diff options
Diffstat (limited to 'interface-definitions')
190 files changed, 6392 insertions, 1693 deletions
diff --git a/interface-definitions/container.xml.in b/interface-definitions/container.xml.in index 3a5cfbaa6..8a0da46a4 100644 --- a/interface-definitions/container.xml.in +++ b/interface-definitions/container.xml.in @@ -55,7 +55,7 @@ </valueHelp> <valueHelp> <format>sys-admin</format> - <description>Administation operations (quotactl, mount, sethostname, setdomainame)</description> + <description>Administration operations (quotactl, mount, sethostname, setdomainname)</description> </valueHelp> <valueHelp> <format>sys-module</format> @@ -75,6 +75,12 @@ <multi/> </properties> </leafNode> + <leafNode name="privileged"> + <properties> + <help>Grant root capabilities to the container</help> + <valueless/> + </properties> + </leafNode> <node name="sysctl"> <properties> <help>Configure namespaced kernel parameters of the container</help> @@ -306,6 +312,24 @@ <multi/> </properties> </leafNode> + <leafNode name="mac"> + <properties> + <help>Media Access Control (MAC) address</help> + <valueHelp> + <format>macaddr</format> + <description>Hardware (MAC) address</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Generate a random MAC address for the container</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + <regex>(auto)</regex> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> </children> </tagNode> <tagNode name="port"> @@ -526,6 +550,90 @@ </leafNode> </children> </tagNode> + <leafNode name="log-driver"> + <properties> + <help>Configure container log driver</help> + <completionHelp> + <list>k8s-file journald none</list> + </completionHelp> + <valueHelp> + <format>k8s-file</format> + <description>Logs to plain-text file</description> + </valueHelp> + <valueHelp> + <format>journald</format> + <description>Logs to systemd's journal</description> + </valueHelp> + <valueHelp> + <format>none</format> + <description>Disable logging for the container</description> + </valueHelp> + <constraint> + <regex>(k8s-file|journald|none)</regex> + </constraint> + </properties> + <defaultValue>journald</defaultValue> + </leafNode> + <node name="health-check"> + <properties> + <help>Configure container health checks</help> + </properties> + <children> + <leafNode name="command"> + <properties> + <help>Health check command to run for the container</help> + </properties> + </leafNode> + <leafNode name="interval"> + <properties> + <help>Overwrite related health check configuration from the image</help> + <completionHelp> + <list>disable</list> + </completionHelp> + <valueHelp> + <format>disable</format> + <description>No automatic timer setup</description> + </valueHelp> + <valueHelp> + <format>u32:1-16384</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16384"/> + <regex>(disable)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Timeout for the health check to complete</help> + <valueHelp> + <format>u32:1-16384</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="retry"> + <properties> + <help>The number of retries before container is consider unhealthy</help> + <valueHelp> + <format>0</format> + <description>No retry</description> + </valueHelp> + <valueHelp> + <format>u32:1-255</format> + <description>Number of retries</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <tagNode name="network"> @@ -536,6 +644,24 @@ <children> #include <include/generic-description.xml.i> #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="gateway"> + <properties> + <help>Gateway address to use for this network</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 gateway address</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 gateway address</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="ipv6-address"/> + </constraint> + <multi/> + </properties> + </leafNode> <leafNode name="prefix"> <properties> <help>Prefix which allocated to that network</help> @@ -560,6 +686,62 @@ <valueless/> </properties> </leafNode> + <node name="type"> + <properties> + <help>Network type (default: bridge)</help> + </properties> + <children> + <leafNode name="bridge"> + <properties> + <help>Bridge network</help> + <valueless/> + </properties> + </leafNode> + <node name="macvlan"> + <properties> + <help>MACVLAN network</help> + </properties> + <children> + <leafNode name="mode"> + <properties> + <help>MACVLAN mode</help> + <completionHelp> + <list>bridge private vepa</list> + </completionHelp> + <valueHelp> + <format>bridge</format> + <description>Containers act as separate hosts on the parent network</description> + </valueHelp> + <valueHelp> + <format>private</format> + <description>Containers are isolated from the host and each other</description> + </valueHelp> + <valueHelp> + <format>vepa</format> + <description>Containers send all traffic through the parent switch for forwarding</description> + </valueHelp> + <constraint> + <regex>bridge|private|vepa</regex> + </constraint> + <constraintErrorMessage>Invalid mode</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="parent"> + <properties> + <help>Parent network interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --type ethernet --type bonding --type bridge</script> + </completionHelp> + <constraint> + <regex>((bond|br|eth)[0-9]+(\.[0-9]+)?)</regex> + </constraint> + <constraintErrorMessage>Invalid parent interface</constraintErrorMessage> + </properties> + </leafNode> + </children> + </node> + </children> + </node> #include <include/interface/vrf.xml.i> </children> </tagNode> diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 7538c3cc5..f5986164a 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -428,6 +428,29 @@ </properties> <defaultValue>drop</defaultValue> </leafNode> + <node name="default-firewall"> + <properties> + <help>Default firewall rules for traffic coming into this zone</help> + </properties> + <children> + <leafNode name="ipv6-name"> + <properties> + <help>IPv6 firewall ruleset</help> + <completionHelp> + <path>firewall ipv6 name</path> + </completionHelp> + </properties> + </leafNode> + <leafNode name="name"> + <properties> + <help>IPv4 firewall ruleset</help> + <completionHelp> + <path>firewall ipv4 name</path> + </completionHelp> + </properties> + </leafNode> + </children> + </node> <tagNode name="from"> <properties> <help>Zone from which to filter traffic</help> @@ -466,7 +489,7 @@ <help>Interface associated with zone</help> </properties> <children> - #include <include/generic-interface-multi.xml.i> + #include <include/generic-interface-multi-wildcard.xml.i> <leafNode name="vrf"> <properties> <help>VRF associated with zone</help> diff --git a/interface-definitions/high-availability.xml.in b/interface-definitions/high-availability.xml.in index 6cf6237ca..11ea91309 100644 --- a/interface-definitions/high-availability.xml.in +++ b/interface-definitions/high-availability.xml.in @@ -12,12 +12,19 @@ <help>Virtual Router Redundancy Protocol settings</help> </properties> <children> - <leafNode name="snmp"> + <node name="snmp"> <properties> - <valueless/> <help>Enable SNMP</help> </properties> - </leafNode> + <children> + <leafNode name="trap"> + <properties> + <valueless/> + <help>Enable SNMP traps</help> + </properties> + </leafNode> + </children> + </node> <node name="global-parameters"> <properties> <help>VRRP global parameters</help> @@ -163,6 +170,18 @@ </constraint> </properties> </leafNode> + <leafNode name="timeout"> + <properties> + <help>Health check script timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--positive"/> + </constraint> + </properties> + </leafNode> </children> </node> <leafNode name="hello-source-address"> @@ -386,6 +405,18 @@ </constraint> </properties> </leafNode> + <leafNode name="timeout"> + <properties> + <help>Health check script timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--positive"/> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/vrrp-transition-script.xml.i> @@ -482,11 +513,15 @@ <properties> <help>Timeout for persistent connections</help> <valueHelp> + <format>u32:0</format> + <description>Disable persistent connections</description> + </valueHelp> + <valueHelp> <format>u32:1-86400</format> <description>Timeout for persistent connections</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-86400"/> + <validator name="numeric" argument="--range 0-86400"/> </constraint> </properties> <defaultValue>300</defaultValue> diff --git a/interface-definitions/include/accel-ppp/auth-mode.xml.i b/interface-definitions/include/accel-ppp/auth-mode.xml.i index ccaed6f04..476cf7b62 100644 --- a/interface-definitions/include/accel-ppp/auth-mode.xml.i +++ b/interface-definitions/include/accel-ppp/auth-mode.xml.i @@ -8,7 +8,7 @@ </valueHelp> <valueHelp> <format>radius</format> - <description>Use RADIUS server for user autentication</description> + <description>Use RADIUS server for user authentication</description> </valueHelp> <valueHelp> <format>noauth</format> diff --git a/interface-definitions/include/accel-ppp/idle-timeout.xml.i b/interface-definitions/include/accel-ppp/idle-timeout.xml.i new file mode 100644 index 000000000..98af5aa85 --- /dev/null +++ b/interface-definitions/include/accel-ppp/idle-timeout.xml.i @@ -0,0 +1,15 @@ +<!-- include start from accel-ppp/idle-timeout.xml.i --> +<leafNode name="idle-timeout"> + <properties> + <help>Disconnect idle sessions after the specified time (in seconds)</help> + <valueHelp> + <format>u32:0-86400</format> + <description>Idle timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-86400"/> + </constraint> + <constraintErrorMessage>Idle timeout must be in range 0 to 86400</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i b/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i index f6ef41019..20b40f60e 100644 --- a/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i +++ b/interface-definitions/include/accel-ppp/max-concurrent-sessions.xml.i @@ -9,7 +9,7 @@ <constraint> <validator name="numeric" argument="--allow-range --range 0-65535"/> </constraint> - <constraintErrorMessage>Maximum concurent sessions must be in range 0-65535</constraintErrorMessage> + <constraintErrorMessage>Maximum concurrent sessions must be in range 0-65535</constraintErrorMessage> </properties> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/accel-ppp/radius-additions.xml.i b/interface-definitions/include/accel-ppp/radius-additions.xml.i index 5222ba864..b6c88c6e8 100644 --- a/interface-definitions/include/accel-ppp/radius-additions.xml.i +++ b/interface-definitions/include/accel-ppp/radius-additions.xml.i @@ -133,17 +133,8 @@ </valueHelp> </properties> </leafNode> + #include <include/port-number.xml.i> <leafNode name="port"> - <properties> - <help>Port for Dynamic Authorization Extension server (DM/CoA)</help> - <valueHelp> - <format>u32:1-65535</format> - <description>TCP port</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-65535"/> - </constraint> - </properties> <defaultValue>1700</defaultValue> </leafNode> <leafNode name="key"> diff --git a/interface-definitions/include/accel-ppp/thread-count.xml.i b/interface-definitions/include/accel-ppp/thread-count.xml.i new file mode 100644 index 000000000..84d9224d0 --- /dev/null +++ b/interface-definitions/include/accel-ppp/thread-count.xml.i @@ -0,0 +1,27 @@ +<!-- include start from accel-ppp/thread-count.xml.i --> +<leafNode name="thread-count"> + <properties> + <help>Number of working threads</help> + <completionHelp> + <list>all half</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>Use all available CPU cores</description> + </valueHelp> + <valueHelp> + <format>half</format> + <description>Use half of available CPU cores</description> + </valueHelp> + <valueHelp> + <format>u32:1-512</format> + <description>Thread count</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-512"/> + <regex>(all|half)</regex> + </constraint> + </properties> + <defaultValue>all</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/auth-psk-secret.xml.i b/interface-definitions/include/auth-psk-secret.xml.i index 24257dcab..4577d2ac1 100644 --- a/interface-definitions/include/auth-psk-secret.xml.i +++ b/interface-definitions/include/auth-psk-secret.xml.i @@ -9,7 +9,7 @@ <constraint> <validator name="psk-secret"/> </constraint> - <constraintErrorMessage>Pre-Shared-Keys must be at leas 16 bytes long, which implies at least 32 characterss</constraintErrorMessage> + <constraintErrorMessage>Pre-Shared-Keys must be at least 16 bytes long, which implies at least 32 characters</constraintErrorMessage> </properties> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i b/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i index 261d60232..d4bb0093e 100644 --- a/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i +++ b/interface-definitions/include/bgp/bmp-monitor-afi-policy.xml.i @@ -1,4 +1,10 @@ <!-- include start from bgp/bmp-monitor-afi-policy.xml.i --> +<leafNode name="local-rib"> + <properties> + <help>Enable BMP monitoring of local RIB</help> + <valueless/> + </properties> +</leafNode> <leafNode name="pre-policy"> <properties> <help>Send state before policy and filter processing</help> diff --git a/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i b/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i new file mode 100644 index 000000000..fa31f5c46 --- /dev/null +++ b/interface-definitions/include/bgp/neighbor-afi-link-state.xml.i @@ -0,0 +1,8 @@ +<!-- include start from bgp/neighbor-afi-link-state.xml.i --> +<leafNode name="link-state"> + <properties> + <help>Link State BGP address family</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/bgp/neighbor-bfd.xml.i b/interface-definitions/include/bgp/neighbor-bfd.xml.i index fac2a1166..6de4c9373 100644 --- a/interface-definitions/include/bgp/neighbor-bfd.xml.i +++ b/interface-definitions/include/bgp/neighbor-bfd.xml.i @@ -11,6 +11,25 @@ <valueless/> </properties> </leafNode> + <node name="strict"> + <properties> + <help>Strict mode</help> + </properties> + <children> + <leafNode name="hold-time"> + <properties> + <help>BFD hold time</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>BFD hold time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/bgp/neighbor-local-role.xml.i b/interface-definitions/include/bgp/neighbor-local-role.xml.i index 6ddb4908f..472e5ab8b 100644 --- a/interface-definitions/include/bgp/neighbor-local-role.xml.i +++ b/interface-definitions/include/bgp/neighbor-local-role.xml.i @@ -33,7 +33,7 @@ <children> <leafNode name="strict"> <properties> - <help>Neighbor must send this exact capability, otherwise a role missmatch notification will be sent</help> + <help>Neighbor must send this exact capability, otherwise a role mismatch notification will be sent</help> <valueless/> </properties> </leafNode> diff --git a/interface-definitions/include/bgp/protocol-common-config.xml.i b/interface-definitions/include/bgp/protocol-common-config.xml.i index 31c8cafea..f342402bb 100644 --- a/interface-definitions/include/bgp/protocol-common-config.xml.i +++ b/interface-definitions/include/bgp/protocol-common-config.xml.i @@ -1036,6 +1036,8 @@ <validator name="ip-address"/> #include <include/constraint/interface-name.xml.i> </constraint> + <constraintSilenceOutput/> + <constraintErrorMessage>BGP neighbor must be one of: IP address, IPv6 address, or interface name</constraintErrorMessage> </properties> <children> <node name="address-family"> @@ -1054,6 +1056,7 @@ #include <include/bgp/neighbor-afi-ipv4-multicast.xml.i> #include <include/bgp/neighbor-afi-ipv6-multicast.xml.i> #include <include/bgp/neighbor-afi-l2vpn-evpn.xml.i> + #include <include/bgp/neighbor-afi-link-state.xml.i> </children> </node> <leafNode name="advertisement-interval"> @@ -1103,12 +1106,7 @@ #include <include/bgp/peer-group.xml.i> #include <include/bgp/remote-as.xml.i> #include <include/bgp/neighbor-shutdown.xml.i> - <leafNode name="solo"> - <properties> - <help>Do not send back prefixes learned from the neighbor</help> - <valueless/> - </properties> - </leafNode> + #include <include/bgp/solo.xml.i> <leafNode name="enforce-first-as"> <properties> <help>Ensure the first AS in the AS path matches the peer AS</help> @@ -1156,6 +1154,25 @@ <help>BGP parameters</help> </properties> <children> + <leafNode name="as-notation"> + <properties> + <help>BGP AS-notation output format</help> + <completionHelp> + <list>asdot asdot+</list> + </completionHelp> + <valueHelp> + <format>asdot</format> + <description>Use asdot notation only for 4 byte AS numbers</description> + </valueHelp> + <valueHelp> + <format>asdot+</format> + <description>Use asdot notation for all AS numbers</description> + </valueHelp> + <constraint> + <regex>(asdot\+|asdot)</regex> + </constraint> + </properties> + </leafNode> <leafNode name="allow-martian-nexthop"> <properties> <help>Allow Martian nexthops to be received in the NLRI from a peer</help> @@ -1596,6 +1613,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="no-ipv6-auto-ra"> + <properties> + <help>Disable IPv6 automatic router advertisement</help> + <valueless/> + </properties> + </leafNode> <leafNode name="no-suppress-duplicates"> <properties> <help>Disable suppress duplicate updates if the route actually not changed</help> @@ -1664,6 +1687,41 @@ </leafNode> </children> </node> + <node name="update-delay"> + <properties> + <help>BGP update-delay read-only mode</help> + </properties> + <children> + <leafNode name="max-delay"> + <properties> + <help>Maximum delay before exiting read-only mode</help> + <valueHelp> + <format>u32:0</format> + <description>Disable feature</description> + </valueHelp> + <valueHelp> + <format>u32:1-3600</format> + <description>Delay in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-3600"/> + </constraint> + </properties> + </leafNode> + <leafNode name="establish-wait"> + <properties> + <help>Time to wait for peers to reach Established state before determining expected peers</help> + <valueHelp> + <format>u32:1-3600</format> + <description>Wait time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-3600"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <tagNode name="peer-group"> @@ -1686,6 +1744,7 @@ #include <include/bgp/neighbor-afi-ipv6-labeled-unicast.xml.i> #include <include/bgp/neighbor-afi-ipv6-vpn.xml.i> #include <include/bgp/neighbor-afi-l2vpn-evpn.xml.i> + #include <include/bgp/neighbor-afi-link-state.xml.i> </children> </node> #include <include/generic-description.xml.i> @@ -1695,7 +1754,6 @@ #include <include/bgp/neighbor-disable-connected-check.xml.i> #include <include/bgp/neighbor-ebgp-multihop.xml.i> #include <include/bgp/neighbor-graceful-restart.xml.i> - #include <include/bgp/neighbor-graceful-restart.xml.i> #include <include/bgp/neighbor-local-as.xml.i> #include <include/bgp/neighbor-local-role.xml.i> #include <include/bgp/neighbor-override-capability.xml.i> @@ -1707,6 +1765,7 @@ #include <include/bgp/neighbor-update-source.xml.i> #include <include/bgp/remote-as.xml.i> #include <include/port-number.xml.i> + #include <include/bgp/solo.xml.i> </children> </tagNode> <node name="srv6"> diff --git a/interface-definitions/include/bgp/remote-as.xml.i b/interface-definitions/include/bgp/remote-as.xml.i index 79d3b95a9..4c622b831 100644 --- a/interface-definitions/include/bgp/remote-as.xml.i +++ b/interface-definitions/include/bgp/remote-as.xml.i @@ -3,13 +3,17 @@ <properties> <help>Neighbor BGP AS number</help> <completionHelp> - <list>external internal</list> + <list>auto external internal</list> </completionHelp> <valueHelp> <format>u32:1-4294967294</format> <description>Neighbor AS number</description> </valueHelp> <valueHelp> + <format>auto</format> + <description>Automatically detect remote AS</description> + </valueHelp> + <valueHelp> <format>external</format> <description>Any AS different from the local AS</description> </valueHelp> @@ -19,7 +23,7 @@ </valueHelp> <constraint> <validator name="numeric" argument="--range 1-4294967294"/> - <regex>(external|internal)</regex> + <regex>(auto|external|internal)</regex> </constraint> <constraintErrorMessage>Invalid AS number</constraintErrorMessage> </properties> diff --git a/interface-definitions/include/bgp/solo.xml.i b/interface-definitions/include/bgp/solo.xml.i new file mode 100644 index 000000000..2b26b5af3 --- /dev/null +++ b/interface-definitions/include/bgp/solo.xml.i @@ -0,0 +1,8 @@ +<!-- include start from bgp/solo.xml.i --> +<leafNode name="solo"> + <properties> + <help>Do not send back prefixes learned from the neighbor</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i index adff530b6..aa40017e9 100644 --- a/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i +++ b/interface-definitions/include/constraint/interface-name-with-wildcard.xml.i @@ -1,4 +1,5 @@ <!-- include start from constraint/interface-name-with-wildcard.xml.i --> -<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vpptap|vpptun|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|lo</regex> +<regex>(pod-[-_a-zA-Z0-9]{1,11})</regex> <validator name="file-path --lookup-path /sys/class/net --directory"/> <!-- include end --> diff --git a/interface-definitions/include/constraint/vrf.xml.i b/interface-definitions/include/constraint/vrf.xml.i index a1922bb6d..fa0518dad 100644 --- a/interface-definitions/include/constraint/vrf.xml.i +++ b/interface-definitions/include/constraint/vrf.xml.i @@ -2,5 +2,5 @@ <constraint> <validator name="vrf-name"/> </constraint> -<constraintErrorMessage>VRF instance name must be 15 characters or less and can not\nbe named as regular network interfaces.\nA name must starts from a letter.\n</constraintErrorMessage> +<constraintErrorMessage>VRF instance name must be 15 characters or less and can not be named as a\nregular network interfaces. VRF name must start with a letter.\n</constraintErrorMessage> <!-- include end --> diff --git a/interface-definitions/include/dhcp-interface-multi.xml.i b/interface-definitions/include/dhcp-interface-multi.xml.i index 0db11cf79..5f5c54cfd 100644 --- a/interface-definitions/include/dhcp-interface-multi.xml.i +++ b/interface-definitions/include/dhcp-interface-multi.xml.i @@ -1,18 +1,8 @@ <!-- include start from dhcp-interface-multi.xml.i --> -<leafNode name="dhcp-interface"> - <properties> - <help>DHCP interface supplying next-hop IP address</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>DHCP interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> - <multi/> - </properties> + <leafNode name="dhcp-interface"> + <properties> + #include <include/dhcp-interface-properties.xml.i> + <multi/> + </properties> </leafNode> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/dhcp-interface-properties.xml.i b/interface-definitions/include/dhcp-interface-properties.xml.i new file mode 100644 index 000000000..b184b8f0a --- /dev/null +++ b/interface-definitions/include/dhcp-interface-properties.xml.i @@ -0,0 +1,13 @@ +<!-- include end --> + <help>DHCP interface supplying next-hop IP address</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>DHCP interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> +<!-- include end --> diff --git a/interface-definitions/include/dhcp-interface.xml.i b/interface-definitions/include/dhcp-interface.xml.i index b5c94cb24..e056b3fe1 100644 --- a/interface-definitions/include/dhcp-interface.xml.i +++ b/interface-definitions/include/dhcp-interface.xml.i @@ -1,15 +1,7 @@ +<!-- include start from dhcp-interface.xml.i --> <leafNode name="dhcp-interface"> <properties> - <help>DHCP interface supplying next-hop IP address</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <valueHelp> - <format>txt</format> - <description>DHCP interface name</description> - </valueHelp> - <constraint> - #include <include/constraint/interface-name.xml.i> - </constraint> + #include <include/dhcp-interface-properties.xml.i> </properties> </leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/ddns-dns-server.xml.i b/interface-definitions/include/dhcp/ddns-dns-server.xml.i new file mode 100644 index 000000000..ba9f186d0 --- /dev/null +++ b/interface-definitions/include/dhcp/ddns-dns-server.xml.i @@ -0,0 +1,19 @@ +<!-- include start from dhcp/ddns-dns-server.xml.i --> +<tagNode name="dns-server"> + <properties> + <help>DNS server specification</help> + <valueHelp> + <format>u32:1-999999</format> + <description>Number for this DNS server</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-999999"/> + </constraint> + <constraintErrorMessage>DNS server number must be between 1 and 999999</constraintErrorMessage> + </properties> + <children> + #include <include/address-ipv4-ipv6-single.xml.i> + #include <include/port-number.xml.i> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/ddns-settings.xml.i b/interface-definitions/include/dhcp/ddns-settings.xml.i new file mode 100644 index 000000000..3e202685e --- /dev/null +++ b/interface-definitions/include/dhcp/ddns-settings.xml.i @@ -0,0 +1,172 @@ +<!-- include start from dhcp/ddns-settings.xml.i --> +<leafNode name="send-updates"> + <properties> + <help>Enable or disable updates for this scope</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Enable updates for this scope</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Disable updates for this scope</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="override-client-update"> + <properties> + <help>Always update both forward and reverse DNS data, regardless of the client's request</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Force update both forward and reverse DNS records</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Respect client request settings</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="override-no-update"> + <properties> + <help>Perform a DDNS update, even if the client instructs the server not to</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Force DDNS updates regardless of client request</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Respect client request settings</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="replace-client-name"> + <properties> + <help>Replace client name mode</help> + <completionHelp> + <list>never always when-present when-not-present</list> + </completionHelp> + <valueHelp> + <format>never</format> + <description>Use the name the client sent. If the client sent no name, do not generate + one</description> + </valueHelp> + <valueHelp> + <format>always</format> + <description>Replace the name the client sent. If the client sent no name, generate one + for the client</description> + </valueHelp> + <valueHelp> + <format>when-present</format> + <description>Replace the name the client sent. If the client sent no name, do not + generate one</description> + </valueHelp> + <valueHelp> + <format>when-not-present</format> + <description>Use the name the client sent. If the client sent no name, generate one for + the client</description> + </valueHelp> + <constraint> + <regex>(never|always|when-present|when-not-present)</regex> + </constraint> + <constraintErrorMessage>Invalid replace client name mode</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="generated-prefix"> + <properties> + <help>The prefix used in the generation of an FQDN</help> + <constraint> + <validator name="fqdn" /> + </constraint> + <constraintErrorMessage>Invalid generated prefix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="qualifying-suffix"> + <properties> + <help>The suffix used when generating an FQDN, or when qualifying a partial name</help> + <constraint> + <validator name="fqdn" /> + </constraint> + <constraintErrorMessage>Invalid qualifying suffix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="update-on-renew"> + <properties> + <help>Update DNS record on lease renew</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Update DNS record on lease renew</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Do not update DNS record on lease renew</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="conflict-resolution"> + <properties> + <help>DNS conflict resolution behavior</help> + <completionHelp> + <list>enable disable</list> + </completionHelp> + <valueHelp> + <format>enable</format> + <description>Enable DNS conflict resolution</description> + </valueHelp> + <valueHelp> + <format>disable</format> + <description>Disable DNS conflict resolution</description> + </valueHelp> + <constraint> + <regex>(enable|disable)</regex> + </constraint> + <constraintErrorMessage>Set it to either enable or disable</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="ttl-percent"> + <properties> + <help>Calculate TTL of the DNS record as a percentage of the lease lifetime</help> + <constraint> + <validator name="numeric" argument="--range 1-100" /> + </constraint> + <constraintErrorMessage>Invalid qualifying suffix</constraintErrorMessage> + </properties> +</leafNode> +<leafNode name="hostname-char-set"> + <properties> + <help>A regular expression describing the invalid character set in the host name</help> + </properties> +</leafNode> +<leafNode name="hostname-char-replacement"> + <properties> + <help>A string of zero or more characters with which to replace each invalid character in + the host name</help> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i b/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i new file mode 100644 index 000000000..64f9707f7 --- /dev/null +++ b/interface-definitions/include/dhcp/dhcp-server-common-config.xml.i @@ -0,0 +1,393 @@ +<!