <regex>(allow|prefer|force|never)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/ipsec/ppk.xml.i b/interface-definitions/include/ipsec/ppk.xml.i new file mode 100644 index 000000000..bd420766c --- /dev/null +++ b/interface-definitions/include/ipsec/ppk.xml.i @@ -0,0 +1,24 @@ +<!-- include start from ipsec/ppk.xml.i --> +<node name="ppk"> + <properties> + <help>Post-quantum preshared key</help> + </properties> + <children> + <leafNode name="id"> + <properties> + <help>Post-quantum preshared key for this connection</help> + <valueHelp> + <format>txt</format> + <description>ID used for PPK</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="required"> + <properties> + <help>Require a valid PPK for connection to establish</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/isis/exclude-interface.xml.i b/interface-definitions/include/isis/exclude-interface.xml.i new file mode 100644 index 000000000..87399b43f --- /dev/null +++ b/interface-definitions/include/isis/exclude-interface.xml.i @@ -0,0 +1,10 @@ +<!-- include start from isis/exclude-interface.xml.i --> +<node name="exclude"> + <properties> + <help>Exclude interfaces from fast reroute</help> + </properties> + <children> + #include <include/generic-interface-multi.xml.i> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/frr-maxmetric.xml.i b/interface-definitions/include/isis/frr-maxmetric.xml.i new file mode 100644 index 000000000..2e1cad19d --- /dev/null +++ b/interface-definitions/include/isis/frr-maxmetric.xml.i @@ -0,0 +1,14 @@ +<!-- include start from isis/frr-maxmetric.xml.i --> +<leafNode name="maximum-metric"> + <properties> + <help>Limit remote LFA node selection within the metric</help> + <valueHelp> + <format>u32:1-16777215</format> + <description>Metric value</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16777215"/> + </constraint> + </properties> +</leafNode> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/node-protection.xml.i b/interface-definitions/include/isis/node-protection.xml.i new file mode 100644 index 000000000..2dda81c0c --- /dev/null +++ b/interface-definitions/include/isis/node-protection.xml.i @@ -0,0 +1,15 @@ +<!-- include start from isis/node-protection.xml.i --> +<node name="node-protection"> + <properties> + <help>Protect against node failures</help> + </properties> + <children> + <leafNode name="link-fallback"> + <properties> + <help>Enable link-protection fallback</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/protocol-common-config.xml.i b/interface-definitions/include/isis/protocol-common-config.xml.i index 35ce80be9..6a7388c99 100644 --- a/interface-definitions/include/isis/protocol-common-config.xml.i +++ b/interface-definitions/include/isis/protocol-common-config.xml.i @@ -98,6 +98,7 @@ <validator name="numeric" argument="--range 1-120"/> </constraint> </properties> + <defaultValue>30</defaultValue> </leafNode> <leafNode name="lsp-mtu"> <properties> @@ -116,13 +117,14 @@ <properties> <help>LSP refresh interval</help> <valueHelp> - <format>u32:1-65235</format> + <format>u32:2-65235</format> <description>LSP refresh interval in seconds</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-65235"/> + <validator name="numeric" argument="--range 2-65235"/> </constraint> </properties> + <defaultValue>900</defaultValue> </leafNode> <leafNode name="max-lsp-lifetime"> <properties> @@ -135,6 +137,7 @@ <validator name="numeric" argument="--range 1-65535"/> </constraint> </properties> + <defaultValue>1200</defaultValue> </leafNode> <leafNode name="metric-style"> <properties> @@ -266,6 +269,12 @@ </constraint> </properties> </leafNode> + <leafNode name="export"> + <properties> + <help>Export Traffic Engineering Database, see options under protocols traffic-engineering</help> + <valueless/> + </properties> + </leafNode> </children> </node> <node name="segment-routing"> @@ -275,7 +284,7 @@ <children> <node name="global-block"> <properties> - <help>Segment Routing Global Block label range</help> + <help>Segment-Routing Global Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -283,7 +292,7 @@ </node> <node name="local-block"> <properties> - <help>Segment Routing Local Block label range</help> + <help>Segment-Routing Local Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -382,6 +391,94 @@ </node> </children> </tagNode> + <node name="srv6"> + <properties> + <help>Segment-Routing over IPv6 (SRv6) configuration</help> + </properties> + <children> + <leafNode name="locator"> + <properties> + <help>Specify SRv6 locator</help> + <valueHelp> + <format>txt</format> + <description>SRv6 locator name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_srv6_locators.sh</script> + </completionHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + </properties> + </leafNode> + <node name="node-msd"> + <properties> + <help>SRv6 Maximum Segment ID (SID) Depth (MSD)</help> + </properties> + <children> + <leafNode name="max-end-d"> + <properties> + <help>Maximum Segment Identifier for End-of-Data</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum End D MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-end-pop"> + <properties> + <help>Maximum number of SIDs in Segment-Routing Header (SRH) for segment pop</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum End Pop MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-h-encaps"> + <properties> + <help>Maximum Headend Encapsulation in MSD</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum Headend encaps in MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-segs-left"> + <properties> + <help>Maximum Segments left in MSD</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum Segments Left</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <leafNode name="interface"> + <properties> + <help>Interface for Segment-Routing over IPv6 (SRv6)</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <node name="redistribute"> @@ -418,6 +515,14 @@ #include <include/isis/redistribute-level-1-2.xml.i> </children> </node> + <node name="nhrp"> + <properties> + <help>Redistribute NHRP routes into IS-IS</help> + </properties> + <children> + #include <include/isis/redistribute-level-1-2.xml.i> + </children> + </node> <node name="ospf"> <properties> <help>Redistribute OSPF routes into IS-IS</help> @@ -640,6 +745,96 @@ </constraint> </properties> </leafNode> + <node name="fast-reroute"> + <properties> + <help>IS-IS fast reroute</help> + </properties> + <children> + <node name="lfa"> + <properties> + <help>Enable LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help> Enable LFA computation for Level 1 only</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable LFA</help> + <valueless/> + </properties> + </leafNode> + #include <include/isis/exclude-interface.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable LFA computation for Level 2 only</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable LFA</help> + <valueless/> + </properties> + </leafNode> + #include <include/isis/exclude-interface.xml.i> + </children> + </node> + </children> + </node> + <node name="remote-lfa"> + <properties> + <help>Enable remote LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help> Enable remote LFA computation for Level 1 only</help> + </properties> + <children> + #include <include/isis/frr-maxmetric.xml.i> + #include <include/isis/remote_lfa_tunnel.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable remote LFA computation for Level 2 only</help> + </properties> + <children> + #include <include/isis/frr-maxmetric.xml.i> + #include <include/isis/remote_lfa_tunnel.xml.i> + </children> + </node> + </children> + </node> + <node name="ti-lfa"> + <properties> + <help> Enable TI-LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help>Enable TI-LFA computation for Level 1 only</help> + </properties> + <children> + #include <include/isis/node-protection.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable TI-LFA computation for Level 2 only</help> + </properties> + <children> + #include <include/isis/node-protection.xml.i> + </children> + </node> + </children> + </node> + </children> + </node> <leafNode name="hello-padding"> <properties> <help>Add padding to IS-IS hello packets</help> diff --git a/interface-definitions/include/isis/remote_lfa_tunnel.xml.i b/interface-definitions/include/isis/remote_lfa_tunnel.xml.i new file mode 100644 index 000000000..62091a5ee --- /dev/null +++ b/interface-definitions/include/isis/remote_lfa_tunnel.xml.i @@ -0,0 +1,15 @@ +<!-- include start from isis/remote_lfa_tunnel.xml.i --> +<node name="tunnel"> + <properties> + <help>Enable remote LFA computation using tunnels</help> + </properties> + <children> + <leafNode name="mpls-ldp"> + <properties> + <help>Use MPLS LDP tunnel to reach the remote LFA node</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/monitoring/blackbox-exporter-module-commons.xml.i b/interface-definitions/include/monitoring/blackbox-exporter-module-commons.xml.i new file mode 100644 index 000000000..a97eb5232 --- /dev/null +++ b/interface-definitions/include/monitoring/blackbox-exporter-module-commons.xml.i @@ -0,0 +1,39 @@ +<!-- include start from monitoring/blackbox-module-commons.xml.i --> +<leafNode name="timeout"> + <properties> + <help>Timeout in seconds for the probe request</help> + <valueHelp> + <format>u32:1-60</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-60"/> + </constraint> + <constraintErrorMessage>Timeout must be between 1 and 60 seconds</constraintErrorMessage> + </properties> + <defaultValue>5</defaultValue> +</leafNode> +<leafNode name="preferred-ip-protocol"> + <properties> + <help>Preferred IP protocol for this module</help> + <valueHelp> + <format>ipv4</format> + <description>Prefer IPv4</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Prefer IPv6</description> + </valueHelp> + <constraint> + <regex>(ipv4|ipv6)</regex> + </constraint> + </properties> + <defaultValue>ip6</defaultValue> +</leafNode> +<leafNode name="ip-protocol-fallback"> + <properties> + <help>Allow fallback to other IP protocol if necessary</help> + <valueless/> + </properties> +</leafNode> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/nat-rule.xml.i b/interface-definitions/include/nat-rule.xml.i index deb13529d..3d5a6ede1 100644 --- a/interface-definitions/include/nat-rule.xml.i +++ b/interface-definitions/include/nat-rule.xml.i @@ -18,9 +18,15 @@ <help>NAT destination parameters</help> </properties> <children> + #include <include/firewall/fqdn.xml.i> #include <include/nat-address.xml.i> #include <include/nat-port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> #include <include/generic-disable-node.xml.i> @@ -315,9 +321,15 @@ <help>NAT source parameters</help> </properties> <children> + #include <include/firewall/fqdn.xml.i> #include <include/nat-address.xml.i> #include <include/nat-port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/include/nat64/protocol.xml.i b/interface-definitions/include/nat64/protocol.xml.i index a640873b5..3905f8190 100644 --- a/interface-definitions/include/nat64/protocol.xml.i +++ b/interface-definitions/include/nat64/protocol.xml.i @@ -1,7 +1,7 @@ <!-- include start from nat64/protocol.xml.i --> <node name="protocol"> <properties> - <help>Apply translation address to a specfic protocol</help> + <help>Apply translation address to a specific protocol</help> </properties> <children> <leafNode name="tcp"> diff --git a/interface-definitions/include/netlink/log-level.xml.i b/interface-definitions/include/netlink/log-level.xml.i new file mode 100644 index 000000000..bbaf9412c --- /dev/null +++ b/interface-definitions/include/netlink/log-level.xml.i @@ -0,0 +1,21 @@ +<!-- include start from netlink/log-level.xml.i --> +<leafNode name="log-level"> + <properties> + <help>Set log-level</help> + <completionHelp> + <list>info debug</list> + </completionHelp> + <valueHelp> + <format>info</format> + <description>Info log level</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug log level</description> + </valueHelp> + <constraint> + <regex>(info|debug)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/netlink/queue-size.xml.i b/interface-definitions/include/netlink/queue-size.xml.i new file mode 100644 index 000000000..d284838cf --- /dev/null +++ b/interface-definitions/include/netlink/queue-size.xml.i @@ -0,0 +1,15 @@ +<!-- include start from netlink/queue-size.xml.i --> +<leafNode name="queue-size"> + <properties> + <help>Internal message queue size</help> + <valueHelp> + <format>u32:100-2147483647</format> + <description>Queue size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-2147483647"/> + </constraint> + <constraintErrorMessage>Queue size must be between 100 and 2147483647</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/ospf/authentication.xml.i b/interface-definitions/include/ospf/authentication.xml.i index 8e8cad067..f38a37269 100644 --- a/interface-definitions/include/ospf/authentication.xml.i +++ b/interface-definitions/include/ospf/authentication.xml.i @@ -38,6 +38,12 @@ </tagNode> </children> </node> + <leafNode name="null"> + <properties> + <help>Use null authentication</help> + <valueless/> + </properties> + </leafNode> <leafNode name="plaintext-password"> <properties> <help>Plain text password</help> diff --git a/interface-definitions/include/ospf/default-information.xml.i b/interface-definitions/include/ospf/default-information.xml.i index 50cda54a4..dc44617f7 100644 --- a/interface-definitions/include/ospf/default-information.xml.i +++ b/interface-definitions/include/ospf/default-information.xml.i @@ -1,7 +1,7 @@ <!-- include start from ospf/intervals.xml.i --> <node name="default-information"> <properties> - <help>Default route advertisment settings</help> + <help>Default route advertisement settings</help> </properties> <children> <node name="originate"> diff --git a/interface-definitions/include/ospf/protocol-common-config.xml.i b/interface-definitions/include/ospf/protocol-common-config.xml.i index c4778e126..93d718ed4 100644 --- a/interface-definitions/include/ospf/protocol-common-config.xml.i +++ b/interface-definitions/include/ospf/protocol-common-config.xml.i @@ -314,13 +314,13 @@ <description>OSPF area in dotted decimal notation</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> <validator name="ip-address"/> </constraint> </properties> <children> #include <include/ospf/authentication.xml.i> #include <include/ospf/intervals.xml.i> + #include <include/ospf/retransmit-window.xml.i> </children> </tagNode> </children> @@ -433,6 +433,7 @@ </leafNode> #include <include/ospf/authentication.xml.i> #include <include/ospf/intervals.xml.i> + #include <include/ospf/retransmit-window.xml.i> #include <include/ospf/interface-common.xml.i> #include <include/isis/ldp-sync-interface.xml.i> <leafNode name="bandwidth"> @@ -678,7 +679,7 @@ <children> <node name="global-block"> <properties> - <help>Segment Routing Global Block label range</help> + <help>Segment-Routing Global Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -686,7 +687,7 @@ </node> <node name="local-block"> <properties> - <help>Segment Routing Local Block label range</help> + <help>Segment-Routing Local Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -796,6 +797,16 @@ #include <include/route-map.xml.i> </children> </node> + <node name="nhrp"> + <properties> + <help>Redistribute NHRP routes</help> + </properties> + <children> + #include <include/ospf/metric.xml.i> + #include <include/ospf/metric-type.xml.i> + #include <include/route-map.xml.i> + </children> + </node> <node name="rip"> <properties> <help>Redistribute RIP routes</help> diff --git a/interface-definitions/include/ospf/retransmit-window.xml.i b/interface-definitions/include/ospf/retransmit-window.xml.i new file mode 100644 index 000000000..a5e20f522 --- /dev/null +++ b/interface-definitions/include/ospf/retransmit-window.xml.i @@ -0,0 +1,15 @@ +<!-- include start from ospf/retransmit-window.xml.i --> +<leafNode name="retransmit-window"> + <properties> + <help>Window for LSA retransmit</help> + <valueHelp> + <format>u32:20-1000</format> + <description>Retransmit LSAs expiring in this window (milliseconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 20-1000"/> + </constraint> + </properties> + <defaultValue>50</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/policy/community-value-list.xml.i b/interface-definitions/include/policy/community-value-list.xml.i index 8c665c5f0..b1499440a 100644 --- a/interface-definitions/include/policy/community-value-list.xml.i +++ b/interface-definitions/include/policy/community-value-list.xml.i @@ -4,7 +4,6 @@ local-as no-advertise no-export - internet graceful-shutdown accept-own route-filter-translated-v4 @@ -35,10 +34,6 @@ <description>Well-known communities value NO_EXPORT 0xFFFFFF01</description> </valueHelp> <valueHelp> - <format>internet</format> - <description>Well-known communities value 0</description> -</valueHelp> -<valueHelp> <format>graceful-shutdown</format> <description>Well-known communities value GRACEFUL_SHUTDOWN 0xFFFF0000</description> </valueHelp> @@ -84,7 +79,7 @@ </valueHelp> <multi/> <constraint> - <regex>local-as|no-advertise|no-export|internet|graceful-shutdown|accept-own|route-filter-translated-v4|route-filter-v4|route-filter-translated-v6|route-filter-v6|llgr-stale|no-llgr|accept-own-nexthop|blackhole|no-peer</regex> + <regex>local-as|no-advertise|no-export|graceful-shutdown|accept-own|route-filter-translated-v4|route-filter-v4|route-filter-translated-v6|route-filter-v6|llgr-stale|no-llgr|accept-own-nexthop|blackhole|no-peer</regex> <validator name="bgp-regular-community"/> </constraint> <!-- include end --> diff --git a/interface-definitions/include/policy/route-common.xml.i b/interface-definitions/include/policy/route-common.xml.i index 19ffc0506..5c69a5279 100644 --- a/interface-definitions/include/policy/route-common.xml.i +++ b/interface-definitions/include/policy/route-common.xml.i @@ -66,7 +66,11 @@ </leafNode> </children> </node> -#include <include/firewall/set-packet-modifications.xml.i> +#include <include/firewall/set-packet-modifications-conn-mark.xml.i> +#include <include/firewall/set-packet-modifications-dscp.xml.i> +#include <include/firewall/set-packet-modifications-mark.xml.i> +#include <include/firewall/set-packet-modifications-table-and-vrf.xml.i> +#include <include/firewall/set-packet-modifications-tcp-mss.xml.i> #include <include/firewall/state.xml.i> #include <include/firewall/tcp-flags.xml.i> #include <include/firewall/tcp-mss.xml.i> diff --git a/interface-definitions/include/policy/route-ipv4.xml.i b/interface-definitions/include/policy/route-ipv4.xml.i deleted file mode 100644 index c12abcae2..000000000 --- a/interface-definitions/include/policy/route-ipv4.xml.i +++ /dev/null @@ -1,14 +0,0 @@ -<!-- include start from policy/route-ipv4.xml.i --> -<node name="source"> - <properties> - <help>Source parameters</help> - </properties> - <children> - #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> - #include <include/firewall/mac-address.xml.i> - #include <include/firewall/port.xml.i> - </children> -</node> -#include <include/firewall/icmp.xml.i> -<!-- include end --> diff --git a/interface-definitions/include/policy/route-ipv6.xml.i b/interface-definitions/include/policy/route-ipv6.xml.i deleted file mode 100644 index d636a654b..000000000 --- a/interface-definitions/include/policy/route-ipv6.xml.i +++ /dev/null @@ -1,196 +0,0 @@ -<!-- include start from policy/route-ipv6.xml.i --> -<node name="source"> - <properties> - <help>Source parameters</help> - </properties> - <children> - #include <include/firewall/address-ipv6.xml.i> - #include <include/firewall/source-destination-group.xml.i> - #include <include/firewall/mac-address.xml.i> - #include <include/firewall/port.xml.i> - </children> -</node> -<node name="icmpv6"> - <properties> - <help>ICMPv6 type and code information</help> - </properties> - <children> - <leafNode name="type"> - <properties> - <help>ICMP type-name</help> - <completionHelp> - <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list> - </completionHelp> - <valueHelp> - <format>any</format> - <description>Any ICMP type/code</description> - </valueHelp> - <valueHelp> - <format>echo-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>pong</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>destination-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>protocol-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>port-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>fragmentation-needed</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>source-route-failed</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-unknown</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-unknown</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-network-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-host-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>communication-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-precedence-violation</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>precedence-cutoff</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>source-quench</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-network-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS host-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>echo-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ping</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>router-advertisement</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>router-solicitation</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>time-exceeded</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-exceeded</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-zero-during-transit</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-zero-during-reassembly</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>parameter-problem</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ip-header-bad</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>required-option-missing</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>timestamp-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>timestamp-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>address-mask-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>address-mask-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>packet-too-big</format> - <description>ICMP type/code name</description> - </valueHelp> - <constraint> - <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex> - <validator name="numeric" argument="--range 0-255"/> - </constraint> - </properties> - </leafNode> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/qos/class-match.xml.i b/interface-definitions/include/qos/class-match.xml.i index 77d1933a3..3ad5547f2 100644 --- a/interface-definitions/include/qos/class-match.xml.i +++ b/interface-definitions/include/qos/class-match.xml.i @@ -29,12 +29,12 @@ <leafNode name="protocol"> <properties> <help>Ethernet protocol for this match</help> - <!-- this refers to /etc/protocols --> + <!-- this refers to /etc/ethertypes --> <completionHelp> <list>all 802.1Q 802_2 802_3 aarp aoe arp atalk dec ip ipv6 ipx lat localtalk rarp snap x25</list> </completionHelp> <valueHelp> - <format>u32:0-65535</format> + <format>u32:1-65535</format> <description>Ethernet protocol number</description> </valueHelp> <valueHelp> @@ -50,7 +50,7 @@ <description>Internet IP (IPv4)</description> </valueHelp> <valueHelp> - <format>ipv6</format> + <format>_ipv6</format> <description>Internet IP (IPv6)</description> </valueHelp> <valueHelp> @@ -59,7 +59,7 @@ </valueHelp> <valueHelp> <format>atalk</format> - <description>Appletalk</description> + <description>AppleTalk</description> </valueHelp> <valueHelp> <format>ipx</format> @@ -69,8 +69,48 @@ <format>802.1Q</format> <description>802.1Q VLAN tag</description> </valueHelp> + <valueHelp> + <format>802_2</format> + <description>IEEE 802.2</description> + </valueHelp> + <valueHelp> + <format>802_3</format> + <description>IEEE 802.3</description> + </valueHelp> + <valueHelp> + <format>aarp</format> + <description>AppleTalk Address Resolution Protocol</description> + </valueHelp> + <valueHelp> + <format>aoe</format> + <description>ATA over Ethernet</description> + </valueHelp> + <valueHelp> + <format>dec</format> + <description>DECnet Protocol</description> + </valueHelp> + <valueHelp> + <format>lat</format> + <description>Local Area Transport</description> + </valueHelp> + <valueHelp> + <format>localtalk</format> + <description>Apple LocalTalk</description> + </valueHelp> + <valueHelp> + <format>rarp</format> + <description>Reverse Address Resolution Protocol</description> + </valueHelp> + <valueHelp> + <format>snap</format> + <description>Subnetwork Access Protocol</description> + </valueHelp> + <valueHelp> + <format>x25</format> + <description>X.25 Packet-Switching Protocol</description> + </valueHelp> <constraint> - <validator name="ip-protocol"/> + <validator name="ether-type"/> </constraint> </properties> </leafNode> diff --git a/interface-definitions/include/qos/hfsc-m1.xml.i b/interface-definitions/include/qos/hfsc-m1.xml.i index 21b9c4f32..ca37f6ecf 100644 --- a/interface-definitions/include/qos/hfsc-m1.xml.i +++ b/interface-definitions/include/qos/hfsc-m1.xml.i @@ -27,6 +27,5 @@ <description>bps(8),kbps(8*10^3),mbps(8*10^6), gbps, tbps - Byte/sec</description> </valueHelp> </properties> - <defaultValue>0bit</defaultValue> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/qos/hfsc-m2.xml.i b/interface-definitions/include/qos/hfsc-m2.xml.i index 24e8f5d63..816546657 100644 --- a/interface-definitions/include/qos/hfsc-m2.xml.i +++ b/interface-definitions/include/qos/hfsc-m2.xml.i @@ -27,6 +27,5 @@ <description>bps(8),kbps(8*10^3),mbps(8*10^6), gbps, tbps - Byte/sec</description> </valueHelp> </properties> - <defaultValue>100%</defaultValue> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/rip/access-list6.xml.i b/interface-definitions/include/rip/access-list6.xml.i index 732135253..395d21c14 100644 --- a/interface-definitions/include/rip/access-list6.xml.i +++ b/interface-definitions/include/rip/access-list6.xml.i @@ -7,31 +7,25 @@ <leafNode name="in"> <properties> <help>Access list to apply to input packets</help> - <valueHelp> - <format>u32</format> - <description>Access list to apply to input packets</description> - </valueHelp> <completionHelp> <path>policy access-list6</path> </completionHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> + <valueHelp> + <format>txt</format> + <description>Name of IPv6 access-list</description> + </valueHelp> </properties> </leafNode> <leafNode name="out"> <properties> <help>Access list to apply to output packets</help> - <valueHelp> - <format>u32</format> - <description>Access list to apply to output packets</description> - </valueHelp> <completionHelp> <path>policy access-list6</path> </completionHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> + <valueHelp> + <format>txt</format> + <description>Name of IPv6 access-list</description> + </valueHelp> </properties> </leafNode> </children> diff --git a/interface-definitions/include/rip/timers.xml.i b/interface-definitions/include/rip/timers.xml.i index 771a6700e..e8b9d99c6 100644 --- a/interface-definitions/include/rip/timers.xml.i +++ b/interface-definitions/include/rip/timers.xml.i @@ -9,7 +9,7 @@ <help>Garbage collection timer</help> <valueHelp> <format>u32:5-2147483647</format> - <description>Garbage colletion time</description> + <description>Garbage collection time</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 5-2147483647"/> diff --git a/interface-definitions/include/rpki/protocol-common-config.xml.i b/interface-definitions/include/rpki/protocol-common-config.xml.i new file mode 100644 index 000000000..0b3356604 --- /dev/null +++ b/interface-definitions/include/rpki/protocol-common-config.xml.i @@ -0,0 +1,87 @@ +<!-- include start from rpki/protocol-common-config.xml.i --> +<tagNode name="cache"> + <properties> + <help>RPKI cache server address</help> + <valueHelp> + <format>ipv4</format> + <description>IP address of RPKI server</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address of RPKI server</description> + </valueHelp> + <valueHelp> + <format>hostname</format> + <description>Fully qualified domain name of RPKI server</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="fqdn"/> + </constraint> + </properties> + <children> + #include <include/port-number.xml.i> + <leafNode name="preference"> + <properties> + <help>Preference of the cache server</help> + <valueHelp> + <format>u32:1-255</format> + <description>Preference of the cache server</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + </leafNode> + #include <include/source-address-ipv4.xml.i> + <node name="ssh"> + <properties> + <help>RPKI SSH connection settings</help> + </properties> + <children> + #include <include/pki/openssh-key.xml.i> + #include <include/generic-username.xml.i> + </children> + </node> + </children> +</tagNode> +<leafNode name="expire-interval"> + <properties> + <help>Interval to wait before expiring the cache</help> + <valueHelp> + <format>u32:600-172800</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 600-172800"/> + </constraint> + </properties> + <defaultValue>7200</defaultValue> +</leafNode> +<leafNode name="polling-period"> + <properties> + <help>Cache polling interval</help> + <valueHelp> + <format>u32:1-86400</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-86400"/> + </constraint> + </properties> + <defaultValue>300</defaultValue> +</leafNode> +<leafNode name="retry-interval"> + <properties> + <help>Retry interval to connect to the cache server</help> + <valueHelp> + <format>u32:1-7200</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-7200"/> + </constraint> + </properties> + <defaultValue>600</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/segment-routing/algorithm.xml.i b/interface-definitions/include/segment-routing/algorithm.xml.i new file mode 100644 index 000000000..dae019b22 --- /dev/null +++ b/interface-definitions/include/segment-routing/algorithm.xml.i @@ -0,0 +1,20 @@ +<!-- include start from segment-routing/algorithm.xml.i --> +<node name="algorithm"> + <properties> + <help>IGP prefix algorithm style</help> + </properties> + <children> + <leafNode name="spf"> + <properties> + <help>Shortest Path First (SPF)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="strict-spf"> + <properties> + <help>Strict Shortest Path First (SPF) - ignore any possible local policy overriding the SPF along the path</help> + <valueless/> + </properties> + </leafNode> + </children> +</node>