-- include start from dhcp/dhcp-server-common-config.xml.i --> +<tagNode name="client-class"> + <properties> + <help>Client class name</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Client class name may only contain letters, numbers, dots, underscores, and hyphens</constraintErrorMessage> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + <node name="relay-agent-information"> + <properties> + <help>Match DHCP Option 82 (relay agent information)</help> + </properties> + <children> + <leafNode name="circuit-id"> + <properties> + <help>Filters on the contents of the circuit-id sub option</help> + <valueHelp> + <format>hex</format> + <description>Values that start with 0x are interpreted as raw hex. This must only be hexadecimal characters e.g. 0x1234567890ABCDEF</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Any other text string is interpreted as ASCII text</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="remote-id"> + <properties> + <help>Filters on the contents of the remote-id sub option</help> + <valueHelp> + <format>hex</format> + <description>Values that start with 0x are interpreted as raw hex. This must only be hexadecimal characters e.g. 0x1234567890ABCDEF</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Any other text string is interpreted as ASCII text</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> + </children> +</tagNode> +#include <include/generic-disable-node.xml.i> +<node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + <tagNode name="tsig-key"> + <properties> + <help>TSIG key definition for DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + <children> + <leafNode name="algorithm"> + <properties> + <help>TSIG key algorithm</help> + <completionHelp> + <list>md5 sha1 sha224 sha256 sha384 sha512</list> + </completionHelp> + <valueHelp> + <format>md5</format> + <description>MD5 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha1</format> + <description>SHA1 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha224</format> + <description>SHA224 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha256</format> + <description>SHA256 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha384</format> + <description>SHA384 HMAC algorithm</description> + </valueHelp> + <valueHelp> + <format>sha512</format> + <description>SHA512 HMAC algorithm</description> + </valueHelp> + <constraint> + <regex>(md5|sha1|sha224|sha256|sha384|sha512)</regex> + </constraint> + <constraintErrorMessage>Invalid TSIG key algorithm</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="secret"> + <properties> + <help>TSIG key secret (base64-encoded)</help> + <constraint> + <validator name="base64"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="forward-domain"> + <properties> + <help>Forward DNS domain name</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid forward DNS domain name</constraintErrorMessage> + </properties> + <children> + <leafNode name="key-name"> + <properties> + <help>TSIG key name for forward DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + </leafNode> + #include <include/dhcp/ddns-dns-server.xml.i> + </children> + </tagNode> + <tagNode name="reverse-domain"> + <properties> + <help>Reverse DNS domain name</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid reverse DNS domain name</constraintErrorMessage> + </properties> + <children> + <leafNode name="key-name"> + <properties> + <help>TSIG key name for reverse DNS updates</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + <constraintErrorMessage>Invalid TSIG key name. May only contain letters, numbers, numbers, hyphen and underscore</constraintErrorMessage> + </properties> + </leafNode> + #include <include/dhcp/ddns-dns-server.xml.i> + </children> + </tagNode> + </children> +</node> +<node name="high-availability"> + <properties> + <help>DHCP high availability configuration</help> + </properties> + <children> + #include <include/source-address-ipv4.xml.i> + <leafNode name="mode"> + <properties> + <help>Configure high availability mode</help> + <completionHelp> + <list>active-active active-passive</list> + </completionHelp> + <valueHelp> + <format>active-active</format> + <description>Both server attend DHCP requests</description> + </valueHelp> + <valueHelp> + <format>active-passive</format> + <description>Only primary server attends DHCP requests</description> + </valueHelp> + <constraint> + <regex>(active-active|active-passive)</regex> + </constraint> + <constraintErrorMessage>Invalid DHCP high availability mode</constraintErrorMessage> + </properties> + <defaultValue>active-active</defaultValue> + </leafNode> + <leafNode name="remote"> + <properties> + <help>IPv4 remote address used for connection</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address of high availability peer</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="name"> + <properties> + <help>Peer name used to identify connection</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid failover peer name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="status"> + <properties> + <help>High availability hierarchy</help> + <completionHelp> + <list>primary secondary</list> + </completionHelp> + <valueHelp> + <format>primary</format> + <description>Configure this server to be the primary node</description> + </valueHelp> + <valueHelp> + <format>secondary</format> + <description>Configure this server to be the secondary node</description> + </valueHelp> + <constraint> + <regex>(primary|secondary)</regex> + </constraint> + <constraintErrorMessage>Invalid DHCP high availability peer status</constraintErrorMessage> + </properties> + </leafNode> + #include <include/pki/ca-certificate.xml.i> + #include <include/pki/certificate.xml.i> + </children> +</node> +<leafNode name="hostfile-update"> + <properties> + <help>Updating /etc/hosts file (per client lease)</help> + <valueless/> + </properties> +</leafNode> +#include <include/dhcp/log-level.xml.i> +#include <include/listen-address-ipv4.xml.i> +#include <include/listen-interface-multi-broadcast.xml.i> +<tagNode name="shared-network-name"> + <properties> + <help>Name of DHCP shared network</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + <children> + <node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + </children> + </node> + <leafNode name="authoritative"> + <properties> + <help>Option to make DHCP server authoritative for this physical network</help> + <valueless/> + </properties> + </leafNode> + #include <include/dhcp/option-v4.xml.i> + #include <include/dhcp/ping-check.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + <tagNode name="subnet"> + <properties> + <help>DHCP subnet for shared network</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + <constraintErrorMessage>Invalid IPv4 subnet definition</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + #include <include/dhcp/ping-check.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + <leafNode name="client-class"> + <properties> + <help>DHCP client class</help> + <completionHelp> + <path>service dhcp-server client-class</path> + </completionHelp> + </properties> + </leafNode> + <node name="dynamic-dns-update"> + <properties> + <help>Dynamically update Domain Name System (RFC4702)</help> + </properties> + <children> + #include <include/dhcp/ddns-settings.xml.i> + </children> + </node> + <leafNode name="exclude"> + <properties> + <help>IP address to exclude from DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address to exclude from lease range</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="ignore-client-id"> + <properties> + <help>Ignore client identifier for lease lookups</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="lease"> + <properties> + <help>Lease timeout in seconds</help> + <valueHelp> + <format>u32</format> + <description>DHCP lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + <constraintErrorMessage>DHCP lease time must be between 0 and 4294967295 (49 days)</constraintErrorMessage> + </properties> + <defaultValue>86400</defaultValue> + </leafNode> + <tagNode name="range"> + <properties> + <help>DHCP lease range</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + <leafNode name="client-class"> + <properties> + <help>DHCP client class</help> + <completionHelp> + <path>service dhcp-server client-class</path> + </completionHelp> + </properties> + </leafNode> + <leafNode name="start"> + <properties> + <help>First IP address for DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 start address of pool</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stop"> + <properties> + <help>Last IP address for DHCP lease range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 end address of pool</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="static-mapping"> + <properties> + <help>Hostname for static mapping reservation</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v4.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-disable-node.xml.i> + #include <include/ip-address.xml.i> + #include <include/interface/mac.xml.i> + #include <include/interface/duid.xml.i> + </children> + </tagNode> + #include <include/dhcp/subnet-id.xml.i> + </children> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i b/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i new file mode 100644 index 000000000..6e40fbcd4 --- /dev/null +++ b/interface-definitions/include/dhcp/dhcpv6-server-common-config.xml.i @@ -0,0 +1,268 @@ +<!-- include start from dhcp/dhcpv6-server-common-config.xml.i --> +#include <include/generic-disable-node.xml.i> +#include <include/listen-interface-multi-broadcast.xml.i> +<leafNode name="disable-route-autoinstall"> + <properties> + <help>Do not install routes for delegated prefixes</help> + <valueless/> + </properties> +</leafNode> +<node name="global-parameters"> + <properties> + <help>Additional global parameters for DHCPv6 server</help> + </properties> + <children> + #include <include/name-server-ipv6.xml.i> + </children> +</node> +<leafNode name="preference"> + <properties> + <help>Preference of this DHCPv6 server compared with others</help> + <valueHelp> + <format>u32:0-255</format> + <description>DHCPv6 server preference (0-255)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + <constraintErrorMessage>Preference must be between 0 and 255</constraintErrorMessage> + </properties> +</leafNode> +#include <include/dhcp/log-level.xml.i> +<tagNode name="shared-network-name"> + <properties> + <help>DHCPv6 shared network name</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> + </properties> + <children> + #include <include/generic-disable-node.xml.i> + #include <include/generic-description.xml.i> + #include <include/generic-interface.xml.i> + #include <include/dhcp/option-v6.xml.i> + <tagNode name="subnet"> + <properties> + <help>IPv6 DHCP subnet for this shared network</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + #include <include/generic-interface.xml.i> + <tagNode name="range"> + <properties> + <help>Parameters setting ranges for assigning IPv6 addresses</help> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> + </constraint> + <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + <leafNode name="prefix"> + <properties> + <help>IPv6 prefix defining range of addresses to assign</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 address and prefix length</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + </leafNode> + <leafNode name="start"> + <properties> + <help>First in range of consecutive IPv6 addresses to assign</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stop"> + <properties> + <help>Last in range of consecutive IPv6 addresses</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <node name="lease-time"> + <properties> + <help>Parameters relating to the lease time</help> + </properties> + <children> + <leafNode name="default"> + <properties> + <help>Default time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>DHCPv6 valid lifetime</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="maximum"> + <properties> + <help>Maximum time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="minimum"> + <properties> + <help>Minimum time (in seconds) that will be assigned to a lease</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Minimum lease time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="prefix-delegation"> + <properties> + <help>Parameters relating to IPv6 prefix delegation</help> + </properties> + <children> + <tagNode name="prefix"> + <properties> + <help>IPv6 prefix to be used in prefix delegation</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 prefix used in prefix delegation</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + <children> + <leafNode name="prefix-length"> + <properties> + <help>Length in bits of prefix</help> + <valueHelp> + <format>u32:32-64</format> + <description>Prefix length (32-64)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 32-64"/> + </constraint> + <constraintErrorMessage>Prefix length must be between 32 and 64</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="delegated-length"> + <properties> + <help>Length in bits of prefixes to be delegated</help> + <valueHelp> + <format>u32:32-64</format> + <description>Delegated prefix length (32-64)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 32-96"/> + </constraint> + <constraintErrorMessage>Delegated prefix length must be between 32 and 96</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="excluded-prefix"> + <properties> + <help>IPv6 prefix to be excluded from prefix delegation</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 prefix excluded from prefix delegation</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="excluded-prefix-length"> + <properties> + <help>Length in bits of excluded prefix</help> + <valueHelp> + <format>u32:33-64</format> + <description>Excluded prefix length (33-128)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 33-128"/> + </constraint> + <constraintErrorMessage>Prefix length must be between 33 and 128</constraintErrorMessage> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <tagNode name="static-mapping"> + <properties> + <help>Hostname for static mapping reservation</help> + <constraint> + <validator name="fqdn"/> + </constraint> + <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> + </properties> + <children> + #include <include/dhcp/option-v6.xml.i> + #include <include/generic-disable-node.xml.i> + #include <include/interface/mac.xml.i> + #include <include/interface/duid.xml.i> + <leafNode name="ipv6-address"> + <properties> + <help>Client IPv6 address for this static mapping</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address for this static mapping</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="ipv6-prefix"> + <properties> + <help>Client IPv6 prefix for this static mapping</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix for this static mapping</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </tagNode> + #include <include/dhcp/subnet-id.xml.i> + </children> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/log-level.xml.i b/interface-definitions/include/dhcp/log-level.xml.i new file mode 100644 index 000000000..d9a9e9931 --- /dev/null +++ b/interface-definitions/include/dhcp/log-level.xml.i @@ -0,0 +1,34 @@ +<!-- include start from dhcp/log-level.xml.i --> +<leafNode name="log-level"> + <properties> + <help>Logging level</help> + <completionHelp> + <list>fatal error warn info debug</list> + </completionHelp> + <valueHelp> + <format>fatal</format> + <description>Fatal log level</description> + </valueHelp> + <valueHelp> + <format>error</format> + <description>Error log level</description> + </valueHelp> + <valueHelp> + <format>warn</format> + <description>Warning log level</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational log level</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug log level</description> + </valueHelp> + <constraint> + <regex>(fatal|error|warn|info|debug)</regex> + </constraint> + </properties> + <defaultValue>info</defaultValue> +</leafNode> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/dhcp/option-v4.xml.i b/interface-definitions/include/dhcp/option-v4.xml.i index bd6fc6043..0f446c9a9 100644 --- a/interface-definitions/include/dhcp/option-v4.xml.i +++ b/interface-definitions/include/dhcp/option-v4.xml.i @@ -59,6 +59,18 @@ <constraintErrorMessage>DHCP client prefix length must be 0 to 32</constraintErrorMessage> </properties> </leafNode> + <leafNode name="capwap-controller"> + <properties> + <help>IP address of CAPWAP access controller (Option 138)</help> + <valueHelp> + <format>ipv4</format> + <description>CAPWAP AC controller</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> <leafNode name="default-router"> <properties> <help>IP address of default router</help> @@ -71,6 +83,18 @@ </constraint> </properties> </leafNode> + <leafNode name="interface-mtu"> + <properties> + <help>Interface MTU</help> + <valueHelp> + <format>u16:576-9000</format> + <description>Client interface MTU</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 576-9000"/> + </constraint> + </properties> + </leafNode> <leafNode name="ip-forwarding"> <properties> <help>Enable IP forwarding on client</help> diff --git a/interface-definitions/include/dhcp/option-v6.xml.i b/interface-definitions/include/dhcp/option-v6.xml.i index e1897f52d..c97d652b6 100644 --- a/interface-definitions/include/dhcp/option-v6.xml.i +++ b/interface-definitions/include/dhcp/option-v6.xml.i @@ -7,6 +7,18 @@ #include <include/dhcp/captive-portal.xml.i> #include <include/dhcp/domain-search.xml.i> #include <include/name-server-ipv6.xml.i> + <leafNode name="capwap-controller"> + <properties> + <help>IP address of CAPWAP access controller (Option 52)</help> + <valueHelp> + <format>ipv6</format> + <description>CAPWAP AC controller</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> <leafNode name="nis-domain"> <properties> <help>NIS domain name for client to use</help> @@ -90,6 +102,17 @@ </constraint> </properties> </leafNode> + <leafNode name="time-zone"> + <properties> + <help>Time zone to send to clients. Uses RFC4833 options 41 and 42</help> + <completionHelp> + <script>timedatectl list-timezones</script> + </completionHelp> + <constraint> + <validator name="timezone" argument="--validate"/> + </constraint> + </properties> + </leafNode> <node name="vendor-option"> <properties> <help>Vendor Specific Options</help> diff --git a/interface-definitions/include/dhcp/ping-check.xml.i b/interface-definitions/include/dhcp/ping-check.xml.i new file mode 100644 index 000000000..a506f68e4 --- /dev/null +++ b/interface-definitions/include/dhcp/ping-check.xml.i @@ -0,0 +1,8 @@ +<!-- include start from dhcp/ping-check.xml.i --> +<leafNode name="ping-check"> + <properties> + <help>Sends ICMP Echo request to the address being assigned</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/dhcp/subnet-id.xml.i b/interface-definitions/include/dhcp/subnet-id.xml.i new file mode 100644 index 000000000..c7e88250d --- /dev/null +++ b/interface-definitions/include/dhcp/subnet-id.xml.i @@ -0,0 +1,14 @@ +<!-- include start from dhcp/subnet-id.xml.i --> +<leafNode name="subnet-id"> + <properties> + <help>Unique ID mapped to leases in the lease file</help> + <valueHelp> + <format>u32:1-4294967294</format> + <description>Unique subnet ID</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967294"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/failover/common-failover.xml.i b/interface-definitions/include/failover/common-failover.xml.i new file mode 100644 index 000000000..b147a0f8d --- /dev/null +++ b/interface-definitions/include/failover/common-failover.xml.i @@ -0,0 +1,105 @@ +<!-- include start from include/failover/common-failover.xml.i --> +<children> + <node name="check"> + <properties> + <help>Check target options</help> + </properties> + <children> + <leafNode name="policy"> + <properties> + <help>Policy for check targets</help> + <completionHelp> + <list>any-available all-available</list> + </completionHelp> + <valueHelp> + <format>all-available</format> + <description>All targets must be alive</description> + </valueHelp> + <valueHelp> + <format>any-available</format> + <description>Any target must be alive</description> + </valueHelp> + <constraint> + <regex>(all-available|any-available)</regex> + </constraint> + </properties> + <defaultValue>any-available</defaultValue> + </leafNode> + #include <include/port-number.xml.i> + <tagNode name="target"> + <properties> + <help>Check target address</help> + <valueHelp> + <format>ipv4</format> + <description>Address to check</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + <children> + #include <include/interface/vrf.xml.i> + #include <include/generic-interface.xml.i> + </children> + </tagNode> + <leafNode name="timeout"> + <properties> + <help>Timeout between checks</help> + <valueHelp> + <format>u32:1-300</format> + <description>Timeout in seconds between checks</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + <defaultValue>10</defaultValue> + </leafNode> + <leafNode name="type"> + <properties> + <help>Check type</help> + <completionHelp> + <list>arp icmp tcp</list> + </completionHelp> + <valueHelp> + <format>arp</format> + <description>Check target by ARP</description> + </valueHelp> + <valueHelp> + <format>icmp</format> + <description>Check target by ICMP</description> + </valueHelp> + <valueHelp> + <format>tcp</format> + <description>Check target by TCP</description> + </valueHelp> + <constraint> + <regex>(arp|icmp|tcp)</regex> + </constraint> + </properties> + <defaultValue>icmp</defaultValue> + </leafNode> + </children> + </node> + #include <include/generic-interface.xml.i> + <leafNode name="metric"> + <properties> + <help>Route metric for this gateway</help> + <valueHelp> + <format>u32:1-255</format> + <description>Route metric</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + <defaultValue>1</defaultValue> + </leafNode> + <leafNode name="onlink"> + <properties> + <help>The next hop is directly connected to the interface, even if it does not match interface prefix</help> + <valueless/> + </properties> + </leafNode> +</children> +<!-- include end --> diff --git a/interface-definitions/include/failover/protocol-common-config.xml.i b/interface-definitions/include/failover/protocol-common-config.xml.i new file mode 100644 index 000000000..56c9d8f90 --- /dev/null +++ b/interface-definitions/include/failover/protocol-common-config.xml.i @@ -0,0 +1,35 @@ +<!-- include start from failover/protocol-common-config.xml.i --> +<tagNode name="route"> + <properties> + <help>Failover IPv4 route</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 failover route</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + <children> + <tagNode name="next-hop"> + <properties> + <help>Next-hop IPv4 router address</help> + <valueHelp> + <format>ipv4</format> + <description>Next-hop router address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + #include <include/failover/common-failover.xml.i> + </tagNode> + <tagNode name="dhcp-interface"> + <properties> + #include <include/dhcp-interface-properties.xml.i> + </properties> + #include <include/failover/common-failover.xml.i> + </tagNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i index e8da1a0e1..85f1071a6 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -27,7 +27,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> <node name="source"> @@ -41,7 +46,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i index b67ef25dc..b6c1b13b3 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i @@ -14,7 +14,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> #include <include/firewall/source-destination-remote-group.xml.i> </children> @@ -38,9 +43,14 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i index bb176fe71..65ec415fb 100644 --- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i @@ -16,6 +16,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> <leafNode name="jump-target"> @@ -39,6 +40,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/disable-conntrack.xml.i b/interface-definitions/include/firewall/disable-conntrack.xml.i new file mode 100644 index 000000000..96a692166 --- /dev/null +++ b/interface-definitions/include/firewall/disable-conntrack.xml.i @@ -0,0 +1,8 @@ +<!-- include start from firewall/disable-conntrack.xml.i --> +<leafNode name="disable-conntrack"> + <properties> + <help>Disable conntrack within this chain</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/domain-group.xml.i b/interface-definitions/include/firewall/domain-group.xml.i new file mode 100644 index 000000000..46e00ce09 --- /dev/null +++ b/interface-definitions/include/firewall/domain-group.xml.i @@ -0,0 +1,10 @@ +<!-- include start from firewall/domain-group.xml.i --> +<leafNode name="domain-group"> + <properties> + <help>Group of domains</help> + <completionHelp> + <path>firewall group domain-group</path> + </completionHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/geoip.xml.i b/interface-definitions/include/firewall/geoip.xml.i index 9fb37a574..09b2da663 100644 --- a/interface-definitions/include/firewall/geoip.xml.i +++ b/interface-definitions/include/firewall/geoip.xml.i @@ -7,12 +7,15 @@ <leafNode name="country-code"> <properties> <help>GeoIP country code</help> + <completionHelp> + <list>ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bl bm bn bo bq br bs bt bv bw by bz ca cc cd cf cg ch ci ck cl cm cn co cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg eh er es et fi fj fk fm fo fr ga gb gd ge gf gg gh gi gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in io iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mf mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sj sk sl sm sn so sr ss st sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tv tw tz ua ug um us uy uz va vc ve vg vi vn vu wf ws ye yt za zm zw</list> + </completionHelp> <valueHelp> <format><country></format> - <description>Country code (2 characters)</description> + <description>Country code (2 characters, lowercase)</description> </valueHelp> <constraint> - <regex>^(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)$</regex> + <regex>(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)</regex> </constraint> <multi /> </properties> diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 355b41fde..5ff5acfd8 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -49,12 +49,53 @@ <help>Apply configured firewall rules to traffic switched by bridges</help> </properties> <children> - <leafNode name="invalid-connections"> + <node name="accept-invalid"> <properties> - <help>Accept ARP, DHCP and PPPoE despite they are marked as invalid connection</help> - <valueless/> + <help>Accept connections despite they are marked as invalid</help> </properties> - </leafNode> + <children> + <leafNode name="ethernet-type"> + <properties> + <help>Ethernet type</help> + <completionHelp> + <list>arp dhcp pppoe 802.1q 802.1ad pppoe-discovery wol</list> + </completionHelp> + <valueHelp> + <format>arp</format> + <description>Address Resolution Protocol (ARP)</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Dynamic Host Configuration Protocol (DHCP)</description> + </valueHelp> + <valueHelp> + <format>pppoe</format> + <description>Point to Point over Ethernet (PPPoE) Session</description> + </valueHelp> + <valueHelp> + <format>pppoe-discovery</format> + <description>PPPoE Discovery</description> + </valueHelp> + <valueHelp> + <format>802.1q</format> + <description>Customer VLAN tag type (802.1Q)</description> + </valueHelp> + <valueHelp> + <format>802.1ad</format> + <description>Service VLAN tag type (802.1ad)</description> + </valueHelp> + <valueHelp> + <format>wol</format> + <description>Wake-on-LAN magic packet</description> + </valueHelp> + <constraint> + <regex>(arp|dhcp|pppoe|pppoe-discovery|802.1q|802.1ad|wol)</regex> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ipv4"> <properties> <help>Apply configured IPv4 firewall rules</help> @@ -89,6 +130,49 @@ </properties> <defaultValue>enable</defaultValue> </leafNode> + <node name="geoip"> + <properties> + <help>GeoIP options</help> + </properties> + <children> + <leafNode name="provider"> + <properties> + <help>GeoIP database provider</help> + <completionHelp> + <list>db-ip maxmind</list> + </completionHelp> + <valueHelp> + <format>db-ip</format> + <description>Use GeoIP database by DB-IP.com</description> + </valueHelp> + <valueHelp> + <format>maxmind</format> + <description>Use GeoIP database by MaxMind (Requires API key)</description> + </valueHelp> + <constraint> + <regex>(db-ip|maxmind)</regex> + </constraint> + </properties> + <defaultValue>db-ip</defaultValue> + </leafNode> + <leafNode name="maxmind-account-id"> + <properties> + <help>Account ID for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-license-key"> + <properties> + <help>License key for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-lite"> + <properties> + <help>Use MaxMind GeoLite2 database</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ip-src-route"> <properties> <help>Policy for handling IPv4 packets with source route option</help> @@ -217,6 +301,14 @@ <help>Global firewall state-policy</help> </properties> <children> + <node name="offload"> + <properties> + <help>All stateful forward traffic is offloaded to a flowtable</help> + </properties> + <children> + #include <include/firewall/offload-target.xml.i> + </children> + </node> <node name="established"> <properties> <help>Global firewall policy for packets part of an established connection</help> @@ -279,7 +371,7 @@ </node> <leafNode name="twa-hazards-protection"> <properties> - <help>RFC1337 TCP TIME-WAIT assasination hazards protection</help> + <help>RFC1337 TCP TIME-WAIT assassination hazards protection</help> <completionHelp> <list>enable disable</list> </completionHelp> diff --git a/interface-definitions/include/firewall/icmpv6.xml.i b/interface-definitions/include/firewall/icmpv6.xml.i index c0118626e..9631f0012 100644 --- a/interface-definitions/include/firewall/icmpv6.xml.i +++ b/interface-definitions/include/firewall/icmpv6.xml.i @@ -6,7 +6,7 @@ <children> <leafNode name="code"> <properties> - <help>ICMPv6 code</help> + <help>ICMPv6 code field - depends on the message type</help> <valueHelp> <format>u32:0-255</format> <description>ICMPv6 code (0-255)</description> @@ -18,10 +18,14 @@ </leafNode> <leafNode name="type"> <properties> - <help>ICMPv6 type</help> + <help>ICMPv6 message type</help> <valueHelp> - <format>u32:0-255</format> - <description>ICMPv6 type (0-255)</description> + <format>u32:0-127</format> + <description>ICMPv6 error message</description> + </valueHelp> + <valueHelp> + <format>u32:128-255</format> + <description>ICMPv6 information message</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i index a2da4b701..8f04d6739 100644 --- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i index 491d1a9f3..64366eac0 100644 --- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i index f68136557..14ea1073b 100644 --- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i index 79898d691..0319c915a 100644 --- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i index 154b10259..ae78f8910 100644 --- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i index 9a6d0bb77..96976b4a8 100644 --- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i index abfa9034d..536e59bb3 100644 --- a/interface-definitions/include/firewall/match-ether-type.xml.i +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -15,7 +15,7 @@ </valueHelp> <valueHelp> <format>arp</format> - <description>Adress Resolution Protocol</description> + <description>Address Resolution Protocol</description> </valueHelp> <valueHelp> <format>_ipv4</format> diff --git a/interface-definitions/include/firewall/port-group.xml.i b/interface-definitions/include/firewall/port-group.xml.i new file mode 100644 index 000000000..297f0d781 --- /dev/null +++ b/interface-definitions/include/firewall/port-group.xml.i @@ -0,0 +1,10 @@ + <!-- include start from firewall/port-group.xml.i --> + <leafNode name="port-group"> + <properties> + <help>Group of ports</help> + <completionHelp> + <path>firewall group port-group</path> + </completionHelp> + </properties> + </leafNode> + <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-inet.xml.i b/interface-definitions/include/firewall/source-destination-group-inet.xml.i index 174051624..775fda9b3 100644 --- a/interface-definitions/include/firewall/source-destination-group-inet.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-inet.xml.i @@ -20,7 +20,6 @@ </completionHelp> </properties> </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="ipv4-network-group"> <properties> <help>Group of IPv4 networks</help> @@ -37,14 +36,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i index 8c34fb933..ccee5b247 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i @@ -12,14 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -28,14 +20,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i index 2a42d236c..43a9e9cf5 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i @@ -12,15 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -29,14 +20,9 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i deleted file mode 100644 index 6ebee356c..000000000 --- a/interface-definitions/include/firewall/source-destination-group.xml.i +++ /dev/null @@ -1,42 +0,0 @@ -<!-- include start from firewall/source-destination-group.xml.i --> -<node name="group"> - <properties> - <help>Group</help> - </properties> - <children> - <leafNode name="address-group"> - <properties> - <help>Group of addresses</help> - <completionHelp> - <path>firewall group address-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> - <leafNode name="network-group"> - <properties> - <help>Group of networks</help> - <completionHelp> - <path>firewall group network-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/generic-password.xml.i b/interface-definitions/include/generic-password.xml.i index 76d5f12d8..0048e5173 100644 --- a/interface-definitions/include/generic-password.xml.i +++ b/interface-definitions/include/generic-password.xml.i @@ -7,9 +7,9 @@ <description>Password</description> </valueHelp> <constraint> - <regex>[[:ascii:]]{1,128}</regex> + <regex>[[:ascii:]]{1,512}</regex> </constraint> - <constraintErrorMessage>Password is limited to ASCII characters only, with a total length of 128</constraintErrorMessage> + <constraintErrorMessage>Password is limited to ASCII characters only, with a total length of 512</constraintErrorMessage> </properties> </leafNode> <!-- include end --> diff --git a/interface-definitions/include/haproxy/listen-address.xml.i b/interface-definitions/include/haproxy/listen-address.xml.i new file mode 100644 index 000000000..785b46117 --- /dev/null +++ b/interface-definitions/include/haproxy/listen-address.xml.i @@ -0,0 +1,30 @@ +<!-- include start from haproxy/listen-address.xml.i --> +<tagNode name="listen-address"> + <properties> + <help>Local IP addresses to listen on</help> + <completionHelp> + <script>${vyos_completion_dir}/list_local_ips.sh --both</script> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address to listen for incoming connections</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address to listen for incoming connections</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="ipv6-link-local"/> + </constraint> + </properties> + <children> + <leafNode name="accept-proxy"> + <properties> + <help>Accept PROXY protocol</help> + <valueless/> + </properties> + </leafNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/haproxy/logging.xml.i b/interface-definitions/include/haproxy/logging.xml.i index e0af54fa4..315c959bf 100644 --- a/interface-definitions/include/haproxy/logging.xml.i +++ b/interface-definitions/include/haproxy/logging.xml.i @@ -4,7 +4,137 @@ <help>Logging parameters</help> </properties> <children> - #include <include/syslog-facility.xml.i> + <tagNode name="facility"> + <properties> + <help>Facility for logging</help> + <completionHelp> + <list>auth cron daemon kern lpr mail news syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7</list> + </completionHelp> + <constraint> + <regex>(auth|cron|daemon|kern|lpr|mail|news|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7)</regex> + </constraint> + <constraintErrorMessage>Invalid facility type</constraintErrorMessage> + <valueHelp> + <format>auth</format> + <description>Authentication and authorization</description> + </valueHelp> + <valueHelp> + <format>cron</format> + <description>Cron daemon</description> + </valueHelp> + <valueHelp> + <format>daemon</format> + <description>System daemons</description> + </valueHelp> + <valueHelp> + <format>kern</format> + <description>Kernel</description> + </valueHelp> + <valueHelp> + <format>lpr</format> + <description>Line printer spooler</description> + </valueHelp> + <valueHelp> + <format>mail</format> + <description>Mail subsystem</description> + </valueHelp> + <valueHelp> + <format>news</format> + <description>USENET subsystem</description> + </valueHelp> + <valueHelp> + <format>syslog</format> + <description>Authentication and authorization</description> + </valueHelp> + <valueHelp> + <format>user</format> + <description>Application processes</description> + </valueHelp> + <valueHelp> + <format>uucp</format> + <description>UUCP subsystem</description> + </valueHelp> + <valueHelp> + <format>local0</format> + <description>Local facility 0</description> + </valueHelp> + <valueHelp> + <format>local1</format> + <description>Local facility 1</description> + </valueHelp> + <valueHelp> + <format>local2</format> + <description>Local facility 2</description> + </valueHelp> + <valueHelp> + <format>local3</format> + <description>Local facility 3</description> + </valueHelp> + <valueHelp> + <format>local4</format> + <description>Local facility 4</description> + </valueHelp> + <valueHelp> + <format>local5</format> + <description>Local facility 5</description> + </valueHelp> + <valueHelp> + <format>local6</format> + <description>Local facility 6</description> + </valueHelp> + <valueHelp> + <format>local7</format> + <description>Local facility 7</description> + </valueHelp> + </properties> + <children> + <leafNode name="level"> + <properties> + <help>Logging level</help> + <completionHelp> + <list>emerg alert crit err warning notice info debug</list> + </completionHelp> + <valueHelp> + <format>emerg</format> + <description>Emergency messages</description> + </valueHelp> + <valueHelp> + <format>alert</format> + <description>Urgent messages</description> + </valueHelp> + <valueHelp> + <format>crit</format> + <description>Critical messages</description> + </valueHelp> + <valueHelp> + <format>err</format> + <description>Error messages</description> + </valueHelp> + <valueHelp> + <format>warning</format> + <description>Warning messages</description> + </valueHelp> + <valueHelp> + <format>notice</format> + <description>Messages for further investigation</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational messages</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug messages</description> + </valueHelp> + <constraint> + <regex>(emerg|alert|crit|err|warning|notice|info|debug)</regex> + </constraint> + <constraintErrorMessage>Invalid loglevel</constraintErrorMessage> + </properties> + <defaultValue>err</defaultValue> + </leafNode> + </children> + </tagNode> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/haproxy/rule-backend.xml.i b/interface-definitions/include/haproxy/rule-backend.xml.i index 1df9d5dcf..20263c23c 100644 --- a/interface-definitions/include/haproxy/rule-backend.xml.i +++ b/interface-definitions/include/haproxy/rule-backend.xml.i @@ -12,19 +12,7 @@ <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage> </properties> <children> - <leafNode name="domain-name"> - <properties> - <help>Domain name to match</help> - <valueHelp> - <format>txt</format> - <description>Domain address to match</description> - </valueHelp> - <constraint> - <validator name="fqdn"/> - </constraint> - <multi/> - </properties> - </leafNode> + #include <include/haproxy/rule-match-domain.xml.i> <node name="set"> <properties> <help>Proxy modifications</help> @@ -38,7 +26,7 @@ <description>Set URL location</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> </properties> @@ -90,7 +78,7 @@ <description>Begin URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -104,7 +92,7 @@ <description>End URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -118,7 +106,7 @@ <description>Exactly URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]*$</regex> + <regex>\/[\w\-.\/]*</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> diff --git a/interface-definitions/include/haproxy/rule-frontend.xml.i b/interface-definitions/include/haproxy/rule-frontend.xml.i index eabdd8632..6237fd44b 100644 --- a/interface-definitions/include/haproxy/rule-frontend.xml.i +++ b/interface-definitions/include/haproxy/rule-frontend.xml.i @@ -12,19 +12,7 @@ <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage> </properties> <children> - <leafNode name="domain-name"> - <properties> - <help>Domain name to match</help> - <valueHelp> - <format>txt</format> - <description>Domain address to match</description> - </valueHelp> - <constraint> - <validator name="fqdn"/> - </constraint> - <multi/> - </properties> - </leafNode> + #include <include/haproxy/rule-match-domain.xml.i> <node name="set"> <properties> <help>Proxy modifications</help> @@ -32,15 +20,15 @@ <children> <leafNode name="redirect-location"> <properties> - <help>Set URL location</help> + <help>Set path location</help> <valueHelp> <format>url</format> - <description>Set URL location</description> + <description>Set path location</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> - <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> + <constraintErrorMessage>Incorrect path format</constraintErrorMessage> </properties> </leafNode> <leafNode name="backend"> @@ -93,7 +81,7 @@ <description>Begin URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -107,7 +95,7 @@ <description>End URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> @@ -121,7 +109,7 @@ <description>Exactly URL</description> </valueHelp> <constraint> - <regex>^\/[\w\-.\/]+$</regex> + <regex>\/[\w\-.\/]+</regex> </constraint> <constraintErrorMessage>Incorrect URL format</constraintErrorMessage> <multi/> diff --git a/interface-definitions/include/haproxy/rule-match-domain.xml.i b/interface-definitions/include/haproxy/rule-match-domain.xml.i new file mode 100644 index 000000000..2ec61a940 --- /dev/null +++ b/interface-definitions/include/haproxy/rule-match-domain.xml.i @@ -0,0 +1,21 @@ +<!-- include start from haproxy/rule-match-domain.xml.i --> +<leafNode name="domain-name"> + <properties> + <help>Domain name to match</help> + <valueHelp> + <format>txt</format> + <description>Domain address to match</description> + </valueHelp> + <constraint> + <validator name="fqdn"/> + </constraint> + <multi/> + </properties> +</leafNode> +<leafNode name="wildcard-domain"> + <properties> + <help>Match subdomains of specified domain(s)</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i b/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i index 5057ed9ae..6e96185e7 100644 --- a/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i +++ b/interface-definitions/include/interface/address-ipv4-ipv6-dhcp.xml.i @@ -22,7 +22,7 @@ <description>Dynamic Host Configuration Protocol for IPv6</description> </valueHelp> <constraint> - <validator name="ip-host"/> + <validator name="interface-address"/> <regex>(dhcp|dhcpv6)</regex> </constraint> <multi/> diff --git a/interface-definitions/include/interface/address-ipv4-ipv6.xml.i b/interface-definitions/include/interface/address-ipv4-ipv6.xml.i index d689da5aa..48802c4dc 100644 --- a/interface-definitions/include/interface/address-ipv4-ipv6.xml.i +++ b/interface-definitions/include/interface/address-ipv4-ipv6.xml.i @@ -11,7 +11,7 @@ <description>IPv6 address and prefix length</description> </valueHelp> <constraint> - <validator name="ip-host"/> + <validator name="interface-address"/> </constraint> <multi/> </properties> diff --git a/interface-definitions/include/interface/arp-cache-timeout.xml.i b/interface-definitions/include/interface/arp-cache-timeout.xml.i index 06d7ffe96..f3cbac24d 100644 --- a/interface-definitions/include/interface/arp-cache-timeout.xml.i +++ b/interface-definitions/include/interface/arp-cache-timeout.xml.i @@ -4,7 +4,7 @@ <help>ARP cache entry timeout in seconds</help> <valueHelp> <format>u32:1-86400</format> - <description>ARP cache entry timout in seconds</description> + <description>ARP cache entry timeout in seconds</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 1-86400"/> diff --git a/interface-definitions/include/interface/dhcpv6-options.xml.i b/interface-definitions/include/interface/dhcpv6-options.xml.i index 68d1b172f..2dc0c0aaa 100644 --- a/interface-definitions/include/interface/dhcpv6-options.xml.i +++ b/interface-definitions/include/interface/dhcpv6-options.xml.i @@ -11,6 +11,18 @@ <valueless/> </properties> </leafNode> + <leafNode name="no-request-domain-name"> + <properties> + <help>Do not request domain name</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="no-request-dns"> + <properties> + <help>Do not request DNS servers</help> + <valueless/> + </properties> + </leafNode> <tagNode name="pd"> <properties> <help>DHCPv6 prefix delegation interface statement</help> @@ -42,6 +54,13 @@ <completionHelp> <script>${vyos_completion_dir}/list_interfaces --broadcast</script> </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> </properties> <children> <leafNode name="address"> diff --git a/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i b/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i new file mode 100644 index 000000000..d173dfdb8 --- /dev/null +++ b/interface-definitions/include/interface/ipv6-address-interface-identifier.xml.i @@ -0,0 +1,15 @@ +<!-- include start from interface/ipv6-address-interface-identifier.xml.i --> +<leafNode name="interface-identifier"> + <properties> + <help>SLAAC interface identifier</help> + <valueHelp> + <format>::h:h:h:h</format> + <description>Interface identifier</description> + </valueHelp> + <constraint> + <regex>::([0-9a-fA-F]{1,4}(:[0-9a-fA-F]{1,4}){0,3})</regex> + </constraint> + <constraintErrorMessage>Interface identifier format must start with :: and may contain up four hextets (::h:h:h:h)</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/interface/ipv6-address.xml.i b/interface-definitions/include/interface/ipv6-address.xml.i deleted file mode 100644 index e1bdf02fd..000000000 --- a/interface-definitions/include/interface/ipv6-address.xml.i +++ /dev/null @@ -1,12 +0,0 @@ -<!-- include start from interface/ipv6-address.xml.i --> -<node name="address"> - <properties> - <help>IPv6 address configuration modes</help> - </properties> - <children> - #include <include/interface/ipv6-address-autoconf.xml.i> - #include <include/interface/ipv6-address-eui64.xml.i> - #include <include/interface/ipv6-address-no-default-link-local.xml.i> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i b/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i index 3b9294dd0..82bf52876 100644 --- a/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i +++ b/interface-definitions/include/interface/ipv6-dup-addr-detect-transmits.xml.i @@ -4,7 +4,7 @@ <help>Number of NS messages to send while performing DAD</help> <valueHelp> <format>u32:0</format> - <description>Disable Duplicate Address Dectection (DAD)</description> + <description>Disable Duplicate Address Detection (DAD)</description> </valueHelp> <valueHelp> <format>u32:1-n</format> diff --git a/interface-definitions/include/interface/ipv6-options-with-nd.xml.i b/interface-definitions/include/interface/ipv6-options-with-nd.xml.i new file mode 100644 index 000000000..5894104b3 --- /dev/null +++ b/interface-definitions/include/interface/ipv6-options-with-nd.xml.i @@ -0,0 +1,9 @@ + <node name="ipv6"> + <children> + <node name="address"> + <children> + #include <include/interface/ipv6-address-interface-identifier.xml.i> + </children> + </node> + </children> + </node> diff --git a/interface-definitions/include/interface/ipv6-options.xml.i b/interface-definitions/include/interface/ipv6-options.xml.i index ec6ec64ee..f84a9f2cd 100644 --- a/interface-definitions/include/interface/ipv6-options.xml.i +++ b/interface-definitions/include/interface/ipv6-options.xml.i @@ -8,9 +8,18 @@ #include <include/interface/base-reachable-time.xml.i> #include <include/interface/disable-forwarding.xml.i> #include <include/interface/ipv6-accept-dad.xml.i> - #include <include/interface/ipv6-address.xml.i> #include <include/interface/ipv6-dup-addr-detect-transmits.xml.i> #include <include/interface/source-validation.xml.i> + <node name="address"> + <properties> + <help>IPv6 address configuration modes</help> + </properties> + <children> + #include <include/interface/ipv6-address-autoconf.xml.i> + #include <include/interface/ipv6-address-eui64.xml.i> + #include <include/interface/ipv6-address-no-default-link-local.xml.i> + </children> + </node> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/interface/vif-s.xml.i b/interface-definitions/include/interface/vif-s.xml.i index 02e7ab057..65ca10207 100644 --- a/interface-definitions/include/interface/vif-s.xml.i +++ b/interface-definitions/include/interface/vif-s.xml.i @@ -21,6 +21,7 @@ #include <include/interface/vlan-protocol.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> @@ -41,6 +42,7 @@ #include <include/interface/disable.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/include/interface/vif.xml.i b/interface-definitions/include/interface/vif.xml.i index ec3921bf6..87f91c5ce 100644 --- a/interface-definitions/include/interface/vif.xml.i +++ b/interface-definitions/include/interface/vif.xml.i @@ -46,6 +46,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/include/ipsec/childless.xml.i b/interface-definitions/include/ipsec/childless.xml.i new file mode 100644 index 000000000..76ba8d548 --- /dev/null +++ b/interface-definitions/include/ipsec/childless.xml.i @@ -0,0 +1,29 @@ +<!-- include start from ipsec/childless.xml.i --> +<leafNode name="childless"> + <properties> + <help>Enable support for childless IKE SA initiation</help> + <completionHelp> + <list>allow prefer force never</list> + </completionHelp> + <valueHelp> + <format>allow</format> + <description>Accept childless IKE SA in responder mode. Create regular IKE SA in initiator mode</description> + </valueHelp> + <valueHelp> + <format>prefer</format> + <description>In both responder and initiator modes, accept and create childless IKE SA correspondingly</description> + </valueHelp> + <valueHelp> + <format>force</format> + <description>Require the use of childless IKE SA in both responder and initiator modes</description> + </valueHelp> + <valueHelp> + <format>never</format> + <description>Disable support for childless IKE SAs when acting as a responder</description> + </valueHelp> + <constraint> + <regex>(allow|prefer|force|never)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/ipsec/ppk.xml.i b/interface-definitions/include/ipsec/ppk.xml.i new file mode 100644 index 000000000..bd420766c --- /dev/null +++ b/interface-definitions/include/ipsec/ppk.xml.i @@ -0,0 +1,24 @@ +<!-- include start from ipsec/ppk.xml.i --> +<node name="ppk"> + <properties> + <help>Post-quantum preshared key</help> + </properties> + <children> + <leafNode name="id"> + <properties> + <help>Post-quantum preshared key for this connection</help> + <valueHelp> + <format>txt</format> + <description>ID used for PPK</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="required"> + <properties> + <help>Require a valid PPK for connection to establish</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/isis/exclude-interface.xml.i b/interface-definitions/include/isis/exclude-interface.xml.i new file mode 100644 index 000000000..87399b43f --- /dev/null +++ b/interface-definitions/include/isis/exclude-interface.xml.i @@ -0,0 +1,10 @@ +<!-- include start from isis/exclude-interface.xml.i --> +<node name="exclude"> + <properties> + <help>Exclude interfaces from fast reroute</help> + </properties> + <children> + #include <include/generic-interface-multi.xml.i> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/frr-maxmetric.xml.i b/interface-definitions/include/isis/frr-maxmetric.xml.i new file mode 100644 index 000000000..2e1cad19d --- /dev/null +++ b/interface-definitions/include/isis/frr-maxmetric.xml.i @@ -0,0 +1,14 @@ +<!-- include start from isis/frr-maxmetric.xml.i --> +<leafNode name="maximum-metric"> + <properties> + <help>Limit remote LFA node selection within the metric</help> + <valueHelp> + <format>u32:1-16777215</format> + <description>Metric value</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-16777215"/> + </constraint> + </properties> +</leafNode> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/node-protection.xml.i b/interface-definitions/include/isis/node-protection.xml.i new file mode 100644 index 000000000..2dda81c0c --- /dev/null +++ b/interface-definitions/include/isis/node-protection.xml.i @@ -0,0 +1,15 @@ +<!-- include start from isis/node-protection.xml.i --> +<node name="node-protection"> + <properties> + <help>Protect against node failures</help> + </properties> + <children> + <leafNode name="link-fallback"> + <properties> + <help>Enable link-protection fallback</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/isis/protocol-common-config.xml.i b/interface-definitions/include/isis/protocol-common-config.xml.i index e0a7e62b6..6a7388c99 100644 --- a/interface-definitions/include/isis/protocol-common-config.xml.i +++ b/interface-definitions/include/isis/protocol-common-config.xml.i @@ -98,6 +98,7 @@ <validator name="numeric" argument="--range 1-120"/> </constraint> </properties> + <defaultValue>30</defaultValue> </leafNode> <leafNode name="lsp-mtu"> <properties> @@ -116,13 +117,14 @@ <properties> <help>LSP refresh interval</help> <valueHelp> - <format>u32:1-65235</format> + <format>u32:2-65235</format> <description>LSP refresh interval in seconds</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-65235"/> + <validator name="numeric" argument="--range 2-65235"/> </constraint> </properties> + <defaultValue>900</defaultValue> </leafNode> <leafNode name="max-lsp-lifetime"> <properties> @@ -135,6 +137,7 @@ <validator name="numeric" argument="--range 1-65535"/> </constraint> </properties> + <defaultValue>1200</defaultValue> </leafNode> <leafNode name="metric-style"> <properties> @@ -266,6 +269,12 @@ </constraint> </properties> </leafNode> + <leafNode name="export"> + <properties> + <help>Export Traffic Engineering Database, see options under protocols traffic-engineering</help> + <valueless/> + </properties> + </leafNode> </children> </node> <node name="segment-routing"> @@ -275,7 +284,7 @@ <children> <node name="global-block"> <properties> - <help>Segment Routing Global Block label range</help> + <help>Segment-Routing Global Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -283,7 +292,7 @@ </node> <node name="local-block"> <properties> - <help>Segment Routing Local Block label range</help> + <help>Segment-Routing Local Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -382,6 +391,94 @@ </node> </children> </tagNode> + <node name="srv6"> + <properties> + <help>Segment-Routing over IPv6 (SRv6) configuration</help> + </properties> + <children> + <leafNode name="locator"> + <properties> + <help>Specify SRv6 locator</help> + <valueHelp> + <format>txt</format> + <description>SRv6 locator name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_srv6_locators.sh</script> + </completionHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + </properties> + </leafNode> + <node name="node-msd"> + <properties> + <help>SRv6 Maximum Segment ID (SID) Depth (MSD)</help> + </properties> + <children> + <leafNode name="max-end-d"> + <properties> + <help>Maximum Segment Identifier for End-of-Data</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum End D MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-end-pop"> + <properties> + <help>Maximum number of SIDs in Segment-Routing Header (SRH) for segment pop</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum End Pop MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-h-encaps"> + <properties> + <help>Maximum Headend Encapsulation in MSD</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum Headend encaps in MSD</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-segs-left"> + <properties> + <help>Maximum Segments left in MSD</help> + <valueHelp> + <format>u32:0-255</format> + <description>Maximum Segments Left</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <leafNode name="interface"> + <properties> + <help>Interface for Segment-Routing over IPv6 (SRv6)</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> <node name="redistribute"> @@ -648,6 +745,96 @@ </constraint> </properties> </leafNode> + <node name="fast-reroute"> + <properties> + <help>IS-IS fast reroute</help> + </properties> + <children> + <node name="lfa"> + <properties> + <help>Enable LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help> Enable LFA computation for Level 1 only</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable LFA</help> + <valueless/> + </properties> + </leafNode> + #include <include/isis/exclude-interface.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable LFA computation for Level 2 only</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable LFA</help> + <valueless/> + </properties> + </leafNode> + #include <include/isis/exclude-interface.xml.i> + </children> + </node> + </children> + </node> + <node name="remote-lfa"> + <properties> + <help>Enable remote LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help> Enable remote LFA computation for Level 1 only</help> + </properties> + <children> + #include <include/isis/frr-maxmetric.xml.i> + #include <include/isis/remote_lfa_tunnel.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable remote LFA computation for Level 2 only</help> + </properties> + <children> + #include <include/isis/frr-maxmetric.xml.i> + #include <include/isis/remote_lfa_tunnel.xml.i> + </children> + </node> + </children> + </node> + <node name="ti-lfa"> + <properties> + <help> Enable TI-LFA computation</help> + </properties> + <children> + <node name="level-1"> + <properties> + <help>Enable TI-LFA computation for Level 1 only</help> + </properties> + <children> + #include <include/isis/node-protection.xml.i> + </children> + </node> + <node name="level-2"> + <properties> + <help>Enable TI-LFA computation for Level 2 only</help> + </properties> + <children> + #include <include/isis/node-protection.xml.i> + </children> + </node> + </children> + </node> + </children> + </node> <leafNode name="hello-padding"> <properties> <help>Add padding to IS-IS hello packets</help> diff --git a/interface-definitions/include/isis/remote_lfa_tunnel.xml.i b/interface-definitions/include/isis/remote_lfa_tunnel.xml.i new file mode 100644 index 000000000..62091a5ee --- /dev/null +++ b/interface-definitions/include/isis/remote_lfa_tunnel.xml.i @@ -0,0 +1,15 @@ +<!-- include start from isis/remote_lfa_tunnel.xml.i --> +<node name="tunnel"> + <properties> + <help>Enable remote LFA computation using tunnels</help> + </properties> + <children> + <leafNode name="mpls-ldp"> + <properties> + <help>Use MPLS LDP tunnel to reach the remote LFA node</help> + <valueless/> + </properties> + </leafNode> + </children> +</node> +<!-- include end -->
\ No newline at end of file diff --git a/interface-definitions/include/nat-rule.xml.i b/interface-definitions/include/nat-rule.xml.i index 0a7179ff1..3d5a6ede1 100644 --- a/interface-definitions/include/nat-rule.xml.i +++ b/interface-definitions/include/nat-rule.xml.i @@ -21,7 +21,12 @@ #include <include/firewall/fqdn.xml.i> #include <include/nat-address.xml.i> #include <include/nat-port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> #include <include/generic-disable-node.xml.i> @@ -319,7 +324,12 @@ #include <include/firewall/fqdn.xml.i> #include <include/nat-address.xml.i> #include <include/nat-port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/include/nat64/protocol.xml.i b/interface-definitions/include/nat64/protocol.xml.i index a640873b5..3905f8190 100644 --- a/interface-definitions/include/nat64/protocol.xml.i +++ b/interface-definitions/include/nat64/protocol.xml.i @@ -1,7 +1,7 @@ <!-- include start from nat64/protocol.xml.i --> <node name="protocol"> <properties> - <help>Apply translation address to a specfic protocol</help> + <help>Apply translation address to a specific protocol</help> </properties> <children> <leafNode name="tcp"> diff --git a/interface-definitions/include/ospf/authentication.xml.i b/interface-definitions/include/ospf/authentication.xml.i index 8e8cad067..f38a37269 100644 --- a/interface-definitions/include/ospf/authentication.xml.i +++ b/interface-definitions/include/ospf/authentication.xml.i @@ -38,6 +38,12 @@ </tagNode> </children> </node> + <leafNode name="null"> + <properties> + <help>Use null authentication</help> + <valueless/> + </properties> + </leafNode> <leafNode name="plaintext-password"> <properties> <help>Plain text password</help> diff --git a/interface-definitions/include/ospf/default-information.xml.i b/interface-definitions/include/ospf/default-information.xml.i index 50cda54a4..dc44617f7 100644 --- a/interface-definitions/include/ospf/default-information.xml.i +++ b/interface-definitions/include/ospf/default-information.xml.i @@ -1,7 +1,7 @@ <!-- include start from ospf/intervals.xml.i --> <node name="default-information"> <properties> - <help>Default route advertisment settings</help> + <help>Default route advertisement settings</help> </properties> <children> <node name="originate"> diff --git a/interface-definitions/include/ospf/protocol-common-config.xml.i b/interface-definitions/include/ospf/protocol-common-config.xml.i index f597be64e..93d718ed4 100644 --- a/interface-definitions/include/ospf/protocol-common-config.xml.i +++ b/interface-definitions/include/ospf/protocol-common-config.xml.i @@ -314,7 +314,6 @@ <description>OSPF area in dotted decimal notation</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> <validator name="ip-address"/> </constraint> </properties> @@ -680,7 +679,7 @@ <children> <node name="global-block"> <properties> - <help>Segment Routing Global Block label range</help> + <help>Segment-Routing Global Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> @@ -688,7 +687,7 @@ </node> <node name="local-block"> <properties> - <help>Segment Routing Local Block label range</help> + <help>Segment-Routing Local Block label range</help> </properties> <children> #include <include/segment-routing-label-value.xml.i> diff --git a/interface-definitions/include/policy/route-ipv4.xml.i b/interface-definitions/include/policy/route-ipv4.xml.i deleted file mode 100644 index c12abcae2..000000000 --- a/interface-definitions/include/policy/route-ipv4.xml.i +++ /dev/null @@ -1,14 +0,0 @@ -<!-- include start from policy/route-ipv4.xml.i --> -<node name="source"> - <properties> - <help>Source parameters</help> - </properties> - <children> - #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> - #include <include/firewall/mac-address.xml.i> - #include <include/firewall/port.xml.i> - </children> -</node> -#include <include/firewall/icmp.xml.i> -<!-- include end --> diff --git a/interface-definitions/include/policy/route-ipv6.xml.i b/interface-definitions/include/policy/route-ipv6.xml.i deleted file mode 100644 index d636a654b..000000000 --- a/interface-definitions/include/policy/route-ipv6.xml.i +++ /dev/null @@ -1,196 +0,0 @@ -<!-- include start from policy/route-ipv6.xml.i --> -<node name="source"> - <properties> - <help>Source parameters</help> - </properties> - <children> - #include <include/firewall/address-ipv6.xml.i> - #include <include/firewall/source-destination-group.xml.i> - #include <include/firewall/mac-address.xml.i> - #include <include/firewall/port.xml.i> - </children> -</node> -<node name="icmpv6"> - <properties> - <help>ICMPv6 type and code information</help> - </properties> - <children> - <leafNode name="type"> - <properties> - <help>ICMP type-name</help> - <completionHelp> - <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list> - </completionHelp> - <valueHelp> - <format>any</format> - <description>Any ICMP type/code</description> - </valueHelp> - <valueHelp> - <format>echo-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>pong</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>destination-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>protocol-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>port-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>fragmentation-needed</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>source-route-failed</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-unknown</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-unknown</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-network-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-host-unreachable</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>communication-prohibited</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-precedence-violation</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>precedence-cutoff</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>source-quench</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>network-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>host-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS-network-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>TOS host-redirect</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>echo-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ping</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>router-advertisement</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>router-solicitation</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>time-exceeded</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-exceeded</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-zero-during-transit</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ttl-zero-during-reassembly</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>parameter-problem</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>ip-header-bad</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>required-option-missing</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>timestamp-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>timestamp-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>address-mask-request</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>address-mask-reply</format> - <description>ICMP type/code name</description> - </valueHelp> - <valueHelp> - <format>packet-too-big</format> - <description>ICMP type/code name</description> - </valueHelp> - <constraint> - <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex> - <validator name="numeric" argument="--range 0-255"/> - </constraint> - </properties> - </leafNode> - </children> -</node> -<!