\ No newline at end of file diff --git a/interface-definitions/include/source-address-ipv4.xml.i b/interface-definitions/include/source-address-ipv4.xml.i index 052678113..aa0b083c7 100644 --- a/interface-definitions/include/source-address-ipv4.xml.i +++ b/interface-definitions/include/source-address-ipv4.xml.i @@ -1,7 +1,7 @@ <!-- include start from source-address-ipv4.xml.i --> <leafNode name="source-address"> <properties> - <help>IPv4 source address used to initiate connection</help> + <help>IPv4 address used to initiate connection</help> <completionHelp> <script>${vyos_completion_dir}/list_local_ips.sh --ipv4</script> </completionHelp> diff --git a/interface-definitions/include/source-address-ipv6.xml.i b/interface-definitions/include/source-address-ipv6.xml.i new file mode 100644 index 000000000..a27955b0c --- /dev/null +++ b/interface-definitions/include/source-address-ipv6.xml.i @@ -0,0 +1,17 @@ +<!-- include start from source-address-ipv6.xml.i --> +<leafNode name="source-address"> + <properties> + <help>IPv6 address used to initiate connection</help> + <completionHelp> + <script>${vyos_completion_dir}/list_local_ips.sh --ipv6</script> + </completionHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 source address</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/source-interface-broadcast.xml.i b/interface-definitions/include/source-interface-broadcast.xml.i new file mode 100644 index 000000000..344a49024 --- /dev/null +++ b/interface-definitions/include/source-interface-broadcast.xml.i @@ -0,0 +1,14 @@ +<!-- include start from source-interface-broadcast.xml.i --> +<leafNode name="source-interface"> + <properties> + <help>Physical interface the traffic will go through</help> + <valueHelp> + <format>interface</format> + <description>Interface name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --broadcast</script> + </completionHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/source-interface-ethernet.xml.i b/interface-definitions/include/source-interface-ethernet.xml.i index e06e47d6c..ff6948090 100644 --- a/interface-definitions/include/source-interface-ethernet.xml.i +++ b/interface-definitions/include/source-interface-ethernet.xml.i @@ -4,7 +4,7 @@ <help>Physical interface the traffic will go through</help> <valueHelp> <format>interface</format> - <description>Physical interface used for traffic forwarding</description> + <description>Interface name</description> </valueHelp> <completionHelp> <script>${vyos_completion_dir}/list_interfaces --type ethernet</script> diff --git a/interface-definitions/include/static/static-route-bfd.xml.i b/interface-definitions/include/static/static-route-bfd.xml.i deleted file mode 100644 index d588b369f..000000000 --- a/interface-definitions/include/static/static-route-bfd.xml.i +++ /dev/null @@ -1,36 +0,0 @@ -<!-- include start from static/static-route-bfd.xml.i --> -<node name="bfd"> - <properties> - <help>BFD monitoring</help> - </properties> - <children> - #include <include/bfd/profile.xml.i> - <node name="multi-hop"> - <properties> - <help>Use BFD multi hop session</help> - </properties> - <children> - <tagNode name="source"> - <properties> - <help>Use source for BFD session</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 source address</description> - </valueHelp> - <valueHelp> - <format>ipv6</format> - <description>IPv6 source address</description> - </valueHelp> - <constraint> - <validator name="ip-address"/> - </constraint> - </properties> - <children> - #include <include/bfd/profile.xml.i> - </children> - </tagNode> - </children> - </node> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/static/static-route-interface.xml.i b/interface-definitions/include/static/static-route-interface.xml.i deleted file mode 100644 index cb5436847..000000000 --- a/interface-definitions/include/static/static-route-interface.xml.i +++ /dev/null @@ -1,17 +0,0 @@ -<!-- include start from static/static-route-interface.xml.i --> -<leafNode name="interface"> - <properties> - <help>Gateway interface name</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Gateway interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - </properties> -</leafNode> -<!-- include end --> diff --git a/interface-definitions/include/static/static-route.xml.i b/interface-definitions/include/static/static-route.xml.i index 29921a731..59742dd3b 100644 --- a/interface-definitions/include/static/static-route.xml.i +++ b/interface-definitions/include/static/static-route.xml.i @@ -13,7 +13,7 @@ <children> #include <include/static/static-route-blackhole.xml.i> #include <include/static/static-route-reject.xml.i> - #include <include/dhcp-interface.xml.i> + #include <include/dhcp-interface-multi.xml.i> #include <include/generic-description.xml.i> <tagNode name="interface"> <properties> @@ -32,6 +32,7 @@ <children> #include <include/generic-disable-node.xml.i> #include <include/static/static-route-distance.xml.i> + #include <include/static/static-route-segments.xml.i> #include <include/static/static-route-vrf.xml.i> </children> </tagNode> @@ -49,12 +50,27 @@ <children> #include <include/generic-disable-node.xml.i> #include <include/static/static-route-distance.xml.i> - #include <include/static/static-route-interface.xml.i> + #include <include/generic-interface.xml.i> + #include <include/static/static-route-segments.xml.i> #include <include/static/static-route-vrf.xml.i> - #include <include/static/static-route-bfd.xml.i> + <node name="bfd"> + <properties> + <help>BFD monitoring</help> + </properties> + <children> + #include <include/bfd/profile.xml.i> + <node name="multi-hop"> + <properties> + <help>Configure BFD multi-hop session</help> + </properties> + <children> + #include <include/source-address-ipv4.xml.i> + </children> + </node> + </children> + </node> </children> </tagNode> </children> </tagNode> <!-- include end --> - diff --git a/interface-definitions/include/static/static-route6.xml.i b/interface-definitions/include/static/static-route6.xml.i index 4468c8025..a3d972d39 100644 --- a/interface-definitions/include/static/static-route6.xml.i +++ b/interface-definitions/include/static/static-route6.xml.i @@ -48,11 +48,26 @@ </properties> <children> #include <include/generic-disable-node.xml.i> - #include <include/static/static-route-bfd.xml.i> #include <include/static/static-route-distance.xml.i> - #include <include/static/static-route-interface.xml.i> + #include <include/generic-interface.xml.i> #include <include/static/static-route-segments.xml.i> #include <include/static/static-route-vrf.xml.i> + <node name="bfd"> + <properties> + <help>BFD monitoring</help> + </properties> + <children> + #include <include/bfd/profile.xml.i> + <node name="multi-hop"> + <properties> + <help>Configure BFD multi-hop session</help> + </properties> + <children> + #include <include/source-address-ipv6.xml.i> + </children> + </node> + </children> + </node> </children> </tagNode> </children> diff --git a/interface-definitions/include/stunnel/protocol-value-cifs.xml.i b/interface-definitions/include/stunnel/protocol-value-cifs.xml.i index 5b9484750..12eae6584 100644 --- a/interface-definitions/include/stunnel/protocol-value-cifs.xml.i +++ b/interface-definitions/include/stunnel/protocol-value-cifs.xml.i @@ -1,6 +1,6 @@ <!-- include start from stunnel/protocol-value-cifs.xml.i --> <valueHelp> <format>cifs</format> - <description>Proprietary (undocummented) extension of CIFS protocol</description> + <description>Proprietary (undocumented) extension of CIFS protocol</description> </valueHelp> <!-- include end --> diff --git a/interface-definitions/include/stunnel/psk.xml.i b/interface-definitions/include/stunnel/psk.xml.i index db11a93d3..a8226c866 100644 --- a/interface-definitions/include/stunnel/psk.xml.i +++ b/interface-definitions/include/stunnel/psk.xml.i @@ -4,27 +4,8 @@ <help>Pre-shared key name</help> </properties> <children> - <leafNode name="id"> - <properties> - <help>ID for authentication</help> - <valueHelp> - <format>txt</format> - <description>ID used for authentication</description> - </valueHelp> - </properties> - </leafNode> - <leafNode name="secret"> - <properties> - <help>pre-shared secret key</help> - <valueHelp> - <format>txt</format> - <description>pre-shared secret key are required to be at least 16 bytes long, which implies at least 32 characters for hexadecimal key</description> - </valueHelp> - <constraint> - <validator name="psk-secret"/> - </constraint> - </properties> - </leafNode> + #include <include/auth-psk-id.xml.i> + #include <include/auth-psk-secret.xml.i> </children> </tagNode> <!-- include end --> diff --git a/interface-definitions/include/system-ip-protocol.xml.i b/interface-definitions/include/system-ip-protocol.xml.i index c630eb3f7..30d7ab04e 100644 --- a/interface-definitions/include/system-ip-protocol.xml.i +++ b/interface-definitions/include/system-ip-protocol.xml.i @@ -3,7 +3,7 @@ <properties> <help>Filter routing info exchanged between routing protocol and zebra</help> <completionHelp> - <list>any babel bgp connected eigrp isis kernel ospf rip static table</list> + <list>any babel bgp eigrp isis ospf rip static</list> </completionHelp> <valueHelp> <format>any</format> @@ -18,10 +18,6 @@ <description>Border Gateway Protocol</description> </valueHelp> <valueHelp> - <format>connected</format> - <description>Connected routes (directly attached subnet or host)</description> - </valueHelp> - <valueHelp> <format>eigrp</format> <description>Enhanced Interior Gateway Routing Protocol</description> </valueHelp> @@ -30,10 +26,6 @@ <description>Intermediate System to Intermediate System</description> </valueHelp> <valueHelp> - <format>kernel</format> - <description>Kernel routes (not installed via the zebra RIB)</description> - </valueHelp> - <valueHelp> <format>ospf</format> <description>Open Shortest Path First (OSPFv2)</description> </valueHelp> @@ -46,11 +38,11 @@ <description>Statically configured routes</description> </valueHelp> <constraint> - <regex>(any|babel|bgp|connected|eigrp|isis|kernel|ospf|rip|static|table)</regex> + <regex>(any|babel|bgp|eigrp|isis|ospf|rip|static)</regex> </constraint> </properties> <children> #include <include/route-map.xml.i> </children> </tagNode> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/system-ipv6-protocol.xml.i b/interface-definitions/include/system-ipv6-protocol.xml.i index 485776a71..1a8123cb2 100644 --- a/interface-definitions/include/system-ipv6-protocol.xml.i +++ b/interface-definitions/include/system-ipv6-protocol.xml.i @@ -3,7 +3,7 @@ <properties> <help>Filter routing info exchanged between routing protocol and zebra</help> <completionHelp> - <list>any babel bgp connected isis kernel ospfv3 ripng static table</list> + <list>any babel bgp isis ospfv3 ripng static</list> </completionHelp> <valueHelp> <format>any</format> @@ -18,18 +18,10 @@ <description>Border Gateway Protocol</description> </valueHelp> <valueHelp> - <format>connected</format> - <description>Connected routes (directly attached subnet or host)</description> - </valueHelp> - <valueHelp> <format>isis</format> <description>Intermediate System to Intermediate System</description> </valueHelp> <valueHelp> - <format>kernel</format> - <description>Kernel routes (not installed via the zebra RIB)</description> - </valueHelp> - <valueHelp> <format>ospfv3</format> <description>Open Shortest Path First (OSPFv3)</description> </valueHelp> @@ -42,7 +34,7 @@ <description>Statically configured routes</description> </valueHelp> <constraint> - <regex>(any|babel|bgp|connected|isis|kernel|ospfv3|ripng|static|table)</regex> + <regex>(any|babel|bgp|isis|ospfv3|ripng|static)</regex> </constraint> </properties> <children> diff --git a/interface-definitions/include/unformat_log2_page_size.xml.i b/interface-definitions/include/unformat_log2_page_size.xml.i new file mode 100644 index 000000000..7678c1860 --- /dev/null +++ b/interface-definitions/include/unformat_log2_page_size.xml.i @@ -0,0 +1,20 @@ +<!-- include start from unformat_log2_page_size.xml.i --> +<completionHelp> + <list>4K 2M 1G</list> +</completionHelp> +<valueHelp> + <format>4K</format> + <description>4 kilobytes</description> +</valueHelp> +<valueHelp> + <format>2M</format> + <description>2 megabytes</description> +</valueHelp> +<valueHelp> + <format>1G</format> + <description>1 gigabyte</description> +</valueHelp> +<constraint> + <regex>(4K|2M|1G)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/unformat_memory_size.xml.i b/interface-definitions/include/unformat_memory_size.xml.i new file mode 100644 index 000000000..bb8f4ae67 --- /dev/null +++ b/interface-definitions/include/unformat_memory_size.xml.i @@ -0,0 +1,22 @@ +<!-- include start from unformat_memory_size.xml.i --> +<valueHelp> + <format><number></format> + <description>byte</description> +</valueHelp> +<valueHelp> + <format><number>K</format> + <description>Kilobyte</description> +</valueHelp> +<valueHelp> + <format><number>M</format> + <description>Megabyte</description> +</valueHelp> +<valueHelp> + <format><number>G</format> + <description>Gigabyte</description> +</valueHelp> +<constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + <regex>(\d+|\d+K|\d+M|\d+G)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/version/bgp-version.xml.i b/interface-definitions/include/version/bgp-version.xml.i index 6bed7189f..c90276151 100644 --- a/interface-definitions/include/version/bgp-version.xml.i +++ b/interface-definitions/include/version/bgp-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/bgp-version.xml.i --> -<syntaxVersion component='bgp' version='5'></syntaxVersion> +<syntaxVersion component='bgp' version='6'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/conntrack-version.xml.i b/interface-definitions/include/version/conntrack-version.xml.i index 6995ce119..517424034 100644 --- a/interface-definitions/include/version/conntrack-version.xml.i +++ b/interface-definitions/include/version/conntrack-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/conntrack-version.xml.i --> -<syntaxVersion component='conntrack' version='5'></syntaxVersion> +<syntaxVersion component='conntrack' version='6'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/container-version.xml.i b/interface-definitions/include/version/container-version.xml.i index ed6e942cd..046bacfdc 100644 --- a/interface-definitions/include/version/container-version.xml.i +++ b/interface-definitions/include/version/container-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/container-version.xml.i --> -<syntaxVersion component='container' version='2'></syntaxVersion> +<syntaxVersion component='container' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/firewall-version.xml.i b/interface-definitions/include/version/firewall-version.xml.i index a15cf0eec..f50c450ef 100644 --- a/interface-definitions/include/version/firewall-version.xml.i +++ b/interface-definitions/include/version/firewall-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/firewall-version.xml.i --> -<syntaxVersion component='firewall' version='17'></syntaxVersion> +<syntaxVersion component='firewall' version='20'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/flow-accounting-version.xml.i b/interface-definitions/include/version/flow-accounting-version.xml.i index 5b01fe4b5..3a22d391c 100644 --- a/interface-definitions/include/version/flow-accounting-version.xml.i +++ b/interface-definitions/include/version/flow-accounting-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/flow-accounting-version.xml.i --> -<syntaxVersion component='flow-accounting' version='1'></syntaxVersion> +<syntaxVersion component='flow-accounting' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/https-version.xml.i b/interface-definitions/include/version/https-version.xml.i index 525314dbd..a889a7805 100644 --- a/interface-definitions/include/version/https-version.xml.i +++ b/interface-definitions/include/version/https-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/https-version.xml.i --> -<syntaxVersion component='https' version='6'></syntaxVersion> +<syntaxVersion component='https' version='7'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ids-version.xml.i b/interface-definitions/include/version/ids-version.xml.i index 9133be02b..6d4e92c21 100644 --- a/interface-definitions/include/version/ids-version.xml.i +++ b/interface-definitions/include/version/ids-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ids-version.xml.i --> -<syntaxVersion component='ids' version='1'></syntaxVersion> +<syntaxVersion component='ids' version='2'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/interfaces-version.xml.i b/interface-definitions/include/version/interfaces-version.xml.i index 2915b318e..28564b3d7 100644 --- a/interface-definitions/include/version/interfaces-version.xml.i +++ b/interface-definitions/include/version/interfaces-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/interfaces-version.xml.i --> -<syntaxVersion component='interfaces' version='33'></syntaxVersion> +<syntaxVersion component='interfaces' version='34'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ipsec-version.xml.i b/interface-definitions/include/version/ipsec-version.xml.i index a4d556cfc..6c24b0b2d 100644 --- a/interface-definitions/include/version/ipsec-version.xml.i +++ b/interface-definitions/include/version/ipsec-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ipsec-version.xml.i --> -<syntaxVersion component='ipsec' version='13'></syntaxVersion> +<syntaxVersion component='ipsec' version='14'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/lldp-version.xml.i b/interface-definitions/include/version/lldp-version.xml.i index b41d80451..a7110691a 100644 --- a/interface-definitions/include/version/lldp-version.xml.i +++ b/interface-definitions/include/version/lldp-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/lldp-version.xml.i --> -<syntaxVersion component='lldp' version='2'></syntaxVersion> +<syntaxVersion component='lldp' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/monitoring-version.xml.i b/interface-definitions/include/version/monitoring-version.xml.i index 6a275a5d8..2e2e0116e 100644 --- a/interface-definitions/include/version/monitoring-version.xml.i +++ b/interface-definitions/include/version/monitoring-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/monitoring-version.xml.i --> -<syntaxVersion component='monitoring' version='1'></syntaxVersion> +<syntaxVersion component='monitoring' version='2'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/nhrp-version.xml.i b/interface-definitions/include/version/nhrp-version.xml.i new file mode 100644 index 000000000..7f6f3c4f7 --- /dev/null +++ b/interface-definitions/include/version/nhrp-version.xml.i @@ -0,0 +1,3 @@ +<!-- include start from include/version/nhrp-version.xml.i --> +<syntaxVersion component='nhrp' version='1'></syntaxVersion> +<!-- include end --> diff --git a/interface-definitions/include/version/openvpn-version.xml.i b/interface-definitions/include/version/openvpn-version.xml.i index 67ef21983..6bc2b2da6 100644 --- a/interface-definitions/include/version/openvpn-version.xml.i +++ b/interface-definitions/include/version/openvpn-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/openvpn-version.xml.i --> -<syntaxVersion component='openvpn' version='4'></syntaxVersion> +<syntaxVersion component='openvpn' version='5'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/policy-version.xml.i b/interface-definitions/include/version/policy-version.xml.i index db727fea9..5c53a4032 100644 --- a/interface-definitions/include/version/policy-version.xml.i +++ b/interface-definitions/include/version/policy-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/policy-version.xml.i --> -<syntaxVersion component='policy' version='8'></syntaxVersion> +<syntaxVersion component='policy' version='9'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/pppoe-server-version.xml.i b/interface-definitions/include/version/pppoe-server-version.xml.i index 2e020faa3..1b2718d61 100644 --- a/interface-definitions/include/version/pppoe-server-version.xml.i +++ b/interface-definitions/include/version/pppoe-server-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/pppoe-server-version.xml.i --> -<syntaxVersion component='pppoe-server' version='11'></syntaxVersion> +<syntaxVersion component='pppoe-server' version='12'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/qos-version.xml.i b/interface-definitions/include/version/qos-version.xml.i index c67e61e91..127f771a9 100644 --- a/interface-definitions/include/version/qos-version.xml.i +++ b/interface-definitions/include/version/qos-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/qos-version.xml.i --> -<syntaxVersion component='qos' version='2'></syntaxVersion> +<syntaxVersion component='qos' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/quagga-version.xml.i b/interface-definitions/include/version/quagga-version.xml.i index 23d884cd4..10ca2816e 100644 --- a/interface-definitions/include/version/quagga-version.xml.i +++ b/interface-definitions/include/version/quagga-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/quagga-version.xml.i --> -<syntaxVersion component='quagga' version='11'></syntaxVersion> +<syntaxVersion component='quagga' version='12'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/reverseproxy-version.xml.i b/interface-definitions/include/version/reverseproxy-version.xml.i index 907ea1e5e..71f7def1a 100644 --- a/interface-definitions/include/version/reverseproxy-version.xml.i +++ b/interface-definitions/include/version/reverseproxy-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/reverseproxy-version.xml.i --> -<syntaxVersion component='reverse-proxy' version='1'></syntaxVersion> +<syntaxVersion component='reverse-proxy' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ssh-version.xml.i b/interface-definitions/include/version/ssh-version.xml.i index 0f25caf98..05cf431a7 100644 --- a/interface-definitions/include/version/ssh-version.xml.i +++ b/interface-definitions/include/version/ssh-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ssh-version.xml.i --> -<syntaxVersion component='ssh' version='2'></syntaxVersion> +<syntaxVersion component='ssh' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i index fcb24abe2..f29226c03 100644 --- a/interface-definitions/include/version/system-version.xml.i +++ b/interface-definitions/include/version/system-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/system-version.xml.i --> -<syntaxVersion component='system' version='27'></syntaxVersion> +<syntaxVersion component='system' version='32'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/vpp-version.xml.i b/interface-definitions/include/version/vpp-version.xml.i new file mode 100644 index 000000000..c12e3786c --- /dev/null +++ b/interface-definitions/include/version/vpp-version.xml.i @@ -0,0 +1,3 @@ +<!-- include start from include/version/vpp-version.xml.i --> +<syntaxVersion component='vpp' version='6'></syntaxVersion> +<!-- include end --> diff --git a/interface-definitions/include/version/vrf-version.xml.i b/interface-definitions/include/version/vrf-version.xml.i index 9d7ff35fe..1c7c81155 100644 --- a/interface-definitions/include/version/vrf-version.xml.i +++ b/interface-definitions/include/version/vrf-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/vrf-version.xml.i --> -<syntaxVersion component='vrf' version='3'></syntaxVersion> +<syntaxVersion component='vrf' version='4'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/wanloadbalance-version.xml.i b/interface-definitions/include/version/wanloadbalance-version.xml.i index 59f8729cc..34c3c76ff 100644 --- a/interface-definitions/include/version/wanloadbalance-version.xml.i +++ b/interface-definitions/include/version/wanloadbalance-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/wanloadbalance-version.xml.i --> -<syntaxVersion component='wanloadbalance' version='3'></syntaxVersion> +<syntaxVersion component='wanloadbalance' version='4'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i new file mode 100644 index 000000000..a719a6223 --- /dev/null +++ b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i @@ -0,0 +1,25 @@ +<!-- include start from vpp/acl_common_interface_ip_rule.xml.i --> +<tagNode name="acl-tag"> + <properties> + <help>ACL rule (tag) number</help> + <valueHelp> + <format>u32</format> + <description>Number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + <leafNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <completionHelp> + <path>vpp acl ip tag-name</path> + </completionHelp> + </properties> + </leafNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/acl_port_range.xml.i b/interface-definitions/include/vpp/acl_port_range.xml.i new file mode 100644 index 000000000..ba4a133bb --- /dev/null +++ b/interface-definitions/include/vpp/acl_port_range.xml.i @@ -0,0 +1,19 @@ +<!-- include start from vpp/acl_port_range.xml.i --> +<leafNode name="port"> + <properties> + <help>Port number or range</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <valueHelp> + <format>range</format> + <description>Numbered port range (e.g., 1001-1005)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--allow-range --range 1-65535"/> + </constraint> + <constraintErrorMessage>Invalid port or port range</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/acl_prefix.xml.i b/interface-definitions/include/vpp/acl_prefix.xml.i new file mode 100644 index 000000000..790153c8f --- /dev/null +++ b/interface-definitions/include/vpp/acl_prefix.xml.i @@ -0,0 +1,20 @@ +<!-- include start from vpp/acl_prefix.xml.i --> +<leafNode name="prefix"> + <properties> + <help>IP prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> + diff --git a/interface-definitions/include/vpp/acl_tcp_flags.xml.i b/interface-definitions/include/vpp/acl_tcp_flags.xml.i new file mode 100644 index 000000000..380df33a0 --- /dev/null +++ b/interface-definitions/include/vpp/acl_tcp_flags.xml.i @@ -0,0 +1,41 @@ +<!-- include start from vpp/acl_tcp_flags.xml.i --> +<completionHelp> + <list>ack cwr ecn fin psh rst syn urg</list> +</completionHelp> +<valueHelp> + <format>ack</format> + <description>Acknowledge flag</description> +</valueHelp> +<valueHelp> + <format>cwr</format> + <description>Congestion Window Reduced flag</description> +</valueHelp> +<valueHelp> + <format>ecn</format> + <description>Explicit Congestion Notification flag</description> +</valueHelp> +<valueHelp> + <format>fin</format> + <description>Finish flag</description> +</valueHelp> +<valueHelp> + <format>psh</format> + <description>Push flag</description> +</valueHelp> +<valueHelp> + <format>rst</format> + <description>Reset flag</description> +</valueHelp> +<valueHelp> + <format>syn</format> + <description>Synchronise flag</description> +</valueHelp> +<valueHelp> + <format>urg</format> + <description>Urgent flag</description> +</valueHelp> +<constraint> + <regex>(syn|ack|fin|rst|urg|psh|ecn|cwr)</regex> +</constraint> +<multi/> +<!-- include end --> diff --git a/interface-definitions/include/vpp/iface_rx_mode.xml.i b/interface-definitions/include/vpp/iface_rx_mode.xml.i new file mode 100644 index 000000000..36aa7e28b --- /dev/null +++ b/interface-definitions/include/vpp/iface_rx_mode.xml.i @@ -0,0 +1,25 @@ +<!-- include start from vpp/iface_rx_mode.xml.i --> +<leafNode name="interface-rx-mode"> + <properties> + <help>Receive packet processing mode</help> + <completionHelp> + <list>polling interrupt adaptive</list> + </completionHelp> + <valueHelp> + <format>polling</format> + <description>Constantly check for new data</description> + </valueHelp> + <valueHelp> + <format>interrupt</format> + <description>Interrupt mode</description> + </valueHelp> + <valueHelp> + <format>adaptive</format> + <description>Adaptive mode</description> + </valueHelp> + <constraint> + <regex>(polling|interrupt|adaptive)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_address_range.xml.i b/interface-definitions/include/vpp/nat_address_range.xml.i new file mode 100644 index 000000000..48648f91a --- /dev/null +++ b/interface-definitions/include/vpp/nat_address_range.xml.i @@ -0,0 +1,20 @@ +<!-- include start from vpp/nat_address_range.xml.i --> +<leafNode name="address"> + <properties> + <help>IP address or range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <valueHelp> + <format>ipv4range</format> + <description>IPv4 address range</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <validator name="ipv4-range"/> + </constraint> + <multi/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_interface.xml.i b/interface-definitions/include/vpp/nat_interface.xml.i new file mode 100644 index 000000000..20a7356bf --- /dev/null +++ b/interface-definitions/include/vpp/nat_interface.xml.i @@ -0,0 +1,11 @@ +<!-- include start from vpp/nat_interface.xml.i --> +<leafNode name="interface"> + <properties> + <help>Add IP address from an interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_protocol.xml.i b/interface-definitions/include/vpp/nat_protocol.xml.i new file mode 100644 index 000000000..b88fd2b62 --- /dev/null +++ b/interface-definitions/include/vpp/nat_protocol.xml.i @@ -0,0 +1,30 @@ +<!-- include start from vpp/nat_protocol.xml.i --> +<leafNode name="protocol"> + <properties> + <help>Protocol</help> + <completionHelp> + <list>tcp udp icmp all</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All protocols (TCP, UDP, and ICMP)</description> + </valueHelp> + <valueHelp> + <format>icmp</format> + <description>Internet Control Message Protocol (ICMP)</description> + </valueHelp> + <valueHelp> + <format>tcp</format> + <description>Transmission Control Protocol (TCP)</description> + </valueHelp> + <valueHelp> + <format>udp</format> + <description>User Datagram Protocol (UDP)</description> + </valueHelp> + <constraint> + <regex>(tcp|udp|icmp|all)</regex> + </constraint> + </properties> + <defaultValue>all</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/netlink.xml.i b/interface-definitions/include/vpp/netlink.xml.i new file mode 100644 index 000000000..903100d00 --- /dev/null +++ b/interface-definitions/include/vpp/netlink.xml.i @@ -0,0 +1,45 @@ +<!-- include start from vpp/netlink.xml.i --> +<node name="netlink"> + <properties> + <help>Netlink options</help> + </properties> + <children> + <leafNode name="rx-buffer-size"> + <properties> + <help>Receive buffer size</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Receive buffer size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="batch-size"> + <properties> + <help>Batch size</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Batch size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="batch-delay-ms"> + <properties> + <help>Batch delay</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Batch delay (in ms)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> +</children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/vpp/queue_size.xml.i b/interface-definitions/include/vpp/queue_size.xml.i new file mode 100644 index 000000000..dc25df04d --- /dev/null +++ b/interface-definitions/include/vpp/queue_size.xml.i @@ -0,0 +1,44 @@ +<!-- include start from vpp/queue_size.xml.i --> +<completionHelp> + <list>0 256 512 1024 2048 4096 8192 16384 32468</list> +</completionHelp> +<valueHelp> + <format>0</format> + <description>Use default VPP queue size</description> +</valueHelp> +<valueHelp> + <format>256</format> + <description>256 descriptors</description> +</valueHelp> +<valueHelp> + <format>512</format> + <description>512 descriptors</description> +</valueHelp> +<valueHelp> + <format>1024</format> + <description>1024 descriptors</description> +</valueHelp> +<valueHelp> + <format>2048</format> + <description>2048 descriptors</description> +</valueHelp> +<valueHelp> + <format>4096</format> + <description>4096 descriptors</description> +</valueHelp> +<valueHelp> + <format>8192</format> + <description>8192 descriptors</description> +</valueHelp> +<valueHelp> + <format>16384</format> + <description>16384 descriptors</description> +</valueHelp> +<valueHelp> + <format>32468</format> + <description>32468 descriptors</description> +</valueHelp> +<constraint> + <regex>(0|256|512|1024|2048|4096|8192|16384|32468)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/vpp/vif.xml.i b/interface-definitions/include/vpp/vif.xml.i new file mode 100644 index 000000000..8f0e9772f --- /dev/null +++ b/interface-definitions/include/vpp/vif.xml.i @@ -0,0 +1,21 @@ +<!-- include start from vpp/vif.xml.i --> +<tagNode name="vif"> + <properties> + <help>Virtual Local Area Network (VLAN) ID</help> + <valueHelp> + <format>u32:0-4094</format> + <description>Virtual Local Area Network (VLAN) ID</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4094"/> + </constraint> + <constraintErrorMessage>VLAN ID must be between 0 and 4094</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/address-ipv4-ipv6-dhcp.xml.i> + #include <include/interface/disable.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/vrrp/garp.xml.i b/interface-definitions/include/vrrp/garp.xml.i index b56b490df..54bb34572 100644 --- a/interface-definitions/include/vrrp/garp.xml.i +++ b/interface-definitions/include/vrrp/garp.xml.i @@ -32,7 +32,7 @@ </leafNode> <leafNode name="master-refresh"> <properties> - <help>Minimum time interval for refreshing gratuitous ARPs while beeing master</help> + <help>Minimum time interval for refreshing gratuitous ARPs while being master</help> <valueHelp> <format>u32:0</format> <description>No refresh</description> @@ -49,7 +49,7 @@ </leafNode> <leafNode name="master-refresh-repeat"> <properties> - <help>Number of gratuitous ARP messages to send at a time while beeing master</help> + <help>Number of gratuitous ARP messages to send at a time while being master</help> <valueHelp> <format>u32:1-255</format> <description>Number of gratuitous ARP messages</description> diff --git a/interface-definitions/interfaces_bonding.xml.in b/interface-definitions/interfaces_bonding.xml.in index b17cad478..9945fc15d 100644 --- a/interface-definitions/interfaces_bonding.xml.in +++ b/interface-definitions/interfaces_bonding.xml.in @@ -141,6 +141,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> <leafNode name="mii-mon-interval"> <properties> @@ -239,7 +240,7 @@ <description>Distribute based on MAC address</description> </valueHelp> <constraint> - <regex>(802.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex> + <regex>(802\.