-- include end --> diff --git a/interface-definitions/include/rip/timers.xml.i b/interface-definitions/include/rip/timers.xml.i index 771a6700e..e8b9d99c6 100644 --- a/interface-definitions/include/rip/timers.xml.i +++ b/interface-definitions/include/rip/timers.xml.i @@ -9,7 +9,7 @@ <help>Garbage collection timer</help> <valueHelp> <format>u32:5-2147483647</format> - <description>Garbage colletion time</description> + <description>Garbage collection time</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 5-2147483647"/> diff --git a/interface-definitions/include/rpki/protocol-common-config.xml.i b/interface-definitions/include/rpki/protocol-common-config.xml.i new file mode 100644 index 000000000..0b3356604 --- /dev/null +++ b/interface-definitions/include/rpki/protocol-common-config.xml.i @@ -0,0 +1,87 @@ +<!-- include start from rpki/protocol-common-config.xml.i --> +<tagNode name="cache"> + <properties> + <help>RPKI cache server address</help> + <valueHelp> + <format>ipv4</format> + <description>IP address of RPKI server</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address of RPKI server</description> + </valueHelp> + <valueHelp> + <format>hostname</format> + <description>Fully qualified domain name of RPKI server</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + <validator name="fqdn"/> + </constraint> + </properties> + <children> + #include <include/port-number.xml.i> + <leafNode name="preference"> + <properties> + <help>Preference of the cache server</help> + <valueHelp> + <format>u32:1-255</format> + <description>Preference of the cache server</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + </properties> + </leafNode> + #include <include/source-address-ipv4.xml.i> + <node name="ssh"> + <properties> + <help>RPKI SSH connection settings</help> + </properties> + <children> + #include <include/pki/openssh-key.xml.i> + #include <include/generic-username.xml.i> + </children> + </node> + </children> +</tagNode> +<leafNode name="expire-interval"> + <properties> + <help>Interval to wait before expiring the cache</help> + <valueHelp> + <format>u32:600-172800</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 600-172800"/> + </constraint> + </properties> + <defaultValue>7200</defaultValue> +</leafNode> +<leafNode name="polling-period"> + <properties> + <help>Cache polling interval</help> + <valueHelp> + <format>u32:1-86400</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-86400"/> + </constraint> + </properties> + <defaultValue>300</defaultValue> +</leafNode> +<leafNode name="retry-interval"> + <properties> + <help>Retry interval to connect to the cache server</help> + <valueHelp> + <format>u32:1-7200</format> + <description>Interval in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-7200"/> + </constraint> + </properties> + <defaultValue>600</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/segment-routing/algorithm.xml.i b/interface-definitions/include/segment-routing/algorithm.xml.i new file mode 100644 index 000000000..dae019b22 --- /dev/null +++ b/interface-definitions/include/segment-routing/algorithm.xml.i @@ -0,0 +1,20 @@ +<!-- include start from segment-routing/algorithm.xml.i --> +<node name="algorithm"> + <properties> + <help>IGP prefix algorithm style</help> + </properties> + <children> + <leafNode name="spf"> + <properties> + <help>Shortest Path First (SPF)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="strict-spf"> + <properties> + <help>Strict Shortest Path First (SPF) - ignore any possible local policy overriding the SPF along the path</help> + <valueless/> + </properties> + </leafNode> + </children> +</node>
\ No newline at end of file diff --git a/interface-definitions/include/source-interface-broadcast.xml.i b/interface-definitions/include/source-interface-broadcast.xml.i new file mode 100644 index 000000000..344a49024 --- /dev/null +++ b/interface-definitions/include/source-interface-broadcast.xml.i @@ -0,0 +1,14 @@ +<!-- include start from source-interface-broadcast.xml.i --> +<leafNode name="source-interface"> + <properties> + <help>Physical interface the traffic will go through</help> + <valueHelp> + <format>interface</format> + <description>Interface name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --broadcast</script> + </completionHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/source-interface-ethernet.xml.i b/interface-definitions/include/source-interface-ethernet.xml.i index e06e47d6c..ff6948090 100644 --- a/interface-definitions/include/source-interface-ethernet.xml.i +++ b/interface-definitions/include/source-interface-ethernet.xml.i @@ -4,7 +4,7 @@ <help>Physical interface the traffic will go through</help> <valueHelp> <format>interface</format> - <description>Physical interface used for traffic forwarding</description> + <description>Interface name</description> </valueHelp> <completionHelp> <script>${vyos_completion_dir}/list_interfaces --type ethernet</script> diff --git a/interface-definitions/include/static/static-route.xml.i b/interface-definitions/include/static/static-route.xml.i index c261874f5..59742dd3b 100644 --- a/interface-definitions/include/static/static-route.xml.i +++ b/interface-definitions/include/static/static-route.xml.i @@ -32,6 +32,7 @@ <children> #include <include/generic-disable-node.xml.i> #include <include/static/static-route-distance.xml.i> + #include <include/static/static-route-segments.xml.i> #include <include/static/static-route-vrf.xml.i> </children> </tagNode> @@ -50,6 +51,7 @@ #include <include/generic-disable-node.xml.i> #include <include/static/static-route-distance.xml.i> #include <include/generic-interface.xml.i> + #include <include/static/static-route-segments.xml.i> #include <include/static/static-route-vrf.xml.i> <node name="bfd"> <properties> diff --git a/interface-definitions/include/stunnel/protocol-value-cifs.xml.i b/interface-definitions/include/stunnel/protocol-value-cifs.xml.i index 5b9484750..12eae6584 100644 --- a/interface-definitions/include/stunnel/protocol-value-cifs.xml.i +++ b/interface-definitions/include/stunnel/protocol-value-cifs.xml.i @@ -1,6 +1,6 @@ <!-- include start from stunnel/protocol-value-cifs.xml.i --> <valueHelp> <format>cifs</format> - <description>Proprietary (undocummented) extension of CIFS protocol</description> + <description>Proprietary (undocumented) extension of CIFS protocol</description> </valueHelp> <!-- include end --> diff --git a/interface-definitions/include/system-ip-protocol.xml.i b/interface-definitions/include/system-ip-protocol.xml.i index c630eb3f7..30d7ab04e 100644 --- a/interface-definitions/include/system-ip-protocol.xml.i +++ b/interface-definitions/include/system-ip-protocol.xml.i @@ -3,7 +3,7 @@ <properties> <help>Filter routing info exchanged between routing protocol and zebra</help> <completionHelp> - <list>any babel bgp connected eigrp isis kernel ospf rip static table</list> + <list>any babel bgp eigrp isis ospf rip static</list> </completionHelp> <valueHelp> <format>any</format> @@ -18,10 +18,6 @@ <description>Border Gateway Protocol</description> </valueHelp> <valueHelp> - <format>connected</format> - <description>Connected routes (directly attached subnet or host)</description> - </valueHelp> - <valueHelp> <format>eigrp</format> <description>Enhanced Interior Gateway Routing Protocol</description> </valueHelp> @@ -30,10 +26,6 @@ <description>Intermediate System to Intermediate System</description> </valueHelp> <valueHelp> - <format>kernel</format> - <description>Kernel routes (not installed via the zebra RIB)</description> - </valueHelp> - <valueHelp> <format>ospf</format> <description>Open Shortest Path First (OSPFv2)</description> </valueHelp> @@ -46,11 +38,11 @@ <description>Statically configured routes</description> </valueHelp> <constraint> - <regex>(any|babel|bgp|connected|eigrp|isis|kernel|ospf|rip|static|table)</regex> + <regex>(any|babel|bgp|eigrp|isis|ospf|rip|static)</regex> </constraint> </properties> <children> #include <include/route-map.xml.i> </children> </tagNode> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/system-ipv6-protocol.xml.i b/interface-definitions/include/system-ipv6-protocol.xml.i index 485776a71..1a8123cb2 100644 --- a/interface-definitions/include/system-ipv6-protocol.xml.i +++ b/interface-definitions/include/system-ipv6-protocol.xml.i @@ -3,7 +3,7 @@ <properties> <help>Filter routing info exchanged between routing protocol and zebra</help> <completionHelp> - <list>any babel bgp connected isis kernel ospfv3 ripng static table</list> + <list>any babel bgp isis ospfv3 ripng static</list> </completionHelp> <valueHelp> <format>any</format> @@ -18,18 +18,10 @@ <description>Border Gateway Protocol</description> </valueHelp> <valueHelp> - <format>connected</format> - <description>Connected routes (directly attached subnet or host)</description> - </valueHelp> - <valueHelp> <format>isis</format> <description>Intermediate System to Intermediate System</description> </valueHelp> <valueHelp> - <format>kernel</format> - <description>Kernel routes (not installed via the zebra RIB)</description> - </valueHelp> - <valueHelp> <format>ospfv3</format> <description>Open Shortest Path First (OSPFv3)</description> </valueHelp> @@ -42,7 +34,7 @@ <description>Statically configured routes</description> </valueHelp> <constraint> - <regex>(any|babel|bgp|connected|isis|kernel|ospfv3|ripng|static|table)</regex> + <regex>(any|babel|bgp|isis|ospfv3|ripng|static)</regex> </constraint> </properties> <children> diff --git a/interface-definitions/include/unformat_log2_page_size.xml.i b/interface-definitions/include/unformat_log2_page_size.xml.i new file mode 100644 index 000000000..7678c1860 --- /dev/null +++ b/interface-definitions/include/unformat_log2_page_size.xml.i @@ -0,0 +1,20 @@ +<!-- include start from unformat_log2_page_size.xml.i --> +<completionHelp> + <list>4K 2M 1G</list> +</completionHelp> +<valueHelp> + <format>4K</format> + <description>4 kilobytes</description> +</valueHelp> +<valueHelp> + <format>2M</format> + <description>2 megabytes</description> +</valueHelp> +<valueHelp> + <format>1G</format> + <description>1 gigabyte</description> +</valueHelp> +<constraint> + <regex>(4K|2M|1G)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/unformat_memory_size.xml.i b/interface-definitions/include/unformat_memory_size.xml.i new file mode 100644 index 000000000..bb8f4ae67 --- /dev/null +++ b/interface-definitions/include/unformat_memory_size.xml.i @@ -0,0 +1,22 @@ +<!-- include start from unformat_memory_size.xml.i --> +<valueHelp> + <format><number></format> + <description>byte</description> +</valueHelp> +<valueHelp> + <format><number>K</format> + <description>Kilobyte</description> +</valueHelp> +<valueHelp> + <format><number>M</format> + <description>Megabyte</description> +</valueHelp> +<valueHelp> + <format><number>G</format> + <description>Gigabyte</description> +</valueHelp> +<constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + <regex>(\d+|\d+K|\d+M|\d+G)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/version/conntrack-version.xml.i b/interface-definitions/include/version/conntrack-version.xml.i index 6995ce119..517424034 100644 --- a/interface-definitions/include/version/conntrack-version.xml.i +++ b/interface-definitions/include/version/conntrack-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/conntrack-version.xml.i --> -<syntaxVersion component='conntrack' version='5'></syntaxVersion> +<syntaxVersion component='conntrack' version='6'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/container-version.xml.i b/interface-definitions/include/version/container-version.xml.i index ed6e942cd..046bacfdc 100644 --- a/interface-definitions/include/version/container-version.xml.i +++ b/interface-definitions/include/version/container-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/container-version.xml.i --> -<syntaxVersion component='container' version='2'></syntaxVersion> +<syntaxVersion component='container' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/firewall-version.xml.i b/interface-definitions/include/version/firewall-version.xml.i index 1a8098297..f50c450ef 100644 --- a/interface-definitions/include/version/firewall-version.xml.i +++ b/interface-definitions/include/version/firewall-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/firewall-version.xml.i --> -<syntaxVersion component='firewall' version='18'></syntaxVersion> +<syntaxVersion component='firewall' version='20'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/flow-accounting-version.xml.i b/interface-definitions/include/version/flow-accounting-version.xml.i index 95d1e20db..3a22d391c 100644 --- a/interface-definitions/include/version/flow-accounting-version.xml.i +++ b/interface-definitions/include/version/flow-accounting-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/flow-accounting-version.xml.i --> -<syntaxVersion component='flow-accounting' version='2'></syntaxVersion> +<syntaxVersion component='flow-accounting' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ids-version.xml.i b/interface-definitions/include/version/ids-version.xml.i index 9133be02b..6d4e92c21 100644 --- a/interface-definitions/include/version/ids-version.xml.i +++ b/interface-definitions/include/version/ids-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ids-version.xml.i --> -<syntaxVersion component='ids' version='1'></syntaxVersion> +<syntaxVersion component='ids' version='2'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/interfaces-version.xml.i b/interface-definitions/include/version/interfaces-version.xml.i index 2915b318e..28564b3d7 100644 --- a/interface-definitions/include/version/interfaces-version.xml.i +++ b/interface-definitions/include/version/interfaces-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/interfaces-version.xml.i --> -<syntaxVersion component='interfaces' version='33'></syntaxVersion> +<syntaxVersion component='interfaces' version='34'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ipsec-version.xml.i b/interface-definitions/include/version/ipsec-version.xml.i index a4d556cfc..6c24b0b2d 100644 --- a/interface-definitions/include/version/ipsec-version.xml.i +++ b/interface-definitions/include/version/ipsec-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ipsec-version.xml.i --> -<syntaxVersion component='ipsec' version='13'></syntaxVersion> +<syntaxVersion component='ipsec' version='14'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/openvpn-version.xml.i b/interface-definitions/include/version/openvpn-version.xml.i index 67ef21983..6bc2b2da6 100644 --- a/interface-definitions/include/version/openvpn-version.xml.i +++ b/interface-definitions/include/version/openvpn-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/openvpn-version.xml.i --> -<syntaxVersion component='openvpn' version='4'></syntaxVersion> +<syntaxVersion component='openvpn' version='5'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/pppoe-server-version.xml.i b/interface-definitions/include/version/pppoe-server-version.xml.i index 2e020faa3..1b2718d61 100644 --- a/interface-definitions/include/version/pppoe-server-version.xml.i +++ b/interface-definitions/include/version/pppoe-server-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/pppoe-server-version.xml.i --> -<syntaxVersion component='pppoe-server' version='11'></syntaxVersion> +<syntaxVersion component='pppoe-server' version='12'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/reverseproxy-version.xml.i b/interface-definitions/include/version/reverseproxy-version.xml.i index 4f09f2848..71f7def1a 100644 --- a/interface-definitions/include/version/reverseproxy-version.xml.i +++ b/interface-definitions/include/version/reverseproxy-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/reverseproxy-version.xml.i --> -<syntaxVersion component='reverse-proxy' version='2'></syntaxVersion> +<syntaxVersion component='reverse-proxy' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/ssh-version.xml.i b/interface-definitions/include/version/ssh-version.xml.i index 0f25caf98..05cf431a7 100644 --- a/interface-definitions/include/version/ssh-version.xml.i +++ b/interface-definitions/include/version/ssh-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ssh-version.xml.i --> -<syntaxVersion component='ssh' version='2'></syntaxVersion> +<syntaxVersion component='ssh' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i index 5cdece74a..f29226c03 100644 --- a/interface-definitions/include/version/system-version.xml.i +++ b/interface-definitions/include/version/system-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/system-version.xml.i --> -<syntaxVersion component='system' version='29'></syntaxVersion> +<syntaxVersion component='system' version='32'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/version/vpp-version.xml.i b/interface-definitions/include/version/vpp-version.xml.i new file mode 100644 index 000000000..c12e3786c --- /dev/null +++ b/interface-definitions/include/version/vpp-version.xml.i @@ -0,0 +1,3 @@ +<!-- include start from include/version/vpp-version.xml.i --> +<syntaxVersion component='vpp' version='6'></syntaxVersion> +<!-- include end --> diff --git a/interface-definitions/include/version/vrf-version.xml.i b/interface-definitions/include/version/vrf-version.xml.i index 9d7ff35fe..1c7c81155 100644 --- a/interface-definitions/include/version/vrf-version.xml.i +++ b/interface-definitions/include/version/vrf-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/vrf-version.xml.i --> -<syntaxVersion component='vrf' version='3'></syntaxVersion> +<syntaxVersion component='vrf' version='4'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i new file mode 100644 index 000000000..a719a6223 --- /dev/null +++ b/interface-definitions/include/vpp/acl_common_interface_ip_rule.xml.i @@ -0,0 +1,25 @@ +<!-- include start from vpp/acl_common_interface_ip_rule.xml.i --> +<tagNode name="acl-tag"> + <properties> + <help>ACL rule (tag) number</help> + <valueHelp> + <format>u32</format> + <description>Number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + <leafNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <completionHelp> + <path>vpp acl ip tag-name</path> + </completionHelp> + </properties> + </leafNode> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/acl_port_range.xml.i b/interface-definitions/include/vpp/acl_port_range.xml.i new file mode 100644 index 000000000..ba4a133bb --- /dev/null +++ b/interface-definitions/include/vpp/acl_port_range.xml.i @@ -0,0 +1,19 @@ +<!-- include start from vpp/acl_port_range.xml.i --> +<leafNode name="port"> + <properties> + <help>Port number or range</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <valueHelp> + <format>range</format> + <description>Numbered port range (e.g., 1001-1005)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--allow-range --range 1-65535"/> + </constraint> + <constraintErrorMessage>Invalid port or port range</constraintErrorMessage> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/acl_prefix.xml.i b/interface-definitions/include/vpp/acl_prefix.xml.i new file mode 100644 index 000000000..790153c8f --- /dev/null +++ b/interface-definitions/include/vpp/acl_prefix.xml.i @@ -0,0 +1,20 @@ +<!-- include start from vpp/acl_prefix.xml.i --> +<leafNode name="prefix"> + <properties> + <help>IP prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> + diff --git a/interface-definitions/include/vpp/acl_tcp_flags.xml.i b/interface-definitions/include/vpp/acl_tcp_flags.xml.i new file mode 100644 index 000000000..380df33a0 --- /dev/null +++ b/interface-definitions/include/vpp/acl_tcp_flags.xml.i @@ -0,0 +1,41 @@ +<!-- include start from vpp/acl_tcp_flags.xml.i --> +<completionHelp> + <list>ack cwr ecn fin psh rst syn urg</list> +</completionHelp> +<valueHelp> + <format>ack</format> + <description>Acknowledge flag</description> +</valueHelp> +<valueHelp> + <format>cwr</format> + <description>Congestion Window Reduced flag</description> +</valueHelp> +<valueHelp> + <format>ecn</format> + <description>Explicit Congestion Notification flag</description> +</valueHelp> +<valueHelp> + <format>fin</format> + <description>Finish flag</description> +</valueHelp> +<valueHelp> + <format>psh</format> + <description>Push flag</description> +</valueHelp> +<valueHelp> + <format>rst</format> + <description>Reset flag</description> +</valueHelp> +<valueHelp> + <format>syn</format> + <description>Synchronise flag</description> +</valueHelp> +<valueHelp> + <format>urg</format> + <description>Urgent flag</description> +</valueHelp> +<constraint> + <regex>(syn|ack|fin|rst|urg|psh|ecn|cwr)</regex> +</constraint> +<multi/> +<!-- include end --> diff --git a/interface-definitions/include/vpp/iface_rx_mode.xml.i b/interface-definitions/include/vpp/iface_rx_mode.xml.i new file mode 100644 index 000000000..36aa7e28b --- /dev/null +++ b/interface-definitions/include/vpp/iface_rx_mode.xml.i @@ -0,0 +1,25 @@ +<!-- include start from vpp/iface_rx_mode.xml.i --> +<leafNode name="interface-rx-mode"> + <properties> + <help>Receive packet processing mode</help> + <completionHelp> + <list>polling interrupt adaptive</list> + </completionHelp> + <valueHelp> + <format>polling</format> + <description>Constantly check for new data</description> + </valueHelp> + <valueHelp> + <format>interrupt</format> + <description>Interrupt mode</description> + </valueHelp> + <valueHelp> + <format>adaptive</format> + <description>Adaptive mode</description> + </valueHelp> + <constraint> + <regex>(polling|interrupt|adaptive)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_address_range.xml.i b/interface-definitions/include/vpp/nat_address_range.xml.i new file mode 100644 index 000000000..48648f91a --- /dev/null +++ b/interface-definitions/include/vpp/nat_address_range.xml.i @@ -0,0 +1,20 @@ +<!-- include start from vpp/nat_address_range.xml.i --> +<leafNode name="address"> + <properties> + <help>IP address or range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <valueHelp> + <format>ipv4range</format> + <description>IPv4 address range</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <validator name="ipv4-range"/> + </constraint> + <multi/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_interface.xml.i b/interface-definitions/include/vpp/nat_interface.xml.i new file mode 100644 index 000000000..20a7356bf --- /dev/null +++ b/interface-definitions/include/vpp/nat_interface.xml.i @@ -0,0 +1,11 @@ +<!-- include start from vpp/nat_interface.xml.i --> +<leafNode name="interface"> + <properties> + <help>Add IP address from an interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/nat_protocol.xml.i b/interface-definitions/include/vpp/nat_protocol.xml.i new file mode 100644 index 000000000..b88fd2b62 --- /dev/null +++ b/interface-definitions/include/vpp/nat_protocol.xml.i @@ -0,0 +1,30 @@ +<!-- include start from vpp/nat_protocol.xml.i --> +<leafNode name="protocol"> + <properties> + <help>Protocol</help> + <completionHelp> + <list>tcp udp icmp all</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All protocols (TCP, UDP, and ICMP)</description> + </valueHelp> + <valueHelp> + <format>icmp</format> + <description>Internet Control Message Protocol (ICMP)</description> + </valueHelp> + <valueHelp> + <format>tcp</format> + <description>Transmission Control Protocol (TCP)</description> + </valueHelp> + <valueHelp> + <format>udp</format> + <description>User Datagram Protocol (UDP)</description> + </valueHelp> + <constraint> + <regex>(tcp|udp|icmp|all)</regex> + </constraint> + </properties> + <defaultValue>all</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/vpp/netlink.xml.i b/interface-definitions/include/vpp/netlink.xml.i new file mode 100644 index 000000000..903100d00 --- /dev/null +++ b/interface-definitions/include/vpp/netlink.xml.i @@ -0,0 +1,45 @@ +<!-- include start from vpp/netlink.xml.i --> +<node name="netlink"> + <properties> + <help>Netlink options</help> + </properties> + <children> + <leafNode name="rx-buffer-size"> + <properties> + <help>Receive buffer size</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Receive buffer size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="batch-size"> + <properties> + <help>Batch size</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Batch size</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="batch-delay-ms"> + <properties> + <help>Batch delay</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Batch delay (in ms)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> +</children> +</node> +<!-- include end --> diff --git a/interface-definitions/include/vpp/queue_size.xml.i b/interface-definitions/include/vpp/queue_size.xml.i new file mode 100644 index 000000000..dc25df04d --- /dev/null +++ b/interface-definitions/include/vpp/queue_size.xml.i @@ -0,0 +1,44 @@ +<!-- include start from vpp/queue_size.xml.i --> +<completionHelp> + <list>0 256 512 1024 2048 4096 8192 16384 32468</list> +</completionHelp> +<valueHelp> + <format>0</format> + <description>Use default VPP queue size</description> +</valueHelp> +<valueHelp> + <format>256</format> + <description>256 descriptors</description> +</valueHelp> +<valueHelp> + <format>512</format> + <description>512 descriptors</description> +</valueHelp> +<valueHelp> + <format>1024</format> + <description>1024 descriptors</description> +</valueHelp> +<valueHelp> + <format>2048</format> + <description>2048 descriptors</description> +</valueHelp> +<valueHelp> + <format>4096</format> + <description>4096 descriptors</description> +</valueHelp> +<valueHelp> + <format>8192</format> + <description>8192 descriptors</description> +</valueHelp> +<valueHelp> + <format>16384</format> + <description>16384 descriptors</description> +</valueHelp> +<valueHelp> + <format>32468</format> + <description>32468 descriptors</description> +</valueHelp> +<constraint> + <regex>(0|256|512|1024|2048|4096|8192|16384|32468)</regex> +</constraint> +<!-- include end --> diff --git a/interface-definitions/include/vpp/vif.xml.i b/interface-definitions/include/vpp/vif.xml.i new file mode 100644 index 000000000..8f0e9772f --- /dev/null +++ b/interface-definitions/include/vpp/vif.xml.i @@ -0,0 +1,21 @@ +<!-- include start from vpp/vif.xml.i --> +<tagNode name="vif"> + <properties> + <help>Virtual Local Area Network (VLAN) ID</help> + <valueHelp> + <format>u32:0-4094</format> + <description>Virtual Local Area Network (VLAN) ID</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4094"/> + </constraint> + <constraintErrorMessage>VLAN ID must be between 0 and 4094</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/address-ipv4-ipv6-dhcp.xml.i> + #include <include/interface/disable.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + </children> +</tagNode> +<!-- include end --> diff --git a/interface-definitions/include/vrrp/garp.xml.i b/interface-definitions/include/vrrp/garp.xml.i index b56b490df..54bb34572 100644 --- a/interface-definitions/include/vrrp/garp.xml.i +++ b/interface-definitions/include/vrrp/garp.xml.i @@ -32,7 +32,7 @@ </leafNode> <leafNode name="master-refresh"> <properties> - <help>Minimum time interval for refreshing gratuitous ARPs while beeing master</help> + <help>Minimum time interval for refreshing gratuitous ARPs while being master</help> <valueHelp> <format>u32:0</format> <description>No refresh</description> @@ -49,7 +49,7 @@ </leafNode> <leafNode name="master-refresh-repeat"> <properties> - <help>Number of gratuitous ARP messages to send at a time while beeing master</help> + <help>Number of gratuitous ARP messages to send at a time while being master</help> <valueHelp> <format>u32:1-255</format> <description>Number of gratuitous ARP messages</description> diff --git a/interface-definitions/interfaces_bonding.xml.in b/interface-definitions/interfaces_bonding.xml.in index b17cad478..9945fc15d 100644 --- a/interface-definitions/interfaces_bonding.xml.in +++ b/interface-definitions/interfaces_bonding.xml.in @@ -141,6 +141,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> <leafNode name="mii-mon-interval"> <properties> @@ -239,7 +240,7 @@ <description>Distribute based on MAC address</description> </valueHelp> <constraint> - <regex>(802.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex> + <regex>(802\.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex> </constraint> <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, transmit-load-balance, adaptive-load-balance, or xor</constraintErrorMessage> </properties> diff --git a/interface-definitions/interfaces_bridge.xml.in b/interface-definitions/interfaces_bridge.xml.in index 29dd61df5..d4ee2a652 100644 --- a/interface-definitions/interfaces_bridge.xml.in +++ b/interface-definitions/interfaces_bridge.xml.in @@ -5,7 +5,7 @@ <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/interfaces_bridge.py"> <properties> <help>Bridge Interface</help> - <priority>310</priority> + <priority>319</priority> <constraint> <regex>br[0-9]+</regex> </constraint> @@ -93,6 +93,7 @@ </node> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="enable-vlan"> @@ -200,6 +201,24 @@ <valueless/> </properties> </leafNode> + <leafNode name="bpdu-guard"> + <properties> + <help>Enable BPDU Guard</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="root-guard"> + <properties> + <help>Enable Root Guard</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-learning"> + <properties> + <help>Disable MAC address learning</help> + <valueless/> + </properties> + </leafNode> </children> </tagNode> </children> diff --git a/interface-definitions/interfaces_dummy.xml.in b/interface-definitions/interfaces_dummy.xml.in index 36b4e41f2..993380ab8 100644 --- a/interface-definitions/interfaces_dummy.xml.in +++ b/interface-definitions/interfaces_dummy.xml.in @@ -18,6 +18,7 @@ <children> #include <include/interface/address-ipv4-ipv6.xml.i> #include <include/generic-description.xml.i> + #include <include/interface/mac.xml.i> #include <include/interface/disable.xml.i> <node name="ip"> <properties> diff --git a/interface-definitions/interfaces_ethernet.xml.in b/interface-definitions/interfaces_ethernet.xml.in index b3559a626..e9814817f 100644 --- a/interface-definitions/interfaces_ethernet.xml.in +++ b/interface-definitions/interfaces_ethernet.xml.in @@ -74,6 +74,7 @@ #include <include/interface/hw-id.