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex> </constraint> <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, transmit-load-balance, adaptive-load-balance, or xor</constraintErrorMessage> </properties> diff --git a/interface-definitions/interfaces_bridge.xml.in b/interface-definitions/interfaces_bridge.xml.in index 29dd61df5..d4ee2a652 100644 --- a/interface-definitions/interfaces_bridge.xml.in +++ b/interface-definitions/interfaces_bridge.xml.in @@ -5,7 +5,7 @@ <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/interfaces_bridge.py"> <properties> <help>Bridge Interface</help> - <priority>310</priority> + <priority>319</priority> <constraint> <regex>br[0-9]+</regex> </constraint> @@ -93,6 +93,7 @@ </node> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="enable-vlan"> @@ -200,6 +201,24 @@ <valueless/> </properties> </leafNode> + <leafNode name="bpdu-guard"> + <properties> + <help>Enable BPDU Guard</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="root-guard"> + <properties> + <help>Enable Root Guard</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-learning"> + <properties> + <help>Disable MAC address learning</help> + <valueless/> + </properties> + </leafNode> </children> </tagNode> </children> diff --git a/interface-definitions/interfaces_dummy.xml.in b/interface-definitions/interfaces_dummy.xml.in index 36b4e41f2..993380ab8 100644 --- a/interface-definitions/interfaces_dummy.xml.in +++ b/interface-definitions/interfaces_dummy.xml.in @@ -18,6 +18,7 @@ <children> #include <include/interface/address-ipv4-ipv6.xml.i> #include <include/generic-description.xml.i> + #include <include/interface/mac.xml.i> #include <include/interface/disable.xml.i> <node name="ip"> <properties> diff --git a/interface-definitions/interfaces_ethernet.xml.in b/interface-definitions/interfaces_ethernet.xml.in index 89f990d41..e9814817f 100644 --- a/interface-definitions/interfaces_ethernet.xml.in +++ b/interface-definitions/interfaces_ethernet.xml.in @@ -56,6 +56,12 @@ </properties> <defaultValue>auto</defaultValue> </leafNode> + <leafNode name="switchdev"> + <properties> + <help>Enables switchdev mode on interface</help> + <valueless/> + </properties> + </leafNode> #include <include/interface/eapol.xml.i> <node name="evpn"> <properties> @@ -68,6 +74,7 @@ #include <include/interface/hw-id.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-68-16000.xml.i> #include <include/interface/mirror.xml.i> @@ -214,6 +221,313 @@ </leafNode> </children> </node> + <node name="interrupt-coalescing"> + <properties> + <help>Interrupt coalescing options for the interface</help> + </properties> + <children> + <leafNode name="adaptive-rx"> + <properties> + <help>Enable adaptive receive interrupt coalescing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="adaptive-tx"> + <properties> + <help>Enable adaptive transmit interrupt coalescing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="rx-usecs"> + <properties> + <help>Delay in microseconds before generating RX interrupt</help> + <valueHelp> + <format>u32:0-16384</format> + <description>RX interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frames"> + <properties> + <help>Number of RX frames before generating interrupt</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>RX interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-irq"> + <properties> + <help>Delay in microseconds before generating RX interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-16384</format> + <description>RX IRQ interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frames-irq"> + <properties> + <help>Number of RX frames before generating interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>RX IRQ interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs"> + <properties> + <help>Delay in microseconds before generating TX interrupt</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frames"> + <properties> + <help>Number of TX frames before generating interrupt</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-irq"> + <properties> + <help>Delay in microseconds before generating TX interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX IRQ interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frames-irq"> + <properties> + <help>Number of TX frames before generating interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX IRQ interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stats-block-usecs"> + <properties> + <help>Time in microseconds between updating coalescing statistics</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Statistics block interval</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="pkt-rate-low"> + <properties> + <help>Lower packet rate threshold for adaptive coalescing</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low packet rate threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-low"> + <properties> + <help>RX coalescing delay (usecs) for low packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>Low-rate RX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frame-low"> + <properties> + <help>RX coalescing frames threshold for low packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low-rate RX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-low"> + <properties> + <help>TX coalescing delay (usecs) for low packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>Low-rate TX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frame-low"> + <properties> + <help>TX coalescing frames threshold for low packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low-rate TX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="pkt-rate-high"> + <properties> + <help>Upper packet rate threshold for adaptive coalescing</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High packet rate threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-high"> + <properties> + <help>RX coalescing delay (usecs) for high packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>High-rate RX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frame-high"> + <properties> + <help>RX coalescing frames threshold for high packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High-rate RX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-high"> + <properties> + <help>TX coalescing delay (usecs) for high packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>High-rate TX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frame-high"> + <properties> + <help>TX coalescing frames threshold for high packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High-rate TX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="sample-interval"> + <properties> + <help>Sampling interval for adaptive coalescing (in seconds)</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Adaptive sampling interval</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="cqe-mode-rx"> + <properties> + <help>Enable RX CQE (Completion Queue Entry) mode</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="cqe-mode-tx"> + <properties> + <help>Enable TX CQE (Completion Queue Entry) mode</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="tx-aggr-max-bytes"> + <properties> + <help>Maximum number of bytes to aggregate before transmitting</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX aggregation maximum bytes</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-aggr-max-frames"> + <properties> + <help>Maximum number of frames to aggregate before transmitting</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX aggregation maximum frames</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-aggr-time-usecs"> + <properties> + <help>Maximum time in microseconds to wait before transmitting aggregated frames</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX aggregation timeout</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + </children> + </node> #include <include/interface/redirect.xml.i> #include <include/interface/vif-s.xml.i> #include <include/interface/vif.xml.i> diff --git a/interface-definitions/interfaces_geneve.xml.in b/interface-definitions/interfaces_geneve.xml.in index 990c5bd91..b85bd3b9e 100644 --- a/interface-definitions/interfaces_geneve.xml.in +++ b/interface-definitions/interfaces_geneve.xml.in @@ -21,8 +21,13 @@ #include <include/interface/disable.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-1200-16000.xml.i> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>6081</defaultValue> + </leafNode> <node name="parameters"> <properties> <help>GENEVE tunnel parameters</help> diff --git a/interface-definitions/interfaces_l2tpv3.xml.in b/interface-definitions/interfaces_l2tpv3.xml.in index 5f816c956..381e86bd0 100644 --- a/interface-definitions/interfaces_l2tpv3.xml.in +++ b/interface-definitions/interfaces_l2tpv3.xml.in @@ -55,6 +55,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/interfaces_macsec.xml.in b/interface-definitions/interfaces_macsec.xml.in index d825f8262..5279a9495 100644 --- a/interface-definitions/interfaces_macsec.xml.in +++ b/interface-definitions/interfaces_macsec.xml.in @@ -21,6 +21,7 @@ #include <include/interface/dhcpv6-options.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mirror.xml.i> <node name="security"> <properties> diff --git a/interface-definitions/interfaces_openvpn.xml.in b/interface-definitions/interfaces_openvpn.xml.in index 3c844107e..005d7c015 100644 --- a/interface-definitions/interfaces_openvpn.xml.in +++ b/interface-definitions/interfaces_openvpn.xml.in @@ -131,10 +131,54 @@ <multi/> </properties> </leafNode> + <leafNode name="data-ciphers-fallback"> + <properties> + <help>Fallback cipher to use for site-to-site tunnels</help> + <completionHelp> + <list>none 3des aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list> + </completionHelp> + <valueHelp> + <format>none</format> + <description>Disable encryption</description> + </valueHelp> + <valueHelp> + <format>3des</format> + <description>DES algorithm with triple encryption</description> + </valueHelp> + <valueHelp> + <format>aes128</format> + <description>AES algorithm with 128-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes128gcm</format> + <description>AES algorithm with 128-bit key GCM</description> + </valueHelp> + <valueHelp> + <format>aes192</format> + <description>AES algorithm with 192-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes192gcm</format> + <description>AES algorithm with 192-bit key GCM</description> + </valueHelp> + <valueHelp> + <format>aes256</format> + <description>AES algorithm with 256-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes256gcm</format> + <description>AES algorithm with 256-bit key GCM</description> + </valueHelp> + <constraint> + <regex>(none|3des|aes128|aes128gcm|aes192|aes192gcm|aes256|aes256gcm)</regex> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="hash"> <properties> @@ -330,11 +374,11 @@ </valueHelp> <valueHelp> <format>_ipv4</format> - <description>Accept connections on or initate connections to IPv4 addresses only</description> + <description>Accept connections on or initiate connections to IPv4 addresses only</description> </valueHelp> <valueHelp> <format>_ipv6</format> - <description>Accept connections on or initate connections to IPv6 addresses only</description> + <description>Accept connections on or initiate connections to IPv6 addresses only</description> </valueHelp> <valueHelp> <format>dual-stack</format> @@ -767,7 +811,7 @@ </valueHelp> <valueHelp> <format>enable</format> - <description>Enable chalenge-response</description> + <description>Enable challenge-response</description> </valueHelp> <constraint> <regex>(disable|enable)</regex> diff --git a/interface-definitions/interfaces_pppoe.xml.in b/interface-definitions/interfaces_pppoe.xml.in index 56660bc15..d38074b41 100644 --- a/interface-definitions/interfaces_pppoe.xml.in +++ b/interface-definitions/interfaces_pppoe.xml.in @@ -16,11 +16,30 @@ </valueHelp> </properties> <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <completionHelp> + <list>dhcpv6</list> + </completionHelp> + <valueHelp> + <format>dhcpv6</format> + <description>Dynamic Host Configuration Protocol for IPv6</description> + </valueHelp> + <constraint> + <regex>(dhcpv6)</regex> + </constraint> + <multi/> + </properties> + </leafNode> #include <include/pppoe-access-concentrator.xml.i> #include <include/interface/authentication.xml.i> #include <include/interface/dial-on-demand.xml.i> #include <include/interface/no-default-route.xml.i> #include <include/interface/default-route-distance.xml.i> + <leafNode name="default-route-distance"> + <defaultValue>1</defaultValue> + </leafNode> #include <include/interface/dhcpv6-options.xml.i> #include <include/generic-description.xml.i> #include <include/interface/disable.xml.i> @@ -85,6 +104,7 @@ </properties> <children> #include <include/interface/ipv6-address-autoconf.xml.i> + #include <include/interface/ipv6-address-interface-identifier.xml.i> </children> </node> #include <include/interface/adjust-mss.xml.i> diff --git a/interface-definitions/interfaces_pseudo-ethernet.xml.in b/interface-definitions/interfaces_pseudo-ethernet.xml.in index 031af3563..f6e3b6970 100644 --- a/interface-definitions/interfaces_pseudo-ethernet.xml.in +++ b/interface-definitions/interfaces_pseudo-ethernet.xml.in @@ -25,7 +25,8 @@ #include <include/interface/vrf.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> - #include <include/source-interface-ethernet.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> + #include <include/source-interface-broadcast.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="mode"> diff --git a/interface-definitions/interfaces_tunnel.xml.in b/interface-definitions/interfaces_tunnel.xml.in index fe1dad371..74849be5d 100644 --- a/interface-definitions/interfaces_tunnel.xml.in +++ b/interface-definitions/interfaces_tunnel.xml.in @@ -158,7 +158,7 @@ <help>ERSPAN version 1 index field</help> <valueHelp> <format>u32:0-63</format> - <description>Platform-depedent field for specifying port number and direction</description> + <description>Platform-dependent field for specifying port number and direction</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-63"/> diff --git a/interface-definitions/interfaces_virtual-ethernet.xml.in b/interface-definitions/interfaces_virtual-ethernet.xml.in index c4610feec..1559a6038 100644 --- a/interface-definitions/interfaces_virtual-ethernet.xml.in +++ b/interface-definitions/interfaces_virtual-ethernet.xml.in @@ -21,6 +21,10 @@ #include <include/interface/dhcp-options.xml.i> #include <include/interface/dhcpv6-options.xml.i> #include <include/interface/disable.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1500</defaultValue> + </leafNode> #include <include/interface/netns.xml.i> #include <include/interface/vif-s.xml.i> #include <include/interface/vif.xml.i> @@ -38,7 +42,7 @@ <constraint> <regex>veth[0-9]+</regex> </constraint> - <constraintErrorMessage>Virutal Ethernet interface must be named vethN</constraintErrorMessage> + <constraintErrorMessage>Virtual Ethernet interface must be named vethN</constraintErrorMessage> </properties> </leafNode> </children> diff --git a/interface-definitions/interfaces_vxlan.xml.in b/interface-definitions/interfaces_vxlan.xml.in index 937acb123..321c2d8f3 100644 --- a/interface-definitions/interfaces_vxlan.xml.in +++ b/interface-definitions/interfaces_vxlan.xml.in @@ -45,6 +45,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-1200-16000.xml.i> #include <include/interface/mirror.xml.i> @@ -62,7 +63,7 @@ #include <include/interface/parameters-tos.xml.i> #include <include/interface/parameters-ttl.xml.i> <leafNode name="ttl"> - <defaultValue>16</defaultValue> + <defaultValue>64</defaultValue> </leafNode> </children> </node> @@ -127,6 +128,7 @@ <constraintErrorMessage>Not a valid VLAN ID or range, VLAN ID must be between 0 and 4094</constraintErrorMessage> </properties> <children> + #include <include/generic-description.xml.i> <leafNode name="vni"> <properties> <help>Virtual Network Identifier</help> diff --git a/interface-definitions/interfaces_wireguard.xml.in b/interface-definitions/interfaces_wireguard.xml.in index ce49de038..33cb5864a 100644 --- a/interface-definitions/interfaces_wireguard.xml.in +++ b/interface-definitions/interfaces_wireguard.xml.in @@ -40,13 +40,23 @@ </properties> <defaultValue>0</defaultValue> </leafNode> - <leafNode name="private-key"> + <leafNode name="max-dns-retry"> <properties> - <help>Base64 encoded private key</help> + <help>DNS retries when resolve fails</help> + <valueHelp> + <format>u32:1-15</format> + <description>Maximum number of retries</description> + </valueHelp> <constraint> - <validator name="base64"/> + <validator name="numeric" argument="--range 1-15"/> </constraint> - <constraintErrorMessage>Key is not base64-encoded</constraintErrorMessage> + </properties> + <defaultValue>3</defaultValue> + </leafNode> + <leafNode name="private-key"> + <properties> + <help>Base64 encoded private key</help> + #include <include/constraint/wireguard-keys.xml.i> </properties> </leafNode> <tagNode name="peer"> @@ -62,20 +72,14 @@ #include <include/generic-description.xml.i> <leafNode name="public-key"> <properties> - <help>base64 encoded public key</help> - <constraint> - <validator name="base64"/> - </constraint> - <constraintErrorMessage>Key is not base64-encoded</constraintErrorMessage> + <help>Base64 encoded public key</help> + #include <include/constraint/wireguard-keys.xml.i> </properties> </leafNode> <leafNode name="preshared-key"> <properties> - <help>base64 encoded preshared key</help> - <constraint> - <validator name="base64"/> - </constraint> - <constraintErrorMessage>Key is not base64-encoded</constraintErrorMessage> + <help>Base64 encoded preshared key</help> + #include <include/constraint/wireguard-keys.xml.i> </properties> </leafNode> <leafNode name="allowed-ips"> @@ -104,6 +108,18 @@ </constraint> </properties> </leafNode> + <leafNode name="host-name"> + <properties> + <help>Hostname of tunnel endpoint</help> + <valueHelp> + <format>hostname</format> + <description>FQDN of WireGuard endpoint</description> + </valueHelp> + <constraint> + <validator name="fqdn"/> + </constraint> + </properties> + </leafNode> #include <include/port-number.xml.i> <leafNode name="persistent-keepalive"> <properties> diff --git a/interface-definitions/interfaces_wireless.xml.in b/interface-definitions/interfaces_wireless.xml.in index 474953500..1b5356caa 100644 --- a/interface-definitions/interfaces_wireless.xml.in +++ b/interface-definitions/interfaces_wireless.xml.in @@ -626,6 +626,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/hw-id.xml.i> <leafNode name="isolate-stations"> <properties> diff --git a/interface-definitions/interfaces_wwan.xml.in b/interface-definitions/interfaces_wwan.xml.in index 1580c3bcb..552806d4e 100644 --- a/interface-definitions/interfaces_wwan.xml.in +++ b/interface-definitions/interfaces_wwan.xml.in @@ -38,6 +38,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/dial-on-demand.xml.i> #include <include/interface/redirect.xml.i> #include <include/interface/vrf.xml.i> diff --git a/interface-definitions/load-balancing_reverse-proxy.xml.in b/interface-definitions/load-balancing_haproxy.xml.in index 18274622c..f3baf86ca 100644 --- a/interface-definitions/load-balancing_reverse-proxy.xml.in +++ b/interface-definitions/load-balancing_haproxy.xml.in @@ -2,9 +2,9 @@ <interfaceDefinition> <node name="load-balancing"> <children> - <node name="reverse-proxy" owner="${vyos_conf_scripts_dir}/load-balancing_reverse-proxy.py"> + <node name="haproxy" owner="${vyos_conf_scripts_dir}/load-balancing_haproxy.py"> <properties> - <help>Configure reverse-proxy</help> + <help>HAProxy TCP/HTTP Load Balancer</help> <priority>900</priority> </properties> <children> @@ -26,16 +26,16 @@ <constraintErrorMessage>Backend name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> <valueHelp> <format>txt</format> - <description>Name of reverse-proxy backend system</description> + <description>HAProxy backend system name</description> </valueHelp> <completionHelp> - <path>load-balancing reverse-proxy backend</path> + <path>load-balancing haproxy backend</path> </completionHelp> <multi/> </properties> </leafNode> #include <include/generic-description.xml.i> - #include <include/listen-address.xml.i> + #include <include/haproxy/listen-address.xml.i> #include <include/haproxy/logging.xml.i> #include <include/haproxy/mode.xml.i> #include <include/port-number.xml.i> @@ -48,6 +48,46 @@ <valueless/> </properties> </leafNode> + <node name="timeout"> + <properties> + <help>Timeout options</help> + </properties> + <children> + #include <include/haproxy/timeout-client.xml.i> + </children> + </node> + <node name="http-compression"> + <properties> + <help>Compress HTTP responses</help> + </properties> + <children> + <leafNode name="algorithm"> + <properties> + <help>Compression algorithm</help> + <completionHelp> + <list>gzip deflate identity raw-deflate</list> + </completionHelp> + <constraint> + <regex>(gzip|deflate|identity|raw-deflate)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="mime-type"> + <properties> + <help>MIME types to compress</help> + <valueHelp> + <format>txt</format> + <description>MIME type to compress</description> + </valueHelp> + <multi/> + <constraint> + <regex>\w+\/[-+.\w]+</regex> + </constraint> + <constraintErrorMessage>Invalid MIME type specified</constraintErrorMessage> + </properties> + </leafNode> + </children> + </node> <node name="ssl"> <properties> <help>SSL Certificate, SSL Key and CA</help> @@ -119,7 +159,7 @@ <properties> <help>URI used for HTTP health check (Example: '/' or '/health')</help> <constraint> - <regex>^\/([^?#\s]*)(\?[^#\s]*)?$</regex> + <regex>\/([^?#\s]*)(\?[^#\s]*)?</regex> </constraint> </properties> </leafNode> @@ -213,12 +253,14 @@ <valueless/> </properties> </leafNode> - <leafNode name="check"> + <node name="check"> <properties> <help>Active health check backend server</help> - <valueless/> </properties> - </leafNode> + <children> + #include <include/port-number.xml.i> + </children> + </node> #include <include/port-number.xml.i> <leafNode name="send-proxy"> <properties> @@ -253,7 +295,7 @@ </tagNode> <node name="global-parameters"> <properties> - <help>Global perfomance parameters and limits</help> + <help>Global performance parameters and limits</help> </properties> <children> #include <include/haproxy/logging.xml.i> @@ -336,6 +378,29 @@ </leafNode> </children> </node> + <node name="timeout"> + <properties> + <help>Timeout options</help> + </properties> + <children> + #include <include/haproxy/timeout-check.xml.i> + <leafNode name="check"> + <defaultValue>5</defaultValue> + </leafNode> + #include <include/haproxy/timeout-connect.xml.i> + <leafNode name="connect"> + <defaultValue>10</defaultValue> + </leafNode> + #include <include/haproxy/timeout-client.xml.i> + <leafNode name="client"> + <defaultValue>50</defaultValue> + </leafNode> + #include <include/haproxy/timeout-server.xml.i> + <leafNode name="server"> + <defaultValue>50</defaultValue> + </leafNode> + </children> + </node> #include <include/interface/vrf.xml.i> </children> </node> diff --git a/interface-definitions/load-balancing_wan.xml.in b/interface-definitions/load-balancing_wan.xml.in index 310aa0343..17bd3aaf3 100644 --- a/interface-definitions/load-balancing_wan.xml.in +++ b/interface-definitions/load-balancing_wan.xml.in @@ -7,7 +7,7 @@ <children> <node name="wan" owner="${vyos_conf_scripts_dir}/load-balancing_wan.py"> <properties> - <help>Configure Wide Area Network (WAN) load-balancing</help> + <help>Wide Area Network (WAN) load-balancing</help> <priority>900</priority> </properties> <children> @@ -29,6 +29,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="only-default-route"> + <properties> + <help>Prefer specific routes in the main routing table over WAN load balancing</help> + <valueless/> + </properties> + </leafNode> <leafNode name="hook"> <properties> <help>Script to be executed on interface status change</help> @@ -203,6 +209,7 @@ <help>Destination</help> </properties> <children> + #include <include/firewall/source-destination-group-ipv4.xml.i> #include <include/ipv4-address-prefix-range.xml.i> #include <include/port-port-range.xml.i> </children> @@ -373,6 +380,7 @@ <help>Source information</help> </properties> <children> + #include <include/firewall/source-destination-group-ipv4.xml.i> #include <include/ipv4-address-prefix-range.xml.i> #include <include/port-port-range.xml.i> </children> diff --git a/interface-definitions/nat.xml.in b/interface-definitions/nat.xml.in index 73a748137..93dd847d6 100644 --- a/interface-definitions/nat.xml.in +++ b/interface-definitions/nat.xml.in @@ -65,17 +65,6 @@ <children> #include <include/nat-rule.xml.i> <tagNode name="rule"> - <properties> - <help>Rule number for NAT</help> - <valueHelp> - <format>u32:1-999999</format> - <description>Number of NAT rule</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-999999"/> - </constraint> - <constraintErrorMessage>NAT rule number must be between 1 and 999999</constraintErrorMessage> - </properties> <children> #include <include/firewall/outbound-interface.xml.i> <node name="translation"> diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index c59725c53..3848b4c9a 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -53,6 +53,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="source"> @@ -78,6 +79,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="translation"> @@ -215,6 +217,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="translation"> diff --git a/interface-definitions/pki.xml.in b/interface-definitions/pki.xml.in index b922771c1..161f20b33 100644 --- a/interface-definitions/pki.xml.in +++ b/interface-definitions/pki.xml.in @@ -35,6 +35,12 @@ <multi/> </properties> </leafNode> + <leafNode name="system-install"> + <properties> + <help>Install into CA certificate store on router</help> + <valueless/> + </properties> + </leafNode> #include <include/pki/cli-revoke.xml.i> </children> </tagNode> @@ -74,7 +80,7 @@ </constraint> </properties> </leafNode> - #include <include/listen-address-ipv4-single.xml.i> + #include <include/listen-address-single.xml.i> <leafNode name="rsa-key-size"> <properties> <help>Size of the RSA key</help> @@ -196,30 +202,6 @@ </node> </children> </tagNode> - <tagNode name="openssh"> - <properties> - <help>OpenSSH public and private keys</help> - </properties> - <children> - <node name="public"> - <properties> - <help>Public key</help> - </properties> - <children> - #include <include/pki/cli-public-key-base64.xml.i> - </children> - </node> - <node name="private"> - <properties> - <help>Private key</help> - </properties> - <children> - #include <include/pki/cli-private-key-base64.xml.i> - #include <include/pki/password-protected.xml.i> - </children> - </node> - </children> - </tagNode> <node name="openvpn"> <properties> <help>OpenVPN keys</help> diff --git a/interface-definitions/policy.xml.in b/interface-definitions/policy.xml.in index eb907cb9e..53dcfd8ee 100644 --- a/interface-definitions/policy.xml.in +++ b/interface-definitions/policy.xml.in @@ -202,11 +202,11 @@ <properties> <help>Regular expression to match against a community-list</help> <completionHelp> - <list>local-AS no-advertise no-export internet additive</list> + <list>local-AS no-advertise no-export graceful-shutdown accept-own-nexthop accept-own route-filter-translated-v4 route-filter-v4 route-filter-translated-v6 route-filter-v6 llgr-stale no-llgr blackhole no-peer additive</list> </completionHelp> <valueHelp> <format><aa:nn></format> - <description>Community number in AA:NN format</description> + <description>Community number in AA:NN format where AA and NN are (0-65535)</description> </valueHelp> <valueHelp> <format>local-AS</format> @@ -221,8 +221,48 @@ <description>Well-known communities value NO_EXPORT 0xFFFFFF01</description> </valueHelp> <valueHelp> - <format>internet</format> - <description>Well-known communities value 0</description> + <format>graceful-shutdown</format> + <description>Well-known communities value GRACEFUL_SHUTDOWN 0xFFFF0000</description> + </valueHelp> + <valueHelp> + <format>accept-own-nexthop</format> + <description>Well-known communities value ACCEPT_OWN_NEXTHOP 0xFFFF0008</description> + </valueHelp> + <valueHelp> + <format>accept-own</format> + <description>Well-known communities value ACCEPT_OWN 0xFFFF0001 65535:1</description> + </valueHelp> + <valueHelp> + <format>route-filter-translated-v4</format> + <description>Well-known communities value ROUTE_FILTER_TRANSLATED_v4 0xFFFF0002 65535:2</description> + </valueHelp> + <valueHelp> + <format>route-filter-v4</format> + <description>Well-known communities value ROUTE_FILTER_v4 0xFFFF0003 65535:3</description> + </valueHelp> + <valueHelp> + <format>route-filter-translated-v6</format> + <description>Well-known communities value ROUTE_FILTER_TRANSLATED_v6 0xFFFF0004 65535:4</description> + </valueHelp> + <valueHelp> + <format>route-filter-v6</format> + <description>Well-known communities value ROUTE_FILTER_v6 0xFFFF0005 65535:5</description> + </valueHelp> + <valueHelp> + <format>llgr-stale</format> + <description>Well-known communities value LLGR_STALE 0xFFFF0006 65535:6</description> + </valueHelp> + <valueHelp> + <format>no-llgr</format> + <description>Well-known communities value NO_LLGR 0xFFFF0007 65535:7</description> + </valueHelp> + <valueHelp> + <format>blackhole</format> + <description>Well-known communities value BLACKHOLE 0xFFFF029A 65535:666</description> + </valueHelp> + <valueHelp> + <format>no-peer</format> + <description>Well-known communities value NOPEER 0xFFFFFF04 65535:65284</description> </valueHelp> <valueHelp> <format>additive</format> @@ -567,22 +607,50 @@ <properties> <help>Match route-type</help> <completionHelp> - <list>macip multicast prefix</list> + <list>1 2 3 4 5 ead macip multicast es prefix</list> </completionHelp> <valueHelp> + <format>1</format> + <description>EAD (Type-1) route</description> + </valueHelp> + <valueHelp> + <format>2</format> + <description>MAC-IP (Type-2) route</description> + </valueHelp> + <valueHelp> + <format>3</format> + <description>Multicast (Type-3) route</description> + </valueHelp> + <valueHelp> + <format>4</format> + <description>Ethernet Segment (Type-4) route</description> + </valueHelp> + <valueHelp> + <format>5</format> + <description>Prefix (Type-5) route</description> + </valueHelp> + <valueHelp> + <format>ead</format> + <description>EAD (Type-1) route</description> + </valueHelp> + <valueHelp> <format>macip</format> - <description>mac-ip route</description> + <description>MAC-IP (Type-2) route</description> </valueHelp> <valueHelp> <format>multicast</format> - <description>IMET route</description> + <description>Multicast (Type-3) route</description> + </valueHelp> + <valueHelp> + <format>es</format> + <description>Ethernet Segment (Type-4) route</description> </valueHelp> <valueHelp> <format>prefix</format> - <description>Prefix route</description> + <description>Prefix (Type-5) route</description> </valueHelp> <constraint> - <regex>(macip|multicast|prefix)</regex> + <regex>([1-5]|ead|macip|multicast|es|prefix)</regex> </constraint> </properties> </leafNode> @@ -970,6 +1038,30 @@ </constraint> </properties> </leafNode> + <leafNode name="source-peer"> + <properties> + <help>Source peer to match (BGP)</help> + <valueHelp> + <format>ipv4</format> + <description>Peer IPv4 address</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Peer IPv6 address</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Interface name of peer</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>BGP peer-group name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_bgp_neighbors.sh --ipv4 --ipv6 --interfaces --peer-groups --all-vrfs</script> + </completionHelp> + </properties> + </leafNode> <leafNode name="protocol"> <properties> <help>Match protocol via which the route was learnt</help> @@ -1052,6 +1144,43 @@ </constraint> </properties> </leafNode> + <leafNode name="rpki-extcommunity"> + <properties> + <help>Match RPKI (Origin Validation State) extended community</help> + <completionHelp> + <list>invalid notfound valid</list> + </completionHelp> + <valueHelp> + <format>invalid</format> + <description>Match invalid entries</description> + </valueHelp> + <valueHelp> + <format>notfound</format> + <description>Match notfound entries</description> + </valueHelp> + <valueHelp> + <format>valid</format> + <description>Match valid entries</description> + </valueHelp> + <constraint> + <regex>(invalid|notfound|valid)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="source-vrf"> + <properties> + <help>Source vrf</help> + #include <include/constraint/vrf.xml.i> + <valueHelp> + <format>txt</format> + <description>VRF instance name</description> + </valueHelp> + <completionHelp> + <path>vrf name</path> + <list>default</list> + </completionHelp> + </properties> + </leafNode> #include <include/policy/tag.xml.i> </children> </node> @@ -1465,7 +1594,7 @@ <constraint> <validator name="numeric" argument="--relative --"/> <validator name="numeric" argument="--range 0-4294967295"/> - <regex>^[+|-]?rtt$</regex> + <regex>[+|-]?rtt</regex> </constraint> </properties> </leafNode> @@ -1490,7 +1619,7 @@ </leafNode> <leafNode name="origin"> <properties> - <help>Border Gateway Protocl (BGP) origin code</help> + <help>Border Gateway Protocol (BGP) origin code</help> <completionHelp> <list>igp egp incomplete</list> </completionHelp> diff --git a/interface-definitions/policy_local-route.xml.in b/interface-definitions/policy_local-route.xml.in index 7a019154a..9f6588db8 100644 --- a/interface-definitions/policy_local-route.xml.in +++ b/interface-definitions/policy_local-route.xml.in @@ -39,6 +39,7 @@ </completionHelp> </properties> </leafNode> + #include <include/firewall/vrf.xml.i> </children> </node> <leafNode name="fwmark"> @@ -113,6 +114,7 @@ </completionHelp> </properties> </leafNode> + #include <include/firewall/vrf.xml.i> </children> </node> <leafNode name="fwmark"> diff --git a/interface-definitions/policy_route.xml.in b/interface-definitions/policy_route.xml.in index 9cc22540b..6ec52feeb 100644 --- a/interface-definitions/policy_route.xml.in +++ b/interface-definitions/policy_route.xml.in @@ -35,6 +35,7 @@ #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> </children> </node> <node name="source"> @@ -44,11 +45,195 @@ <children> #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> + #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> + </children> + </node> + <node name="icmpv6"> + <properties> + <help>ICMPv6 type and code information</help> + </properties> + <children> + <leafNode name="type"> + <properties> + <help>ICMP type-name</help> + <completionHelp> + <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list> + </completionHelp> + <valueHelp> + <format>any</format> + <description>Any ICMP type/code</description> + </valueHelp> + <valueHelp> + <format>echo-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>pong</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>destination-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>protocol-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>port-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>fragmentation-needed</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>source-route-failed</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-unknown</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-unknown</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-network-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-host-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>communication-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-precedence-violation</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>precedence-cutoff</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>source-quench</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-network-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS host-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>echo-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ping</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>router-advertisement</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>router-solicitation</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>time-exceeded</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-exceeded</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-zero-during-transit</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-zero-during-reassembly</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>parameter-problem</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ip-header-bad</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>required-option-missing</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>timestamp-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>timestamp-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>address-mask-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>address-mask-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>packet-too-big</format> + <description>ICMP type/code name</description> + </valueHelp> + <constraint> + <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/policy/route-common.xml.i> - #include <include/policy/route-ipv6.xml.i> #include <include/firewall/dscp.xml.i> #include <include/firewall/packet-options.xml.i> #include <include/firewall/hop-limit.xml.i> @@ -88,8 +273,14 @@ </properties> <children> #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> </children> </node> <node name="source"> @@ -98,12 +289,19 @@ </properties> <children> #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> + #include <include/firewall/mac-address.xml.i> </children> </node> #include <include/policy/route-common.xml.i> - #include <include/policy/route-ipv4.xml.i> + #include <include/firewall/icmp.xml.i> #include <include/firewall/dscp.xml.i> #include <include/firewall/packet-options.xml.i> #include <include/firewall/ttl.xml.i> diff --git a/interface-definitions/protocols_babel.xml.in b/interface-definitions/protocols_babel.xml.in index 49fffe230..2795a7dd4 100644 --- a/interface-definitions/protocols_babel.xml.in +++ b/interface-definitions/protocols_babel.xml.in @@ -71,42 +71,7 @@ <help>Redistribute IPv4 routes</help> </properties> <children> - <leafNode name="bgp"> - <properties> - <help>Redistribute BGP routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="connected"> - <properties> - <help>Redistribute connected routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="eigrp"> - <properties> - <help>Redistribute EIGRP routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="isis"> - <properties> - <help>Redistribute IS-IS routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="kernel"> - <properties> - <help>Redistribute kernel routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="nhrp"> - <properties> - <help>Redistribute NHRP routes</help> - <valueless/> - </properties> - </leafNode> + #include <include/babel/redistribute-common.xml.i> <leafNode name="ospf"> <properties> <help>Redistribute OSPF routes</help> @@ -119,12 +84,6 @@ <valueless/> </properties> </leafNode> - <leafNode name="static"> - <properties> - <help>Redistribute static routes</help> - <valueless/> - </properties> - </leafNode> </children> </node> <node name="ipv6"> @@ -132,51 +91,16 @@ <help>Redistribute IPv6 routes</help> </properties> <children> - <leafNode name="bgp"> - <properties> - <help>Redistribute BGP routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="connected"> - <properties> - <help>Redistribute connected routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="isis"> - <properties> - <help>Redistribute IS-IS routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="kernel"> - <properties> - <help>Redistribute kernel routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="nhrp"> - <properties> - <help>Redistribute NHRP routes</help> - <valueless/> - </properties> - </leafNode> + #include <include/babel/redistribute-common.xml.i> <leafNode name="ospfv3"> <properties> - <help>Redistribute OSPFv3 routes</help> + <help>Open Shortest Path First (IPv6) (OSPFv3)</help> <valueless/> </properties> </leafNode> <leafNode name="ripng"> <properties> - <help>Redistribute RIPng routes</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="static"> - <properties> - <help>Redistribute static routes</help> + <help>Routing Information Protocol next-generation (IPv6) (RIPng)</help> <valueless/> </properties> </leafNode> diff --git a/interface-definitions/protocols_failover.xml.in b/interface-definitions/protocols_failover.xml.in index f70975949..0f8a3b2ad 100644 --- a/interface-definitions/protocols_failover.xml.in +++ b/interface-definitions/protocols_failover.xml.in @@ -8,132 +8,7 @@ <priority>490</priority> </properties> <children> - <tagNode name="route"> - <properties> - <help>Failover IPv4 route</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 failover route</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - </constraint> - </properties> - <children> - <tagNode name="next-hop"> - <properties> - <help>Next-hop IPv4 router address</help> - <valueHelp> - <format>ipv4</format> - <description>Next-hop router address</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - <children> - <node name="check"> - <properties> - <help>Check target options</help> - </properties> - <children> - <leafNode name="policy"> - <properties> - <help>Policy for check targets</help> - <completionHelp> - <list>any-available all-available</list> - </completionHelp> - <valueHelp> - <format>all-available</format> - <description>All targets must be alive</description> - </valueHelp> - <valueHelp> - <format>any-available</format> - <description>Any target must be alive</description> - </valueHelp> - <constraint> - <regex>(all-available|any-available)</regex> - </constraint> - </properties> - <defaultValue>any-available</defaultValue> - </leafNode> - #include <include/port-number.xml.i> - <leafNode name="target"> - <properties> - <help>Check target address</help> - <valueHelp> - <format>ipv4</format> - <description>Address to check</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="timeout"> - <properties> - <help>Timeout between checks</help> - <valueHelp> - <format>u32:1-300</format> - <description>Timeout in seconds between checks</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - <defaultValue>10</defaultValue> - </leafNode> - <leafNode name="type"> - <properties> - <help>Check type</help> - <completionHelp> - <list>arp icmp tcp</list> - </completionHelp> - <valueHelp> - <format>arp</format> - <description>Check target by ARP</description> - </valueHelp> - <valueHelp> - <format>icmp</format> - <description>Check target by ICMP</description> - </valueHelp> - <valueHelp> - <format>tcp</format> - <description>Check target by TCP</description> - </valueHelp> - <constraint> - <regex>(arp|icmp|tcp)</regex> - </constraint> - </properties> - <defaultValue>icmp</defaultValue> - </leafNode> - </children> - </node> - #include <include/static/static-route-interface.xml.i> - <leafNode name="metric"> - <properties> - <help>Route metric for this gateway</help> - <valueHelp> - <format>u32:1-255</format> - <description>Route metric</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - <defaultValue>1</defaultValue> - </leafNode> - <leafNode name="onlink"> - <properties> - <help>The next hop is directly connected to the interface, even if it does not match interface prefix</help> - <valueless/> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/failover/protocol-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/protocols_igmp-proxy.xml.in b/interface-definitions/protocols_igmp-proxy.xml.in index 5cde484f5..a1deeb3fc 100644 --- a/interface-definitions/protocols_igmp-proxy.xml.in +++ b/interface-definitions/protocols_igmp-proxy.xml.in @@ -26,7 +26,7 @@ <children> <leafNode name="alt-subnet"> <properties> - <help>Unicast source networks allowed for multicast traffic to be proxyed</help> + <help>Unicast source networks allowed for multicast traffic to be proxied</help> <valueHelp> <format>ipv4net</format> <description>IPv4 network</description> diff --git a/interface-definitions/protocols_mpls.xml.in b/interface-definitions/protocols_mpls.xml.in index 831601fc6..fc1864f38 100644 --- a/interface-definitions/protocols_mpls.xml.in +++ b/interface-definitions/protocols_mpls.xml.in @@ -524,7 +524,29 @@ </node> </children> </node> - #include <include/generic-interface-multi.xml.i> + <tagNode name="interface"> + <properties> + <help>Interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + <children> + <leafNode name="disable-establish-hello"> + <properties> + <help>Disable response to hello packet with an additional hello LDP packet</help> + <valueless/> + </properties> + </leafNode> + </children> + </tagNode> </children> </node> <node name="parameters"> diff --git a/interface-definitions/protocols_nhrp.xml.in b/interface-definitions/protocols_nhrp.xml.in index d7663c095..5304fbd78 100644 --- a/interface-definitions/protocols_nhrp.xml.in +++ b/interface-definitions/protocols_nhrp.xml.in @@ -20,115 +20,163 @@ </valueHelp> </properties> <children> - <leafNode name="cisco-authentication"> + <node name="map"> <properties> - <help>Pass phrase for cisco authentication</help> - <valueHelp> - <format>txt</format> - <description>Pass phrase for cisco authentication</description> - </valueHelp> - <constraint> - <regex>[^[:space:]]{1,8}</regex> - </constraint> - <constraintErrorMessage>Password should contain up to eight non-whitespace characters</constraintErrorMessage> - </properties> - </leafNode> - <tagNode name="dynamic-map"> - <properties> - <help>Set an HUB tunnel address</help> - <valueHelp> - <format>ipv4net</format> - <description>Set the IP address and prefix length</description> - </valueHelp> + <help>Map tunnel IP to NBMA </help> </properties> <children> - <leafNode name="nbma-domain-name"> + <tagNode name ="tunnel-ip"> <properties> - <help>Set HUB fqdn (nbma-address - fqdn)</help> + <help>Set a NHRP tunnel address</help> <valueHelp> - <format><fqdn></format> - <description>Set the external HUB fqdn</description> + <format>ipv4</format> + <description>Set the IP address to map</description> </valueHelp> + <constraint> + <validator name="ip-address"/> + </constraint> </properties> - </leafNode> + <children> + <leafNode name="nbma"> + <properties> + <help>Set NHRP NBMA address to map</help> + <completionHelp> + <list>local</list> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>Set the IP address to map</description> + </valueHelp> + <valueHelp> + <format>local</format> + <description>Set the local address</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <regex>(local)</regex> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> </children> - </tagNode> - <leafNode name="holding-time"> + </node> + <node name="nhs"> <properties> - <help>Holding time in seconds</help> - </properties> - </leafNode> - <tagNode name="map"> - <properties> - <help>Set an HUB tunnel address</help> + <help>Map tunnel IP to NBMA of Next Hop Server</help> </properties> <children> - <leafNode name="cisco"> - <properties> - <help>If the statically mapped peer is running Cisco IOS, specify this</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="nbma-address"> + <tagNode name ="tunnel-ip"> <properties> - <help>Set HUB address (nbma-address - external hub address or fqdn)</help> - </properties> - </leafNode> - <leafNode name="register"> - <properties> - <help>Specifies that Registration Request should be sent to this peer on startup</help> - <valueless/> + <help>Set a NHRP NHS tunnel address</help> + <completionHelp> + <list>dynamic</list> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>Set the IP address to map</description> + </valueHelp> + <valueHelp> + <format>dynamic</format> + <description> Set Next Hop Server to have a dynamic address </description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <regex>(dynamic)</regex> + </constraint> </properties> - </leafNode> + <children> + <leafNode name="nbma"> + <properties> + <help>Set NHRP NBMA address of NHS</help> + <valueHelp> + <format>ipv4</format> + <description>Set the IP address to map</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </tagNode> </children> - </tagNode> + </node> <leafNode name="multicast"> <properties> - <help>Set multicast for NHRP</help> + <help>Map multicast to NBMA</help> <completionHelp> - <list>dynamic nhs</list> + <list>dynamic</list> </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>Set the IP address to map(IP|FQDN)</description> + </valueHelp> + <valueHelp> + <format>dynamic</format> + <description>NBMA address is learnt dynamically</description> + </valueHelp> <constraint> - <regex>(dynamic|nhs)</regex> + <validator name="ip-address"/> + <regex>(dynamic)</regex> </constraint> + <multi/> </properties> </leafNode> - <leafNode name="non-caching"> + <leafNode name="registration-no-unique"> <properties> - <help>This can be used to reduce memory consumption on big NBMA subnets</help> + <help>Don't set unique flag</help> <valueless/> </properties> </leafNode> - <leafNode name="redirect"> + <leafNode name="authentication"> <properties> - <help>Enable sending of Cisco style NHRP Traffic Indication packets</help> - <valueless/> + <help>NHRP authentication</help> + <valueHelp> + <format>txt</format> + <description>Pass phrase for NHRP authentication</description> + </valueHelp> + <constraint> + <regex>[^[:space:]]{1,8}</regex> + </constraint> + <constraintErrorMessage>Password should contain up to eight non-whitespace characters</constraintErrorMessage> </properties> </leafNode> - <leafNode name="shortcut-destination"> + <leafNode name="holdtime"> <properties> - <help>This instructs opennhrp to reply with authorative answers on NHRP Resolution Requests destined to addresses in this interface</help> - <valueless/> + <help>Holding time in seconds</help> + <valueHelp> + <format>u32:1-65000</format> + <description>ring buffer size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65000"/> + </constraint> </properties> </leafNode> - <tagNode name="shortcut-target"> + <leafNode name="redirect"> <properties> - <help>Defines an off-NBMA network prefix for which the GRE interface will act as a gateway</help> + <help>Enable sending of Cisco style NHRP Traffic Indication packets</help> + <valueless/> </properties> - <children> - <leafNode name="holding-time"> - <properties> - <help>Holding time in seconds</help> - </properties> - </leafNode> - </children> - </tagNode> + </leafNode> <leafNode name="shortcut"> <properties> <help>Enable creation of shortcut routes. A received NHRP Traffic Indication will trigger the resolution and establishment of a shortcut route</help> <valueless/> </properties> </leafNode> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="network-id"> + <properties> + <help>NHRP network id</help> + <valueHelp> + <format><1-4294967295></format> + <description>NHRP network id</description> + </valueHelp> + </properties> + </leafNode> </children> </tagNode> </children> diff --git a/interface-definitions/protocols_rip.xml.in b/interface-definitions/protocols_rip.xml.in index 0edd8f2ce..745280fd7 100644 --- a/interface-definitions/protocols_rip.xml.in +++ b/interface-definitions/protocols_rip.xml.in @@ -209,6 +209,14 @@ #include <include/rip/redistribute.xml.i> </children> </node> + <node name="nhrp"> + <properties> + <help>Redistribute NHRP routes</help> + </properties> + <children> + #include <include/rip/redistribute.xml.i> + </children> + </node> <node name="ospf"> <properties> <help>Redistribute OSPF routes</help> diff --git a/interface-definitions/protocols_rpki.xml.in b/interface-definitions/protocols_rpki.xml.in index 54d69eadb..a298cdbfd 100644 --- a/interface-definitions/protocols_rpki.xml.in +++ b/interface-definitions/protocols_rpki.xml.in @@ -8,90 +8,7 @@ <priority>819</priority> </properties> <children> - <tagNode name="cache"> - <properties> - <help>RPKI cache server address</help> - <valueHelp> - <format>ipv4</format> - <description>IP address of RPKI server</description> - </valueHelp> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address of RPKI server</description> - </valueHelp> - <valueHelp> - <format>hostname</format> - <description>Fully qualified domain name of RPKI server</description> - </valueHelp> - <constraint> - <validator name="ip-address"/> - <validator name="fqdn"/> - </constraint> - </properties> - <children> - #include <include/port-number.xml.i> - <leafNode name="preference"> - <properties> - <help>Preference of the cache server</help> - <valueHelp> - <format>u32:1-255</format> - <description>Preference of the cache server</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - </leafNode> - <node name="ssh"> - <properties> - <help>RPKI SSH connection settings</help> - </properties> - <children> - #include <include/pki/openssh-key.xml.i> - #include <include/generic-username.xml.i> - </children> - </node> - </children> - </tagNode> - <leafNode name="expire-interval"> - <properties> - <help>Interval to wait before expiring the cache</help> - <valueHelp> - <format>u32:600-172800</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 600-172800"/> - </constraint> - </properties> - <defaultValue>7200</defaultValue> - </leafNode> - <leafNode name="polling-period"> - <properties> - <help>Cache polling interval</help> - <valueHelp> - <format>u32:1-86400</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-86400"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="retry-interval"> - <properties> - <help>Retry interval to connect to the cache server</help> - <valueHelp> - <format>u32:1-7200</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-7200"/> - </constraint> - </properties> - <defaultValue>600</defaultValue> - </leafNode> + #include <include/rpki/protocol-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/protocols_segment-routing.xml.in b/interface-definitions/protocols_segment-routing.xml.in index c299f624e..cab1e6945 100644 --- a/interface-definitions/protocols_segment-routing.xml.in +++ b/interface-definitions/protocols_segment-routing.xml.in @@ -4,13 +4,13 @@ <children> <node name="segment-routing" owner="${vyos_conf_scripts_dir}/protocols_segment-routing.py"> <properties> - <help>Segment Routing</help> + <help>Segment-Routing (SR) parameters</help> <priority>900</priority> </properties> <children> <tagNode name="interface"> <properties> - <help>Interface specific Segment Routing options</help> + <help>Interface specific Segment-Routing options</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> @@ -61,9 +61,17 @@ <help>Segment-Routing SRv6 configuration</help> </properties> <children> + <node name="encapsulation"> + <properties> + <help>Segment Routing SRv6 encapsulation</help> + </properties> + <children> + #include <include/source-address-ipv6.xml.i> + </children> + </node> <tagNode name="locator"> <properties> - <help>Segment Routing SRv6 locator</help> + <help>Segment-Routing SRv6 locators configuration</help> <constraint> #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> </constraint> @@ -126,6 +134,225 @@ </properties> <defaultValue>24</defaultValue> </leafNode> + <leafNode name="format"> + <properties> + <help>SRv6 SID format</help> + <completionHelp> + <list>uncompressed-f4024 usid-f3216</list> + </completionHelp> + <valueHelp> + <format>uncompressed-f4024</format> + <description>Uncompressed f4024 format</description> + </valueHelp> + <valueHelp> + <format>usid-f3216</format> + <description>usid-f3216 format</description> + </valueHelp> + <constraint> + <regex>(uncompressed-f4024|usid-f3216)</regex> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <node name="traffic-engineering"> + <properties> + <help>SR Traffic Engineering (TE) configuration</help> + </properties> + <children> + <node name="database-import-protocol"> + <properties> + <help>Traffic Engineering Database (TED) IGP import protocol</help> + </properties> + <children> + <leafNode name="isis"> + <properties> + <help>IS-IS originated Traffic Engineering (TE) database</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="ospf"> + <properties> + <help>OSPF originated Traffic Engineering (TE) database</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + <tagNode name="segment-list"> + <properties> + <help>Segment List</help> + <valueHelp> + <format>txt</format> + <description>Segment List Name</description> + </valueHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + </properties> + <children> + <tagNode name="index"> + <properties> + <help>Traffic engineering index value for segment list</help> + <valueHelp> + <format>u32</format> + <description>Segment list index value</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + <children> + <node name="mpls"> + <properties> + <help>MPLS label for index</help> + </properties> + <children> + <leafNode name="label"> + <properties> + <help>MPLS label value for index</help> + <valueHelp> + <format>u32:16-1048575</format> + <description>MPLS label value for index</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 16-1048575"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="nai"> + <properties> + <help>Node or Adjacency identifier (NAI) for index</help> + </properties> + <children> + <node name="adjacency"> + <properties> + <help>Adjacency identifier for index</help> + </properties> + <children> + <node name="ipv4"> + <properties> + <help>IPv4 address</help> + </properties> + <children> + <leafNode name="source-identifier"> + <properties> + <help>Adjacency source address identifier for index</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="destination-identifier"> + <properties> + <help>Adjacency destination address identifier for index</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 adjacency destination address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 address</help> + </properties> + <children> + <leafNode name="source-identifier"> + <properties> + <help>Adjacency source address identifier for index</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="destination-identifier"> + <properties> + <help>Adjacency destination address identifier for index</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 adjacency destination address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + </children> + </node> + <node name="prefix"> + <properties> + <help>IGP prefix identifier for index</help> + </properties> + <children> + <node name="ipv4"> + <properties> + <help>IPv4 address</help> + </properties> + <children> + <tagNode name="prefix-identifier"> + <properties> + <help>IPv4 IGP prefix address identifier for index</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + <children> + #include <include/segment-routing/algorithm.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 address</help> + </properties> + <children> + <tagNode name="prefix-identifier"> + <properties> + <help>IPv6 IGP prefix address identifier for index</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + <children> + #include <include/segment-routing/algorithm.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </tagNode> </children> </tagNode> </children> diff --git a/interface-definitions/protocols_static.xml.in b/interface-definitions/protocols_static.xml.in index ca4ca2d74..c721bb3fc 100644 --- a/interface-definitions/protocols_static.xml.in +++ b/interface-definitions/protocols_static.xml.in @@ -11,21 +11,64 @@ <priority>480</priority> </properties> <children> - #include <include/route-map.xml.i> - #include <include/static/static-route.xml.i> - #include <include/static/static-route6.xml.i> - <tagNode name="table"> + <tagNode name="mroute"> <properties> - <help>Policy route table number</help> + <help>Static IPv4 route for Multicast RIB</help> <valueHelp> - <format>u32:1-200</format> - <description>Policy route table number</description> + <format>ipv4net</format> + <description>Network</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-200"/> + <validator name="ipv4-prefix"/> </constraint> </properties> <children> + <tagNode name="next-hop"> + <properties> + <help>Next-hop IPv4 router address</help> + <valueHelp> + <format>ipv4</format> + <description>Next-hop router address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + #include <include/static/static-route-distance.xml.i> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Next-hop IPv4 router interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Gateway interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + #include <include/static/static-route-distance.xml.i> + </children> + </tagNode> + </children> + </tagNode> + #include <include/route-map.xml.i> + #include <include/static/static-route.xml.i> + #include <include/static/static-route6.xml.i> + <tagNode name="table"> + <properties> + <help>Non-main Kernel Routing Table</help> + #include <include/constraint/protocols-static-table.xml.i> + </properties> + <children> <!-- iproute2 only considers the first "word" until whitespace in the name field but does not complain about special characters. diff --git a/interface-definitions/protocols_static_multicast.xml.in b/interface-definitions/protocols_static_multicast.xml.in deleted file mode 100644 index caf95ed7c..000000000 --- a/interface-definitions/protocols_static_multicast.xml.in +++ /dev/null @@ -1,95 +0,0 @@ -<?xml version="1.0"?> -<interfaceDefinition> - <node name="protocols"> - <children> - <node name="static"> - <children> - <node name="multicast" owner="${vyos_conf_scripts_dir}/protocols_static_multicast.py"> - <properties> - <help>Multicast static route</help> - <priority>481</priority> - </properties> - <children> - <tagNode name="route"> - <properties> - <help>Configure static unicast route into MRIB for multicast RPF lookup</help> - <valueHelp> - <format>ipv4net</format> - <description>Network</description> - </valueHelp> - <constraint> - <validator name="ip-prefix"/> - </constraint> - </properties> - <children> - <tagNode name="next-hop"> - <properties> - <help>Nexthop IPv4 address</help> - <valueHelp> - <format>ipv4</format> - <description>Nexthop IPv4 address</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - <children> - <leafNode name="distance"> - <properties> - <help>Distance value for this route</help> - <valueHelp> - <format>u32:1-255</format> - <description>Distance for this route</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> - <tagNode name="interface-route"> - <properties> - <help>Multicast interface based route</help> - <valueHelp> - <format>ipv4net</format> - <description>Network</description> - </valueHelp> - <constraint> - <validator name="ip-prefix"/> - </constraint> - </properties> - <children> - <tagNode name="next-hop-interface"> - <properties> - <help>Next-hop interface</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - </properties> - <children> - <leafNode name="distance"> - <properties> - <help>Distance value for this route</help> - <valueHelp> - <format>u32:1-255</format> - <description>Distance for this route</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> - </children> - </node> - </children> - </node> - </children> - </node> -</interfaceDefinition> diff --git a/interface-definitions/protocols_traffic_engineering.xml.in b/interface-definitions/protocols_traffic_engineering.xml.in new file mode 100644 index 000000000..32e1793b1 --- /dev/null +++ b/interface-definitions/protocols_traffic_engineering.xml.in @@ -0,0 +1,108 @@ +<?xml version="1.0" encoding="utf-8"?> +<interfaceDefinition> + <node name="protocols"> + <children> + <node name="traffic-engineering" owner="${vyos_conf_scripts_dir}/protocols_traffic_engineering.py"> + <properties> + <help>Traffic Engineering link parameters</help> + <priority>605</priority> + </properties> + <children> + <tagNode name="admin-group"> + <properties> + <help>Configure administrative groups that can be used in interface configuration</help> + <valueHelp> + <format>txt</format> + <description>Administrative group name</description> + </valueHelp> + <constraint> + <regex>[-a-zA-Z0-9]+</regex> + </constraint> + <constraintErrorMessage>Administrative group must be alphanumeric and can contain hyphens</constraintErrorMessage> + </properties> + <children> + <leafNode name="bit-position"> + <properties> + <help>Specify bit position of the admin group</help> + <valueHelp> + <format>u8:0-31</format> + <description>Admin group bit position</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-31"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Traffic engineering parameters for interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface to configure name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + <children> + <leafNode name="metric"> + <properties> + <help>TE metric</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>TE Metric (different from the OSPF or ISIS metric)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-bandwidth"> + <properties> + <help>Maximum bandwidth (interface speed by default)</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum bandwidth in Mbits/sec</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-reservable-bandwidth"> + <properties> + <help>Maximum reservable bandwidth</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum reservable bandwidth in Mbits/sec</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="admin-group"> + <properties> + <help>Admin groups of interface</help> + <valueHelp> + <format>txt</format> + <description>Admin group of interface</description> + </valueHelp> + <completionHelp> + <path>protocols traffic-engineering admin-group</path> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/qos.xml.in b/interface-definitions/qos.xml.in index 927594c11..aad1de629 100644 --- a/interface-definitions/qos.xml.in +++ b/interface-definitions/qos.xml.in @@ -85,62 +85,70 @@ <children> #include <include/generic-description.xml.i> #include <include/qos/bandwidth.xml.i> - <node name="flow-isolation"> + <leafNode name="flow-isolation"> <properties> <help>Flow isolation settings</help> + <completionHelp> + <list>blind src-host dst-host host flow dual-src-host dual-dst-host triple-isolate</list> + </completionHelp> + <valueHelp> + <format>blind</format> + <description>Disables flow isolation, all traffic passes through a single queue</description> + </valueHelp> + <valueHelp> + <format>src-host</format> + <description>Flows are defined only by source address</description> + </valueHelp> + <valueHelp> + <format>dst-host</format> + <description>Flows are defined only by destination address</description> + </valueHelp> + <valueHelp> + <format>host</format> + <description>Flows are defined by source-destination host pairs</description> + </valueHelp> + <valueHelp> + <format>flow</format> + <description>Flows are defined by the entire 5-tuple</description> + </valueHelp> + <valueHelp> + <format>dual-src-host</format> + <description>Flows are defined by the 5-tuple, fairness is applied first over source addresses, then over individual flows</description> + </valueHelp> + <valueHelp> + <format>dual-dst-host</format> + <description>Flows are defined by the 5-tuple, fairness is applied first over destination addresses, then over individual flows</description> + </valueHelp> + <valueHelp> + <format>triple-isolate</format> + <description>Flows are defined by the 5-tuple, fairness is applied over source and destination addresses and also over individual flows (default)</description> + </valueHelp> + <constraint> + <regex>(blind|src-host|dst-host|host|flow|dual-src-host|dual-dst-host|triple-isolate)</regex> + </constraint> + </properties> + <defaultValue>triple-isolate</defaultValue> + </leafNode> + <leafNode name="flow-isolation-nat"> + <properties> + <help>Perform NAT lookup before applying flow-isolation rules</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="no-split-gso"> + <properties> + <help>Do not split GSO super-packets into on-the-wire components</help> + <valueless/> + </properties> + </leafNode> + <node name="ack-filter"> + <properties> + <help>Identify and filter out TCP ACK packets that do not convey significant new information</help> </properties> <children> - <leafNode name="blind"> - <properties> - <help>Disables flow isolation, all traffic passes through a single queue</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="src-host"> - <properties> - <help>Flows are defined only by source address</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="dst-host"> - <properties> - <help>Flows are defined only by destination address</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="host"> - <properties> - <help>Flows are defined by source-destination host pairs</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="flow"> - <properties> - <help>Flows are defined by the entire 5-tuple</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="dual-src-host"> - <properties> - <help>Flows are defined by the 5-tuple, fairness is applied first over source addresses, then over individual flows</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="dual-dst-host"> + <leafNode name="aggressive"> <properties> - <help>Flows are defined by the 5-tuple, fairness is applied first over destination addresses, then over individual flows</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="triple-isolate"> - <properties> - <help>Flows are defined by the 5-tuple, fairness is applied over source and destination addresses and also over individual flows (default)</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="nat"> - <properties> - <help>Perform NAT lookup before applying flow-isolation rules</help> + <help>Enable aggressive mode which will result in more ACK packets being compresses/filtered</help> <valueless/> </properties> </leafNode> @@ -150,13 +158,13 @@ <properties> <help>Round-Trip-Time for Active Queue Management (AQM)</help> <valueHelp> - <format>u32:1-3600000</format> + <format>u32:1-1000000000</format> <description>RTT in ms</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-3600000"/> + <validator name="numeric" argument="--range 1-1000000000"/> </constraint> - <constraintErrorMessage>RTT must be in range 1 to 3600000 milli-seconds</constraintErrorMessage> + <constraintErrorMessage>RTT must be in range 1 to 1000000000 milli-seconds</constraintErrorMessage> </properties> <defaultValue>100</defaultValue> </leafNode> @@ -201,13 +209,13 @@ <description>No perturbation</description> </valueHelp> <valueHelp> - <format>u32:1-127</format> + <format>u32:1-2147483647</format> <description>Interval in seconds for queue algorithm perturbation (advised: 10)</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 0-127"/> + <validator name="numeric" argument="--range 0-2147483647"/> </constraint> - <constraintErrorMessage>Interval must be in range 0 to 127</constraintErrorMessage> + <constraintErrorMessage>Interval must be in range 0 to 2147483647</constraintErrorMessage> </properties> <defaultValue>0</defaultValue> </leafNode> diff --git a/interface-definitions/service_config-sync.xml.in b/interface-definitions/service_config-sync.xml.in index af4e8ed51..1b9ff30bc 100644 --- a/interface-definitions/service_config-sync.xml.in +++ b/interface-definitions/service_config-sync.xml.in @@ -337,7 +337,7 @@ </leafNode> <leafNode name="segment-routing"> <properties> - <help>Segment Routing</help> + <help>Segment-Routing (SR) parameters</help> <valueless/> </properties> </leafNode> @@ -476,6 +476,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="login"> + <properties> + <help>System User Login</help> + <valueless/> + </properties> + </leafNode> <leafNode name="option"> <properties> <help>System Options</help> diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 631c830b4..4f5ccbf96 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -178,6 +178,19 @@ </properties> <defaultValue>1</defaultValue> </leafNode> + <leafNode name="purge-timeout"> + <properties> + <help>Timeout for purging synchronized entries on handover events</help> + <valueHelp> + <format>u32:1-2147483647</format> + <description>Purge timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-2147483647"/> + </constraint> + </properties> + <defaultValue>60</defaultValue> + </leafNode> </children> </node> </children> diff --git a/interface-definitions/service_dhcp-server.xml.in b/interface-definitions/service_dhcp-server.xml.in index cb5f9a804..4d1172e03 100644 --- a/interface-definitions/service_dhcp-server.xml.in +++ b/interface-definitions/service_dhcp-server.xml.in @@ -9,240 +9,7 @@ <priority>911</priority> </properties> <children> - #include <include/generic-disable-node.xml.i> - <leafNode name="dynamic-dns-update"> - <properties> - <help>Dynamically update Domain Name System (RFC4702)</help> - <valueless/> - </properties> - </leafNode> - <node name="high-availability"> - <properties> - <help>DHCP high availability configuration</help> - </properties> - <children> - #include <include/source-address-ipv4.xml.i> - <leafNode name="mode"> - <properties> - <help>Configure high availability mode</help> - <completionHelp> - <list>active-active active-passive</list> - </completionHelp> - <valueHelp> - <format>active-active</format> - <description>Both server attend DHCP requests</description> - </valueHelp> - <valueHelp> - <format>active-passive</format> - <description>Only primary server attends DHCP requests</description> - </valueHelp> - <constraint> - <regex>(active-active|active-passive)</regex> - </constraint> - <constraintErrorMessage>Invalid DHCP high availability mode</constraintErrorMessage> - </properties> - <defaultValue>active-active</defaultValue> - </leafNode> - <leafNode name="remote"> - <properties> - <help>IPv4 remote address used for connection</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 address of high availability peer</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="name"> - <properties> - <help>Peer name used to identify connection</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid failover peer name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="status"> - <properties> - <help>High availability hierarchy</help> - <completionHelp> - <list>primary secondary</list> - </completionHelp> - <valueHelp> - <format>primary</format> - <description>Configure this server to be the primary node</description> - </valueHelp> - <valueHelp> - <format>secondary</format> - <description>Configure this server to be the secondary node</description> - </valueHelp> - <constraint> - <regex>(primary|secondary)</regex> - </constraint> - <constraintErrorMessage>Invalid DHCP high availability peer status</constraintErrorMessage> - </properties> - </leafNode> - #include <include/pki/ca-certificate.xml.i> - #include <include/pki/certificate.xml.i> - </children> - </node> - <leafNode name="hostfile-update"> - <properties> - <help>Updating /etc/hosts file (per client lease)</help> - <valueless/> - </properties> - </leafNode> - #include <include/listen-address-ipv4.xml.i> - #include <include/listen-interface-multi-broadcast.xml.i> - <tagNode name="shared-network-name"> - <properties> - <help>Name of DHCP shared network</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - <children> - <leafNode name="authoritative"> - <properties> - <help>Option to make DHCP server authoritative for this physical network</help> - <valueless/> - </properties> - </leafNode> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - <tagNode name="subnet"> - <properties> - <help>DHCP subnet for shared network</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - </constraint> - <constraintErrorMessage>Invalid IPv4 subnet definition</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - <leafNode name="exclude"> - <properties> - <help>IP address to exclude from DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 address to exclude from lease range</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="ignore-client-id"> - <properties> - <help>Ignore client identifier for lease lookups</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="lease"> - <properties> - <help>Lease timeout in seconds</help> - <valueHelp> - <format>u32</format> - <description>DHCP lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> - <constraintErrorMessage>DHCP lease time must be between 0 and 4294967295 (49 days)</constraintErrorMessage> - </properties> - <defaultValue>86400</defaultValue> - </leafNode> - <tagNode name="range"> - <properties> - <help>DHCP lease range</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - <leafNode name="start"> - <properties> - <help>First IP address for DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 start address of pool</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="stop"> - <properties> - <help>Last IP address for DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 end address of pool</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <tagNode name="static-mapping"> - <properties> - <help>Hostname for static mapping reservation</help> - <constraint> - <validator name="fqdn"/> - </constraint> - <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - <leafNode name="ip-address"> - <properties> - <help>Fixed IP address of static mapping</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 address used in static mapping</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - #include <include/interface/mac.xml.i> - #include <include/interface/duid.xml.i> - </children> - </tagNode> - <leafNode name="subnet-id"> - <properties> - <help>Unique ID mapped to leases in the lease file</help> - <valueHelp> - <format>u32</format> - <description>Unique subnet ID</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/dhcp/dhcp-server-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/service_dhcpv6-server.xml.in b/interface-definitions/service_dhcpv6-server.xml.in index cf14388e8..d2b96061d 100644 --- a/interface-definitions/service_dhcpv6-server.xml.in +++ b/interface-definitions/service_dhcpv6-server.xml.in @@ -8,308 +8,7 @@ <priority>900</priority> </properties> <children> - #include <include/generic-disable-node.xml.i> - #include <include/listen-interface-multi-broadcast.xml.i> - <leafNode name="disable-route-autoinstall"> - <properties> - <help>Do not install routes for delegated prefixes</help> - <valueless/> - </properties> - </leafNode> - <node name="global-parameters"> - <properties> - <help>Additional global parameters for DHCPv6 server</help> - </properties> - <children> - #include <include/name-server-ipv6.xml.i> - </children> - </node> - <leafNode name="preference"> - <properties> - <help>Preference of this DHCPv6 server compared with others</help> - <valueHelp> - <format>u32:0-255</format> - <description>DHCPv6 server preference (0-255)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-255"/> - </constraint> - <constraintErrorMessage>Preference must be between 0 and 255</constraintErrorMessage> - </properties> - </leafNode> - <tagNode name="shared-network-name"> - <properties> - <help>DHCPv6 shared network name</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - <children> - #include <include/generic-disable-node.xml.i> - #include <include/generic-description.xml.i> - <leafNode name="interface"> - <properties> - <help>Optional interface for this shared network to accept requests from</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - </properties> - </leafNode> - #include <include/dhcp/option-v6.xml.i> - <tagNode name="subnet"> - <properties> - <help>IPv6 DHCP subnet for this shared network</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - <leafNode name="interface"> - <properties> - <help>Optional interface for this subnet to accept requests from</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - </properties> - </leafNode> - <tagNode name="range"> - <properties> - <help>Parameters setting ranges for assigning IPv6 addresses</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - <leafNode name="prefix"> - <properties> - <help>IPv6 prefix defining range of addresses to assign</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - </leafNode> - <leafNode name="start"> - <properties> - <help>First in range of consecutive IPv6 addresses to assign</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="stop"> - <properties> - <help>Last in range of consecutive IPv6 addresses</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <node name="lease-time"> - <properties> - <help>Parameters relating to the lease time</help> - </properties> - <children> - <leafNode name="default"> - <properties> - <help>Default time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>DHCPv6 valid lifetime</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - <leafNode name="maximum"> - <properties> - <help>Maximum time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>Maximum lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - <leafNode name="minimum"> - <properties> - <help>Minimum time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>Minimum lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </node> - <node name="prefix-delegation"> - <properties> - <help>Parameters relating to IPv6 prefix delegation</help> - </properties> - <children> - <tagNode name="prefix"> - <properties> - <help>IPv6 prefix to be used in prefix delegation</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 prefix used in prefix delegation</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - <children> - <leafNode name="prefix-length"> - <properties> - <help>Length in bits of prefix</help> - <valueHelp> - <format>u32:32-64</format> - <description>Prefix length (32-64)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 32-64"/> - </constraint> - <constraintErrorMessage>Prefix length must be between 32 and 64</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="delegated-length"> - <properties> - <help>Length in bits of prefixes to be delegated</help> - <valueHelp> - <format>u32:32-64</format> - <description>Delegated prefix length (32-64)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 32-96"/> - </constraint> - <constraintErrorMessage>Delegated prefix length must be between 32 and 96</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="excluded-prefix"> - <properties> - <help>IPv6 prefix to be excluded from prefix delegation</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 prefix excluded from prefix delegation</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="excluded-prefix-length"> - <properties> - <help>Length in bits of excluded prefix</help> - <valueHelp> - <format>u32:33-64</format> - <description>Excluded prefix length (33-128)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 33-128"/> - </constraint> - <constraintErrorMessage>Prefix length must be between 33 and 128</constraintErrorMessage> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </node> - <tagNode name="static-mapping"> - <properties> - <help>Hostname for static mapping reservation</help> - <constraint> - <validator name="fqdn"/> - </constraint> - <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - #include <include/generic-disable-node.xml.i> - #include <include/interface/mac.xml.i> - #include <include/interface/duid.xml.i> - <leafNode name="ipv6-address"> - <properties> - <help>Client IPv6 address for this static mapping</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address for this static mapping</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="ipv6-prefix"> - <properties> - <help>Client IPv6 prefix for this static mapping</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 prefix for this static mapping</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <leafNode name="subnet-id"> - <properties> - <help>Unique ID mapped to leases in the lease file</help> - <valueHelp> - <format>u32</format> - <description>Unique subnet ID</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/dhcp/dhcpv6-server-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/service_dns_dynamic.xml.in b/interface-definitions/service_dns_dynamic.xml.in index 75e5520b7..99103ec73 100644 --- a/interface-definitions/service_dns_dynamic.xml.in +++ b/interface-definitions/service_dns_dynamic.xml.in @@ -52,10 +52,10 @@ #include <include/url-http-https.xml.i> <leafNode name="skip"> <properties> - <help>Pattern to skip from the HTTP(S) respose</help> + <help>Pattern to skip from the HTTP(S) response</help> <valueHelp> <format>txt</format> - <description>Pattern to skip from the HTTP(S) respose to extract the external IP address</description> + <description>Pattern to skip from the HTTP(S) response to extract the external IP address</description> </valueHelp> </properties> </leafNode> diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in index afe430c0c..7bb63fa5a 100644 --- a/interface-definitions/service_https.xml.in +++ b/interface-definitions/service_https.xml.in @@ -32,22 +32,29 @@ </tagNode> </children> </node> - <leafNode name="strict"> + <node name="rest"> <properties> - <help>Enforce strict path checking</help> - <valueless/> + <help>REST API</help> </properties> - </leafNode> - <leafNode name="debug"> - <properties> - <help>Debug</help> - <valueless/> - <hidden/> - </properties> - </leafNode> + <children> + <leafNode name="strict"> + <properties> + <help>Enforce strict path checking</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="debug"> + <properties> + <help>Debug</help> + <valueless/> + <hidden/> + </properties> + </leafNode> + </children> + </node> <node name="graphql"> <properties> - <help>GraphQL support</help> + <help>GraphQL API</help> </properties> <children> <leafNode name="introspection"> @@ -109,19 +116,19 @@ </leafNode> </children> </node> - </children> - </node> - <node name="cors"> - <properties> - <help>Set CORS options</help> - </properties> - <children> - <leafNode name="allow-origin"> + <node name="cors"> <properties> - <help>Allow resource request from origin</help> - <multi/> + <help>Set CORS options</help> </properties> - </leafNode> + <children> + <leafNode name="allow-origin"> + <properties> + <help>Allow resource request from origin</help> + <multi/> + </properties> + </leafNode> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/service_ids_ddos-protection.xml.in b/interface-definitions/service_ids_ddos-protection.xml.in deleted file mode 100644 index 3ef2640b3..000000000 --- a/interface-definitions/service_ids_ddos-protection.xml.in +++ /dev/null @@ -1,167 +0,0 @@ -<?xml version="1.0"?> -<interfaceDefinition> - <node name="service"> - <children> - <node name="ids"> - <properties> - <help>Intrusion Detection System</help> - </properties> - <children> - <node name="ddos-protection" owner="${vyos_conf_scripts_dir}/service_ids_ddos-protection.py"> - <properties> - <help>FastNetMon detection and protection parameters</help> - <priority>731</priority> - </properties> - <children> - <leafNode name="alert-script"> - <properties> - <help>Path to fastnetmon alert script</help> - </properties> - </leafNode> - <leafNode name="ban-time"> - <properties> - <help>How long we should keep an IP in blocked state</help> - <valueHelp> - <format>u32:1-4294967294</format> - <description>Time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967294"/> - </constraint> - </properties> - <defaultValue>1900</defaultValue> - </leafNode> - <leafNode name="direction"> - <properties> - <help>Direction for processing traffic</help> - <completionHelp> - <list>in out</list> - </completionHelp> - <constraint> - <regex>(in|out)</regex> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="excluded-network"> - <properties> - <help>Specify IPv4 and IPv6 networks which are going to be excluded from protection</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 prefix(es) to exclude</description> - </valueHelp> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 prefix(es) to exclude</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - <validator name="ipv6-prefix"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="listen-interface"> - <properties> - <help>Listen interface for mirroring traffic</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <multi/> - </properties> - </leafNode> - <leafNode name="mode"> - <properties> - <help>Traffic capture mode</help> - <completionHelp> - <list>mirror sflow</list> - </completionHelp> - <valueHelp> - <format>mirror</format> - <description>Listen to mirrored traffic</description> - </valueHelp> - <valueHelp> - <format>sflow</format> - <description>Capture sFlow flows</description> - </valueHelp> - <constraint> - <regex>(mirror|sflow)</regex> - </constraint> - </properties> - </leafNode> - <node name="sflow"> - <properties> - <help>Sflow settings</help> - </properties> - <children> - #include <include/listen-address-ipv4-single.xml.i> - #include <include/port-number.xml.i> - <leafNode name="port"> - <defaultValue>6343</defaultValue> - </leafNode> - </children> - </node> - <leafNode name="network"> - <properties> - <help>Specify IPv4 and IPv6 networks which belong to you</help> - <valueHelp> - <format>ipv4net</format> - <description>Your IPv4 prefix(es)</description> - </valueHelp> - <valueHelp> - <format>ipv6net</format> - <description>Your IPv6 prefix(es)</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - <validator name="ipv6-prefix"/> - </constraint> - <multi/> - </properties> - </leafNode> - <node name="threshold"> - <properties> - <help>Attack limits thresholds</help> - </properties> - <children> - <node name="general"> - <properties> - <help>General threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="tcp"> - <properties> - <help>TCP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="udp"> - <properties> - <help>UDP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="icmp"> - <properties> - <help>ICMP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - </children> - </node> - </children> - </node> - </children> - </node> - </children> - </node> -</interfaceDefinition> diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index 25bc43cc6..27b163001 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -70,6 +70,7 @@ <constraintErrorMessage>VLAN IDs need to be in range 1-4094</constraintErrorMessage> </properties> </leafNode> + #include <include/ip-address.xml.i> </children> </tagNode> </children> @@ -131,6 +132,30 @@ </properties> <defaultValue>shared</defaultValue> </leafNode> + <leafNode name="start-session"> + <properties> + <help>Start session options</help> + <completionHelp> + <list>auto dhcp unclassified-packet</list> + </completionHelp> + <valueHelp> + <format>auto</format> + <description>Start session with username as the interface name</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Start session on DHCPv4 Discover</description> + </valueHelp> + <valueHelp> + <format>unclassified-packet</format> + <description>Start session on unclassified-packet</description> + </valueHelp> + <constraint> + <regex>(auto|dhcp|unclassified-packet)</regex> + </constraint> + </properties> + <defaultValue>dhcp</defaultValue> + </leafNode> <leafNode name="client-subnet"> <properties> <help>Client address pool</help> @@ -174,20 +199,46 @@ </leafNode> </children> </node> + <leafNode name="lua-username"> + <properties> + <help>Username function</help> + <valueHelp> + <format>txt</format> + <description>Name of the function in the Lua file to construct usernames with</description> + </valueHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + </properties> + </leafNode> #include <include/accel-ppp/vlan.xml.i> #include <include/accel-ppp/vlan-mon.xml.i> </children> </tagNode> + <leafNode name="lua-file"> + <properties> + <help>Lua script file for constructing user names</help> + <valueHelp> + <format>filename</format> + <description>File with Lua script in /config/scripts directory</description> + </valueHelp> + <constraint> + <validator name="file-path" argument="--strict --parent-dir /config/scripts"/> + </constraint> + </properties> + </leafNode> #include <include/accel-ppp/client-ip-pool.xml.i> #include <include/accel-ppp/client-ipv6-pool.xml.i> #include <include/accel-ppp/default-pool.xml.i> #include <include/accel-ppp/default-ipv6-pool.xml.i> #include <include/accel-ppp/extended-scripts.xml.i> #include <include/accel-ppp/gateway-address-multi.xml.i> + #include <include/accel-ppp/idle-timeout.xml.i> #include <include/accel-ppp/limits.xml.i> #include <include/accel-ppp/max-concurrent-sessions.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> #include <include/accel-ppp/log.xml.i> diff --git a/interface-definitions/service_lldp.xml.in b/interface-definitions/service_lldp.xml.in index 1a06e0cb3..63ccc1776 100644 --- a/interface-definitions/service_lldp.xml.in +++ b/interface-definitions/service_lldp.xml.in @@ -23,9 +23,40 @@ <script>${vyos_completion_dir}/list_interfaces</script> <list>all</list> </completionHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + <regex>all</regex> + </constraint> </properties> <children> - #include <include/generic-disable-node.xml.i> + <leafNode name="mode"> + <properties> + <help>Set LLDP receive/transmit operation mode of this interface</help> + <completionHelp> + <list>disable rx-tx tx rx</list> + </completionHelp> + <valueHelp> + <format>disable</format> + <description>Do not process or send LLDP messages</description> + </valueHelp> + <valueHelp> + <format>rx-tx</format> + <description>Send and process LLDP messages</description> + </valueHelp> + <valueHelp> + <format>rx</format> + <description>Process incoming LLDP messages</description> + </valueHelp> + <valueHelp> + <format>tx</format> + <description>Send LLDP messages</description> + </valueHelp> + <constraint> + <regex>(disable|rx-tx|tx|rx)</regex> + </constraint> + </properties> + <defaultValue>rx-tx</defaultValue> + </leafNode> <node name="location"> <properties> <help>LLDP-MED location data</help> @@ -111,7 +142,7 @@ <properties> <help>ECS ELIN (Emergency location identifier number)</help> <valueHelp> - <format>u32:0-9999999999</format> + <format>u64:0-9999999999</format> <description>Emergency Call Service ELIN number (between 10-25 numbers)</description> </valueHelp> <constraint> diff --git a/interface-definitions/service_mdns_repeater.xml.in b/interface-definitions/service_mdns_repeater.xml.in index 5d6f61d74..9d626bf6a 100644 --- a/interface-definitions/service_mdns_repeater.xml.in +++ b/interface-definitions/service_mdns_repeater.xml.in @@ -67,6 +67,23 @@ <multi/> </properties> </leafNode> + <leafNode name="cache-entries"> + <properties> + <help>Number of resource records cached per interface</help> + <valueHelp> + <format>u32:0</format> + <description>Disable caching</description> + </valueHelp> + <valueHelp> + <format>u32:1-65535</format> + <description>Resource records to cache per interface</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-65535"/> + </constraint> + </properties> + <defaultValue>4096</defaultValue> + </leafNode> <leafNode name="vrrp-disable"> <properties> <help>Disables mDNS repeater on VRRP interfaces not in MASTER state</help> diff --git a/interface-definitions/service_monitoring_network_event.xml.in b/interface-definitions/service_monitoring_network_event.xml.in new file mode 100644 index 000000000..edf23a06a --- /dev/null +++ b/interface-definitions/service_monitoring_network_event.xml.in @@ -0,0 +1,61 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="service"> + <children> + <node name="monitoring"> + <properties> + <help>Monitoring services</help> + </properties> + <children> + <node name="network-event" owner="${vyos_conf_scripts_dir}/service_monitoring_network_event.py"> + <properties> + <help>Network event logger</help> + <priority>1280</priority> + </properties> + <children> + <node name="event"> + <properties> + <help>Network event type</help> + </properties> + <children> + <leafNode name="route"> + <properties> + <help>Log routing table update events</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="link"> + <properties> + <help>Log link status change events</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="addr"> + <properties> + <help>Log address assignment and removal events</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="neigh"> + <properties> + <help>Log neighbor (ARP/ND) table update events</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="rule"> + <properties> + <help>Log policy routing rule change events</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + #include <include/netlink/queue-size.xml.i> + #include <include/netlink/log-level.xml.i> + </children> + </node> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/service_monitoring_prometheus.xml.in b/interface-definitions/service_monitoring_prometheus.xml.in new file mode 100644 index 000000000..8bcebf5f3 --- /dev/null +++ b/interface-definitions/service_monitoring_prometheus.xml.in @@ -0,0 +1,134 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="service"> + <children> + <node name="monitoring"> + <children> + <node name="prometheus" owner="${vyos_conf_scripts_dir}/service_monitoring_prometheus.py"> + <properties> + <help>Prometheus metric exporter</help> + <priority>1280</priority> + </properties> + <children> + <node name="node-exporter"> + <properties> + <help>Prometheus exporter for hardware and operating system metrics</help> + </properties> + <children> + #include <include/listen-address.xml.i> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>9100</defaultValue> + </leafNode> + #include <include/interface/vrf.xml.i> + <node name="collectors"> + <properties> + <help>Collectors specific configuration</help> + </properties> + <children> + <leafNode name="textfile"> + <properties> + <help>Enables textfile collector to read from /run/node_exporter/collector</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + </children> + </node> + <node name="frr-exporter"> + <properties> + <help>Prometheus exporter for FRR metrics</help> + </properties> + <children> + #include <include/listen-address.xml.i> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>9342</defaultValue> + </leafNode> + #include <include/interface/vrf.xml.i> + </children> + </node> + <node name="blackbox-exporter"> + <properties> + <help>Prometheus exporter for probing endpoints</help> + </properties> + <children> + #include <include/listen-address.xml.i> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>9115</defaultValue> + </leafNode> + #include <include/interface/vrf.xml.i> + <node name="modules"> + <properties> + <help>Configure blackbox exporter modules</help> + </properties> + <children> + <node name="dns"> + <properties> + <help>Configure dns module</help> + </properties> + <children> + <tagNode name="name"> + <properties> + <help>Name of the dns module</help> + </properties> + <children> + <leafNode name="query-name"> + <properties> + <help>Name to be queried</help> + <constraint> + <validator name="fqdn"/> + </constraint> + </properties> + </leafNode> + <leafNode name="query-type"> + <properties> + <help>DNS query type</help> + <valueHelp> + <format>ANY</format> + <description>Query any DNS record</description> + </valueHelp> + <valueHelp> + <format>A</format> + <description>Query IPv4 address record</description> + </valueHelp> + <valueHelp> + <format>AAAA</format> + <description>Query IPv6 address record</description> + </valueHelp> + </properties> + <defaultValue>ANY</defaultValue> + </leafNode> + #include <include/monitoring/blackbox-exporter-module-commons.