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-68-16000.xml.i> #include <include/interface/mirror.xml.i> @@ -220,6 +221,313 @@ </leafNode> </children> </node> + <node name="interrupt-coalescing"> + <properties> + <help>Interrupt coalescing options for the interface</help> + </properties> + <children> + <leafNode name="adaptive-rx"> + <properties> + <help>Enable adaptive receive interrupt coalescing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="adaptive-tx"> + <properties> + <help>Enable adaptive transmit interrupt coalescing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="rx-usecs"> + <properties> + <help>Delay in microseconds before generating RX interrupt</help> + <valueHelp> + <format>u32:0-16384</format> + <description>RX interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frames"> + <properties> + <help>Number of RX frames before generating interrupt</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>RX interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-irq"> + <properties> + <help>Delay in microseconds before generating RX interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-16384</format> + <description>RX IRQ interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frames-irq"> + <properties> + <help>Number of RX frames before generating interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>RX IRQ interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs"> + <properties> + <help>Delay in microseconds before generating TX interrupt</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frames"> + <properties> + <help>Number of TX frames before generating interrupt</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-irq"> + <properties> + <help>Delay in microseconds before generating TX interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX IRQ interrupt coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frames-irq"> + <properties> + <help>Number of TX frames before generating interrupt while servicing IRQ</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX IRQ interrupt coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="stats-block-usecs"> + <properties> + <help>Time in microseconds between updating coalescing statistics</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Statistics block interval</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="pkt-rate-low"> + <properties> + <help>Lower packet rate threshold for adaptive coalescing</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low packet rate threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-low"> + <properties> + <help>RX coalescing delay (usecs) for low packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>Low-rate RX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frame-low"> + <properties> + <help>RX coalescing frames threshold for low packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low-rate RX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-low"> + <properties> + <help>TX coalescing delay (usecs) for low packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>Low-rate TX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frame-low"> + <properties> + <help>TX coalescing frames threshold for low packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Low-rate TX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="pkt-rate-high"> + <properties> + <help>Upper packet rate threshold for adaptive coalescing</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High packet rate threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-usecs-high"> + <properties> + <help>RX coalescing delay (usecs) for high packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>High-rate RX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rx-frame-high"> + <properties> + <help>RX coalescing frames threshold for high packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High-rate RX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-usecs-high"> + <properties> + <help>TX coalescing delay (usecs) for high packet rate</help> + <valueHelp> + <format>u32:0-16384</format> + <description>High-rate TX coalescing delay</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-frame-high"> + <properties> + <help>TX coalescing frames threshold for high packet rate</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>High-rate TX coalescing frames threshold</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="sample-interval"> + <properties> + <help>Sampling interval for adaptive coalescing (in seconds)</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Adaptive sampling interval</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="cqe-mode-rx"> + <properties> + <help>Enable RX CQE (Completion Queue Entry) mode</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="cqe-mode-tx"> + <properties> + <help>Enable TX CQE (Completion Queue Entry) mode</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="tx-aggr-max-bytes"> + <properties> + <help>Maximum number of bytes to aggregate before transmitting</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX aggregation maximum bytes</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-aggr-max-frames"> + <properties> + <help>Maximum number of frames to aggregate before transmitting</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>TX aggregation maximum frames</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="tx-aggr-time-usecs"> + <properties> + <help>Maximum time in microseconds to wait before transmitting aggregated frames</help> + <valueHelp> + <format>u32:0-16384</format> + <description>TX aggregation timeout</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-16384"/> + </constraint> + </properties> + </leafNode> + </children> + </node> #include <include/interface/redirect.xml.i> #include <include/interface/vif-s.xml.i> #include <include/interface/vif.xml.i> diff --git a/interface-definitions/interfaces_geneve.xml.in b/interface-definitions/interfaces_geneve.xml.in index c1e6c33d5..b85bd3b9e 100644 --- a/interface-definitions/interfaces_geneve.xml.in +++ b/interface-definitions/interfaces_geneve.xml.in @@ -21,6 +21,7 @@ #include <include/interface/disable.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-1200-16000.xml.i> #include <include/port-number.xml.i> diff --git a/interface-definitions/interfaces_l2tpv3.xml.in b/interface-definitions/interfaces_l2tpv3.xml.in index 5f816c956..381e86bd0 100644 --- a/interface-definitions/interfaces_l2tpv3.xml.in +++ b/interface-definitions/interfaces_l2tpv3.xml.in @@ -55,6 +55,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/mirror.xml.i> #include <include/interface/mtu-68-16000.xml.i> diff --git a/interface-definitions/interfaces_macsec.xml.in b/interface-definitions/interfaces_macsec.xml.in index d825f8262..5279a9495 100644 --- a/interface-definitions/interfaces_macsec.xml.in +++ b/interface-definitions/interfaces_macsec.xml.in @@ -21,6 +21,7 @@ #include <include/interface/dhcpv6-options.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mirror.xml.i> <node name="security"> <properties> diff --git a/interface-definitions/interfaces_openvpn.xml.in b/interface-definitions/interfaces_openvpn.xml.in index 3c844107e..005d7c015 100644 --- a/interface-definitions/interfaces_openvpn.xml.in +++ b/interface-definitions/interfaces_openvpn.xml.in @@ -131,10 +131,54 @@ <multi/> </properties> </leafNode> + <leafNode name="data-ciphers-fallback"> + <properties> + <help>Fallback cipher to use for site-to-site tunnels</help> + <completionHelp> + <list>none 3des aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list> + </completionHelp> + <valueHelp> + <format>none</format> + <description>Disable encryption</description> + </valueHelp> + <valueHelp> + <format>3des</format> + <description>DES algorithm with triple encryption</description> + </valueHelp> + <valueHelp> + <format>aes128</format> + <description>AES algorithm with 128-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes128gcm</format> + <description>AES algorithm with 128-bit key GCM</description> + </valueHelp> + <valueHelp> + <format>aes192</format> + <description>AES algorithm with 192-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes192gcm</format> + <description>AES algorithm with 192-bit key GCM</description> + </valueHelp> + <valueHelp> + <format>aes256</format> + <description>AES algorithm with 256-bit key CBC</description> + </valueHelp> + <valueHelp> + <format>aes256gcm</format> + <description>AES algorithm with 256-bit key GCM</description> + </valueHelp> + <constraint> + <regex>(none|3des|aes128|aes128gcm|aes192|aes192gcm|aes256|aes256gcm)</regex> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="hash"> <properties> @@ -330,11 +374,11 @@ </valueHelp> <valueHelp> <format>_ipv4</format> - <description>Accept connections on or initate connections to IPv4 addresses only</description> + <description>Accept connections on or initiate connections to IPv4 addresses only</description> </valueHelp> <valueHelp> <format>_ipv6</format> - <description>Accept connections on or initate connections to IPv6 addresses only</description> + <description>Accept connections on or initiate connections to IPv6 addresses only</description> </valueHelp> <valueHelp> <format>dual-stack</format> @@ -767,7 +811,7 @@ </valueHelp> <valueHelp> <format>enable</format> - <description>Enable chalenge-response</description> + <description>Enable challenge-response</description> </valueHelp> <constraint> <regex>(disable|enable)</regex> diff --git a/interface-definitions/interfaces_pppoe.xml.in b/interface-definitions/interfaces_pppoe.xml.in index f24bc41d8..d38074b41 100644 --- a/interface-definitions/interfaces_pppoe.xml.in +++ b/interface-definitions/interfaces_pppoe.xml.in @@ -16,6 +16,22 @@ </valueHelp> </properties> <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <completionHelp> + <list>dhcpv6</list> + </completionHelp> + <valueHelp> + <format>dhcpv6</format> + <description>Dynamic Host Configuration Protocol for IPv6</description> + </valueHelp> + <constraint> + <regex>(dhcpv6)</regex> + </constraint> + <multi/> + </properties> + </leafNode> #include <include/pppoe-access-concentrator.xml.i> #include <include/interface/authentication.xml.i> #include <include/interface/dial-on-demand.xml.i> @@ -88,6 +104,7 @@ </properties> <children> #include <include/interface/ipv6-address-autoconf.xml.i> + #include <include/interface/ipv6-address-interface-identifier.xml.i> </children> </node> #include <include/interface/adjust-mss.xml.i> diff --git a/interface-definitions/interfaces_pseudo-ethernet.xml.in b/interface-definitions/interfaces_pseudo-ethernet.xml.in index 031af3563..f6e3b6970 100644 --- a/interface-definitions/interfaces_pseudo-ethernet.xml.in +++ b/interface-definitions/interfaces_pseudo-ethernet.xml.in @@ -25,7 +25,8 @@ #include <include/interface/vrf.xml.i> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> - #include <include/source-interface-ethernet.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> + #include <include/source-interface-broadcast.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mirror.xml.i> <leafNode name="mode"> diff --git a/interface-definitions/interfaces_tunnel.xml.in b/interface-definitions/interfaces_tunnel.xml.in index fe1dad371..74849be5d 100644 --- a/interface-definitions/interfaces_tunnel.xml.in +++ b/interface-definitions/interfaces_tunnel.xml.in @@ -158,7 +158,7 @@ <help>ERSPAN version 1 index field</help> <valueHelp> <format>u32:0-63</format> - <description>Platform-depedent field for specifying port number and direction</description> + <description>Platform-dependent field for specifying port number and direction</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-63"/> diff --git a/interface-definitions/interfaces_virtual-ethernet.xml.in b/interface-definitions/interfaces_virtual-ethernet.xml.in index 2dfbd50b8..1559a6038 100644 --- a/interface-definitions/interfaces_virtual-ethernet.xml.in +++ b/interface-definitions/interfaces_virtual-ethernet.xml.in @@ -42,7 +42,7 @@ <constraint> <regex>veth[0-9]+</regex> </constraint> - <constraintErrorMessage>Virutal Ethernet interface must be named vethN</constraintErrorMessage> + <constraintErrorMessage>Virtual Ethernet interface must be named vethN</constraintErrorMessage> </properties> </leafNode> </children> diff --git a/interface-definitions/interfaces_vxlan.xml.in b/interface-definitions/interfaces_vxlan.xml.in index 937acb123..321c2d8f3 100644 --- a/interface-definitions/interfaces_vxlan.xml.in +++ b/interface-definitions/interfaces_vxlan.xml.in @@ -45,6 +45,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/mac.xml.i> #include <include/interface/mtu-1200-16000.xml.i> #include <include/interface/mirror.xml.i> @@ -62,7 +63,7 @@ #include <include/interface/parameters-tos.xml.i> #include <include/interface/parameters-ttl.xml.i> <leafNode name="ttl"> - <defaultValue>16</defaultValue> + <defaultValue>64</defaultValue> </leafNode> </children> </node> @@ -127,6 +128,7 @@ <constraintErrorMessage>Not a valid VLAN ID or range, VLAN ID must be between 0 and 4094</constraintErrorMessage> </properties> <children> + #include <include/generic-description.xml.i> <leafNode name="vni"> <properties> <help>Virtual Network Identifier</help> diff --git a/interface-definitions/interfaces_wireless.xml.in b/interface-definitions/interfaces_wireless.xml.in index 474953500..1b5356caa 100644 --- a/interface-definitions/interfaces_wireless.xml.in +++ b/interface-definitions/interfaces_wireless.xml.in @@ -626,6 +626,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/hw-id.xml.i> <leafNode name="isolate-stations"> <properties> diff --git a/interface-definitions/interfaces_wwan.xml.in b/interface-definitions/interfaces_wwan.xml.in index 1580c3bcb..552806d4e 100644 --- a/interface-definitions/interfaces_wwan.xml.in +++ b/interface-definitions/interfaces_wwan.xml.in @@ -38,6 +38,7 @@ </leafNode> #include <include/interface/ipv4-options.xml.i> #include <include/interface/ipv6-options.xml.i> + #include <include/interface/ipv6-options-with-nd.xml.i> #include <include/interface/dial-on-demand.xml.i> #include <include/interface/redirect.xml.i> #include <include/interface/vrf.xml.i> diff --git a/interface-definitions/load-balancing_haproxy.xml.in b/interface-definitions/load-balancing_haproxy.xml.in index b95e02337..f3baf86ca 100644 --- a/interface-definitions/load-balancing_haproxy.xml.in +++ b/interface-definitions/load-balancing_haproxy.xml.in @@ -4,7 +4,7 @@ <children> <node name="haproxy" owner="${vyos_conf_scripts_dir}/load-balancing_haproxy.py"> <properties> - <help>Configure haproxy</help> + <help>HAProxy TCP/HTTP Load Balancer</help> <priority>900</priority> </properties> <children> @@ -26,7 +26,7 @@ <constraintErrorMessage>Backend name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> <valueHelp> <format>txt</format> - <description>Name of haproxy backend system</description> + <description>HAProxy backend system name</description> </valueHelp> <completionHelp> <path>load-balancing haproxy backend</path> @@ -35,7 +35,7 @@ </properties> </leafNode> #include <include/generic-description.xml.i> - #include <include/listen-address.xml.i> + #include <include/haproxy/listen-address.xml.i> #include <include/haproxy/logging.xml.i> #include <include/haproxy/mode.xml.i> #include <include/port-number.xml.i> @@ -159,7 +159,7 @@ <properties> <help>URI used for HTTP health check (Example: '/' or '/health')</help> <constraint> - <regex>^\/([^?#\s]*)(\?[^#\s]*)?$</regex> + <regex>\/([^?#\s]*)(\?[^#\s]*)?</regex> </constraint> </properties> </leafNode> @@ -253,12 +253,14 @@ <valueless/> </properties> </leafNode> - <leafNode name="check"> + <node name="check"> <properties> <help>Active health check backend server</help> - <valueless/> </properties> - </leafNode> + <children> + #include <include/port-number.xml.i> + </children> + </node> #include <include/port-number.xml.i> <leafNode name="send-proxy"> <properties> @@ -293,7 +295,7 @@ </tagNode> <node name="global-parameters"> <properties> - <help>Global perfomance parameters and limits</help> + <help>Global performance parameters and limits</help> </properties> <children> #include <include/haproxy/logging.xml.i> diff --git a/interface-definitions/load-balancing_wan.xml.in b/interface-definitions/load-balancing_wan.xml.in index 310aa0343..17bd3aaf3 100644 --- a/interface-definitions/load-balancing_wan.xml.in +++ b/interface-definitions/load-balancing_wan.xml.in @@ -7,7 +7,7 @@ <children> <node name="wan" owner="${vyos_conf_scripts_dir}/load-balancing_wan.py"> <properties> - <help>Configure Wide Area Network (WAN) load-balancing</help> + <help>Wide Area Network (WAN) load-balancing</help> <priority>900</priority> </properties> <children> @@ -29,6 +29,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="only-default-route"> + <properties> + <help>Prefer specific routes in the main routing table over WAN load balancing</help> + <valueless/> + </properties> + </leafNode> <leafNode name="hook"> <properties> <help>Script to be executed on interface status change</help> @@ -203,6 +209,7 @@ <help>Destination</help> </properties> <children> + #include <include/firewall/source-destination-group-ipv4.xml.i> #include <include/ipv4-address-prefix-range.xml.i> #include <include/port-port-range.xml.i> </children> @@ -373,6 +380,7 @@ <help>Source information</help> </properties> <children> + #include <include/firewall/source-destination-group-ipv4.xml.i> #include <include/ipv4-address-prefix-range.xml.i> #include <include/port-port-range.xml.i> </children> diff --git a/interface-definitions/nat.xml.in b/interface-definitions/nat.xml.in index 73a748137..93dd847d6 100644 --- a/interface-definitions/nat.xml.in +++ b/interface-definitions/nat.xml.in @@ -65,17 +65,6 @@ <children> #include <include/nat-rule.xml.i> <tagNode name="rule"> - <properties> - <help>Rule number for NAT</help> - <valueHelp> - <format>u32:1-999999</format> - <description>Number of NAT rule</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-999999"/> - </constraint> - <constraintErrorMessage>NAT rule number must be between 1 and 999999</constraintErrorMessage> - </properties> <children> #include <include/firewall/outbound-interface.xml.i> <node name="translation"> diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index c59725c53..3848b4c9a 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -53,6 +53,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="source"> @@ -78,6 +79,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="translation"> @@ -215,6 +217,7 @@ </properties> </leafNode> #include <include/nat-port.xml.i> + #include <include/firewall/source-destination-group-ipv6.xml.i> </children> </node> <node name="translation"> diff --git a/interface-definitions/policy.xml.in b/interface-definitions/policy.xml.in index 25dbf5581..53dcfd8ee 100644 --- a/interface-definitions/policy.xml.in +++ b/interface-definitions/policy.xml.in @@ -607,22 +607,50 @@ <properties> <help>Match route-type</help> <completionHelp> - <list>macip multicast prefix</list> + <list>1 2 3 4 5 ead macip multicast es prefix</list> </completionHelp> <valueHelp> + <format>1</format> + <description>EAD (Type-1) route</description> + </valueHelp> + <valueHelp> + <format>2</format> + <description>MAC-IP (Type-2) route</description> + </valueHelp> + <valueHelp> + <format>3</format> + <description>Multicast (Type-3) route</description> + </valueHelp> + <valueHelp> + <format>4</format> + <description>Ethernet Segment (Type-4) route</description> + </valueHelp> + <valueHelp> + <format>5</format> + <description>Prefix (Type-5) route</description> + </valueHelp> + <valueHelp> + <format>ead</format> + <description>EAD (Type-1) route</description> + </valueHelp> + <valueHelp> <format>macip</format> - <description>mac-ip route</description> + <description>MAC-IP (Type-2) route</description> </valueHelp> <valueHelp> <format>multicast</format> - <description>IMET route</description> + <description>Multicast (Type-3) route</description> + </valueHelp> + <valueHelp> + <format>es</format> + <description>Ethernet Segment (Type-4) route</description> </valueHelp> <valueHelp> <format>prefix</format> - <description>Prefix route</description> + <description>Prefix (Type-5) route</description> </valueHelp> <constraint> - <regex>(macip|multicast|prefix)</regex> + <regex>([1-5]|ead|macip|multicast|es|prefix)</regex> </constraint> </properties> </leafNode> @@ -1010,6 +1038,30 @@ </constraint> </properties> </leafNode> + <leafNode name="source-peer"> + <properties> + <help>Source peer to match (BGP)</help> + <valueHelp> + <format>ipv4</format> + <description>Peer IPv4 address</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Peer IPv6 address</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Interface name of peer</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>BGP peer-group name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_bgp_neighbors.sh --ipv4 --ipv6 --interfaces --peer-groups --all-vrfs</script> + </completionHelp> + </properties> + </leafNode> <leafNode name="protocol"> <properties> <help>Match protocol via which the route was learnt</help> @@ -1092,6 +1144,29 @@ </constraint> </properties> </leafNode> + <leafNode name="rpki-extcommunity"> + <properties> + <help>Match RPKI (Origin Validation State) extended community</help> + <completionHelp> + <list>invalid notfound valid</list> + </completionHelp> + <valueHelp> + <format>invalid</format> + <description>Match invalid entries</description> + </valueHelp> + <valueHelp> + <format>notfound</format> + <description>Match notfound entries</description> + </valueHelp> + <valueHelp> + <format>valid</format> + <description>Match valid entries</description> + </valueHelp> + <constraint> + <regex>(invalid|notfound|valid)</regex> + </constraint> + </properties> + </leafNode> <leafNode name="source-vrf"> <properties> <help>Source vrf</help> @@ -1519,7 +1594,7 @@ <constraint> <validator name="numeric" argument="--relative --"/> <validator name="numeric" argument="--range 0-4294967295"/> - <regex>^[+|-]?rtt$</regex> + <regex>[+|-]?rtt</regex> </constraint> </properties> </leafNode> @@ -1544,7 +1619,7 @@ </leafNode> <leafNode name="origin"> <properties> - <help>Border Gateway Protocl (BGP) origin code</help> + <help>Border Gateway Protocol (BGP) origin code</help> <completionHelp> <list>igp egp incomplete</list> </completionHelp> diff --git a/interface-definitions/policy_route.xml.in b/interface-definitions/policy_route.xml.in index 9cc22540b..6ec52feeb 100644 --- a/interface-definitions/policy_route.xml.in +++ b/interface-definitions/policy_route.xml.in @@ -35,6 +35,7 @@ #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> </children> </node> <node name="source"> @@ -44,11 +45,195 @@ <children> #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> + #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> + </children> + </node> + <node name="icmpv6"> + <properties> + <help>ICMPv6 type and code information</help> + </properties> + <children> + <leafNode name="type"> + <properties> + <help>ICMP type-name</help> + <completionHelp> + <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list> + </completionHelp> + <valueHelp> + <format>any</format> + <description>Any ICMP type/code</description> + </valueHelp> + <valueHelp> + <format>echo-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>pong</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>destination-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>protocol-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>port-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>fragmentation-needed</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>source-route-failed</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-unknown</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-unknown</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-network-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-host-unreachable</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>communication-prohibited</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-precedence-violation</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>precedence-cutoff</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>source-quench</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>network-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>host-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS-network-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>TOS host-redirect</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>echo-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ping</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>router-advertisement</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>router-solicitation</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>time-exceeded</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-exceeded</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-zero-during-transit</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ttl-zero-during-reassembly</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>parameter-problem</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>ip-header-bad</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>required-option-missing</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>timestamp-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>timestamp-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>address-mask-request</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>address-mask-reply</format> + <description>ICMP type/code name</description> + </valueHelp> + <valueHelp> + <format>packet-too-big</format> + <description>ICMP type/code name</description> + </valueHelp> + <constraint> + <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex> + <validator name="numeric" argument="--range 0-255"/> + </constraint> + </properties> + </leafNode> </children> </node> #include <include/policy/route-common.xml.i> - #include <include/policy/route-ipv6.xml.i> #include <include/firewall/dscp.xml.i> #include <include/firewall/packet-options.xml.i> #include <include/firewall/hop-limit.xml.i> @@ -88,8 +273,14 @@ </properties> <children> #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> </children> </node> <node name="source"> @@ -98,12 +289,19 @@ </properties> <children> #include <include/firewall/address.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/port.xml.i> + #include <include/firewall/geoip.xml.i> + #include <include/firewall/mac-address.xml.i> </children> </node> #include <include/policy/route-common.xml.i> - #include <include/policy/route-ipv4.xml.i> + #include <include/firewall/icmp.xml.i> #include <include/firewall/dscp.xml.i> #include <include/firewall/packet-options.xml.i> #include <include/firewall/ttl.xml.i> diff --git a/interface-definitions/protocols_failover.xml.in b/interface-definitions/protocols_failover.xml.in index fae9be76a..0f8a3b2ad 100644 --- a/interface-definitions/protocols_failover.xml.in +++ b/interface-definitions/protocols_failover.xml.in @@ -8,132 +8,7 @@ <priority>490</priority> </properties> <children> - <tagNode name="route"> - <properties> - <help>Failover IPv4 route</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 failover route</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - </constraint> - </properties> - <children> - <tagNode name="next-hop"> - <properties> - <help>Next-hop IPv4 router address</help> - <valueHelp> - <format>ipv4</format> - <description>Next-hop router address</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - <children> - <node name="check"> - <properties> - <help>Check target options</help> - </properties> - <children> - <leafNode name="policy"> - <properties> - <help>Policy for check targets</help> - <completionHelp> - <list>any-available all-available</list> - </completionHelp> - <valueHelp> - <format>all-available</format> - <description>All targets must be alive</description> - </valueHelp> - <valueHelp> - <format>any-available</format> - <description>Any target must be alive</description> - </valueHelp> - <constraint> - <regex>(all-available|any-available)</regex> - </constraint> - </properties> - <defaultValue>any-available</defaultValue> - </leafNode> - #include <include/port-number.xml.i> - <leafNode name="target"> - <properties> - <help>Check target address</help> - <valueHelp> - <format>ipv4</format> - <description>Address to check</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="timeout"> - <properties> - <help>Timeout between checks</help> - <valueHelp> - <format>u32:1-300</format> - <description>Timeout in seconds between checks</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - <defaultValue>10</defaultValue> - </leafNode> - <leafNode name="type"> - <properties> - <help>Check type</help> - <completionHelp> - <list>arp icmp tcp</list> - </completionHelp> - <valueHelp> - <format>arp</format> - <description>Check target by ARP</description> - </valueHelp> - <valueHelp> - <format>icmp</format> - <description>Check target by ICMP</description> - </valueHelp> - <valueHelp> - <format>tcp</format> - <description>Check target by TCP</description> - </valueHelp> - <constraint> - <regex>(arp|icmp|tcp)</regex> - </constraint> - </properties> - <defaultValue>icmp</defaultValue> - </leafNode> - </children> - </node> - #include <include/generic-interface.xml.i> - <leafNode name="metric"> - <properties> - <help>Route metric for this gateway</help> - <valueHelp> - <format>u32:1-255</format> - <description>Route metric</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - <defaultValue>1</defaultValue> - </leafNode> - <leafNode name="onlink"> - <properties> - <help>The next hop is directly connected to the interface, even if it does not match interface prefix</help> - <valueless/> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/failover/protocol-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/protocols_igmp-proxy.xml.in b/interface-definitions/protocols_igmp-proxy.xml.in index 5cde484f5..a1deeb3fc 100644 --- a/interface-definitions/protocols_igmp-proxy.xml.in +++ b/interface-definitions/protocols_igmp-proxy.xml.in @@ -26,7 +26,7 @@ <children> <leafNode name="alt-subnet"> <properties> - <help>Unicast source networks allowed for multicast traffic to be proxyed</help> + <help>Unicast source networks allowed for multicast traffic to be proxied</help> <valueHelp> <format>ipv4net</format> <description>IPv4 network</description> diff --git a/interface-definitions/protocols_rpki.xml.in b/interface-definitions/protocols_rpki.xml.in index 9e2e84717..a298cdbfd 100644 --- a/interface-definitions/protocols_rpki.xml.in +++ b/interface-definitions/protocols_rpki.xml.in @@ -8,91 +8,7 @@ <priority>819</priority> </properties> <children> - <tagNode name="cache"> - <properties> - <help>RPKI cache server address</help> - <valueHelp> - <format>ipv4</format> - <description>IP address of RPKI server</description> - </valueHelp> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address of RPKI server</description> - </valueHelp> - <valueHelp> - <format>hostname</format> - <description>Fully qualified domain name of RPKI server</description> - </valueHelp> - <constraint> - <validator name="ip-address"/> - <validator name="fqdn"/> - </constraint> - </properties> - <children> - #include <include/port-number.xml.i> - <leafNode name="preference"> - <properties> - <help>Preference of the cache server</help> - <valueHelp> - <format>u32:1-255</format> - <description>Preference of the cache server</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-255"/> - </constraint> - </properties> - </leafNode> - #include <include/source-address-ipv4.xml.i> - <node name="ssh"> - <properties> - <help>RPKI SSH connection settings</help> - </properties> - <children> - #include <include/pki/openssh-key.xml.i> - #include <include/generic-username.xml.i> - </children> - </node> - </children> - </tagNode> - <leafNode name="expire-interval"> - <properties> - <help>Interval to wait before expiring the cache</help> - <valueHelp> - <format>u32:600-172800</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 600-172800"/> - </constraint> - </properties> - <defaultValue>7200</defaultValue> - </leafNode> - <leafNode name="polling-period"> - <properties> - <help>Cache polling interval</help> - <valueHelp> - <format>u32:1-86400</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-86400"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="retry-interval"> - <properties> - <help>Retry interval to connect to the cache server</help> - <valueHelp> - <format>u32:1-7200</format> - <description>Interval in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-7200"/> - </constraint> - </properties> - <defaultValue>600</defaultValue> - </leafNode> + #include <include/rpki/protocol-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/protocols_segment-routing.xml.in b/interface-definitions/protocols_segment-routing.xml.in index 688b253b6..cab1e6945 100644 --- a/interface-definitions/protocols_segment-routing.xml.in +++ b/interface-definitions/protocols_segment-routing.xml.in @@ -4,13 +4,13 @@ <children> <node name="segment-routing" owner="${vyos_conf_scripts_dir}/protocols_segment-routing.py"> <properties> - <help>Segment Routing</help> + <help>Segment-Routing (SR) parameters</help> <priority>900</priority> </properties> <children> <tagNode name="interface"> <properties> - <help>Interface specific Segment Routing options</help> + <help>Interface specific Segment-Routing options</help> <completionHelp> <script>${vyos_completion_dir}/list_interfaces</script> </completionHelp> @@ -61,9 +61,17 @@ <help>Segment-Routing SRv6 configuration</help> </properties> <children> + <node name="encapsulation"> + <properties> + <help>Segment Routing SRv6 encapsulation</help> + </properties> + <children> + #include <include/source-address-ipv6.xml.i> + </children> + </node> <tagNode name="locator"> <properties> - <help>Segment Routing SRv6 locator</help> + <help>Segment-Routing SRv6 locators configuration</help> <constraint> #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> </constraint> @@ -149,6 +157,206 @@ </tagNode> </children> </node> + <node name="traffic-engineering"> + <properties> + <help>SR Traffic Engineering (TE) configuration</help> + </properties> + <children> + <node name="database-import-protocol"> + <properties> + <help>Traffic Engineering Database (TED) IGP import protocol</help> + </properties> + <children> + <leafNode name="isis"> + <properties> + <help>IS-IS originated Traffic Engineering (TE) database</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="ospf"> + <properties> + <help>OSPF originated Traffic Engineering (TE) database</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + <tagNode name="segment-list"> + <properties> + <help>Segment List</help> + <valueHelp> + <format>txt</format> + <description>Segment List Name</description> + </valueHelp> + <constraint> + #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i> + </constraint> + </properties> + <children> + <tagNode name="index"> + <properties> + <help>Traffic engineering index value for segment list</help> + <valueHelp> + <format>u32</format> + <description>Segment list index value</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + <children> + <node name="mpls"> + <properties> + <help>MPLS label for index</help> + </properties> + <children> + <leafNode name="label"> + <properties> + <help>MPLS label value for index</help> + <valueHelp> + <format>u32:16-1048575</format> + <description>MPLS label value for index</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 16-1048575"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="nai"> + <properties> + <help>Node or Adjacency identifier (NAI) for index</help> + </properties> + <children> + <node name="adjacency"> + <properties> + <help>Adjacency identifier for index</help> + </properties> + <children> + <node name="ipv4"> + <properties> + <help>IPv4 address</help> + </properties> + <children> + <leafNode name="source-identifier"> + <properties> + <help>Adjacency source address identifier for index</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="destination-identifier"> + <properties> + <help>Adjacency destination address identifier for index</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 adjacency destination address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 address</help> + </properties> + <children> + <leafNode name="source-identifier"> + <properties> + <help>Adjacency source address identifier for index</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="destination-identifier"> + <properties> + <help>Adjacency destination address identifier for index</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 adjacency destination address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + </children> + </node> + <node name="prefix"> + <properties> + <help>IGP prefix identifier for index</help> + </properties> + <children> + <node name="ipv4"> + <properties> + <help>IPv4 address</help> + </properties> + <children> + <tagNode name="prefix-identifier"> + <properties> + <help>IPv4 IGP prefix address identifier for index</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + <children> + #include <include/segment-routing/algorithm.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 address</help> + </properties> + <children> + <tagNode name="prefix-identifier"> + <properties> + <help>IPv6 IGP prefix address identifier for index</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 adjacency source address identifier</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + <children> + #include <include/segment-routing/algorithm.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </tagNode> + </children> + </tagNode> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/protocols_traffic_engineering.xml.in b/interface-definitions/protocols_traffic_engineering.xml.in new file mode 100644 index 000000000..32e1793b1 --- /dev/null +++ b/interface-definitions/protocols_traffic_engineering.xml.in @@ -0,0 +1,108 @@ +<?xml version="1.0" encoding="utf-8"?> +<interfaceDefinition> + <node name="protocols"> + <children> + <node name="traffic-engineering" owner="${vyos_conf_scripts_dir}/protocols_traffic_engineering.py"> + <properties> + <help>Traffic Engineering link parameters</help> + <priority>605</priority> + </properties> + <children> + <tagNode name="admin-group"> + <properties> + <help>Configure administrative groups that can be used in interface configuration</help> + <valueHelp> + <format>txt</format> + <description>Administrative group name</description> + </valueHelp> + <constraint> + <regex>[-a-zA-Z0-9]+</regex> + </constraint> + <constraintErrorMessage>Administrative group must be alphanumeric and can contain hyphens</constraintErrorMessage> + </properties> + <children> + <leafNode name="bit-position"> + <properties> + <help>Specify bit position of the admin group</help> + <valueHelp> + <format>u8:0-31</format> + <description>Admin group bit position</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-31"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Traffic engineering parameters for interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface to configure name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + <children> + <leafNode name="metric"> + <properties> + <help>TE metric</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>TE Metric (different from the OSPF or ISIS metric)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-bandwidth"> + <properties> + <help>Maximum bandwidth (interface speed by default)</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum bandwidth in Mbits/sec</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="max-reservable-bandwidth"> + <properties> + <help>Maximum reservable bandwidth</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Maximum reservable bandwidth in Mbits/sec</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="admin-group"> + <properties> + <help>Admin groups of interface</help> + <valueHelp> + <format>txt</format> + <description>Admin group of interface</description> + </valueHelp> + <completionHelp> + <path>protocols traffic-engineering admin-group</path> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/qos.xml.in b/interface-definitions/qos.xml.in index c6ecb742e..aad1de629 100644 --- a/interface-definitions/qos.xml.in +++ b/interface-definitions/qos.xml.in @@ -135,6 +135,25 @@ <valueless/> </properties> </leafNode> + <leafNode name="no-split-gso"> + <properties> + <help>Do not split GSO super-packets into on-the-wire components</help> + <valueless/> + </properties> + </leafNode> + <node name="ack-filter"> + <properties> + <help>Identify and filter out TCP ACK packets that do not convey significant new information</help> + </properties> + <children> + <leafNode name="aggressive"> + <properties> + <help>Enable aggressive mode which will result in more ACK packets being compresses/filtered</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <leafNode name="rtt"> <properties> <help>Round-Trip-Time for Active Queue Management (AQM)</help> diff --git a/interface-definitions/service_config-sync.xml.in b/interface-definitions/service_config-sync.xml.in index af4e8ed51..1b9ff30bc 100644 --- a/interface-definitions/service_config-sync.xml.in +++ b/interface-definitions/service_config-sync.xml.in @@ -337,7 +337,7 @@ </leafNode> <leafNode name="segment-routing"> <properties> - <help>Segment Routing</help> + <help>Segment-Routing (SR) parameters</help> <valueless/> </properties> </leafNode> @@ -476,6 +476,12 @@ <valueless/> </properties> </leafNode> + <leafNode name="login"> + <properties> + <help>System User Login</help> + <valueless/> + </properties> + </leafNode> <leafNode name="option"> <properties> <help>System Options</help> diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 631c830b4..4f5ccbf96 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -178,6 +178,19 @@ </properties> <defaultValue>1</defaultValue> </leafNode> + <leafNode name="purge-timeout"> + <properties> + <help>Timeout for purging synchronized entries on handover events</help> + <valueHelp> + <format>u32:1-2147483647</format> + <description>Purge timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-2147483647"/> + </constraint> + </properties> + <defaultValue>60</defaultValue> + </leafNode> </children> </node> </children> diff --git a/interface-definitions/service_dhcp-server.xml.in b/interface-definitions/service_dhcp-server.xml.in index 9a194de4f..4d1172e03 100644 --- a/interface-definitions/service_dhcp-server.xml.in +++ b/interface-definitions/service_dhcp-server.xml.in @@ -9,229 +9,7 @@ <priority>911</priority> </properties> <children> - #include <include/generic-disable-node.xml.i> - <leafNode name="dynamic-dns-update"> - <properties> - <help>Dynamically update Domain Name System (RFC4702)</help> - <valueless/> - </properties> - </leafNode> - <node name="high-availability"> - <properties> - <help>DHCP high availability configuration</help> - </properties> - <children> - #include <include/source-address-ipv4.xml.i> - <leafNode name="mode"> - <properties> - <help>Configure high availability mode</help> - <completionHelp> - <list>active-active active-passive</list> - </completionHelp> - <valueHelp> - <format>active-active</format> - <description>Both server attend DHCP requests</description> - </valueHelp> - <valueHelp> - <format>active-passive</format> - <description>Only primary server attends DHCP requests</description> - </valueHelp> - <constraint> - <regex>(active-active|active-passive)</regex> - </constraint> - <constraintErrorMessage>Invalid DHCP high availability mode</constraintErrorMessage> - </properties> - <defaultValue>active-active</defaultValue> - </leafNode> - <leafNode name="remote"> - <properties> - <help>IPv4 remote address used for connection</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 address of high availability peer</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="name"> - <properties> - <help>Peer name used to identify connection</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid failover peer name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="status"> - <properties> - <help>High availability hierarchy</help> - <completionHelp> - <list>primary secondary</list> - </completionHelp> - <valueHelp> - <format>primary</format> - <description>Configure this server to be the primary node</description> - </valueHelp> - <valueHelp> - <format>secondary</format> - <description>Configure this server to be the secondary node</description> - </valueHelp> - <constraint> - <regex>(primary|secondary)</regex> - </constraint> - <constraintErrorMessage>Invalid DHCP high availability peer status</constraintErrorMessage> - </properties> - </leafNode> - #include <include/pki/ca-certificate.xml.i> - #include <include/pki/certificate.xml.i> - </children> - </node> - <leafNode name="hostfile-update"> - <properties> - <help>Updating /etc/hosts file (per client lease)</help> - <valueless/> - </properties> - </leafNode> - #include <include/listen-address-ipv4.xml.i> - #include <include/listen-interface-multi-broadcast.xml.i> - <tagNode name="shared-network-name"> - <properties> - <help>Name of DHCP shared network</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - <children> - <leafNode name="authoritative"> - <properties> - <help>Option to make DHCP server authoritative for this physical network</help> - <valueless/> - </properties> - </leafNode> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - <tagNode name="subnet"> - <properties> - <help>DHCP subnet for shared network</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - </constraint> - <constraintErrorMessage>Invalid IPv4 subnet definition</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - <leafNode name="exclude"> - <properties> - <help>IP address to exclude from DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 address to exclude from lease range</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="ignore-client-id"> - <properties> - <help>Ignore client identifier for lease lookups</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="lease"> - <properties> - <help>Lease timeout in seconds</help> - <valueHelp> - <format>u32</format> - <description>DHCP lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> - <constraintErrorMessage>DHCP lease time must be between 0 and 4294967295 (49 days)</constraintErrorMessage> - </properties> - <defaultValue>86400</defaultValue> - </leafNode> - <tagNode name="range"> - <properties> - <help>DHCP lease range</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - <leafNode name="start"> - <properties> - <help>First IP address for DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 start address of pool</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="stop"> - <properties> - <help>Last IP address for DHCP lease range</help> - <valueHelp> - <format>ipv4</format> - <description>IPv4 end address of pool</description> - </valueHelp> - <constraint> - <validator name="ipv4-address"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <tagNode name="static-mapping"> - <properties> - <help>Hostname for static mapping reservation</help> - <constraint> - <validator name="fqdn"/> - </constraint> - <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v4.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-disable-node.xml.i> - #include <include/ip-address.xml.i> - #include <include/interface/mac.xml.i> - #include <include/interface/duid.xml.i> - </children> - </tagNode> - <leafNode name="subnet-id"> - <properties> - <help>Unique ID mapped to leases in the lease file</help> - <valueHelp> - <format>u32</format> - <description>Unique subnet ID</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/dhcp/dhcp-server-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/service_dhcpv6-server.xml.in b/interface-definitions/service_dhcpv6-server.xml.in index a6763a345..d2b96061d 100644 --- a/interface-definitions/service_dhcpv6-server.xml.in +++ b/interface-definitions/service_dhcpv6-server.xml.in @@ -8,280 +8,7 @@ <priority>900</priority> </properties> <children> - #include <include/generic-disable-node.xml.i> - #include <include/listen-interface-multi-broadcast.xml.i> - <leafNode name="disable-route-autoinstall"> - <properties> - <help>Do not install routes for delegated prefixes</help> - <valueless/> - </properties> - </leafNode> - <node name="global-parameters"> - <properties> - <help>Additional global parameters for DHCPv6 server</help> - </properties> - <children> - #include <include/name-server-ipv6.xml.i> - </children> - </node> - <leafNode name="preference"> - <properties> - <help>Preference of this DHCPv6 server compared with others</help> - <valueHelp> - <format>u32:0-255</format> - <description>DHCPv6 server preference (0-255)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-255"/> - </constraint> - <constraintErrorMessage>Preference must be between 0 and 255</constraintErrorMessage> - </properties> - </leafNode> - <tagNode name="shared-network-name"> - <properties> - <help>DHCPv6 shared network name</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage> - </properties> - <children> - #include <include/generic-disable-node.xml.i> - #include <include/generic-description.xml.i> - #include <include/generic-interface.xml.i> - #include <include/dhcp/option-v6.xml.i> - <tagNode name="subnet"> - <properties> - <help>IPv6 DHCP subnet for this shared network</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - #include <include/generic-interface.xml.i> - <tagNode name="range"> - <properties> - <help>Parameters setting ranges for assigning IPv6 addresses</help> - <constraint> - #include <include/constraint/alpha-numeric-hyphen-underscore-dot.xml.i> - </constraint> - <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - <leafNode name="prefix"> - <properties> - <help>IPv6 prefix defining range of addresses to assign</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 address and prefix length</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - </leafNode> - <leafNode name="start"> - <properties> - <help>First in range of consecutive IPv6 addresses to assign</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="stop"> - <properties> - <help>Last in range of consecutive IPv6 addresses</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <node name="lease-time"> - <properties> - <help>Parameters relating to the lease time</help> - </properties> - <children> - <leafNode name="default"> - <properties> - <help>Default time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>DHCPv6 valid lifetime</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - <leafNode name="maximum"> - <properties> - <help>Maximum time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>Maximum lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - <leafNode name="minimum"> - <properties> - <help>Minimum time (in seconds) that will be assigned to a lease</help> - <valueHelp> - <format>u32:1-4294967295</format> - <description>Minimum lease time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </node> - <node name="prefix-delegation"> - <properties> - <help>Parameters relating to IPv6 prefix delegation</help> - </properties> - <children> - <tagNode name="prefix"> - <properties> - <help>IPv6 prefix to be used in prefix delegation</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 prefix used in prefix delegation</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - <children> - <leafNode name="prefix-length"> - <properties> - <help>Length in bits of prefix</help> - <valueHelp> - <format>u32:32-64</format> - <description>Prefix length (32-64)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 32-64"/> - </constraint> - <constraintErrorMessage>Prefix length must be between 32 and 64</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="delegated-length"> - <properties> - <help>Length in bits of prefixes to be delegated</help> - <valueHelp> - <format>u32:32-64</format> - <description>Delegated prefix length (32-64)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 32-96"/> - </constraint> - <constraintErrorMessage>Delegated prefix length must be between 32 and 96</constraintErrorMessage> - </properties> - </leafNode> - <leafNode name="excluded-prefix"> - <properties> - <help>IPv6 prefix to be excluded from prefix delegation</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 prefix excluded from prefix delegation</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="excluded-prefix-length"> - <properties> - <help>Length in bits of excluded prefix</help> - <valueHelp> - <format>u32:33-64</format> - <description>Excluded prefix length (33-128)</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 33-128"/> - </constraint> - <constraintErrorMessage>Prefix length must be between 33 and 128</constraintErrorMessage> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </node> - <tagNode name="static-mapping"> - <properties> - <help>Hostname for static mapping reservation</help> - <constraint> - <validator name="fqdn"/> - </constraint> - <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage> - </properties> - <children> - #include <include/dhcp/option-v6.xml.i> - #include <include/generic-disable-node.xml.i> - #include <include/interface/mac.xml.i> - #include <include/interface/duid.xml.i> - <leafNode name="ipv6-address"> - <properties> - <help>Client IPv6 address for this static mapping</help> - <valueHelp> - <format>ipv6</format> - <description>IPv6 address for this static mapping</description> - </valueHelp> - <constraint> - <validator name="ipv6-address"/> - </constraint> - </properties> - </leafNode> - <leafNode name="ipv6-prefix"> - <properties> - <help>Client IPv6 prefix for this static mapping</help> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 prefix for this static mapping</description> - </valueHelp> - <constraint> - <validator name="ipv6-prefix"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - <leafNode name="subnet-id"> - <properties> - <help>Unique ID mapped to leases in the lease file</help> - <valueHelp> - <format>u32</format> - <description>Unique subnet ID</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967295"/> - </constraint> - </properties> - </leafNode> - </children> - </tagNode> - </children> - </tagNode> + #include <include/dhcp/dhcpv6-server-common-config.xml.i> </children> </node> </children> diff --git a/interface-definitions/service_dns_dynamic.xml.in b/interface-definitions/service_dns_dynamic.xml.in index 75e5520b7..99103ec73 100644 --- a/interface-definitions/service_dns_dynamic.xml.in +++ b/interface-definitions/service_dns_dynamic.xml.in @@ -52,10 +52,10 @@ #include <include/url-http-https.xml.i> <leafNode name="skip"> <properties> - <help>Pattern to skip from the HTTP(S) respose</help> + <help>Pattern to skip from the HTTP(S) response</help> <valueHelp> <format>txt</format> - <description>Pattern to skip from the HTTP(S) respose to extract the external IP address</description> + <description>Pattern to skip from the HTTP(S) response to extract the external IP address</description> </valueHelp> </properties> </leafNode> diff --git a/interface-definitions/service_ids_ddos-protection.xml.in b/interface-definitions/service_ids_ddos-protection.xml.in deleted file mode 100644 index 3ef2640b3..000000000 --- a/interface-definitions/service_ids_ddos-protection.xml.in +++ /dev/null @@ -1,167 +0,0 @@ -<?xml version="1.0"?> -<interfaceDefinition> - <node name="service"> - <children> - <node name="ids"> - <properties> - <help>Intrusion Detection System</help> - </properties> - <children> - <node name="ddos-protection" owner="${vyos_conf_scripts_dir}/service_ids_ddos-protection.py"> - <properties> - <help>FastNetMon detection and protection parameters</help> - <priority>731</priority> - </properties> - <children> - <leafNode name="alert-script"> - <properties> - <help>Path to fastnetmon alert script</help> - </properties> - </leafNode> - <leafNode name="ban-time"> - <properties> - <help>How long we should keep an IP in blocked state</help> - <valueHelp> - <format>u32:1-4294967294</format> - <description>Time in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 1-4294967294"/> - </constraint> - </properties> - <defaultValue>1900</defaultValue> - </leafNode> - <leafNode name="direction"> - <properties> - <help>Direction for processing traffic</help> - <completionHelp> - <list>in out</list> - </completionHelp> - <constraint> - <regex>(in|out)</regex> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="excluded-network"> - <properties> - <help>Specify IPv4 and IPv6 networks which are going to be excluded from protection</help> - <valueHelp> - <format>ipv4net</format> - <description>IPv4 prefix(es) to exclude</description> - </valueHelp> - <valueHelp> - <format>ipv6net</format> - <description>IPv6 prefix(es) to exclude</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - <validator name="ipv6-prefix"/> - </constraint> - <multi/> - </properties> - </leafNode> - <leafNode name="listen-interface"> - <properties> - <help>Listen interface for mirroring traffic</help> - <completionHelp> - <script>${vyos_completion_dir}/list_interfaces</script> - </completionHelp> - <multi/> - </properties> - </leafNode> - <leafNode name="mode"> - <properties> - <help>Traffic capture mode</help> - <completionHelp> - <list>mirror sflow</list> - </completionHelp> - <valueHelp> - <format>mirror</format> - <description>Listen to mirrored traffic</description> - </valueHelp> - <valueHelp> - <format>sflow</format> - <description>Capture sFlow flows</description> - </valueHelp> - <constraint> - <regex>(mirror|sflow)</regex> - </constraint> - </properties> - </leafNode> - <node name="sflow"> - <properties> - <help>Sflow settings</help> - </properties> - <children> - #include <include/listen-address-ipv4-single.xml.i> - #include <include/port-number.xml.i> - <leafNode name="port"> - <defaultValue>6343</defaultValue> - </leafNode> - </children> - </node> - <leafNode name="network"> - <properties> - <help>Specify IPv4 and IPv6 networks which belong to you</help> - <valueHelp> - <format>ipv4net</format> - <description>Your IPv4 prefix(es)</description> - </valueHelp> - <valueHelp> - <format>ipv6net</format> - <description>Your IPv6 prefix(es)</description> - </valueHelp> - <constraint> - <validator name="ipv4-prefix"/> - <validator name="ipv6-prefix"/> - </constraint> - <multi/> - </properties> - </leafNode> - <node name="threshold"> - <properties> - <help>Attack limits thresholds</help> - </properties> - <children> - <node name="general"> - <properties> - <help>General threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="tcp"> - <properties> - <help>TCP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="udp"> - <properties> - <help>UDP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - <node name="icmp"> - <properties> - <help>ICMP threshold</help> - </properties> - <children> - #include <include/ids/threshold.xml.i> - </children> - </node> - </children> - </node> - </children> - </node> - </children> - </node> - </children> - </node> -</interfaceDefinition> diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index fe9d32bbd..27b163001 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -233,10 +233,12 @@ #include <include/accel-ppp/default-ipv6-pool.xml.i> #include <include/accel-ppp/extended-scripts.xml.i> #include <include/accel-ppp/gateway-address-multi.xml.i> + #include <include/accel-ppp/idle-timeout.xml.i> #include <include/accel-ppp/limits.xml.i> #include <include/accel-ppp/max-concurrent-sessions.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> #include <include/accel-ppp/log.xml.i> diff --git a/interface-definitions/service_lldp.xml.in b/interface-definitions/service_lldp.xml.in index a189cc13b..63ccc1776 100644 --- a/interface-definitions/service_lldp.xml.in +++ b/interface-definitions/service_lldp.xml.in @@ -142,7 +142,7 @@ <properties> <help>ECS ELIN (Emergency location identifier number)</help> <valueHelp> - <format>u32:0-9999999999</format> + <format>u64:0-9999999999</format> <description>Emergency Call Service ELIN number (between 10-25 numbers)</description> </valueHelp> <constraint> diff --git a/interface-definitions/service_monitoring_telegraf.xml.in b/interface-definitions/service_monitoring_telegraf.xml.in index 2ac0d940e..1ea2a23dd 100644 --- a/interface-definitions/service_monitoring_telegraf.xml.in +++ b/interface-definitions/service_monitoring_telegraf.xml.in @@ -124,7 +124,7 @@ </valueHelp> <valueHelp> <format>table-per-metric</format> - <description>One table per gorups of metric by the metric name</description> + <description>One table per groups of metric by the metric name</description> </valueHelp> <constraint> <regex>(single-table|table-per-metric)</regex> diff --git a/interface-definitions/service_ntp.xml.in b/interface-definitions/service_ntp.xml.in index c31b572bd..ebce1bbf4 100644 --- a/interface-definitions/service_ntp.xml.in +++ b/interface-definitions/service_ntp.xml.in @@ -109,6 +109,18 @@ </properties> <defaultValue>timezone</defaultValue> </leafNode> + <leafNode name="local-stratum"> + <properties> + <help>Local reference stratum</help> + <valueHelp> + <format>u32:1-15</format> + <description>Local reference stratum</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-15"/> + </constraint> + </properties> + </leafNode> <tagNode name="server"> <properties> <help>Network Time Protocol (NTP) server</help> diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in index 32215e9d2..81a4a95e3 100644 --- a/interface-definitions/service_pppoe-server.xml.in +++ b/interface-definitions/service_pppoe-server.xml.in @@ -175,6 +175,7 @@ </node> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/service_router-advert.xml.in b/interface-definitions/service_router-advert.xml.in index 3fd33540a..31ed503d5 100644 --- a/interface-definitions/service_router-advert.xml.in +++ b/interface-definitions/service_router-advert.xml.in @@ -16,6 +16,7 @@ </completionHelp> </properties> <children> + #include <include/dhcp/captive-portal.xml.i> <leafNode name="hop-limit"> <properties> <help>Set Hop Count field of the IP header for outgoing packets</help> @@ -48,7 +49,7 @@ <constraint> <validator name="numeric" argument="--range 0-0 --range 4-9000"/> </constraint> - <constraintErrorMessage>Default router livetime bust be 0 or between 4 and 9000</constraintErrorMessage> + <constraintErrorMessage>Default router lifetime must be 0 or between 4 and 9000</constraintErrorMessage> </properties> </leafNode> <leafNode name="default-preference"> @@ -84,7 +85,7 @@ </leafNode> <leafNode name="link-mtu"> <properties> - <help>Link MTU value placed in RAs, exluded in RAs if unset</help> + <help>Link MTU value placed in RAs, excluded in RAs if unset</help> <valueHelp> <format>u32:1280-9000</format> <description>Link MTU value in RAs</description> @@ -255,6 +256,19 @@ </leafNode> </children> </tagNode> + <leafNode name="auto-ignore"> + <properties> + <help>IPv6 prefix to be excluded in Router Advertisements (RAs) - use in conjunction with the ::/64 wildcard prefix</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix to be excluded</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> <tagNode name="prefix"> <properties> <help>IPv6 prefix to be advertised in Router Advertisements (RAs)</help> @@ -291,6 +305,21 @@ <valueless/> </properties> </leafNode> + <leafNode name="base-interface"> + <properties> + <help>Prefix will be combined with IPv6 address of specified interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + </properties> + </leafNode> <leafNode name="preferred-lifetime"> <properties> <help>Time in seconds that the prefix will remain preferred</help> diff --git a/interface-definitions/service_snmp.xml.in b/interface-definitions/service_snmp.xml.in index cc21f5b8b..be4c2f6cc 100644 --- a/interface-definitions/service_snmp.xml.in +++ b/interface-definitions/service_snmp.xml.in @@ -13,9 +13,9 @@ <properties> <help>Community name</help> <constraint> - <regex>[[:alnum:]-_!