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="icmp"> + <properties> + <help>Configure icmp module</help> + </properties> + <children> + <tagNode name="name"> + <properties> + <help>Name of the icmp module</help> + </properties> + <children> + #include <include/monitoring/blackbox-exporter-module-commons.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/service_monitoring_telegraf.xml.in b/interface-definitions/service_monitoring_telegraf.xml.in index 2ac0d940e..1ea2a23dd 100644 --- a/interface-definitions/service_monitoring_telegraf.xml.in +++ b/interface-definitions/service_monitoring_telegraf.xml.in @@ -124,7 +124,7 @@ </valueHelp> <valueHelp> <format>table-per-metric</format> - <description>One table per gorups of metric by the metric name</description> + <description>One table per groups of metric by the metric name</description> </valueHelp> <constraint> <regex>(single-table|table-per-metric)</regex> diff --git a/interface-definitions/service_monitoring_zabbix-agent.xml.in b/interface-definitions/service_monitoring_zabbix-agent.xml.in index e44b31312..122e61e8b 100644 --- a/interface-definitions/service_monitoring_zabbix-agent.xml.in +++ b/interface-definitions/service_monitoring_zabbix-agent.xml.in @@ -10,6 +10,23 @@ <priority>1280</priority> </properties> <children> + <node name="authentication"> + <properties> + <help>Authentication</help> + </properties> + <children> + #include <include/auth-mode-pre-shared-secret.xml.i> + <node name="psk"> + <properties> + <help>Pre-shared key</help> + </properties> + <children> + #include <include/auth-psk-id.xml.i> + #include <include/auth-psk-secret.xml.i> + </children> + </node> + </children> + </node> <leafNode name="directory"> <properties> <help>Folder containing individual Zabbix-agent configuration files</help> diff --git a/interface-definitions/service_ndp-proxy.xml.in b/interface-definitions/service_ndp-proxy.xml.in index aabba3f4e..327ce89d5 100644 --- a/interface-definitions/service_ndp-proxy.xml.in +++ b/interface-definitions/service_ndp-proxy.xml.in @@ -111,17 +111,7 @@ </properties> <defaultValue>static</defaultValue> </leafNode> - <leafNode name="interface"> - <properties> - <help>Interface to forward Neighbor Solicitation message through. Required for "iface" mode</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - </properties> - </leafNode> + #include <include/generic-interface.xml.i> </children> </tagNode> </children> diff --git a/interface-definitions/service_ntp.xml.in b/interface-definitions/service_ntp.xml.in index c057b62b5..ebce1bbf4 100644 --- a/interface-definitions/service_ntp.xml.in +++ b/interface-definitions/service_ntp.xml.in @@ -13,6 +13,74 @@ #include <include/generic-interface.xml.i> #include <include/listen-address.xml.i> #include <include/interface/vrf.xml.i> + <node name="timestamp"> + <properties> + <help>Enable timestamping of packets in the NIC hardware</help> + </properties> + <children> + <tagNode name="interface"> + <properties> + <help>Interface to enable timestamping on</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + <list>all</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>Select all interfaces</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + <regex>all</regex> + </constraint> + </properties> + <children> + <leafNode name="receive-filter"> + <properties> + <help>Selects which inbound packets are timestamped by the NIC</help> + <completionHelp> + <list>all ntp ptp none</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All packets are timestamped</description> + </valueHelp> + <valueHelp> + <format>ntp</format> + <description>Only NTP packets are timestamped</description> + </valueHelp> + <valueHelp> + <format>ptp</format> + <description>Only PTP or NTP packets using the PTP transport are timestamped</description> + </valueHelp> + <valueHelp> + <format>none</format> + <description>No packet is timestamped</description> + </valueHelp> + <constraint> + <regex>(all|ntp|ptp|none)</regex> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <node name="ptp"> + <properties> + <help>Enable Precision Time Protocol (PTP) transport</help> + </properties> + <children> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>319</defaultValue> + </leafNode> + </children> + </node> <leafNode name="leap-second"> <properties> <help>Leap second behavior</help> @@ -41,6 +109,18 @@ </properties> <defaultValue>timezone</defaultValue> </leafNode> + <leafNode name="local-stratum"> + <properties> + <help>Local reference stratum</help> + <valueHelp> + <format>u32:1-15</format> + <description>Local reference stratum</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-15"/> + </constraint> + </properties> + </leafNode> <tagNode name="server"> <properties> <help>Network Time Protocol (NTP) server</help> @@ -86,6 +166,18 @@ <valueless/> </properties> </leafNode> + <leafNode name="ptp"> + <properties> + <help>Use Precision Time Protocol (PTP) transport for the server</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="interleave"> + <properties> + <help>Use the interleaved mode for the server</help> + <valueless/> + </properties> + </leafNode> </children> </tagNode> </children> diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in index 0c99fd261..81a4a95e3 100644 --- a/interface-definitions/service_pppoe-server.xml.in +++ b/interface-definitions/service_pppoe-server.xml.in @@ -63,6 +63,12 @@ </completionHelp> </properties> <children> + <leafNode name="combined"> + <properties> + <help>Listen on both VLANs and the base interface</help> + <valueless/> + </properties> + </leafNode> #include <include/accel-ppp/vlan.xml.i> #include <include/accel-ppp/vlan-mon.xml.i> </children> @@ -169,6 +175,7 @@ </node> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/service_router-advert.xml.in b/interface-definitions/service_router-advert.xml.in index 3fd33540a..31ed503d5 100644 --- a/interface-definitions/service_router-advert.xml.in +++ b/interface-definitions/service_router-advert.xml.in @@ -16,6 +16,7 @@ </completionHelp> </properties> <children> + #include <include/dhcp/captive-portal.xml.i> <leafNode name="hop-limit"> <properties> <help>Set Hop Count field of the IP header for outgoing packets</help> @@ -48,7 +49,7 @@ <constraint> <validator name="numeric" argument="--range 0-0 --range 4-9000"/> </constraint> - <constraintErrorMessage>Default router livetime bust be 0 or between 4 and 9000</constraintErrorMessage> + <constraintErrorMessage>Default router lifetime must be 0 or between 4 and 9000</constraintErrorMessage> </properties> </leafNode> <leafNode name="default-preference"> @@ -84,7 +85,7 @@ </leafNode> <leafNode name="link-mtu"> <properties> - <help>Link MTU value placed in RAs, exluded in RAs if unset</help> + <help>Link MTU value placed in RAs, excluded in RAs if unset</help> <valueHelp> <format>u32:1280-9000</format> <description>Link MTU value in RAs</description> @@ -255,6 +256,19 @@ </leafNode> </children> </tagNode> + <leafNode name="auto-ignore"> + <properties> + <help>IPv6 prefix to be excluded in Router Advertisements (RAs) - use in conjunction with the ::/64 wildcard prefix</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix to be excluded</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> <tagNode name="prefix"> <properties> <help>IPv6 prefix to be advertised in Router Advertisements (RAs)</help> @@ -291,6 +305,21 @@ <valueless/> </properties> </leafNode> + <leafNode name="base-interface"> + <properties> + <help>Prefix will be combined with IPv6 address of specified interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + </leafNode> <leafNode name="preferred-lifetime"> <properties> <help>Time in seconds that the prefix will remain preferred</help> diff --git a/interface-definitions/service_snmp.xml.in b/interface-definitions/service_snmp.xml.in index f23151ef9..be4c2f6cc 100644 --- a/interface-definitions/service_snmp.xml.in +++ b/interface-definitions/service_snmp.xml.in @@ -13,9 +13,9 @@ <properties> <help>Community name</help> <constraint> - <regex>[[:alnum:]-_!@*#]{1,100}</regex> + <regex>[[:alnum:]\-_!@*#]{1,100}</regex> </constraint> - <constraintErrorMessage>Community string is limited to alphanumerical characters, -, _, !, @, *, and # with a total lenght of 100</constraintErrorMessage> + <constraintErrorMessage>Community string is limited to alphanumerical characters, -, _, !, @, *, and # with a total length of 100</constraintErrorMessage> </properties> <children> <leafNode name="authorization"> @@ -304,7 +304,6 @@ </constraint> <constraintErrorMessage>ID must contain an even number (from 2 to 36) of hex digits</constraintErrorMessage> </properties> - <defaultValue></defaultValue> </leafNode> <tagNode name="group"> <properties> diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in index 221e451d1..7a1348404 100644 --- a/interface-definitions/service_ssh.xml.in +++ b/interface-definitions/service_ssh.xml.in @@ -36,15 +36,15 @@ </node> </children> </node> - <leafNode name="ciphers"> + <leafNode name="cipher"> <properties> <help>Allowed ciphers</help> <completionHelp> <!-- generated by ssh -Q cipher | tr '\n' ' ' as this will not change dynamically --> - <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> + <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> </completionHelp> <constraint> - <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|rijndael-cbc@lysator.liu.se|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> + <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> </constraint> <multi/> </properties> @@ -61,6 +61,25 @@ <valueless/> </properties> </leafNode> + <node name="fido"> + <properties> + <help>FIDO2 SSH options</help> + </properties> + <children> + <leafNode name="pin-required"> + <properties> + <help>Require FIDO2 keys to attest that a user has been verified (e.g. via a PIN)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="touch-required"> + <properties> + <help>Require FIDO2 keys to attest that a user is physically present</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <node name="dynamic-protection"> <properties> <help>Allow dynamic protection</help> @@ -275,6 +294,18 @@ </constraint> </properties> </leafNode> + <leafNode name="trusted-user-ca"> + <properties> + <help>OpenSSH trusted user CA</help> + <completionHelp> + <path>pki openssh</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>OpenSSH certificate name from PKI subsystem</description> + </valueHelp> + </properties> + </leafNode> #include <include/vrf-multi.xml.i> </children> </node> diff --git a/interface-definitions/system_config-management.xml.in b/interface-definitions/system_config-management.xml.in index e666633b7..319611266 100644 --- a/interface-definitions/system_config-management.xml.in +++ b/interface-definitions/system_config-management.xml.in @@ -52,6 +52,7 @@ </properties> </leafNode> #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/vrf.xml.i> </children> </node> <leafNode name="commit-revisions"> @@ -67,6 +68,33 @@ <constraintErrorMessage>Number of revisions must be between 0 and 65535</constraintErrorMessage> </properties> </leafNode> + <node name="commit-confirm"> + <properties> + <help>Commit confirm options</help> + </properties> + <children> + <leafNode name="action"> + <properties> + <help>Commit confirm revert action</help> + <completionHelp> + <list>reload reboot</list> + </completionHelp> + <valueHelp> + <format>reload</format> + <description>Reload previous configuration if not confirmed</description> + </valueHelp> + <valueHelp> + <format>reboot</format> + <description>Reboot to saved configuration if not confirmed</description> + </valueHelp> + <constraint> + <regex>(reload|reboot)</regex> + </constraint> + </properties> + <defaultValue>reboot</defaultValue> + </leafNode> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/system_conntrack.xml.in b/interface-definitions/system_conntrack.xml.in index cd59d1308..733a4a4b8 100644 --- a/interface-definitions/system_conntrack.xml.in +++ b/interface-definitions/system_conntrack.xml.in @@ -32,14 +32,14 @@ <properties> <help>Hash size for connection tracking table</help> <valueHelp> - <format>u32:1-50000000</format> + <format>u32:1024-50000000</format> <description>Size of hash to use for connection tracking table</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-50000000"/> + <validator name="numeric" argument="--range 1024-50000000"/> </constraint> </properties> - <defaultValue>32768</defaultValue> + <defaultValue>65536</defaultValue> </leafNode> <node name="ignore"> <properties> @@ -84,7 +84,6 @@ </completionHelp> </properties> </leafNode> - #include <include/ip-protocol.xml.i> <leafNode name="protocol"> <properties> <help>Protocol to match (protocol name, number, or "all")</help> @@ -170,7 +169,6 @@ </completionHelp> </properties> </leafNode> - #include <include/ip-protocol.xml.i> <leafNode name="protocol"> <properties> <help>Protocol to match (protocol name, number, or "all")</help> @@ -263,38 +261,8 @@ <valueless/> </properties> </leafNode> - <leafNode name="queue-size"> - <properties> - <help>Internal message queue size</help> - <valueHelp> - <format>u32:100-999999</format> - <description>Queue size</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-999999"/> - </constraint> - <constraintErrorMessage>Queue size must be between 100 and 999999</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="log-level"> - <properties> - <help>Set log-level. Log must be enable.</help> - <completionHelp> - <list>info debug</list> - </completionHelp> - <valueHelp> - <format>info</format> - <description>Info log level</description> - </valueHelp> - <valueHelp> - <format>debug</format> - <description>Debug log level</description> - </valueHelp> - <constraint> - <regex>(info|debug)</regex> - </constraint> - </properties> - </leafNode> + #include <include/netlink/queue-size.xml.i> + #include <include/netlink/log-level.xml.i> </children> </node> <node name="modules"> diff --git a/interface-definitions/system_console.xml.in b/interface-definitions/system_console.xml.in index 5acd3e90b..8ae98291e 100644 --- a/interface-definitions/system_console.xml.in +++ b/interface-definitions/system_console.xml.in @@ -12,12 +12,16 @@ <properties> <help>Serial console device name</help> <completionHelp> - <script>ls -1 /dev | grep -e ttyS -e hvc</script> + <script>ls -1 /dev | grep -e ttyS -e ttyAMA -e hvc</script> <script>if [ -d /dev/serial/by-bus ]; then ls -1 /dev/serial/by-bus; fi</script> </completionHelp> <valueHelp> <format>ttySN</format> - <description>TTY device name, regular serial port</description> + <description>TTY device name, ttyS based</description> + </valueHelp> + <valueHelp> + <format>ttyAMAN</format> + <description>TTY device name, ttyAMA based</description> </valueHelp> <valueHelp> <format>usbNbXpY</format> @@ -28,10 +32,16 @@ <description>Xen console</description> </valueHelp> <constraint> - <regex>(ttyS[0-9]+|hvc[0-9]+|usb[0-9]+b.*)</regex> + <regex>(ttyS[0-9]+|ttyAMA[0-9]+|hvc[0-9]+|usb[0-9]+b.*)</regex> </constraint> </properties> <children> + <leafNode name="kernel"> + <properties> + <help>Use the console as an output for kernel messages</help> + <valueless/> + </properties> + </leafNode> <leafNode name="speed"> <properties> <help>Console baud rate</help> diff --git a/interface-definitions/system_flow-accounting.xml.in b/interface-definitions/system_flow-accounting.xml.in index 83a2480a3..53436036e 100644 --- a/interface-definitions/system_flow-accounting.xml.in +++ b/interface-definitions/system_flow-accounting.xml.in @@ -9,153 +9,18 @@ <priority>990</priority> </properties> <children> - <leafNode name="buffer-size"> - <properties> - <help>Buffer size</help> - <valueHelp> - <format>u32</format> - <description>Buffer size in MiB</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> - </properties> - <defaultValue>10</defaultValue> - </leafNode> - <leafNode name="packet-length"> - <properties> - <help>Specifies the maximum number of bytes to capture for each packet</help> - <valueHelp> - <format>u32:128-750</format> - <description>Packet length in bytes</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 128-750"/> - </constraint> - </properties> - <defaultValue>128</defaultValue> - </leafNode> <leafNode name="enable-egress"> <properties> <help>Enable egress flow accounting</help> <valueless/> </properties> </leafNode> - <leafNode name="disable-imt"> - <properties> - <help>Disable in memory table plugin</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="syslog-facility"> - <properties> - <help>Syslog facility for flow-accounting</help> - <completionHelp> - <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list> - </completionHelp> - <valueHelp> - <format>auth</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>authpriv</format> - <description>Non-system authorization</description> - </valueHelp> - <valueHelp> - <format>cron</format> - <description>Cron daemon</description> - </valueHelp> - <valueHelp> - <format>daemon</format> - <description>System daemons</description> - </valueHelp> - <valueHelp> - <format>kern</format> - <description>Kernel</description> - </valueHelp> - <valueHelp> - <format>lpr</format> - <description>Line printer spooler</description> - </valueHelp> - <valueHelp> - <format>mail</format> - <description>Mail subsystem</description> - </valueHelp> - <valueHelp> - <format>mark</format> - <description>Timestamp</description> - </valueHelp> - <valueHelp> - <format>news</format> - <description>USENET subsystem</description> - </valueHelp> - <valueHelp> - <format>protocols</format> - <description>Routing protocols (local7)</description> - </valueHelp> - <valueHelp> - <format>security</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>syslog</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>user</format> - <description>Application processes</description> - </valueHelp> - <valueHelp> - <format>uucp</format> - <description>UUCP subsystem</description> - </valueHelp> - <valueHelp> - <format>local0</format> - <description>Local facility 0</description> - </valueHelp> - <valueHelp> - <format>local1</format> - <description>Local facility 1</description> - </valueHelp> - <valueHelp> - <format>local2</format> - <description>Local facility 2</description> - </valueHelp> - <valueHelp> - <format>local3</format> - <description>Local facility 3</description> - </valueHelp> - <valueHelp> - <format>local4</format> - <description>Local facility 4</description> - </valueHelp> - <valueHelp> - <format>local5</format> - <description>Local facility 5</description> - </valueHelp> - <valueHelp> - <format>local6</format> - <description>Local facility 6</description> - </valueHelp> - <valueHelp> - <format>local7</format> - <description>Local facility 7</description> - </valueHelp> - <valueHelp> - <format>all</format> - <description>Authentication and authorization</description> - </valueHelp> - <constraint> - <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex> - </constraint> - </properties> - </leafNode> - #include <include/generic-interface-multi.xml.i> <node name="netflow"> <properties> <help>NetFlow settings</help> </properties> <children> + #include <include/generic-interface-multi.xml.i> <leafNode name="engine-id"> <properties> <help>NetFlow engine-id</help> @@ -196,7 +61,6 @@ </constraint> </properties> </leafNode> - #include <include/source-address-ipv4-ipv6.xml.i> <leafNode name="version"> <properties> <help>NetFlow version to export</help> @@ -247,186 +111,36 @@ </properties> <defaultValue>2055</defaultValue> </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/source-interface.xml.i> </children> </tagNode> - <node name="timeout"> - <properties> - <help>NetFlow timeout values</help> - </properties> - <children> - <leafNode name="expiry-interval"> - <properties> - <help>Expiry scan interval</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Expiry scan interval</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>60</defaultValue> - </leafNode> - <leafNode name="flow-generic"> - <properties> - <help>Generic flow timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Generic flow timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>3600</defaultValue> - </leafNode> - <leafNode name="icmp"> - <properties> - <help>ICMP timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>ICMP timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="max-active-life"> - <properties> - <help>Max active timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Max active timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>604800</defaultValue> - </leafNode> - <leafNode name="tcp-fin"> - <properties> - <help>TCP finish timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP FIN timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="tcp-generic"> - <properties> - <help>TCP generic timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP generic timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>3600</defaultValue> - </leafNode> - <leafNode name="tcp-rst"> - <properties> - <help>TCP reset timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP RST timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>120</defaultValue> - </leafNode> - <leafNode name="udp"> - <properties> - <help>UDP timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>UDP timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - </children> - </node> - </children> - </node> - <node name="sflow"> - <properties> - <help>sFlow settings</help> - </properties> - <children> - <leafNode name="agent-address"> + <leafNode name="inactive-timeout"> <properties> - <help>sFlow agent IPv4 address</help> - <completionHelp> - <list>auto</list> - <script>${vyos_completion_dir}/list_local_ips.sh --ipv4</script> - </completionHelp> + <help>Flow inactivity timeout</help> <valueHelp> - <format>ipv4</format> - <description>sFlow IPv4 agent address</description> + <format>u32:0-2147483647</format> + <description>Inactive flow export timeout (seconds)</description> </valueHelp> <constraint> - <validator name="ipv4-address"/> + <validator name="numeric" argument="--range 0-2147483647"/> </constraint> </properties> + <defaultValue>15</defaultValue> </leafNode> - <leafNode name="sampling-rate"> + <leafNode name="active-timeout"> <properties> - <help>sFlow sampling-rate</help> + <help>Flow activity timeout</help> <valueHelp> - <format>u32</format> - <description>Sampling rate (1 in N packets)</description> + <format>u32:0-2147483647</format> + <description>Active flow export timeout (seconds)</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> + <validator name="numeric" argument="--range 0-2147483647"/> </constraint> </properties> + <defaultValue>1800</defaultValue> </leafNode> - <tagNode name="server"> - <properties> - <help>sFlow destination server</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 server to export sFlow</description> - </valueHelp> - <valueHelp> - <format>ipv6</format> - <description>IPv6 server to export sFlow</description> - </valueHelp> - <constraint> - <validator name="ip-address"/> - </constraint> - </properties> - <children> - <leafNode name="port"> - <properties> - <help>sFlow port number</help> - <valueHelp> - <format>u32:1025-65535</format> - <description>sFlow port number</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1025-65535"/> - </constraint> - </properties> - <defaultValue>6343</defaultValue> - </leafNode> - </children> - </tagNode> - #include <include/source-address-ipv4-ipv6.xml.i> </children> </node> #include <include/interface/vrf.xml.i> diff --git a/interface-definitions/system_frr.xml.in b/interface-definitions/system_frr.xml.in index 28242dfe4..28b6b93e5 100644 --- a/interface-definitions/system_frr.xml.in +++ b/interface-definitions/system_frr.xml.in @@ -35,6 +35,40 @@ <valueless/> </properties> </leafNode> + <leafNode name="watchfrr-timeout"> + <properties> + <help>Set watchfrr daemon timeout</help> + <valueHelp> + <format>u32:60-600</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-600"/> + </constraint> + <constraintErrorMessage>Timeout must be in range 60 to 600 seconds</constraintErrorMessage> + </properties> + <defaultValue>90</defaultValue> + </leafNode> + <leafNode name="profile"> + <properties> + <help>Select configuration profile to adapt different defaults</help> + <completionHelp> + <list>traditional datacenter</list> + </completionHelp> + <valueHelp> + <format>traditional</format> + <description>Adhere mostly to IETF standards or common practices in wide-area internet routing</description> + </valueHelp> + <valueHelp> + <format>datacenter</format> + <description>Single administrative domain using aggressive timers</description> + </valueHelp> + <constraint> + <regex>(datacenter|traditional)</regex> + </constraint> + </properties> + <defaultValue>traditional</defaultValue> + </leafNode> <node name="snmp"> <properties> <help>Enable SNMP integration for next daemons</help> diff --git a/interface-definitions/system_ip.xml.in b/interface-definitions/system_ip.xml.in index b4b5092fe..df9ffa24b 100644 --- a/interface-definitions/system_ip.xml.in +++ b/interface-definitions/system_ip.xml.in @@ -5,7 +5,7 @@ <node name="ip" owner="${vyos_conf_scripts_dir}/system_ip.py"> <properties> <help>IPv4 Settings</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>290</priority> </properties> <children> @@ -17,6 +17,22 @@ #include <include/arp-ndp-table-size.xml.i> </children> </node> + <tagNode name="import-table"> + <properties> + <help>Routing table for import</help> + <valueHelp> + <format>u32:1-252</format> + <description>Table number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-252"/> + </constraint> + </properties> + <children> + #include <include/static/static-route-distance.xml.i> + #include <include/route-map.xml.i> + </children> + </tagNode> <leafNode name="disable-forwarding"> <properties> <help>Disable IPv4 forwarding on all interfaces</help> diff --git a/interface-definitions/system_ipv6.xml.in b/interface-definitions/system_ipv6.xml.in index dda00af38..6181152f1 100644 --- a/interface-definitions/system_ipv6.xml.in +++ b/interface-definitions/system_ipv6.xml.in @@ -5,7 +5,7 @@ <node name="ipv6" owner="${vyos_conf_scripts_dir}/system_ipv6.py"> <properties> <help>IPv6 Settings</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>290</priority> </properties> <children> diff --git a/interface-definitions/system_lcd.xml.in b/interface-definitions/system_lcd.xml.in index 0cf4de308..cb9664a0f 100644 --- a/interface-definitions/system_lcd.xml.in +++ b/interface-definitions/system_lcd.xml.in @@ -12,7 +12,7 @@ <properties> <help>Model of the display attached to this system</help> <completionHelp> - <list>cfa-533 cfa-631 cfa-633 cfa-635 hd44780 sdec</list> + <list>cfa-533 cfa-631 cfa-633 cfa-635 hd44780 sdec mtc-s16209x</list> </completionHelp> <valueHelp> <format>cfa-533</format> @@ -32,14 +32,18 @@ </valueHelp> <valueHelp> <format>hd44780</format> - <description>Hitachi HD44780, Caswell Appliances</description> + <description>Hitachi HD44780, Caswell Appliances, Sophos XG appliances</description> </valueHelp> <valueHelp> <format>sdec</format> <description>Lanner, Watchguard, Nexcom NSA, Sophos UTM appliances</description> </valueHelp> + <valueHelp> + <format>mtc-s16209x</format> + <description>Microtips Technology S16209x, Sophos SG appliances</description> + </valueHelp> <constraint> - <regex>(cfa-533|cfa-631|cfa-633|cfa-635|hd44780|sdec)</regex> + <regex>(cfa-533|cfa-631|cfa-633|cfa-635|hd44780|sdec|mtc-s16209x)</regex> </constraint> </properties> </leafNode> diff --git a/interface-definitions/system_login.xml.in b/interface-definitions/system_login.xml.in index f6c8021d3..889ee5b98 100644 --- a/interface-definitions/system_login.xml.in +++ b/interface-definitions/system_login.xml.in @@ -8,6 +8,38 @@ <priority>400</priority> </properties> <children> + <tagNode name="operator-group"> + <properties> + <help>Operator group</help> + <constraint> + #include <include/constraint/login-username.xml.i> + </constraint> + <constraintErrorMessage>Operator group name contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage> + </properties> + <children> + <node name="command-policy"> + <properties> + <help>Command policy</help> + </properties> + <children> + <leafNode name="allow"> + <properties> + <multi/> + <help>Command subtree allowed to execute</help> + <valueHelp> + <format>txt</format> + <description>Exact command (e.g., 'show interfaces')</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Command wildcard (e.g., '* vpn')</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> <tagNode name="user"> <properties> <help>Local user account information</help> @@ -17,6 +49,26 @@ <constraintErrorMessage>Username contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage> </properties> <children> + <node name="operator"> + <properties> + <help>Restrict the user to operational mode</help> + </properties> + <children> + <leafNode name="group"> + <properties> + <multi/> + <help>Operator group</help> + <completionHelp> + <path>system login operator-group</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Operator group name</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> <node name="authentication"> <properties> <help>Authentication settings</help> @@ -31,6 +83,7 @@ <regex>\$1\$[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{22}</regex> <regex>\$5\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{43}</regex> <regex>\$6\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{86}</regex> + <regex>\$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{0,86}\$[./A-Za-z0-9]{43}</regex> </constraint> <constraintErrorMessage>Invalid encrypted password for $VAR(../../@).</constraintErrorMessage> </properties> @@ -103,6 +156,15 @@ <help>Plaintext password used for encryption</help> </properties> </leafNode> + <leafNode name="principal"> + <properties> + <help>Accepted principal names for certificate authentication</help> + <constraint> + #include <include/constraint/login-username.xml.i> + </constraint> + <multi/> + </properties> + </leafNode> <tagNode name="public-keys"> <properties> <help>Remote access public keys</help> @@ -190,7 +252,7 @@ <description>Path to home directory</description> </valueHelp> <constraint> - <regex>\/$|(\/[a-zA-Z_0-9-.]+)+</regex> + <regex>(\/[a-zA-Z_0-9-.]+)+\/?