@*#]{1,100}</regex> + <regex>[[:alnum:]\-_!@*#]{1,100}</regex> </constraint> - <constraintErrorMessage>Community string is limited to alphanumerical characters, -, _, !, @, *, and # with a total lenght of 100</constraintErrorMessage> + <constraintErrorMessage>Community string is limited to alphanumerical characters, -, _, !, @, *, and # with a total length of 100</constraintErrorMessage> </properties> <children> <leafNode name="authorization"> diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in index 14d358c78..7a1348404 100644 --- a/interface-definitions/service_ssh.xml.in +++ b/interface-definitions/service_ssh.xml.in @@ -36,15 +36,15 @@ </node> </children> </node> - <leafNode name="ciphers"> + <leafNode name="cipher"> <properties> <help>Allowed ciphers</help> <completionHelp> <!-- generated by ssh -Q cipher | tr '\n' ' ' as this will not change dynamically --> - <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> + <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> </completionHelp> <constraint> - <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|rijndael-cbc@lysator.liu.se|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> + <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> </constraint> <multi/> </properties> @@ -61,6 +61,25 @@ <valueless/> </properties> </leafNode> + <node name="fido"> + <properties> + <help>FIDO2 SSH options</help> + </properties> + <children> + <leafNode name="pin-required"> + <properties> + <help>Require FIDO2 keys to attest that a user has been verified (e.g. via a PIN)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="touch-required"> + <properties> + <help>Require FIDO2 keys to attest that a user is physically present</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <node name="dynamic-protection"> <properties> <help>Allow dynamic protection</help> @@ -275,14 +294,18 @@ </constraint> </properties> </leafNode> - <node name="trusted-user-ca-key"> + <leafNode name="trusted-user-ca"> <properties> - <help>Trusted user CA key</help> + <help>OpenSSH trusted user CA</help> + <completionHelp> + <path>pki openssh</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>OpenSSH certificate name from PKI subsystem</description> + </valueHelp> </properties> - <children> - #include <include/pki/ca-certificate.xml.i> - </children> - </node> + </leafNode> #include <include/vrf-multi.xml.i> </children> </node> diff --git a/interface-definitions/system_config-management.xml.in b/interface-definitions/system_config-management.xml.in index a23d44aea..319611266 100644 --- a/interface-definitions/system_config-management.xml.in +++ b/interface-definitions/system_config-management.xml.in @@ -52,6 +52,7 @@ </properties> </leafNode> #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/vrf.xml.i> </children> </node> <leafNode name="commit-revisions"> diff --git a/interface-definitions/system_conntrack.xml.in b/interface-definitions/system_conntrack.xml.in index 54610b625..733a4a4b8 100644 --- a/interface-definitions/system_conntrack.xml.in +++ b/interface-definitions/system_conntrack.xml.in @@ -32,14 +32,14 @@ <properties> <help>Hash size for connection tracking table</help> <valueHelp> - <format>u32:1-50000000</format> + <format>u32:1024-50000000</format> <description>Size of hash to use for connection tracking table</description> </valueHelp> <constraint> - <validator name="numeric" argument="--range 1-50000000"/> + <validator name="numeric" argument="--range 1024-50000000"/> </constraint> </properties> - <defaultValue>32768</defaultValue> + <defaultValue>65536</defaultValue> </leafNode> <node name="ignore"> <properties> @@ -84,7 +84,6 @@ </completionHelp> </properties> </leafNode> - #include <include/ip-protocol.xml.i> <leafNode name="protocol"> <properties> <help>Protocol to match (protocol name, number, or "all")</help> @@ -170,7 +169,6 @@ </completionHelp> </properties> </leafNode> - #include <include/ip-protocol.xml.i> <leafNode name="protocol"> <properties> <help>Protocol to match (protocol name, number, or "all")</help> diff --git a/interface-definitions/system_console.xml.in b/interface-definitions/system_console.xml.in index 5acd3e90b..8ae98291e 100644 --- a/interface-definitions/system_console.xml.in +++ b/interface-definitions/system_console.xml.in @@ -12,12 +12,16 @@ <properties> <help>Serial console device name</help> <completionHelp> - <script>ls -1 /dev | grep -e ttyS -e hvc</script> + <script>ls -1 /dev | grep -e ttyS -e ttyAMA -e hvc</script> <script>if [ -d /dev/serial/by-bus ]; then ls -1 /dev/serial/by-bus; fi</script> </completionHelp> <valueHelp> <format>ttySN</format> - <description>TTY device name, regular serial port</description> + <description>TTY device name, ttyS based</description> + </valueHelp> + <valueHelp> + <format>ttyAMAN</format> + <description>TTY device name, ttyAMA based</description> </valueHelp> <valueHelp> <format>usbNbXpY</format> @@ -28,10 +32,16 @@ <description>Xen console</description> </valueHelp> <constraint> - <regex>(ttyS[0-9]+|hvc[0-9]+|usb[0-9]+b.*)</regex> + <regex>(ttyS[0-9]+|ttyAMA[0-9]+|hvc[0-9]+|usb[0-9]+b.*)</regex> </constraint> </properties> <children> + <leafNode name="kernel"> + <properties> + <help>Use the console as an output for kernel messages</help> + <valueless/> + </properties> + </leafNode> <leafNode name="speed"> <properties> <help>Console baud rate</help> diff --git a/interface-definitions/system_flow-accounting.xml.in b/interface-definitions/system_flow-accounting.xml.in index 4799205ad..53436036e 100644 --- a/interface-definitions/system_flow-accounting.xml.in +++ b/interface-definitions/system_flow-accounting.xml.in @@ -9,153 +9,18 @@ <priority>990</priority> </properties> <children> - <leafNode name="buffer-size"> - <properties> - <help>Buffer size</help> - <valueHelp> - <format>u32</format> - <description>Buffer size in MiB</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-4294967295"/> - </constraint> - </properties> - <defaultValue>10</defaultValue> - </leafNode> - <leafNode name="packet-length"> - <properties> - <help>Specifies the maximum number of bytes to capture for each packet</help> - <valueHelp> - <format>u32:128-750</format> - <description>Packet length in bytes</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 128-750"/> - </constraint> - </properties> - <defaultValue>128</defaultValue> - </leafNode> <leafNode name="enable-egress"> <properties> <help>Enable egress flow accounting</help> <valueless/> </properties> </leafNode> - <leafNode name="disable-imt"> - <properties> - <help>Disable in memory table plugin</help> - <valueless/> - </properties> - </leafNode> - <leafNode name="syslog-facility"> - <properties> - <help>Syslog facility for flow-accounting</help> - <completionHelp> - <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list> - </completionHelp> - <valueHelp> - <format>auth</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>authpriv</format> - <description>Non-system authorization</description> - </valueHelp> - <valueHelp> - <format>cron</format> - <description>Cron daemon</description> - </valueHelp> - <valueHelp> - <format>daemon</format> - <description>System daemons</description> - </valueHelp> - <valueHelp> - <format>kern</format> - <description>Kernel</description> - </valueHelp> - <valueHelp> - <format>lpr</format> - <description>Line printer spooler</description> - </valueHelp> - <valueHelp> - <format>mail</format> - <description>Mail subsystem</description> - </valueHelp> - <valueHelp> - <format>mark</format> - <description>Timestamp</description> - </valueHelp> - <valueHelp> - <format>news</format> - <description>USENET subsystem</description> - </valueHelp> - <valueHelp> - <format>protocols</format> - <description>Routing protocols (local7)</description> - </valueHelp> - <valueHelp> - <format>security</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>syslog</format> - <description>Authentication and authorization</description> - </valueHelp> - <valueHelp> - <format>user</format> - <description>Application processes</description> - </valueHelp> - <valueHelp> - <format>uucp</format> - <description>UUCP subsystem</description> - </valueHelp> - <valueHelp> - <format>local0</format> - <description>Local facility 0</description> - </valueHelp> - <valueHelp> - <format>local1</format> - <description>Local facility 1</description> - </valueHelp> - <valueHelp> - <format>local2</format> - <description>Local facility 2</description> - </valueHelp> - <valueHelp> - <format>local3</format> - <description>Local facility 3</description> - </valueHelp> - <valueHelp> - <format>local4</format> - <description>Local facility 4</description> - </valueHelp> - <valueHelp> - <format>local5</format> - <description>Local facility 5</description> - </valueHelp> - <valueHelp> - <format>local6</format> - <description>Local facility 6</description> - </valueHelp> - <valueHelp> - <format>local7</format> - <description>Local facility 7</description> - </valueHelp> - <valueHelp> - <format>all</format> - <description>Authentication and authorization</description> - </valueHelp> - <constraint> - <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex> - </constraint> - </properties> - </leafNode> - #include <include/generic-interface-multi.xml.i> <node name="netflow"> <properties> <help>NetFlow settings</help> </properties> <children> + #include <include/generic-interface-multi.xml.i> <leafNode name="engine-id"> <properties> <help>NetFlow engine-id</help> @@ -196,7 +61,6 @@ </constraint> </properties> </leafNode> - #include <include/source-address-ipv4-ipv6.xml.i> <leafNode name="version"> <properties> <help>NetFlow version to export</help> @@ -247,119 +111,36 @@ </properties> <defaultValue>2055</defaultValue> </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/source-interface.xml.i> </children> </tagNode> - <node name="timeout"> + <leafNode name="inactive-timeout"> <properties> - <help>NetFlow timeout values</help> + <help>Flow inactivity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Inactive flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> </properties> - <children> - <leafNode name="expiry-interval"> - <properties> - <help>Expiry scan interval</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Expiry scan interval</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>60</defaultValue> - </leafNode> - <leafNode name="flow-generic"> - <properties> - <help>Generic flow timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Generic flow timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>3600</defaultValue> - </leafNode> - <leafNode name="icmp"> - <properties> - <help>ICMP timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>ICMP timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="max-active-life"> - <properties> - <help>Max active timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>Max active timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>604800</defaultValue> - </leafNode> - <leafNode name="tcp-fin"> - <properties> - <help>TCP finish timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP FIN timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - <leafNode name="tcp-generic"> - <properties> - <help>TCP generic timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP generic timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>3600</defaultValue> - </leafNode> - <leafNode name="tcp-rst"> - <properties> - <help>TCP reset timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>TCP RST timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>120</defaultValue> - </leafNode> - <leafNode name="udp"> - <properties> - <help>UDP timeout value</help> - <valueHelp> - <format>u32:0-2147483647</format> - <description>UDP timeout in seconds</description> - </valueHelp> - <constraint> - <validator name="numeric" argument="--range 0-2147483647"/> - </constraint> - </properties> - <defaultValue>300</defaultValue> - </leafNode> - </children> - </node> + <defaultValue>15</defaultValue> + </leafNode> + <leafNode name="active-timeout"> + <properties> + <help>Flow activity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Active flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + <defaultValue>1800</defaultValue> + </leafNode> </children> </node> #include <include/interface/vrf.xml.i> diff --git a/interface-definitions/system_frr.xml.in b/interface-definitions/system_frr.xml.in index 28242dfe4..28b6b93e5 100644 --- a/interface-definitions/system_frr.xml.in +++ b/interface-definitions/system_frr.xml.in @@ -35,6 +35,40 @@ <valueless/> </properties> </leafNode> + <leafNode name="watchfrr-timeout"> + <properties> + <help>Set watchfrr daemon timeout</help> + <valueHelp> + <format>u32:60-600</format> + <description>Timeout in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-600"/> + </constraint> + <constraintErrorMessage>Timeout must be in range 60 to 600 seconds</constraintErrorMessage> + </properties> + <defaultValue>90</defaultValue> + </leafNode> + <leafNode name="profile"> + <properties> + <help>Select configuration profile to adapt different defaults</help> + <completionHelp> + <list>traditional datacenter</list> + </completionHelp> + <valueHelp> + <format>traditional</format> + <description>Adhere mostly to IETF standards or common practices in wide-area internet routing</description> + </valueHelp> + <valueHelp> + <format>datacenter</format> + <description>Single administrative domain using aggressive timers</description> + </valueHelp> + <constraint> + <regex>(datacenter|traditional)</regex> + </constraint> + </properties> + <defaultValue>traditional</defaultValue> + </leafNode> <node name="snmp"> <properties> <help>Enable SNMP integration for next daemons</help> diff --git a/interface-definitions/system_ip.xml.in b/interface-definitions/system_ip.xml.in index b4b5092fe..df9ffa24b 100644 --- a/interface-definitions/system_ip.xml.in +++ b/interface-definitions/system_ip.xml.in @@ -5,7 +5,7 @@ <node name="ip" owner="${vyos_conf_scripts_dir}/system_ip.py"> <properties> <help>IPv4 Settings</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>290</priority> </properties> <children> @@ -17,6 +17,22 @@ #include <include/arp-ndp-table-size.xml.i> </children> </node> + <tagNode name="import-table"> + <properties> + <help>Routing table for import</help> + <valueHelp> + <format>u32:1-252</format> + <description>Table number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-252"/> + </constraint> + </properties> + <children> + #include <include/static/static-route-distance.xml.i> + #include <include/route-map.xml.i> + </children> + </tagNode> <leafNode name="disable-forwarding"> <properties> <help>Disable IPv4 forwarding on all interfaces</help> diff --git a/interface-definitions/system_ipv6.xml.in b/interface-definitions/system_ipv6.xml.in index dda00af38..6181152f1 100644 --- a/interface-definitions/system_ipv6.xml.in +++ b/interface-definitions/system_ipv6.xml.in @@ -5,7 +5,7 @@ <node name="ipv6" owner="${vyos_conf_scripts_dir}/system_ipv6.py"> <properties> <help>IPv6 Settings</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>290</priority> </properties> <children> diff --git a/interface-definitions/system_lcd.xml.in b/interface-definitions/system_lcd.xml.in index 0cf4de308..cb9664a0f 100644 --- a/interface-definitions/system_lcd.xml.in +++ b/interface-definitions/system_lcd.xml.in @@ -12,7 +12,7 @@ <properties> <help>Model of the display attached to this system</help> <completionHelp> - <list>cfa-533 cfa-631 cfa-633 cfa-635 hd44780 sdec</list> + <list>cfa-533 cfa-631 cfa-633 cfa-635 hd44780 sdec mtc-s16209x</list> </completionHelp> <valueHelp> <format>cfa-533</format> @@ -32,14 +32,18 @@ </valueHelp> <valueHelp> <format>hd44780</format> - <description>Hitachi HD44780, Caswell Appliances</description> + <description>Hitachi HD44780, Caswell Appliances, Sophos XG appliances</description> </valueHelp> <valueHelp> <format>sdec</format> <description>Lanner, Watchguard, Nexcom NSA, Sophos UTM appliances</description> </valueHelp> + <valueHelp> + <format>mtc-s16209x</format> + <description>Microtips Technology S16209x, Sophos SG appliances</description> + </valueHelp> <constraint> - <regex>(cfa-533|cfa-631|cfa-633|cfa-635|hd44780|sdec)</regex> + <regex>(cfa-533|cfa-631|cfa-633|cfa-635|hd44780|sdec|mtc-s16209x)</regex> </constraint> </properties> </leafNode> diff --git a/interface-definitions/system_login.xml.in b/interface-definitions/system_login.xml.in index 9865e3d32..889ee5b98 100644 --- a/interface-definitions/system_login.xml.in +++ b/interface-definitions/system_login.xml.in @@ -8,6 +8,38 @@ <priority>400</priority> </properties> <children> + <tagNode name="operator-group"> + <properties> + <help>Operator group</help> + <constraint> + #include <include/constraint/login-username.xml.i> + </constraint> + <constraintErrorMessage>Operator group name contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage> + </properties> + <children> + <node name="command-policy"> + <properties> + <help>Command policy</help> + </properties> + <children> + <leafNode name="allow"> + <properties> + <multi/> + <help>Command subtree allowed to execute</help> + <valueHelp> + <format>txt</format> + <description>Exact command (e.g., 'show interfaces')</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Command wildcard (e.g., '* vpn')</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> <tagNode name="user"> <properties> <help>Local user account information</help> @@ -17,6 +49,26 @@ <constraintErrorMessage>Username contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage> </properties> <children> + <node name="operator"> + <properties> + <help>Restrict the user to operational mode</help> + </properties> + <children> + <leafNode name="group"> + <properties> + <multi/> + <help>Operator group</help> + <completionHelp> + <path>system login operator-group</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Operator group name</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> <node name="authentication"> <properties> <help>Authentication settings</help> @@ -31,6 +83,7 @@ <regex>\$1\$[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{22}</regex> <regex>\$5\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{43}</regex> <regex>\$6\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{86}</regex> + <regex>\$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{0,86}\$[./A-Za-z0-9]{43}</regex> </constraint> <constraintErrorMessage>Invalid encrypted password for $VAR(../../@).</constraintErrorMessage> </properties> @@ -103,6 +156,15 @@ <help>Plaintext password used for encryption</help> </properties> </leafNode> + <leafNode name="principal"> + <properties> + <help>Accepted principal names for certificate authentication</help> + <constraint> + #include <include/constraint/login-username.xml.i> + </constraint> + <multi/> + </properties> + </leafNode> <tagNode name="public-keys"> <properties> <help>Remote access public keys</help> diff --git a/interface-definitions/system_option.xml.in b/interface-definitions/system_option.xml.in index 638ac1a3d..4f9103e56 100644 --- a/interface-definitions/system_option.xml.in +++ b/interface-definitions/system_option.xml.in @@ -32,12 +32,193 @@ <constraintErrorMessage>Must be ignore, reboot, or poweroff</constraintErrorMessage> </properties> </leafNode> + <node name="resource-limits"> + <properties> + <help>Resource limits</help> + </properties> + <children> + <leafNode name="max-map-count"> + <properties> + <help>Maximum number of memory map areas a process may have</help> + <valueHelp> + <format>u32:65530-2147483647</format> + <description>Areas count</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate areas count based on number of hugepages</description> + </valueHelp> + <constraint> + <regex>(auto)</regex> + <validator name="numeric" argument="--range 65530-2147483647"/> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + <leafNode name="shmmax"> + <properties> + <help>Maximum shared memory segment size that can be created</help> + <valueHelp> + <format>u64:8589934592-18446744073709551615</format> + <description>Size in bytes</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate shared memory based on number of hugepages</description> + </valueHelp> + <constraint> + <regex>(auto)</regex> + <validator name="numeric" argument="--range 8589934592-18446744073709551615"/> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + </children> + </node> <node name="kernel"> <properties> <help>Kernel boot parameters</help> </properties> <children> - <leafNode name="disable-mitigations"> + <node name="cpu"> + <properties> + <help>CPU settings</help> + </properties> + <children> + <leafNode name="disable-nmi-watchdog"> + <properties> + <help>Disable the NMI watchdog for detecting hard CPU lockups</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="isolate-cpus"> + <properties> + <help>Isolate specified CPUs from the scheduler</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + <leafNode name="nohz-full"> + <properties> + <help>Enable full tickless mode for specified CPUs</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + <leafNode name="rcu-no-cbs"> + <properties> + <help>Offload Read-Copy-Update (RCU) callback processing to specified CPUs</help> + <valueHelp> + <format>u32:0-511</format> + <description>CPU core</description> + </valueHelp> + <valueHelp> + <format><start-end></format> + <description>CPU core range (examples: "1", "4-7", "1,2-5,7")</description> + </valueHelp> + <constraint> + <validator name="cpu"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="memory"> + <properties> + <help>Memory settings</help> + </properties> + <children> + <leafNode name="disable-numa-balancing"> + <properties> + <help>Disable automatic NUMA memory balancing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="default-hugepage-size"> + <properties> + <help>Set default hugepage size (e.g., 2M, 1G)</help> + <completionHelp> + <list>2M 1G</list> + </completionHelp> + <valueHelp> + <format>2M</format> + <description>2 megabytes</description> + </valueHelp> + <valueHelp> + <format>1G</format> + <description>1 gigabyte</description> + </valueHelp> + <constraint> + <regex>(2M|1G)</regex> + </constraint> + </properties> + </leafNode> + <tagNode name="hugepage-size"> + <properties> + <help>Set hugepage size for allocation (e.g., 2M, 1G)</help> + <completionHelp> + <list>2M 1G</list> + </completionHelp> + <valueHelp> + <format>2M</format> + <description>2 megabytes</description> + </valueHelp> + <valueHelp> + <format>1G</format> + <description>1 gigabyte</description> + </valueHelp> + <constraint> + <regex>(2M|1G)</regex> + </constraint> + </properties> + <children> + <leafNode name="hugepage-count"> + <properties> + <help>Allocate number of hugepages for system use</help> + <valueHelp> + <format>u32</format> + <description>Number of hugepages</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-100000"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + <leafNode name="disable-hpet"> + <properties> + <help>Disable High Precision Event Timer (HPET)</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-mce"> + <properties> + <help>Disable Machine Check Exceptions (MCE) reporting and handling</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="disable-mitigations"> <properties> <help>Disable all optional CPU mitigations</help> <valueless/> @@ -69,6 +250,18 @@ </valueHelp> </properties> </leafNode> + <leafNode name="disable-softlockup"> + <properties> + <help>Disable soft lockup detector for kernel threads</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="quiet"> + <properties> + <help>Disable most log messages</help> + <valueless/> + </properties> + </leafNode> <node name="debug"> <properties> <help>Dynamic debugging for kernel module</help> @@ -192,6 +385,19 @@ <valueless/> </properties> </leafNode> + <leafNode name="reboot-on-upgrade-failure"> + <properties> + <help>Automatic reboot into previous running image on upgrade failure</help> + <valueHelp> + <format>u32:1-30</format> + <description>Timeout before automatic reboot (minutes)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 5-30"/> + </constraint> + <constraintErrorMessage>Timeout out of range, must be 5 to 30 minutes</constraintErrorMessage> + </properties> + </leafNode> <node name="ssh-client"> <properties> <help>Global options used for SSH client</help> @@ -209,7 +415,7 @@ </leafNode> <leafNode name="root-partition-auto-resize"> <properties> - <help>Enable root partition auto-extention on system boot</help> + <help>Enable root partition auto-extension on system boot</help> <valueless/> </properties> </leafNode> diff --git a/interface-definitions/system_sflow.xml.in b/interface-definitions/system_sflow.xml.in index 2cd7a5d12..a77d6cf00 100644 --- a/interface-definitions/system_sflow.xml.in +++ b/interface-definitions/system_sflow.xml.in @@ -106,6 +106,12 @@ </leafNode> </children> </tagNode> + <leafNode name="vpp"> + <properties> + <help>Enable VPP sampling</help> + <valueless/> + </properties> + </leafNode> <leafNode name="enable-egress"> <properties> <help>Enable egress sampling</help> diff --git a/interface-definitions/system_static-host-mapping.xml.in b/interface-definitions/system_static-host-mapping.xml.in index 492741f11..2e72b97ec 100644 --- a/interface-definitions/system_static-host-mapping.xml.in +++ b/interface-definitions/system_static-host-mapping.xml.in @@ -23,7 +23,7 @@ <constraint> <regex>.{1,63}</regex> </constraint> - <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 charactes</constraintErrorMessage> + <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 characters</constraintErrorMessage> <multi /> </properties> </leafNode> diff --git a/interface-definitions/system_syslog.xml.in b/interface-definitions/system_syslog.xml.in index 116cbde73..221b4320f 100644 --- a/interface-definitions/system_syslog.xml.in +++ b/interface-definitions/system_syslog.xml.in @@ -65,6 +65,55 @@ #include <include/protocol-tcp-udp.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/vrf.xml.i> + <node name="tls"> + <properties> + <help>Transport Layer Security (TLS) options for secure syslog</help> + </properties> + <children> + <!-- CA cert help should describe trust anchor for server/client validation --> + #include <include/pki/ca-certificate.xml.i> + <!-- Certificate help should specify identity for mutual authentication --> + #include <include/pki/certificate.xml.i> + <leafNode name="auth-mode"> + <properties> + <help>Specify the authentication and verification method for the remote peer's certificate during the TLS handshake</help> + <completionHelp> + <list>anon fingerprint certvalid name</list> + </completionHelp> + <valueHelp> + <format>anon</format> + <description>Allow encrypted connection without verifying the peer's identity (anonymous TLS)</description> + </valueHelp> + <valueHelp> + <format>fingerprint</format> + <description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peer` option)</description> + </valueHelp> + <valueHelp> + <format>certvalid</format> + <description>Authenticate peer if it presents a certificate signed by a trusted CA</description> + </valueHelp> + <valueHelp> + <format>name</format> + <description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peer` option)</description> + </valueHelp> + <constraint> + <regex>(anon|fingerprint|certvalid|name)</regex> + </constraint> + </properties> + <defaultValue>anon</defaultValue> + </leafNode> + <leafNode name="permitted-peer"> + <properties> + <help>Allowed peer certificate fingerprint or subject name</help> + <valueHelp> + <format>txt</format> + <description>Peer fingerprint - SHA1:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX or subject name - logs.example.com</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <node name="local"> diff --git a/interface-definitions/system_watchdog.xml.in b/interface-definitions/system_watchdog.xml.in new file mode 100644 index 000000000..c651bc652 --- /dev/null +++ b/interface-definitions/system_watchdog.xml.in @@ -0,0 +1,70 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="system"> + <children> + <node name="watchdog" owner="${vyos_conf_scripts_dir}/system_watchdog.py"> + <properties> + <help>Hardware watchdog configuration</help> + <priority>9999</priority> + </properties> + <children> + <leafNode name="module"> + <properties> + <help>Kernel module to load for watchdog device (optional)</help> + <valueHelp> + <format>txt</format> + <description>Module name (e.g. 'softdog', 'iTCO_wdt', 'sp5100_tco')</description> + </valueHelp> + <constraint> + <validator name="watchdog-module"/> + </constraint> + <constraintErrorMessage>Module must be an available watchdog kernel driver module</constraintErrorMessage> + </properties> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Watchdog timeout for runtime in seconds (1-65535)</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Timeout must be between 1 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>10</defaultValue> + </leafNode> + <leafNode name="shutdown-timeout"> + <properties> + <help>Watchdog timeout during shutdown in seconds (60-65535)</help> + <valueHelp> + <format>u32:60-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-65535"/> + </constraint> + <constraintErrorMessage>Shutdown timeout must be between 60 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + <leafNode name="reboot-timeout"> + <properties> + <help>Watchdog timeout during reboot in seconds (60-65535)</help> + <valueHelp> + <format>u32:60-65535</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-65535"/> + </constraint> + <constraintErrorMessage>Reboot timeout must be between 60 and 65535 seconds</constraintErrorMessage> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/system_wireless.xml.in b/interface-definitions/system_wireless.xml.in index 834f8b624..2b7ed68d0 100644 --- a/interface-definitions/system_wireless.xml.in +++ b/interface-definitions/system_wireless.xml.in @@ -5,7 +5,7 @@ <node name="wireless" owner="${vyos_conf_scripts_dir}/system_wireless.py"> <properties> <help>Wireless (IEEE-802.11) subsystem settings</help> - <!