$</regex> </constraint> </properties> </leafNode> diff --git a/interface-definitions/system_option.xml.in b/interface-definitions/system_option.xml.in index dc9958ff5..4f9103e56 100644 --- a/interface-definitions/system_option.xml.in +++ b/interface-definitions/system_option.xml.in @@ -32,12 +32,193 @@ <constraintErrorMessage>Must be ignore, reboot, or poweroff</constraintErrorMessage> </properties> </leafNode> + <node name="resource-limits"> + <properties> + <help>Resource limits</help> + </properties> + <children> + <leafNode name="max-map-count"> + <properties> + <help>Maximum number of memory map areas a process may have</help> + <valueHelp> + <format>u32:65530-2147483647</format> + <description>Areas count</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate areas count based on number of hugepages</description> + </valueHelp> + <constraint> + <regex>(auto)</regex> + <validator name="numeric" argument="--range 65530-2147483647"/> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + <leafNode name="shmmax"> + <properties> + <help>Maximum shared memory segment size that can be created</help> + <valueHelp> + <format>u64:8589934592-18446744073709551615</format> + <description>Size in bytes</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate shared memory based on number of hugepages</description> + </valueHelp> + <constraint> + <regex>(auto)</regex> + <validator name="numeric" argument="--range 8589934592-18446744073709551615"/> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + </children> + </node> <node name="kernel"> <properties> <help>Kernel boot parameters</help> </properties> <children> - <leafNode name="disable-mitigations"> + <node name="cpu"> + <properties> + <help>CPU settings</help> + </properties> + <children> + <leafNode name="disable-nmi-watchdog"> + <properties> + <help>Disable the NMI watchdog for detecting hard CPU lockups</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="isolate-cpus"> + <properties> + <help>Isolate specified CPUs from the scheduler</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + <leafNode name="nohz-full"> + <properties> + <help>Enable full tickless mode for specified CPUs</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rcu-no-cbs"> + <properties> + <help>Offload Read-Copy-Update (RCU) callback processing to specified CPUs</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="memory"> + <properties> + <help>Memory settings</help> + </properties> + <children> + <leafNode name="disable-numa-balancing"> + <properties> + <help>Disable automatic NUMA memory balancing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="default-hugepage-size"> + <properties> + <help>Set default hugepage size (e.g., 2M, 1G)</help> + <completionHelp> + <list>2M 1G</list> + </completionHelp> + <valueHelp> + <format>2M</format> + <description>2 megabytes</description> + </valueHelp> + <valueHelp> + <format>1G</format> + <description>1 gigabyte</description> + </valueHelp> + <constraint> + <regex>(2M|1G)</regex> + </constraint> + </properties> + </leafNode> + <tagNode name="hugepage-size"> + <properties> + <help>Set hugepage size for allocation (e.g., 2M, 1G)</help> + <completionHelp> + <list>2M 1G</list> + </completionHelp> + <valueHelp> + <format>2M</format> + <description>2 megabytes</description> + </valueHelp> + <valueHelp> + <format>1G</format> + <description>1 gigabyte</description> + </valueHelp> + <constraint> + <regex>(2M|1G)</regex> + </constraint> + </properties> + <children> + <leafNode name="hugepage-count"> + <properties> + <help>Allocate number of hugepages for system use</help> + <valueHelp> + <format>u32</format> + <description>Number of hugepages</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-100000"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <leafNode name="disable-hpet"> + <properties> + <help>Disable High Precision Event Timer (HPET)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-mce"> + <properties> + <help>Disable Machine Check Exceptions (MCE) reporting and handling</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-mitigations"> <properties> <help>Disable all optional CPU mitigations</help> <valueless/> @@ -69,6 +250,18 @@ </valueHelp> </properties> </leafNode> + <leafNode name="disable-softlockup"> + <properties> + <help>Disable soft lockup detector for kernel threads</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="quiet"> + <properties> + <help>Disable most log messages</help> + <valueless/> + </properties> + </leafNode> <node name="debug"> <properties> <help>Dynamic debugging for kernel module</help> @@ -88,7 +281,7 @@ <properties> <help>System keyboard layout, type ISO2</help> <completionHelp> - <list>us uk fr de es fi jp106 no dk se-latin1 dvorak</list> + <list>us uk fr de es fi it jp106 no dk se-latin1 dvorak</list> </completionHelp> <valueHelp> <format>us</format> @@ -115,6 +308,10 @@ <description>Finland</description> </valueHelp> <valueHelp> + <format>it</format> + <description>Italy</description> + </valueHelp> + <valueHelp> <format>jp106</format> <description>Japan</description> </valueHelp> @@ -135,7 +332,7 @@ <description>Dvorak</description> </valueHelp> <constraint> - <regex>(us|uk|fr|de|es|fi|jp106|no|dk|se-latin1|dvorak)</regex> + <regex>(us|uk|fr|de|es|fi|it|jp106|no|dk|se-latin1|dvorak)</regex> </constraint> <constraintErrorMessage>Invalid keyboard layout</constraintErrorMessage> </properties> @@ -145,19 +342,32 @@ <properties> <help>Tune system performance</help> <completionHelp> - <list>throughput latency</list> + <list>network-throughput network-latency power-save virtual-host virtual-guest</list> </completionHelp> <valueHelp> - <format>throughput</format> + <format>network-throughput</format> <description>Tune for maximum network throughput</description> </valueHelp> <valueHelp> - <format>latency</format> + <format>network-latency</format> <description>Tune for low network latency</description> </valueHelp> + <valueHelp> + <format>power-save</format> + <description>Tune for low power consumption</description> + </valueHelp> + <valueHelp> + <format>virtual-guest</format> + <description>Tune for running inside a virtual machine</description> + </valueHelp> + <valueHelp> + <format>virtual-host</format> + <description>Tune for running guest virtual machines</description> + </valueHelp> <constraint> - <regex>(throughput|latency)</regex> + <regex>(network-throughput|network-latency|power-save|virtual-guest|virtual-host)</regex> </constraint> + <multi/> </properties> </leafNode> <node name="http-client"> @@ -175,6 +385,19 @@ <valueless/> </properties> </leafNode> + <leafNode name="reboot-on-upgrade-failure"> + <properties> + <help>Automatic reboot into previous running image on upgrade failure</help> + <valueHelp> + <format>u32:1-30</format> + <description>Timeout before automatic reboot (minutes)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 5-30"/> + </constraint> + <constraintErrorMessage>Timeout out of range, must be 5 to 30 minutes</constraintErrorMessage> + </properties> + </leafNode> <node name="ssh-client"> <properties> <help>Global options used for SSH client</help> @@ -192,7 +415,7 @@ </leafNode> <leafNode name="root-partition-auto-resize"> <properties> - <help>Enable root partition auto-extention on system boot</help> + <help>Enable root partition auto-extension on system boot</help> <valueless/> </properties> </leafNode> diff --git a/interface-definitions/system_sflow.xml.in b/interface-definitions/system_sflow.xml.in index aaf4033d8..a77d6cf00 100644 --- a/interface-definitions/system_sflow.xml.in +++ b/interface-definitions/system_sflow.xml.in @@ -106,6 +106,18 @@ </leafNode> </children> </tagNode> + <leafNode name="vpp"> + <properties> + <help>Enable VPP sampling</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="enable-egress"> + <properties> + <help>Enable egress sampling</help> + <valueless/> + </properties> + </leafNode> #include <include/interface/vrf.xml.i> </children> </node> diff --git a/interface-definitions/system_static-host-mapping.xml.in b/interface-definitions/system_static-host-mapping.xml.in index 492741f11..2e72b97ec 100644 --- a/interface-definitions/system_static-host-mapping.xml.in +++ b/interface-definitions/system_static-host-mapping.xml.in @@ -23,7 +23,7 @@ <constraint> <regex>.{1,63}</regex> </constraint> - <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 charactes</constraintErrorMessage> + <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 characters</constraintErrorMessage> <multi /> </properties> </leafNode> diff --git a/interface-definitions/system_syslog.xml.in b/interface-definitions/system_syslog.xml.in index 3343e2c59..221b4320f 100644 --- a/interface-definitions/system_syslog.xml.in +++ b/interface-definitions/system_syslog.xml.in @@ -8,28 +8,17 @@ <priority>400</priority> </properties> <children> - <tagNode name="user"> + <node name="console"> <properties> - <help>Logging to specific terminal of given user</help> - <completionHelp> - <path>system login user</path> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>Local user account</description> - </valueHelp> - <constraint> - #include <include/constraint/login-username.xml.i> - </constraint> - <constraintErrorMessage>illegal characters in user</constraintErrorMessage> + <help>Log to system console (/dev/console)</help> </properties> <children> #include <include/syslog-facility.xml.i> </children> - </tagNode> - <tagNode name="host"> + </node> + <tagNode name="remote"> <properties> - <help>Logging to remote host</help> + <help>Log to remote host</help> <constraint> <validator name="ip-address"/> <validator name="fqdn"/> @@ -49,11 +38,6 @@ </valueHelp> </properties> <children> - #include <include/port-number.xml.i> - <leafNode name="port"> - <defaultValue>514</defaultValue> - </leafNode> - #include <include/protocol-tcp-udp.xml.i> #include <include/syslog-facility.xml.i> <node name="format"> <properties> @@ -62,92 +46,112 @@ <children> <leafNode name="octet-counted"> <properties> - <help>Allows for the transmission of all characters inside a syslog message</help> + <help>Allows for the transmission of multi-line messages (TCP only)</help> <valueless/> </properties> </leafNode> - </children> - </node> - </children> - </tagNode> - <node name="global"> - <properties> - <help>Logging to system standard location</help> - </properties> - <children> - #include <include/syslog-facility.xml.i> - <node name="marker"> - <properties> - <help>mark messages sent to syslog</help> - </properties> - <children> - <leafNode name="interval"> + <leafNode name="include-timezone"> <properties> - <help>time interval how often a mark message is being sent in seconds</help> - <constraint> - <validator name="numeric" argument="--positive"/> - </constraint> + <help>Use RFC 5424 format (with RFC 3339 timestamp and timezone)</help> + <valueless/> </properties> - <defaultValue>1200</defaultValue> </leafNode> </children> </node> - <leafNode name="preserve-fqdn"> - <properties> - <help>uses FQDN for logging</help> - <valueless/> - </properties> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>514</defaultValue> </leafNode> - </children> - </node> - <tagNode name="file"> - <properties> - <help>Logging to a file</help> - <constraint> - <regex>[a-zA-Z0-9\-_.]{1,255}</regex> - </constraint> - <constraintErrorMessage>illegal characters in filename or filename longer than 255 characters</constraintErrorMessage> - </properties> - <children> - <node name="archive"> + #include <include/protocol-tcp-udp.xml.i> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/vrf.xml.i> + <node name="tls"> <properties> - <help>Log file size and rotation characteristics</help> + <help>Transport Layer Security (TLS) options for secure syslog</help> </properties> <children> - <leafNode name="file"> + <!-- CA cert help should describe trust anchor for server/client validation --> + #include <include/pki/ca-certificate.xml.i> + <!-- Certificate help should specify identity for mutual authentication --> + #include <include/pki/certificate.xml.i> + <leafNode name="auth-mode"> <properties> - <help>Number of saved files</help> + <help>Specify the authentication and verification method for the remote peer's certificate during the TLS handshake</help> + <completionHelp> + <list>anon fingerprint certvalid name</list> + </completionHelp> + <valueHelp> + <format>anon</format> + <description>Allow encrypted connection without verifying the peer's identity (anonymous TLS)</description> + </valueHelp> + <valueHelp> + <format>fingerprint</format> + <description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peer` option)</description> + </valueHelp> + <valueHelp> + <format>certvalid</format> + <description>Authenticate peer if it presents a certificate signed by a trusted CA</description> + </valueHelp> + <valueHelp> + <format>name</format> + <description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peer` option)</description> + </valueHelp> <constraint> - <regex>[0-9]+</regex> + <regex>(anon|fingerprint|certvalid|name)</regex> </constraint> - <constraintErrorMessage>illegal characters in number of files</constraintErrorMessage> </properties> - <defaultValue>5</defaultValue> + <defaultValue>anon</defaultValue> </leafNode> - <leafNode name="size"> + <leafNode name="permitted-peer"> <properties> - <help>Size of log files in kbytes</help> - <constraint> - <regex>[0-9]+</regex> - </constraint> - <constraintErrorMessage>illegal characters in size</constraintErrorMessage> + <help>Allowed peer certificate fingerprint or subject name</help> + <valueHelp> + <format>txt</format> + <description>Peer fingerprint - SHA1:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX or subject name - logs.example.com</description> + </valueHelp> + <multi/> </properties> - <defaultValue>256</defaultValue> </leafNode> </children> </node> - #include <include/syslog-facility.xml.i> </children> </tagNode> - <node name="console"> + <node name="local"> <properties> - <help>logging to serial console</help> + <help>Log to standard system location /var/log/messages</help> </properties> <children> #include <include/syslog-facility.xml.i> </children> </node> - #include <include/interface/vrf.xml.i> + <node name="marker"> + <properties> + <help>Mark messages sent to syslog</help> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + <leafNode name="interval"> + <properties> + <help>Mark message interval</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage> + </properties> + <defaultValue>1200</defaultValue> + </leafNode> + </children> + </node> + <leafNode name="preserve-fqdn"> + <properties> + <help>Always include domain portion in hostname</help> + <valueless/> + </properties> + </leafNode> </children> </node> </children> diff --git a/interface-definitions/system_watchdog.xml.in b/interface-definitions/system_watchdog.xml.in new file mode 100644 index 000000000..c651bc652 --- /dev/null +++ b/interface-definitions/system_watchdog.xml.in @@ -0,0 +1,70 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="system"> + <children> + <node name="watchdog" owner="${vyos_conf_scripts_dir}/system_watchdog.py"> + <properties> + <help>Hardware watchdog configuration</help> + <priority>9999</priority> + </properties> + <children> + <leafNode name="module"> + <properties> + <help>Kernel module to load for watchdog device (optional)</help> + <valueHelp> + <format>txt</format> + <description>Module name (e.g. 'softdog', 'iTCO_wdt', 'sp5100_tco')</description> + </valueHelp> + <constraint> + <validator name="watchdog-module"/> + </constraint> + <constraintErrorMessage>Module must be an available watchdog kernel driver module</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Watchdog timeout for runtime in seconds (1-65535)</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Timeout must be between 1 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>10</defaultValue> + </leafNode> + <leafNode name="shutdown-timeout"> + <properties> + <help>Watchdog timeout during shutdown in seconds (60-65535)</help> + <valueHelp> + <format>u32:60-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-65535"/> + </constraint> + <constraintErrorMessage>Shutdown timeout must be between 60 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + <leafNode name="reboot-timeout"> + <properties> + <help>Watchdog timeout during reboot in seconds (60-65535)</help> + <valueHelp> + <format>u32:60-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-65535"/> + </constraint> + <constraintErrorMessage>Reboot timeout must be between 60 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/system_wireless.xml.in b/interface-definitions/system_wireless.xml.in index 834f8b624..2b7ed68d0 100644 --- a/interface-definitions/system_wireless.xml.in +++ b/interface-definitions/system_wireless.xml.in @@ -5,7 +5,7 @@ <node name="wireless" owner="${vyos_conf_scripts_dir}/system_wireless.py"> <properties> <help>Wireless (IEEE-802.11) subsystem settings</help> - <!-- must be before interface wireless, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before interface wireless, check /usr/libexec/vyos/priority.py --> <priority>317</priority> </properties> <children> diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index d9d6fd93b..ee8340a74 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -41,6 +41,56 @@ </valueHelp> </properties> </leafNode> + <leafNode name="secret-type"> + <properties> + <help>Secret type</help> + <completionHelp> + <list>base64 hex plaintext</list> + </completionHelp> + <constraint> + <regex>(base64|hex|plaintext)</regex> + </constraint> + </properties> + <defaultValue>plaintext</defaultValue> + </leafNode> + </children> + </tagNode> + <tagNode name="ppk"> + <properties> + <help>Post-quantum preshared key name</help> + </properties> + <children> + <leafNode name="id"> + <properties> + <help>ID for PPK</help> + <valueHelp> + <format>txt</format> + <description>ID used for PPK</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="secret"> + <properties> + <help>Post-quantum preshared secret key</help> + <valueHelp> + <format>txt</format> + <description>Post-quantum preshared secret key</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="secret-type"> + <properties> + <help>Secret type</help> + <completionHelp> + <list>base64 hex plaintext</list> + </completionHelp> + <constraint> + <regex>(base64|hex|plaintext)</regex> + </constraint> + </properties> + <defaultValue>plaintext</defaultValue> + </leafNode> </children> </tagNode> </children> @@ -79,7 +129,7 @@ <properties> <help>Security Association byte count to expire</help> <valueHelp> - <format>u32:1024-26843545600000</format> + <format>u64:1024-26843545600000</format> <description>SA life in bytes</description> </valueHelp> <constraint> @@ -91,7 +141,7 @@ <properties> <help>Security Association packet count to expire</help> <valueHelp> - <format>u32:1000-26843545600000</format> + <format>u64:1000-26843545600000</format> <description>SA life in packets</description> </valueHelp> <constraint> @@ -577,7 +627,7 @@ <validator name="numeric" argument="--range 0-2"/> </constraint> </properties> - <defaultValue>0</defaultValue> + <defaultValue>1</defaultValue> </leafNode> <leafNode name="subsystem"> <properties> @@ -689,6 +739,52 @@ <valueless/> </properties> </leafNode> + <node name="retransmission"> + <properties> + <help>IPsec retransmission settings</help> + </properties> + <children> + <leafNode name="attempts"> + <properties> + <help>Maximum number of retransmissions</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Maximum number of retransmissions</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + </properties> + <defaultValue>5</defaultValue> + </leafNode> + <leafNode name="base"> + <properties> + <help>Base of exponential backoff</help> + <valueHelp> + <format><1.0-5.0></format> + <description>Base of exponential backoff</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-5 --float"/> + </constraint> + </properties> + <defaultValue>1.8</defaultValue> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Timeout in seconds before the first retransmission</help> + <valueHelp> + <format>u32:1-1000</format> + <description>Timeout in seconds before the first retransmission</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-1000"/> + </constraint> + </properties> + <defaultValue>4</defaultValue> + </leafNode> + </children> + </node> </children> </node> <tagNode name="profile"> @@ -710,18 +806,7 @@ <help>Authentication</help> </properties> <children> - <leafNode name="mode"> - <properties> - <help>Authentication mode</help> - <completionHelp> - <list>pre-shared-secret</list> - </completionHelp> - <valueHelp> - <format>pre-shared-secret</format> - <description>Use a pre-shared secret key</description> - </valueHelp> - </properties> - </leafNode> + #include <include/auth-mode-pre-shared-secret.xml.i> #include <include/ipsec/authentication-pre-shared-secret.xml.i> </children> </node> @@ -823,6 +908,12 @@ <defaultValue>eap-mschapv2</defaultValue> </leafNode> #include <include/auth-local-users.xml.i> + <leafNode name="always-send-cert"> + <properties> + <help>Always send local certificate for this connection</help> + <valueless/> + </properties> + </leafNode> <leafNode name="server-mode"> <properties> <help>Server authentication mode</help> @@ -843,9 +934,11 @@ </properties> <defaultValue>x509</defaultValue> </leafNode> + #include <include/ipsec/ppk.xml.i> #include <include/ipsec/authentication-pre-shared-secret.xml.i> </children> </node> + #include <include/ipsec/childless.xml.i> #include <include/generic-description.xml.i> #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> @@ -1060,6 +1153,7 @@ </properties> <children> #include <include/ipsec/authentication-id.xml.i> + #include <include/ipsec/ppk.xml.i> #include <include/ipsec/authentication-rsa.xml.i> #include <include/ipsec/authentication-x509.xml.i> <leafNode name="mode"> @@ -1103,32 +1197,33 @@ </leafNode> </children> </node> + #include <include/ipsec/childless.xml.i> <leafNode name="connection-type"> <properties> <help>Connection type</help> <completionHelp> - <list>initiate respond none</list> + <list>initiate trap none</list> </completionHelp> <valueHelp> <format>initiate</format> <description>Bring the connection up immediately</description> </valueHelp> <valueHelp> - <format>respond</format> - <description>Wait for the peer to initiate the connection</description> + <format>trap</format> + <description>Bring the connection up only when matching traffic is detected</description> </valueHelp> <valueHelp> <format>none</format> <description>Load the connection only</description> </valueHelp> <constraint> - <regex>(initiate|respond|none)</regex> + <regex>(initiate|trap|none)</regex> </constraint> </properties> </leafNode> <leafNode name="default-esp-group"> <properties> - <help>Defult ESP group name</help> + <help>Default ESP group name</help> <completionHelp> <path>vpn ipsec esp-group</path> </completionHelp> @@ -1151,11 +1246,11 @@ </completionHelp> <valueHelp> <format>yes</format> - <description>Enable remote host re-autentication during an IKE re-key. Currently broken due to a strong swan bug</description> + <description>Enable remote host re-authentication during an IKE re-key</description> </valueHelp> <valueHelp> <format>no</format> - <description>Disable remote host re-authenticaton during an IKE re-key.</description> + <description>Disable remote host re-authentication during an IKE re-key.</description> </valueHelp> <valueHelp> <format>inherit</format> @@ -1181,6 +1276,13 @@ #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> #include <include/ipsec/local-traffic-selector.xml.i> + <node name="local"> + <children> + <leafNode name="prefix"> + <defaultValue>dynamic</defaultValue> + </leafNode> + </children> + </node> #include <include/ip-protocol.xml.i> <leafNode name="priority"> <properties> @@ -1217,6 +1319,7 @@ </constraint> <multi/> </properties> + <defaultValue>dynamic</defaultValue> </leafNode> </children> </node> @@ -1243,6 +1346,63 @@ <children> #include <include/ipsec/bind.xml.i> #include <include/ipsec/esp-group.xml.i> + <node name="traffic-selector"> + <properties> + <help>Traffic-selectors parameters</help> + </properties> + <children> + <node name="local"> + <properties> + <help>Local parameters for interesting traffic</help> + </properties> + <children> + <leafNode name="prefix"> + <properties> + <help>Local IPv4 or IPv6 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>Local IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>Local IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + <node name="remote"> + <properties> + <help>Remote parameters for interesting traffic</help> + </properties> + <children> + <leafNode name="prefix"> + <properties> + <help>Remote IPv4 or IPv6 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>Remote IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>Remote IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in index c00e82534..d28f86653 100644 --- a/interface-definitions/vpn_l2tp.xml.in +++ b/interface-definitions/vpn_l2tp.xml.in @@ -137,6 +137,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpn_openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in index a2f040b2f..e9280cd12 100644 --- a/interface-definitions/vpn_openconnect.xml.in +++ b/interface-definitions/vpn_openconnect.xml.in @@ -65,10 +65,41 @@ </leafNode> <leafNode name="radius"> <properties> - <help>Use RADIUS server for user autentication</help> + <help>Use RADIUS server for user authentication</help> <valueless/> </properties> </leafNode> + <node name="certificate"> + <properties> + <help>Use certificate-based authentication</help> + </properties> + <children> + <leafNode name="user-identifier-field"> + <properties> + <help>Certificate field to identify users by</help> + <valueHelp> + <format>cn</format> + <description>OID 2.5.4.3 - Common Name</description> + </valueHelp> + <valueHelp> + <format>uid</format> + <description>OID 0.9.2342.19200300.100.1.1 - UID</description> + </valueHelp> + <valueHelp> + <format>x.x.xx.xxx</format> + <description>Custom OID in dotted decimal format</description> + </valueHelp> + <constraint> + <regex>(^\d{1,5}(?:\.\d{1,5})*$|cn|uid)</regex> + </constraint> + <constraintErrorMessage>Invalid OID selection. Must be cn, uid, or a valid OID format.</constraintErrorMessage> + <completionHelp> + <list>cn uid x.x.xx.xxx</list> + </completionHelp> + </properties> + </leafNode> + </children> + </node> </children> </node> <node name="identity-based-config"> @@ -216,7 +247,7 @@ #include <include/radius-timeout.xml.i> <leafNode name="groupconfig"> <properties> - <help>If the groupconfig option is set, then config-per-user will be overriden, and all configuration will be read from RADIUS.</help> + <help>If the groupconfig option is set, then config-per-user will be overridden, and all configuration will be read from RADIUS.</help> </properties> </leafNode> </children> @@ -389,6 +420,37 @@ </leafNode> </children> </node> + <node name="script"> + <properties> + <help>Execute script on client connect/disconnect</help> + </properties> + <children> + <leafNode name="connect"> + <properties> + <help>Script to execute upon client connecting</help> + <valueHelp> + <format>filename</format> + <description>Client connect script, must be under /config/scripts</description> + </valueHelp> + <constraint> + <validator name="file-path" argument="--file --parent-dir /config/scripts --strict"/> + </constraint> + </properties> + </leafNode> + <leafNode name="disconnect"> + <properties> + <help>Script to execute upon client disconnecting</help> + <valueHelp> + <format>filename</format> + <description>Client disconnect script, must be under /config/scripts</description> + </valueHelp> + <constraint> + <validator name="file-path" argument="--file --parent-dir /config/scripts --strict"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in index 8aec0cb1c..3e985486d 100644 --- a/interface-definitions/vpn_pptp.xml.in +++ b/interface-definitions/vpn_pptp.xml.in @@ -53,6 +53,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpn_sstp.xml.in b/interface-definitions/vpn_sstp.xml.in index 5fd5c95ca..851a202dc 100644 --- a/interface-definitions/vpn_sstp.xml.in +++ b/interface-definitions/vpn_sstp.xml.in @@ -50,6 +50,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in new file mode 100644 index 000000000..bf5e56db8 --- /dev/null +++ b/interface-definitions/vpp.xml.in @@ -0,0 +1,1255 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="vpp" owner="${vyos_conf_scripts_dir}/vpp.py"> + <properties> + <help>Accelerated data-plane</help> + <priority>295</priority> + </properties> + <children> + <node name="ipfix" owner="${vyos_conf_scripts_dir}/vpp_ipfix.py"> + <properties> + <help>IP Flow Information Export (IPFIX) configuration</help> + <priority>332</priority> + </properties> + <children> + <tagNode name="collector"> + <properties> + <help>Collector IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 server to export IPFIX</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 server to export IPFIX</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + </constraint> + </properties> + <children> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>4739</defaultValue> + </leafNode> + <leafNode name="path-mtu"> + <properties> + <help>Path MTU</help> + <valueHelp> + <format>u32:68-1450</format> + <description>Bytes</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 68-1450"/> + </constraint> + </properties> + <defaultValue>512</defaultValue> + </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + <leafNode name="template-interval"> + <properties> + <help>Interval in seconds</help> + <valueHelp> + <format>u32:1-300</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-300"/> + </constraint> + </properties> + <defaultValue>20</defaultValue> + </leafNode> + <leafNode name="udp-checksum"> + <properties> + <help>Allow UDP checksum</help> + <valueless/> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + </properties> + <children> + <leafNode name="direction"> + <properties> + <help>Flow direction</help> + <completionHelp> + <list>rx tx both</list> + </completionHelp> + <valueHelp> + <format>rx</format> + <description>Rx direction</description> + </valueHelp> + <valueHelp> + <format>tx</format> + <description>Tx direction</description> + </valueHelp> + <valueHelp> + <format>both</format> + <description>Rx and Tx direction</description> + </valueHelp> + <constraint> + <regex>(rx|tx|both)</regex> + </constraint> + </properties> + <defaultValue>both</defaultValue> + </leafNode> + <leafNode name="flow-variant"> + <properties> + <help>Flow variant</help> + <completionHelp> + <list>l2 ipv4 ipv6</list> + </completionHelp> + <valueHelp> + <format>l2</format> + <description>L2</description> + </valueHelp> + <valueHelp> + <format>_ipv4</format> + <description>IPv4</description> + </valueHelp> + <valueHelp> + <format>_ipv6</format> + <description>IPv6</description> + </valueHelp> + <constraint> + <regex>(l2|ipv4|ipv6)</regex> + </constraint> + </properties> + <defaultValue>ipv4</defaultValue> + </leafNode> + </children> + </tagNode> + <leafNode name="active-timeout"> + <properties> + <help>Flow activity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Active flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + <defaultValue>15</defaultValue> + </leafNode> + <leafNode name="inactive-timeout"> + <properties> + <help>Flow inactivity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Inactive flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + <leafNode name="flowprobe-record"> + <properties> + <help>Flow record layers</help> + <completionHelp> + <list>l2 l3 l4</list> + </completionHelp> + <valueHelp> + <format>l2</format> + <description>Include level 2 information</description> + </valueHelp> + <valueHelp> + <format>l3</format> + <description>Include level 3 information</description> + </valueHelp> + <valueHelp> + <format>l4</format> + <description>Include level 4 information</description> + </valueHelp> + <constraint> + <regex>(l2|l3|l4)</regex> + </constraint> + <multi/> + </properties> + <defaultValue>l3</defaultValue> + </leafNode> + </children> + </node> + <node name="settings"> + <properties> + <help>VPP settings</help> + </properties> + <children> + <node name="resource-allocation"> + <properties> + <help>Resource allocation settings</help> + </properties> + <children> + <leafNode name="cpu-cores"> + <properties> + <help>Create worker threads (including main-core)</help> + <valueHelp> + <format>u32:1-512</format> + <description>Worker threads</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-512"/> + </constraint> + </properties> + <defaultValue>1</defaultValue> + </leafNode> + <node name="buffers"> + <properties> + <help>Buffer settings</help> + </properties> + <children> + <leafNode name="buffers-per-numa"> + <properties> + <help>Number of buffers per numa node</help> + <completionHelp> + <list>auto</list> + </completionHelp> + <valueHelp> + <format>u32:16384-4294967295</format> + <description>Number of buffers</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate number of buffers per numa node</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 16384-4294967295"/> + <regex>(auto)</regex> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + <leafNode name="data-size"> + <properties> + <help>Size of buffer data area</help> + <valueHelp> + <format>u32</format> + <description>Size of buffer data area</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + <defaultValue>2048</defaultValue> + </leafNode> + <leafNode name="page-size"> + <properties> + <help>Set the page-size for buffer allocation</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 settings</help> + </properties> + <children> + <leafNode name="heap-size"> + <properties> + <help>IPv6 heap size</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>32M</defaultValue> + </leafNode> + <leafNode name="hash-buckets"> + <properties> + <help>IPv6 forwarding table hash buckets</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>IPv6 forwarding table hash buckets</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + <defaultValue>65536</defaultValue> + </leafNode> + </children> + </node> + <leafNode name="mac-limit"> + <properties> + <help>Number of MAC addresses in the L2 FIB</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Number of MAC addresses in the L2 FIB</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + <defaultValue>4194304</defaultValue> + </leafNode> + <node name="memory"> + <properties> + <help>Memory settings</help> + </properties> + <children> + <leafNode name="main-heap-size"> + <properties> + <help>Main heap size</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>3G</defaultValue> + </leafNode> + <leafNode name="main-heap-page-size"> + <properties> + <help>Main heap page size</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + <leafNode name="physmem-max-size"> + <properties> + <help>Memory size for protectable memory allocator (pmalloc) memory space</help> + #include <include/unformat_memory_size.xml.i> + </properties> + </leafNode> + <node name="stats"> + <properties> + <help>Stats settings</help> + </properties> + <children> + <leafNode name="size"> + <properties> + <help>Size of stats segment</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>128M</defaultValue> + </leafNode> + <leafNode name="page-size"> + <properties> + <help>Stats page size</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> + </children> + </node> + <tagNode name="interface"> + <properties> + <help>Interface</help> + <valueHelp> + <format>ethN</format> + <description>Interface name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --type ethernet</script> + </completionHelp> + <constraint> + <validator name="ethernet-interface"/> + </constraint> + <constraintErrorMessage>Invalid interface name</constraintErrorMessage> + </properties> + <children> + <leafNode name="num-rx-desc"> + <properties> + <help>Receive ring descriptors</help> + <valueHelp> + <format>u32:256-16384</format> + <description>Number of descriptors in receive ring</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 256-16384"/> + </constraint> + </properties> + <defaultValue>1024</defaultValue> + </leafNode> + <leafNode name="num-tx-desc"> + <properties> + <help>Tranceive ring descriptors</help> + <valueHelp> + <format>u32:256-8192</format> + <description>Number of descriptors in tranceive ring</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 256-8192"/> + </constraint> + </properties> + <defaultValue>1024</defaultValue> + </leafNode> + <leafNode name="num-rx-queues"> + <properties> + <help>Number of receive queues</help> + <valueHelp> + <format>u32:1-8192</format> + <description>Number of receive queues</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-8192"/> + </constraint> + </properties> + </leafNode> + <leafNode name="num-tx-queues"> + <properties> + <help>Number of tranceive queues</help> + <valueHelp> + <format>u32:1-8192</format> + <description>Number of tranceive queues</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-8192"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <leafNode name="ipsec-acceleration"> + <properties> + <help>Enable IPsec acceleration</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="ignore-kernel-routes"> + <properties> + <help>Ignore kernel routes</help> + <valueless/> + </properties> + </leafNode> + <node name="logging"> + <properties> + <help>Logging settings</help> + </properties> + <children> + <leafNode name="default-level"> + <properties> + <help>Default logging level</help> + <completionHelp> + <list>alert crit debug disabled emerg error info notice warn</list> + </completionHelp> + <valueHelp> + <format>alert</format> + <description>Alert</description> + </valueHelp> + <valueHelp> + <format>crit</format> + <description>Critical</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug</description> + </valueHelp> + <valueHelp> + <format>disabled</format> + <description>Disabled</description> + </valueHelp> + <valueHelp> + <format>emerg</format> + <description>Emergency</description> + </valueHelp> + <valueHelp> + <format>error</format> + <description>Error</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational</description> + </valueHelp> + <valueHelp> + <format>notice</format> + <description>Notice</description> + </valueHelp> + <valueHelp> + <format>warn</format> + <description>Warning</description> + </valueHelp> + <constraint> + <regex>(alert|crit|debug|disabled|emerg|error|info|notice|warn)</regex> + </constraint> + </properties> + </leafNode> + </children> + </node> + <leafNode name="poll-sleep-usec"> + <properties> + <help>Add a fixed-sleep between main loop poll</help> + <valueHelp> + <format>u32:0-500000</format> + <description>Sleep interval in microseconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-500000"/> + </constraint> + </properties> + <defaultValue>0</defaultValue> + </leafNode> + #include <include/vpp/iface_rx_mode.xml.i> + <leafNode name="allow-unsupported-nics"> + <properties> + <help>Allow the attachment of unsupported NICs to VPP. This operation voids official support for the system</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + <node name="sflow" owner="${vyos_conf_scripts_dir}/vpp_sflow.py"> + <properties> + <help>VPP data-plane sFlow</help> + <priority>322</priority> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="header-bytes"> + <properties> + <help>sFlow maximum packet-header length</help> + <completionHelp> + <list>64 96 128 160 192 224 256</list> + </completionHelp> + <valueHelp> + <format>64</format> + <description>64 bytes</description> + </valueHelp> + <valueHelp> + <format>96</format> + <description>96 bytes</description> + </valueHelp> + <valueHelp> + <format>128</format> + <description>128 bytes</description> + </valueHelp> + <valueHelp> + <format>160</format> + <description>160 bytes</description> + </valueHelp> + <valueHelp> + <format>192</format> + <description>192 bytes</description> + </valueHelp> + <valueHelp> + <format>224</format> + <description>224 bytes</description> + </valueHelp> + <valueHelp> + <format>256</format> + <description>256 bytes</description> + </valueHelp> + <constraint> + <regex>(64|96|128|160|192|224|256)</regex> + </constraint> + </properties> + <defaultValue>128</defaultValue> + </leafNode> + </children> + </node> + <node name="nat"> + <properties> + <help>Network Address Translation (NAT) settings</help> + </properties> + <children> + <node name="cgnat" owner="${vyos_conf_scripts_dir}/vpp_nat_cgnat.py"> + <properties> + <help>Carrier-grade NAT (CGNAT)</help> + <priority>331</priority> + </properties> + <children> + <node name="interface"> + <properties> + <help>CGNAT interface setting</help> + </properties> + <children> + <leafNode name="inside"> + <properties> + <help>CGNAT inside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="outside"> + <properties> + <help>CGNAT outside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + <tagNode name="rule"> + <properties> + <help>Rule number for CGNAT</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="inside-prefix"> + <properties> + <help>Inside IPv4 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + </leafNode> + <leafNode name="outside-prefix"> + <properties> + <help>Outside IPv4 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + </leafNode> + #include <include/generic-description.xml.i> + </children> + </tagNode> + <node name="exclude"> + <properties> + <help>Exclude packets matching these rules from CGNAT</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="local-address"> + <properties> + <help>IP address of the internal (local) device</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="local-port"> + <properties> + <help>Port number used by connection on internal device</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage> + </properties> + </leafNode> + #include <include/vpp/nat_protocol.xml.i> + #include <include/generic-description.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="timeout"> + <properties> + <help>Timeouts for CGNAT sessions</help> + </properties> + <children> + <leafNode name="icmp"> + <properties> + <help>ICMP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 60)</description> + </valueHelp> + </properties> + <defaultValue>60</defaultValue> + </leafNode> + <leafNode name="tcp-established"> + <properties> + <help>TCP established timeout</help> + <valueHelp> + <format>u32</format> + <description>TCP established timeout in seconds (default: 7440)</description> + </valueHelp> + </properties> + <defaultValue>7440</defaultValue> + </leafNode> + <leafNode name="tcp-transitory"> + <properties> + <help>TCP transitory timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 240)</description> + </valueHelp> + </properties> + <defaultValue>240</defaultValue> + </leafNode> + <leafNode name="udp"> + <properties> + <help>UDP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 300)</description> + </valueHelp> + </properties> + <defaultValue>300</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> + <node name="nat44" owner="${vyos_conf_scripts_dir}/vpp_nat_nat44.py"> + <properties> + <help>NAT44</help> + <priority>330</priority> + </properties> + <children> + <node name="timeout"> + <properties> + <help>NAT44 session timeouts</help> + </properties> + <children> + <leafNode name="icmp"> + <properties> + <help>ICMP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 60)</description> + </valueHelp> + </properties> + <defaultValue>60</defaultValue> + </leafNode> + <leafNode name="tcp-established"> + <properties> + <help>TCP established timeout</help> + <valueHelp> + <format>u32</format> + <description>TCP established timeout in seconds (default: 7440)</description> + </valueHelp> + </properties> + <defaultValue>7440</defaultValue> + </leafNode> + <leafNode name="tcp-transitory"> + <properties> + <help>TCP transitory timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 240)</description> + </valueHelp> + </properties> + <defaultValue>240</defaultValue> + </leafNode> + <leafNode name="udp"> + <properties> + <help>UDP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 300)</description> + </valueHelp> + </properties> + <defaultValue>300</defaultValue> + </leafNode> + </children> + </node> + <leafNode name="session-limit"> + <properties> + <help>Maximum number of sessions per thread</help> + <valueHelp> + <format>u32</format> + <description>Number of sessions</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Number of sessions must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <defaultValue>64512</defaultValue> + </leafNode> + <node name="interface"> + <properties> + <help>NAT interface setting</help> + </properties> + <children> + <leafNode name="inside"> + <properties> + <help>NAT inside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="outside"> + <properties> + <help>NAT outside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + <node name="address-pool"> + <properties> + <help>NAT address pool</help> + </properties> + <children> + <node name="translation"> + <properties> + <help>NAT translation pool</help> + </properties> + <children> + #include <include/vpp/nat_address_range.xml.i> + #include <include/vpp/nat_interface.xml.i> + </children> + </node> + <node name="twice-nat"> + <properties> + <help>NAT twice-nat pool</help> + </properties> + <children> + #include <include/vpp/nat_address_range.xml.i> + #include <include/vpp/nat_interface.xml.i> + </children> + </node> + </children> + </node> + <node name="static"> + <properties> + <help>Static NAT rules</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number for NAT</help> + <valueHelp> + <format>u32</format> + <description>Number of NAT rule</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <node name="external"> + <properties> + <help>NAT external parameters</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + #include <include/port-number.xml.i> + </children> + </node> + <node name="local"> + <properties> + <help>NAT local parameters</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + #include <include/port-number.xml.i> + </children> + </node> + <node name="options"> + <properties> + <help>NAT static mapping options</help> + </properties> + <children> + <leafNode name="twice-nat"> + <properties> + <help>Rewrite source IP addresses on packets sent from outside to inside</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="self-twice-nat"> + <properties> + <help>Rewrite source IP addresses on packets sent only from a local address to an external address</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="out-to-in-only"> + <properties> + <help>Only apply rule for traffic from outside to inside interfaces</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="twice-nat-address"> + <properties> + <help>Force use of specific IP address from twice-nat address pool</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + #include <include/vpp/nat_protocol.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="exclude"> + <properties> + <help>Exclude packets matching these rules from NAT</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="local-address"> + <properties> + <help>IP address of the internal (local) device</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="local-port"> + <properties> + <help>Port number used by connection on internal device</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage> + </properties> + </leafNode> + #include <include/vpp/nat_protocol.xml.i> + <leafNode name="external-interface"> + <properties> + <help>External interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + </leafNode> + #include <include/generic-description.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> + </node> + <node name="acl" owner="${vyos_conf_scripts_dir}/vpp_acl.py"> + <properties> + <help>Access Control Lists (ACLs)</help> + <priority>332</priority> + </properties> + <children> + <node name="ip"> + <properties> + <help>Access Control List by IPv4/IPv6</help> + </properties> + <children> + <tagNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <valueHelp> + <format>txt</format> + <description>Tag name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <tagNode name="rule"> + <properties> + <help>Rule number for Access control element (ACE)</help> + <valueHelp> + <format>u32</format> + <description>Number of ACE</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + <leafNode name="action"> + <properties> + <help>Rule action</help> + <completionHelp> + <list>permit deny permit-reflect</list> + </completionHelp> + <valueHelp> + <format>permit</format> + <description>Permit matching traffic</description> + </valueHelp> + <valueHelp> + <format>deny</format> + <description>Deny matching traffic</description> + </valueHelp> + <valueHelp> + <format>permit-reflect</format> + <description>Permit the matching outbound traffic and allow the reverse traffic</description> + </valueHelp> + <constraint> + <regex>(permit|deny|permit-reflect)</regex> + </constraint> + </properties> + </leafNode> + <node name="source"> + <properties> + <help>Source parameters</help> + </properties> + <children> + #include <include/vpp/acl_prefix.xml.i> + #include <include/vpp/acl_port_range.xml.i> + </children> + </node> + <node name="destination"> + <properties> + <help>Destination parameters</help> + </properties> + <children> + #include <include/vpp/acl_prefix.xml.i> + #include <include/vpp/acl_port_range.xml.i> + </children> + </node> + <leafNode name="protocol"> + <properties> + <help>Protocol</help> + <completionHelp> + <script>${vyos_completion_dir}/list_protocols.sh</script> + <list>all</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All IP protocols</description> + </valueHelp> + <valueHelp> + <format><protocol></format> + <description>IP protocol name</description> + </valueHelp> + <constraint> + <validator name="ip-protocol"/> + </constraint> + </properties> + <defaultValue>all</defaultValue> + </leafNode> + <node name="tcp-flags"> + <properties> + <help>Match TCP packet flags</help> + </properties> + <children> + <leafNode name="is-set"> + <properties> + <help>Match TCP flags that are set</help> + #include <include/vpp/acl_tcp_flags.xml.i> + </properties> + </leafNode> + <leafNode name="is-not-set"> + <properties> + <help>Match TCP flags that are not set</help> + #include <include/vpp/acl_tcp_flags.xml.i> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Apply an ACL to an interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + <children> + <node name="input"> + <properties> + <help>Input direction</help> + </properties> + <children> + #include <include/vpp/acl_common_interface_ip_rule.xml.i> + </children> + </node> + <node name="output"> + <properties> + <help>Output direction</help> + </properties> + <children> + #include <include/vpp/acl_common_interface_ip_rule.xml.i> + </children> + </node> + </children> + </tagNode> + </children> + </node> + <node name="mac"> + <properties> + <help>Access Control List by mac address</help> + </properties> + <children> + <tagNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <valueHelp> + <format>txt</format> + <description>ACL name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <tagNode name="rule"> + <properties> + <help>Rule number for Access control element (ACE)</help> + <valueHelp> + <format>u32</format> + <description>Number of ACE</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + <leafNode name="action"> + <properties> + <help>Rule action</help> + <completionHelp> + <list>permit deny</list> + </completionHelp> + <valueHelp> + <format>permit</format> + <description>Permit matching traffic</description> + </valueHelp> + <valueHelp> + <format>deny</format> + <description>Deny matching traffic</description> + </valueHelp> + <constraint> + <regex>(permit|deny)</regex> + </constraint> + </properties> + </leafNode> + #include <include/vpp/acl_prefix.xml.i> + <leafNode name="prefix"> + <properties> + <help>Source IP prefix</help> + </properties> + </leafNode> + <leafNode name="mac-address"> + <properties> + <help>Source MAC address</help> + <valueHelp> + <format>macaddr</format> + <description>MAC address</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="mac-mask"> + <properties> + <help>Source MAC mask (default ff:ff:ff:ff:ff:ff)</help> + <valueHelp> + <format>macaddr</format> + <description>MAC mask</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + </constraint> + </properties> + <defaultValue>ff:ff:ff:ff:ff:ff</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Apply an ACL to an input interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + <children> + <leafNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <completionHelp> + <path>vpp acl mac tag-name</path> + </completionHelp> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> +</node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_bonding.xml.in b/interface-definitions/vpp_interface_bonding.xml.in new file mode 100644 index 000000000..78166e306 --- /dev/null +++ b/interface-definitions/vpp_interface_bonding.xml.in @@ -0,0 +1,121 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <properties> + <help>Network interfaces</help> + <priority>300</priority> + </properties> + <children> + <tagNode name="bonding" owner="${vyos_conf_scripts_dir}/vpp_interfaces_bonding.py"> + <properties> + <priority>324</priority> + <help>Bonding Interface/Link Aggregation</help> + <constraint> + <regex>vppbond[0-9]+</regex> + </constraint> + <constraintErrorMessage>Bonding interface must be named vppbondN</constraintErrorMessage> + <valueHelp> + <format>vppbondN</format> + <description>Bonding interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <leafNode name="hash-policy"> + <properties> + <help>Bonding transmit hash policy</help> + <completionHelp> + <list>layer2 layer2+3 layer3+4</list> + </completionHelp> + <valueHelp> + <format>layer2</format> + <description>use MAC addresses to generate the hash</description> + </valueHelp> + <valueHelp> + <format>layer2+3</format> + <description>combine MAC address and IP address to make hash</description> + </valueHelp> + <valueHelp> + <format>layer3+4</format> + <description>combine IP address and port to make hash</description> + </valueHelp> + <constraint> + <regex>(layer2\+3|layer3\+4|layer2)</regex> + </constraint> + <constraintErrorMessage>hash-policy must be layer2 layer2+3 layer3+4</constraintErrorMessage> + </properties> + <defaultValue>layer2</defaultValue> + </leafNode> + #include <include/interface/mac.xml.i> + <leafNode name="mode"> + <properties> + <help>Bonding mode</help> + <completionHelp> + <list>802.3ad active-backup broadcast round-robin xor-hash</list> + </completionHelp> + <valueHelp> + <format>802.3ad</format> + <description>IEEE 802.3ad Dynamic link aggregation</description> + </valueHelp> + <valueHelp> + <format>active-backup</format> + <description>Fault tolerant: only one slave in the bond is active</description> + </valueHelp> + <valueHelp> + <format>broadcast</format> + <description>Fault tolerant: transmits everything on all slave interfaces</description> + </valueHelp> + <valueHelp> + <format>round-robin</format> + <description>Load balance: transmit packets in sequential order</description> + </valueHelp> + <valueHelp> + <format>xor-hash</format> + <description>Distribute based on MAC address</description> + </valueHelp> + <constraint> + <regex>(802.3ad|active-backup|broadcast|round-robin|xor-hash)</regex> + </constraint> + <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, or xor-hash</constraintErrorMessage> + </properties> + <defaultValue>802.3ad</defaultValue> + </leafNode> + <node name="member"> + <properties> + <help>Bonding member interfaces</help> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bondable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1500</defaultValue> + </leafNode> + #include <include/vpp/vif.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_bridge.xml.in b/interface-definitions/vpp_interface_bridge.xml.in new file mode 100644 index 000000000..a918ec99b --- /dev/null +++ b/interface-definitions/vpp_interface_bridge.xml.in @@ -0,0 +1,56 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/vpp_interfaces_bridge.py"> + <properties> + <priority>327</priority> + <help>Bridge domain</help> + <constraint> + <!-- Bridge domain 0 is reserved to vpp default --> + <regex>vppbr(?!0$)[0-9]+</regex> + </constraint> + <constraintErrorMessage>Bridge domain must be named vppbrN and vppbr0 is reserved</constraintErrorMessage> + <valueHelp> + <format>vppbrN</format> + <description>Bridge interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <node name="member"> + <properties> + <help>Bridge member interfaces</help> + </properties> + <children> + <tagNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bridgeable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + </properties> + <children> + <leafNode name="bvi"> + <properties> + <help>Bridge Virtual Interface (BVI)</help> + <valueless/> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_gre.xml.in b/interface-definitions/vpp_interface_gre.xml.in new file mode 100644 index 000000000..a0228420a --- /dev/null +++ b/interface-definitions/vpp_interface_gre.xml.in @@ -0,0 +1,88 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="gre" owner="${vyos_conf_scripts_dir}/vpp_interfaces_gre.py"> + <properties> + <priority>325</priority> + <help>Generic Network Encapsulation (GRE) Interface</help> + <constraint> + <regex>vppgre[0-9]+</regex> + </constraint> + <constraintErrorMessage>GRE interface must be named vppgreN</constraintErrorMessage> + <valueHelp> + <format>vppgreN</format> + <description>GRE interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <!-- Disable as point-to-multipoint mode does not work without 'teib' feature that is not implemented yet --> + <!-- <leafNode name="mode"> + <leafNode name="mode"> + <properties> + <help>GRE tunnel mode</help> + <completionHelp> + <list>point-to-point point-to-multipoint</list> + </completionHelp> + <valueHelp> + <format>point-to-point</format> + <description>Point to point mode</description> + </valueHelp> + <valueHelp> + <format>point-to-multipoint</format> + <description>Point to multipoint mode</description> + </valueHelp> + <constraint> + <regex>(point-to-point|point-to-multipoint)</regex> + </constraint> + <constraintErrorMessage>Invalid mode, must be one of: point-to-point or point-to-multipoint</constraintErrorMessage> + </properties> + <defaultValue>point-to-point</defaultValue> + </leafNode> --> + #include <include/interface/parameters-key.xml.i> + <leafNode name="key"> + <defaultValue>0</defaultValue> + </leafNode> + <leafNode name="tunnel-type"> + <properties> + <help>GRE tunnel type</help> + <completionHelp> + <list>erspan l3 teb</list> + </completionHelp> + <valueHelp> + <format>erspan</format> + <description>Encapsulated Remote Switched Port Analyzer</description> + </valueHelp> + <valueHelp> + <format>l3</format> + <description>Generic Routing Encapsulation (network layer)</description> + </valueHelp> + <valueHelp> + <format>teb</format> + <description>L2 Transparent Ethernet Bridge</description> + </valueHelp> + <constraint> + <regex>(erspan|l3|teb)</regex> + </constraint> + <constraintErrorMessage>Invalid encapsulation, must be one of: l3, teb or erspan</constraintErrorMessage> + </properties> + <defaultValue>l3</defaultValue> + </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1476</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_ipip.xml.in b/interface-definitions/vpp_interface_ipip.xml.in new file mode 100644 index 000000000..a214f728e --- /dev/null +++ b/interface-definitions/vpp_interface_ipip.xml.in @@ -0,0 +1,36 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="ipip" owner="${vyos_conf_scripts_dir}/vpp_interfaces_ipip.py"> + <properties> + <priority>325</priority> + <help>IP encapsulation tunnel interface</help> + <constraint> + <regex>vppipip[0-9]+</regex> + </constraint> + <constraintErrorMessage>IPIP tunnel interface must be named vppipipN</constraintErrorMessage> + <valueHelp> + <format>vppipipN</format> + <description>IPIP tunnel interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1476</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_loopback.xml.in b/interface-definitions/vpp_interface_loopback.xml.in new file mode 100644 index 000000000..9998c34d2 --- /dev/null +++ b/interface-definitions/vpp_interface_loopback.xml.in @@ -0,0 +1,32 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="loopback" owner="${vyos_conf_scripts_dir}/vpp_interfaces_loopback.py"> + <properties> + <priority>325</priority> + <help>Loopback Interface</help> + <constraint> + <regex>vpplo[0-9]+</regex> + </constraint> + <constraintErrorMessage>Loopback interface must be named vpploN</constraintErrorMessage> + <valueHelp> + <format>vpploN</format> + <description>Loopback interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + #include <include/vpp/vif.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_vxlan.xml.in b/interface-definitions/vpp_interface_vxlan.xml.in new file mode 100644 index 000000000..1de141b1e --- /dev/null +++ b/interface-definitions/vpp_interface_vxlan.xml.in @@ -0,0 +1,37 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="vxlan" owner="${vyos_conf_scripts_dir}/vpp_interfaces_vxlan.py"> + <properties> + <priority>325</priority> + <help>Virtual Extensible LAN (VXLAN) Interface</help> + <constraint> + <regex>vppvxlan[0-9]+</regex> + </constraint> + <constraintErrorMessage>VXLAN interface must be named vppvxlanN</constraintErrorMessage> + <valueHelp> + <format>vppvxlanN</format> + <description>VXLAN interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/vni.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1450</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_xconnnect.xml.in b/interface-definitions/vpp_interface_xconnnect.xml.in new file mode 100644 index 000000000..3480a0d41 --- /dev/null +++ b/interface-definitions/vpp_interface_xconnnect.xml.in @@ -0,0 +1,49 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="xconnect" owner="${vyos_conf_scripts_dir}/vpp_interfaces_xconnect.py"> + <properties> + <help>Layer 2 cross-connect</help> + <priority>325</priority> + <constraint> + <regex>vppxcon[0-9]+</regex> + </constraint> + <constraintErrorMessage>Cross-connect interface must be named vppxconN</constraintErrorMessage> + <valueHelp> + <format>vppxconN</format> + <description>Cross-connect interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <node name="member"> + <properties> + <help>Cross-connect pair member interfaces</help> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bridgeable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vrf.xml.in b/interface-definitions/vrf.xml.in index a20be995a..317707cc5 100644 --- a/interface-definitions/vrf.xml.in +++ b/interface-definitions/vrf.xml.in @@ -3,7 +3,7 @@ <node name="vrf" owner="${vyos_conf_scripts_dir}/vrf.py"> <properties> <help>Virtual Routing and Forwarding</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>11</priority> </properties> <children> @@ -95,6 +95,15 @@ #include <include/ospfv3/protocol-common-config.xml.i> </children> </node> + <node name="rpki" owner="${vyos_conf_scripts_dir}/protocols_rpki.py $VAR(../../@)"> + <properties> + <help>Resource Public Key Infrastructure (RPKI)</help> + <priority>820</priority> + </properties> + <children> + #include <include/rpki/protocol-common-config.xml.i> + </children> + </node> <node name="static" owner="${vyos_conf_scripts_dir}/protocols_static.py $VAR(../../@)"> <properties> <help>Static Routing</help> @@ -105,6 +114,40 @@ #include <include/static/static-route6.xml.i> </children> </node> + <node name="failover" owner="${vyos_conf_scripts_dir}/protocols_failover.py $VAR(../../@)"> + <properties> + <help>Failover Routing</help> + <priority>491</priority> + </properties> + <children> + #include <include/failover/protocol-common-config.xml.i> + </children> + </node> + </children> + </node> + <node name="service"> + <properties> + <help>Enable services in the vrf itself</help> + </properties> + <children> + <node name="dhcp-server" owner="${vyos_conf_scripts_dir}/service_dhcp-server.py $VAR(../../@)"> + <properties> + <help>Dynamic Host Configuration Protocol (DHCP) for DHCP server</help> + <priority>912</priority> + </properties> + <children> + #include <include/dhcp/dhcp-server-common-config.xml.i> + </children> + </node> + <node name="dhcpv6-server" owner="${vyos_conf_scripts_dir}/service_dhcpv6-server.py $VAR(../../@)"> + <properties> + <help>DHCP for IPv6 (DHCPv6) server</help> + <priority>901</priority> + </properties> + <children> + #include <include/dhcp/dhcpv6-server-common-config.xml.i> + </children> + </node> </children> </node> <leafNode name="table"> diff --git a/interface-definitions/xml-component-version.xml.in b/interface-definitions/xml-component-version.xml.in index 67d86a1d0..70957c5fa 100644 --- a/interface-definitions/xml-component-version.xml.in +++ b/interface-definitions/xml-component-version.xml.in @@ -1,52 +1,4 @@ <?xml version="1.0"?> <interfaceDefinition> - #include <include/version/bgp-version.xml.i> - #include <include/version/broadcast-relay-version.xml.i> - #include <include/version/cluster-version.xml.i> - #include <include/version/config-management-version.xml.i> - #include <include/version/conntrack-sync-version.xml.i> - #include <include/version/conntrack-version.xml.i> - #include <include/version/container-version.xml.i> - #include <include/version/dhcp-relay-version.xml.i> - #include <include/version/dhcp-server-version.xml.i> - #include <include/version/dhcpv6-server-version.xml.i> - #include <include/version/dns-dynamic-version.xml.i> - #include <include/version/dns-forwarding-version.xml.i> - #include <include/version/firewall-version.xml.i> - #include <include/version/flow-accounting-version.xml.i> - #include <include/version/https-version.xml.i> - #include <include/version/interfaces-version.xml.i> - #include <include/version/ids-version.xml.i> - #include <include/version/ipoe-server-version.xml.i> - #include <include/version/ipsec-version.xml.i> - #include <include/version/openvpn-version.xml.i> - #include <include/version/isis-version.xml.i> - #include <include/version/l2tp-version.xml.i> - #include <include/version/lldp-version.xml.i> - #include <include/version/mdns-version.xml.i> - #include <include/version/monitoring-version.xml.i> - #include <include/version/nat66-version.xml.i> - #include <include/version/nat-version.xml.i> - #include <include/version/ntp-version.xml.i> - #include <include/version/openconnect-version.xml.i> - #include <include/version/ospf-version.xml.i> - #include <include/version/pim-version.xml.i> - #include <include/version/policy-version.xml.i> - #include <include/version/pppoe-server-version.xml.i> - #include <include/version/pptp-version.xml.i> - #include <include/version/qos-version.xml.i> - #include <include/version/quagga-version.xml.i> - #include <include/version/rip-version.xml.i> - #include <include/version/rpki-version.xml.i> - #include <include/version/salt-version.xml.i> - #include <include/version/snmp-version.xml.i> - #include <include/version/ssh-version.xml.i> - #include <include/version/sstp-version.xml.i> - #include <include/version/system-version.xml.i> - #include <include/version/vrf-version.xml.i> - #include <include/version/vrrp-version.xml.i> - #include <include/version/vyos-accel-ppp-version.xml.i> - #include <include/version/wanloadbalance-version.xml.i> - #include <include/version/webproxy-version.xml.i> - #include <include/version/reverseproxy-version.xml.i> + #include <include/version/*> </interfaceDefinition> |