-- must be before interface wireless, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before interface wireless, check /usr/libexec/vyos/priority.py --> <priority>317</priority> </properties> <children> diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index 0cf526fad..ee8340a74 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -45,10 +45,48 @@ <properties> <help>Secret type</help> <completionHelp> - <list>base64 plaintext</list> + <list>base64 hex plaintext</list> </completionHelp> <constraint> - <regex>(base64|plaintext)</regex> + <regex>(base64|hex|plaintext)</regex> + </constraint> + </properties> + <defaultValue>plaintext</defaultValue> + </leafNode> + </children> + </tagNode> + <tagNode name="ppk"> + <properties> + <help>Post-quantum preshared key name</help> + </properties> + <children> + <leafNode name="id"> + <properties> + <help>ID for PPK</help> + <valueHelp> + <format>txt</format> + <description>ID used for PPK</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="secret"> + <properties> + <help>Post-quantum preshared secret key</help> + <valueHelp> + <format>txt</format> + <description>Post-quantum preshared secret key</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="secret-type"> + <properties> + <help>Secret type</help> + <completionHelp> + <list>base64 hex plaintext</list> + </completionHelp> + <constraint> + <regex>(base64|hex|plaintext)</regex> </constraint> </properties> <defaultValue>plaintext</defaultValue> @@ -91,7 +129,7 @@ <properties> <help>Security Association byte count to expire</help> <valueHelp> - <format>u32:1024-26843545600000</format> + <format>u64:1024-26843545600000</format> <description>SA life in bytes</description> </valueHelp> <constraint> @@ -103,7 +141,7 @@ <properties> <help>Security Association packet count to expire</help> <valueHelp> - <format>u32:1000-26843545600000</format> + <format>u64:1000-26843545600000</format> <description>SA life in packets</description> </valueHelp> <constraint> @@ -589,7 +627,7 @@ <validator name="numeric" argument="--range 0-2"/> </constraint> </properties> - <defaultValue>0</defaultValue> + <defaultValue>1</defaultValue> </leafNode> <leafNode name="subsystem"> <properties> @@ -701,6 +739,52 @@ <valueless/> </properties> </leafNode> + <node name="retransmission"> + <properties> + <help>IPsec retransmission settings</help> + </properties> + <children> + <leafNode name="attempts"> + <properties> + <help>Maximum number of retransmissions</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Maximum number of retransmissions</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + </properties> + <defaultValue>5</defaultValue> + </leafNode> + <leafNode name="base"> + <properties> + <help>Base of exponential backoff</help> + <valueHelp> + <format><1.0-5.0></format> + <description>Base of exponential backoff</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-5 --float"/> + </constraint> + </properties> + <defaultValue>1.8</defaultValue> + </leafNode> + <leafNode name="timeout"> + <properties> + <help>Timeout in seconds before the first retransmission</help> + <valueHelp> + <format>u32:1-1000</format> + <description>Timeout in seconds before the first retransmission</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-1000"/> + </constraint> + </properties> + <defaultValue>4</defaultValue> + </leafNode> + </children> + </node> </children> </node> <tagNode name="profile"> @@ -824,6 +908,12 @@ <defaultValue>eap-mschapv2</defaultValue> </leafNode> #include <include/auth-local-users.xml.i> + <leafNode name="always-send-cert"> + <properties> + <help>Always send local certificate for this connection</help> + <valueless/> + </properties> + </leafNode> <leafNode name="server-mode"> <properties> <help>Server authentication mode</help> @@ -844,9 +934,11 @@ </properties> <defaultValue>x509</defaultValue> </leafNode> + #include <include/ipsec/ppk.xml.i> #include <include/ipsec/authentication-pre-shared-secret.xml.i> </children> </node> + #include <include/ipsec/childless.xml.i> #include <include/generic-description.xml.i> #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> @@ -1061,6 +1153,7 @@ </properties> <children> #include <include/ipsec/authentication-id.xml.i> + #include <include/ipsec/ppk.xml.i> #include <include/ipsec/authentication-rsa.xml.i> #include <include/ipsec/authentication-x509.xml.i> <leafNode name="mode"> @@ -1104,32 +1197,33 @@ </leafNode> </children> </node> + #include <include/ipsec/childless.xml.i> <leafNode name="connection-type"> <properties> <help>Connection type</help> <completionHelp> - <list>initiate respond none</list> + <list>initiate trap none</list> </completionHelp> <valueHelp> <format>initiate</format> <description>Bring the connection up immediately</description> </valueHelp> <valueHelp> - <format>respond</format> - <description>Wait for the peer to initiate the connection</description> + <format>trap</format> + <description>Bring the connection up only when matching traffic is detected</description> </valueHelp> <valueHelp> <format>none</format> <description>Load the connection only</description> </valueHelp> <constraint> - <regex>(initiate|respond|none)</regex> + <regex>(initiate|trap|none)</regex> </constraint> </properties> </leafNode> <leafNode name="default-esp-group"> <properties> - <help>Defult ESP group name</help> + <help>Default ESP group name</help> <completionHelp> <path>vpn ipsec esp-group</path> </completionHelp> @@ -1152,11 +1246,11 @@ </completionHelp> <valueHelp> <format>yes</format> - <description>Enable remote host re-autentication during an IKE re-key. Currently broken due to a strong swan bug</description> + <description>Enable remote host re-authentication during an IKE re-key</description> </valueHelp> <valueHelp> <format>no</format> - <description>Disable remote host re-authenticaton during an IKE re-key.</description> + <description>Disable remote host re-authentication during an IKE re-key.</description> </valueHelp> <valueHelp> <format>inherit</format> @@ -1182,6 +1276,13 @@ #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> #include <include/ipsec/local-traffic-selector.xml.i> + <node name="local"> + <children> + <leafNode name="prefix"> + <defaultValue>dynamic</defaultValue> + </leafNode> + </children> + </node> #include <include/ip-protocol.xml.i> <leafNode name="priority"> <properties> @@ -1218,6 +1319,7 @@ </constraint> <multi/> </properties> + <defaultValue>dynamic</defaultValue> </leafNode> </children> </node> @@ -1244,6 +1346,63 @@ <children> #include <include/ipsec/bind.xml.i> #include <include/ipsec/esp-group.xml.i> + <node name="traffic-selector"> + <properties> + <help>Traffic-selectors parameters</help> + </properties> + <children> + <node name="local"> + <properties> + <help>Local parameters for interesting traffic</help> + </properties> + <children> + <leafNode name="prefix"> + <properties> + <help>Local IPv4 or IPv6 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>Local IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>Local IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + <node name="remote"> + <properties> + <help>Remote parameters for interesting traffic</help> + </properties> + <children> + <leafNode name="prefix"> + <properties> + <help>Remote IPv4 or IPv6 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>Remote IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>Remote IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in index c00e82534..d28f86653 100644 --- a/interface-definitions/vpn_l2tp.xml.in +++ b/interface-definitions/vpn_l2tp.xml.in @@ -137,6 +137,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpn_openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in index a2f040b2f..e9280cd12 100644 --- a/interface-definitions/vpn_openconnect.xml.in +++ b/interface-definitions/vpn_openconnect.xml.in @@ -65,10 +65,41 @@ </leafNode> <leafNode name="radius"> <properties> - <help>Use RADIUS server for user autentication</help> + <help>Use RADIUS server for user authentication</help> <valueless/> </properties> </leafNode> + <node name="certificate"> + <properties> + <help>Use certificate-based authentication</help> + </properties> + <children> + <leafNode name="user-identifier-field"> + <properties> + <help>Certificate field to identify users by</help> + <valueHelp> + <format>cn</format> + <description>OID 2.5.4.3 - Common Name</description> + </valueHelp> + <valueHelp> + <format>uid</format> + <description>OID 0.9.2342.19200300.100.1.1 - UID</description> + </valueHelp> + <valueHelp> + <format>x.x.xx.xxx</format> + <description>Custom OID in dotted decimal format</description> + </valueHelp> + <constraint> + <regex>(^\d{1,5}(?:\.\d{1,5})*$|cn|uid)</regex> + </constraint> + <constraintErrorMessage>Invalid OID selection. Must be cn, uid, or a valid OID format.</constraintErrorMessage> + <completionHelp> + <list>cn uid x.x.xx.xxx</list> + </completionHelp> + </properties> + </leafNode> + </children> + </node> </children> </node> <node name="identity-based-config"> @@ -216,7 +247,7 @@ #include <include/radius-timeout.xml.i> <leafNode name="groupconfig"> <properties> - <help>If the groupconfig option is set, then config-per-user will be overriden, and all configuration will be read from RADIUS.</help> + <help>If the groupconfig option is set, then config-per-user will be overridden, and all configuration will be read from RADIUS.</help> </properties> </leafNode> </children> @@ -389,6 +420,37 @@ </leafNode> </children> </node> + <node name="script"> + <properties> + <help>Execute script on client connect/disconnect</help> + </properties> + <children> + <leafNode name="connect"> + <properties> + <help>Script to execute upon client connecting</help> + <valueHelp> + <format>filename</format> + <description>Client connect script, must be under /config/scripts</description> + </valueHelp> + <constraint> + <validator name="file-path" argument="--file --parent-dir /config/scripts --strict"/> + </constraint> + </properties> + </leafNode> + <leafNode name="disconnect"> + <properties> + <help>Script to execute upon client disconnecting</help> + <valueHelp> + <format>filename</format> + <description>Client disconnect script, must be under /config/scripts</description> + </valueHelp> + <constraint> + <validator name="file-path" argument="--file --parent-dir /config/scripts --strict"/> + </constraint> + </properties> + </leafNode> + </children> + </node> </children> </node> </children> diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in index 8aec0cb1c..3e985486d 100644 --- a/interface-definitions/vpn_pptp.xml.in +++ b/interface-definitions/vpn_pptp.xml.in @@ -53,6 +53,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpn_sstp.xml.in b/interface-definitions/vpn_sstp.xml.in index 5fd5c95ca..851a202dc 100644 --- a/interface-definitions/vpn_sstp.xml.in +++ b/interface-definitions/vpn_sstp.xml.in @@ -50,6 +50,7 @@ #include <include/accel-ppp/ppp-options.xml.i> #include <include/accel-ppp/shaper.xml.i> #include <include/accel-ppp/snmp.xml.i> + #include <include/accel-ppp/thread-count.xml.i> #include <include/accel-ppp/wins-server.xml.i> #include <include/generic-description.xml.i> #include <include/name-server-ipv4-ipv6.xml.i> diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in new file mode 100644 index 000000000..bf5e56db8 --- /dev/null +++ b/interface-definitions/vpp.xml.in @@ -0,0 +1,1255 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="vpp" owner="${vyos_conf_scripts_dir}/vpp.py"> + <properties> + <help>Accelerated data-plane</help> + <priority>295</priority> + </properties> + <children> + <node name="ipfix" owner="${vyos_conf_scripts_dir}/vpp_ipfix.py"> + <properties> + <help>IP Flow Information Export (IPFIX) configuration</help> + <priority>332</priority> + </properties> + <children> + <tagNode name="collector"> + <properties> + <help>Collector IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 server to export IPFIX</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 server to export IPFIX</description> + </valueHelp> + <constraint> + <validator name="ip-address"/> + </constraint> + </properties> + <children> + #include <include/port-number.xml.i> + <leafNode name="port"> + <defaultValue>4739</defaultValue> + </leafNode> + <leafNode name="path-mtu"> + <properties> + <help>Path MTU</help> + <valueHelp> + <format>u32:68-1450</format> + <description>Bytes</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 68-1450"/> + </constraint> + </properties> + <defaultValue>512</defaultValue> + </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + <leafNode name="template-interval"> + <properties> + <help>Interval in seconds</help> + <valueHelp> + <format>u32:1-300</format> + <description>Seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-300"/> + </constraint> + </properties> + <defaultValue>20</defaultValue> + </leafNode> + <leafNode name="udp-checksum"> + <properties> + <help>Allow UDP checksum</help> + <valueless/> + </properties> + </leafNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + </properties> + <children> + <leafNode name="direction"> + <properties> + <help>Flow direction</help> + <completionHelp> + <list>rx tx both</list> + </completionHelp> + <valueHelp> + <format>rx</format> + <description>Rx direction</description> + </valueHelp> + <valueHelp> + <format>tx</format> + <description>Tx direction</description> + </valueHelp> + <valueHelp> + <format>both</format> + <description>Rx and Tx direction</description> + </valueHelp> + <constraint> + <regex>(rx|tx|both)</regex> + </constraint> + </properties> + <defaultValue>both</defaultValue> + </leafNode> + <leafNode name="flow-variant"> + <properties> + <help>Flow variant</help> + <completionHelp> + <list>l2 ipv4 ipv6</list> + </completionHelp> + <valueHelp> + <format>l2</format> + <description>L2</description> + </valueHelp> + <valueHelp> + <format>_ipv4</format> + <description>IPv4</description> + </valueHelp> + <valueHelp> + <format>_ipv6</format> + <description>IPv6</description> + </valueHelp> + <constraint> + <regex>(l2|ipv4|ipv6)</regex> + </constraint> + </properties> + <defaultValue>ipv4</defaultValue> + </leafNode> + </children> + </tagNode> + <leafNode name="active-timeout"> + <properties> + <help>Flow activity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Active flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + <defaultValue>15</defaultValue> + </leafNode> + <leafNode name="inactive-timeout"> + <properties> + <help>Flow inactivity timeout</help> + <valueHelp> + <format>u32:0-2147483647</format> + <description>Inactive flow export timeout (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-2147483647"/> + </constraint> + </properties> + <defaultValue>120</defaultValue> + </leafNode> + <leafNode name="flowprobe-record"> + <properties> + <help>Flow record layers</help> + <completionHelp> + <list>l2 l3 l4</list> + </completionHelp> + <valueHelp> + <format>l2</format> + <description>Include level 2 information</description> + </valueHelp> + <valueHelp> + <format>l3</format> + <description>Include level 3 information</description> + </valueHelp> + <valueHelp> + <format>l4</format> + <description>Include level 4 information</description> + </valueHelp> + <constraint> + <regex>(l2|l3|l4)</regex> + </constraint> + <multi/> + </properties> + <defaultValue>l3</defaultValue> + </leafNode> + </children> + </node> + <node name="settings"> + <properties> + <help>VPP settings</help> + </properties> + <children> + <node name="resource-allocation"> + <properties> + <help>Resource allocation settings</help> + </properties> + <children> + <leafNode name="cpu-cores"> + <properties> + <help>Create worker threads (including main-core)</help> + <valueHelp> + <format>u32:1-512</format> + <description>Worker threads</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-512"/> + </constraint> + </properties> + <defaultValue>1</defaultValue> + </leafNode> + <node name="buffers"> + <properties> + <help>Buffer settings</help> + </properties> + <children> + <leafNode name="buffers-per-numa"> + <properties> + <help>Number of buffers per numa node</help> + <completionHelp> + <list>auto</list> + </completionHelp> + <valueHelp> + <format>u32:16384-4294967295</format> + <description>Number of buffers</description> + </valueHelp> + <valueHelp> + <format>auto</format> + <description>Auto calculate number of buffers per numa node</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 16384-4294967295"/> + <regex>(auto)</regex> + </constraint> + </properties> + <defaultValue>auto</defaultValue> + </leafNode> + <leafNode name="data-size"> + <properties> + <help>Size of buffer data area</help> + <valueHelp> + <format>u32</format> + <description>Size of buffer data area</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + <defaultValue>2048</defaultValue> + </leafNode> + <leafNode name="page-size"> + <properties> + <help>Set the page-size for buffer allocation</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + </children> + </node> + <node name="ipv6"> + <properties> + <help>IPv6 settings</help> + </properties> + <children> + <leafNode name="heap-size"> + <properties> + <help>IPv6 heap size</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>32M</defaultValue> + </leafNode> + <leafNode name="hash-buckets"> + <properties> + <help>IPv6 forwarding table hash buckets</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>IPv6 forwarding table hash buckets</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + <defaultValue>65536</defaultValue> + </leafNode> + </children> + </node> + <leafNode name="mac-limit"> + <properties> + <help>Number of MAC addresses in the L2 FIB</help> + <valueHelp> + <format>u32:1-4294967295</format> + <description>Number of MAC addresses in the L2 FIB</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + </properties> + <defaultValue>4194304</defaultValue> + </leafNode> + <node name="memory"> + <properties> + <help>Memory settings</help> + </properties> + <children> + <leafNode name="main-heap-size"> + <properties> + <help>Main heap size</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>3G</defaultValue> + </leafNode> + <leafNode name="main-heap-page-size"> + <properties> + <help>Main heap page size</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + <leafNode name="physmem-max-size"> + <properties> + <help>Memory size for protectable memory allocator (pmalloc) memory space</help> + #include <include/unformat_memory_size.xml.i> + </properties> + </leafNode> + <node name="stats"> + <properties> + <help>Stats settings</help> + </properties> + <children> + <leafNode name="size"> + <properties> + <help>Size of stats segment</help> + #include <include/unformat_memory_size.xml.i> + </properties> + <defaultValue>128M</defaultValue> + </leafNode> + <leafNode name="page-size"> + <properties> + <help>Stats page size</help> + #include <include/unformat_log2_page_size.xml.i> + </properties> + <defaultValue>2M</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> + </children> + </node> + <tagNode name="interface"> + <properties> + <help>Interface</help> + <valueHelp> + <format>ethN</format> + <description>Interface name</description> + </valueHelp> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --type ethernet</script> + </completionHelp> + <constraint> + <validator name="ethernet-interface"/> + </constraint> + <constraintErrorMessage>Invalid interface name</constraintErrorMessage> + </properties> + <children> + <leafNode name="num-rx-desc"> + <properties> + <help>Receive ring descriptors</help> + <valueHelp> + <format>u32:256-16384</format> + <description>Number of descriptors in receive ring</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 256-16384"/> + </constraint> + </properties> + <defaultValue>1024</defaultValue> + </leafNode> + <leafNode name="num-tx-desc"> + <properties> + <help>Tranceive ring descriptors</help> + <valueHelp> + <format>u32:256-8192</format> + <description>Number of descriptors in tranceive ring</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 256-8192"/> + </constraint> + </properties> + <defaultValue>1024</defaultValue> + </leafNode> + <leafNode name="num-rx-queues"> + <properties> + <help>Number of receive queues</help> + <valueHelp> + <format>u32:1-8192</format> + <description>Number of receive queues</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-8192"/> + </constraint> + </properties> + </leafNode> + <leafNode name="num-tx-queues"> + <properties> + <help>Number of tranceive queues</help> + <valueHelp> + <format>u32:1-8192</format> + <description>Number of tranceive queues</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-8192"/> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + <leafNode name="ipsec-acceleration"> + <properties> + <help>Enable IPsec acceleration</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="ignore-kernel-routes"> + <properties> + <help>Ignore kernel routes</help> + <valueless/> + </properties> + </leafNode> + <node name="logging"> + <properties> + <help>Logging settings</help> + </properties> + <children> + <leafNode name="default-level"> + <properties> + <help>Default logging level</help> + <completionHelp> + <list>alert crit debug disabled emerg error info notice warn</list> + </completionHelp> + <valueHelp> + <format>alert</format> + <description>Alert</description> + </valueHelp> + <valueHelp> + <format>crit</format> + <description>Critical</description> + </valueHelp> + <valueHelp> + <format>debug</format> + <description>Debug</description> + </valueHelp> + <valueHelp> + <format>disabled</format> + <description>Disabled</description> + </valueHelp> + <valueHelp> + <format>emerg</format> + <description>Emergency</description> + </valueHelp> + <valueHelp> + <format>error</format> + <description>Error</description> + </valueHelp> + <valueHelp> + <format>info</format> + <description>Informational</description> + </valueHelp> + <valueHelp> + <format>notice</format> + <description>Notice</description> + </valueHelp> + <valueHelp> + <format>warn</format> + <description>Warning</description> + </valueHelp> + <constraint> + <regex>(alert|crit|debug|disabled|emerg|error|info|notice|warn)</regex> + </constraint> + </properties> + </leafNode> + </children> + </node> + <leafNode name="poll-sleep-usec"> + <properties> + <help>Add a fixed-sleep between main loop poll</help> + <valueHelp> + <format>u32:0-500000</format> + <description>Sleep interval in microseconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-500000"/> + </constraint> + </properties> + <defaultValue>0</defaultValue> + </leafNode> + #include <include/vpp/iface_rx_mode.xml.i> + <leafNode name="allow-unsupported-nics"> + <properties> + <help>Allow the attachment of unsupported NICs to VPP. This operation voids official support for the system</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + <node name="sflow" owner="${vyos_conf_scripts_dir}/vpp_sflow.py"> + <properties> + <help>VPP data-plane sFlow</help> + <priority>322</priority> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="header-bytes"> + <properties> + <help>sFlow maximum packet-header length</help> + <completionHelp> + <list>64 96 128 160 192 224 256</list> + </completionHelp> + <valueHelp> + <format>64</format> + <description>64 bytes</description> + </valueHelp> + <valueHelp> + <format>96</format> + <description>96 bytes</description> + </valueHelp> + <valueHelp> + <format>128</format> + <description>128 bytes</description> + </valueHelp> + <valueHelp> + <format>160</format> + <description>160 bytes</description> + </valueHelp> + <valueHelp> + <format>192</format> + <description>192 bytes</description> + </valueHelp> + <valueHelp> + <format>224</format> + <description>224 bytes</description> + </valueHelp> + <valueHelp> + <format>256</format> + <description>256 bytes</description> + </valueHelp> + <constraint> + <regex>(64|96|128|160|192|224|256)</regex> + </constraint> + </properties> + <defaultValue>128</defaultValue> + </leafNode> + </children> + </node> + <node name="nat"> + <properties> + <help>Network Address Translation (NAT) settings</help> + </properties> + <children> + <node name="cgnat" owner="${vyos_conf_scripts_dir}/vpp_nat_cgnat.py"> + <properties> + <help>Carrier-grade NAT (CGNAT)</help> + <priority>331</priority> + </properties> + <children> + <node name="interface"> + <properties> + <help>CGNAT interface setting</help> + </properties> + <children> + <leafNode name="inside"> + <properties> + <help>CGNAT inside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="outside"> + <properties> + <help>CGNAT outside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + <tagNode name="rule"> + <properties> + <help>Rule number for CGNAT</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="inside-prefix"> + <properties> + <help>Inside IPv4 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + </leafNode> + <leafNode name="outside-prefix"> + <properties> + <help>Outside IPv4 prefix</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + </constraint> + </properties> + </leafNode> + #include <include/generic-description.xml.i> + </children> + </tagNode> + <node name="exclude"> + <properties> + <help>Exclude packets matching these rules from CGNAT</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="local-address"> + <properties> + <help>IP address of the internal (local) device</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="local-port"> + <properties> + <help>Port number used by connection on internal device</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage> + </properties> + </leafNode> + #include <include/vpp/nat_protocol.xml.i> + #include <include/generic-description.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="timeout"> + <properties> + <help>Timeouts for CGNAT sessions</help> + </properties> + <children> + <leafNode name="icmp"> + <properties> + <help>ICMP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 60)</description> + </valueHelp> + </properties> + <defaultValue>60</defaultValue> + </leafNode> + <leafNode name="tcp-established"> + <properties> + <help>TCP established timeout</help> + <valueHelp> + <format>u32</format> + <description>TCP established timeout in seconds (default: 7440)</description> + </valueHelp> + </properties> + <defaultValue>7440</defaultValue> + </leafNode> + <leafNode name="tcp-transitory"> + <properties> + <help>TCP transitory timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 240)</description> + </valueHelp> + </properties> + <defaultValue>240</defaultValue> + </leafNode> + <leafNode name="udp"> + <properties> + <help>UDP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 300)</description> + </valueHelp> + </properties> + <defaultValue>300</defaultValue> + </leafNode> + </children> + </node> + </children> + </node> + <node name="nat44" owner="${vyos_conf_scripts_dir}/vpp_nat_nat44.py"> + <properties> + <help>NAT44</help> + <priority>330</priority> + </properties> + <children> + <node name="timeout"> + <properties> + <help>NAT44 session timeouts</help> + </properties> + <children> + <leafNode name="icmp"> + <properties> + <help>ICMP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 60)</description> + </valueHelp> + </properties> + <defaultValue>60</defaultValue> + </leafNode> + <leafNode name="tcp-established"> + <properties> + <help>TCP established timeout</help> + <valueHelp> + <format>u32</format> + <description>TCP established timeout in seconds (default: 7440)</description> + </valueHelp> + </properties> + <defaultValue>7440</defaultValue> + </leafNode> + <leafNode name="tcp-transitory"> + <properties> + <help>TCP transitory timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 240)</description> + </valueHelp> + </properties> + <defaultValue>240</defaultValue> + </leafNode> + <leafNode name="udp"> + <properties> + <help>UDP timeout</help> + <valueHelp> + <format>u32</format> + <description>Timeout in seconds (default: 300)</description> + </valueHelp> + </properties> + <defaultValue>300</defaultValue> + </leafNode> + </children> + </node> + <leafNode name="session-limit"> + <properties> + <help>Maximum number of sessions per thread</help> + <valueHelp> + <format>u32</format> + <description>Number of sessions</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Number of sessions must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <defaultValue>64512</defaultValue> + </leafNode> + <node name="interface"> + <properties> + <help>NAT interface setting</help> + </properties> + <children> + <leafNode name="inside"> + <properties> + <help>NAT inside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + <leafNode name="outside"> + <properties> + <help>NAT outside interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + <node name="address-pool"> + <properties> + <help>NAT address pool</help> + </properties> + <children> + <node name="translation"> + <properties> + <help>NAT translation pool</help> + </properties> + <children> + #include <include/vpp/nat_address_range.xml.i> + #include <include/vpp/nat_interface.xml.i> + </children> + </node> + <node name="twice-nat"> + <properties> + <help>NAT twice-nat pool</help> + </properties> + <children> + #include <include/vpp/nat_address_range.xml.i> + #include <include/vpp/nat_interface.xml.i> + </children> + </node> + </children> + </node> + <node name="static"> + <properties> + <help>Static NAT rules</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number for NAT</help> + <valueHelp> + <format>u32</format> + <description>Number of NAT rule</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <node name="external"> + <properties> + <help>NAT external parameters</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + #include <include/port-number.xml.i> + </children> + </node> + <node name="local"> + <properties> + <help>NAT local parameters</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IP address</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + #include <include/port-number.xml.i> + </children> + </node> + <node name="options"> + <properties> + <help>NAT static mapping options</help> + </properties> + <children> + <leafNode name="twice-nat"> + <properties> + <help>Rewrite source IP addresses on packets sent from outside to inside</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="self-twice-nat"> + <properties> + <help>Rewrite source IP addresses on packets sent only from a local address to an external address</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="out-to-in-only"> + <properties> + <help>Only apply rule for traffic from outside to inside interfaces</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="twice-nat-address"> + <properties> + <help>Force use of specific IP address from twice-nat address pool</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + #include <include/vpp/nat_protocol.xml.i> + </children> + </tagNode> + </children> + </node> + <node name="exclude"> + <properties> + <help>Exclude packets matching these rules from NAT</help> + </properties> + <children> + <tagNode name="rule"> + <properties> + <help>Rule number</help> + <valueHelp> + <format>u32</format> + <description>Number of rule</description> + </valueHelp> + </properties> + <children> + <leafNode name="local-address"> + <properties> + <help>IP address of the internal (local) device</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="local-port"> + <properties> + <help>Port number used by connection on internal device</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-65535"/> + </constraint> + <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage> + </properties> + </leafNode> + #include <include/vpp/nat_protocol.xml.i> + <leafNode name="external-interface"> + <properties> + <help>External interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + </leafNode> + #include <include/generic-description.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> + </node> + <node name="acl" owner="${vyos_conf_scripts_dir}/vpp_acl.py"> + <properties> + <help>Access Control Lists (ACLs)</help> + <priority>332</priority> + </properties> + <children> + <node name="ip"> + <properties> + <help>Access Control List by IPv4/IPv6</help> + </properties> + <children> + <tagNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <valueHelp> + <format>txt</format> + <description>Tag name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <tagNode name="rule"> + <properties> + <help>Rule number for Access control element (ACE)</help> + <valueHelp> + <format>u32</format> + <description>Number of ACE</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + <leafNode name="action"> + <properties> + <help>Rule action</help> + <completionHelp> + <list>permit deny permit-reflect</list> + </completionHelp> + <valueHelp> + <format>permit</format> + <description>Permit matching traffic</description> + </valueHelp> + <valueHelp> + <format>deny</format> + <description>Deny matching traffic</description> + </valueHelp> + <valueHelp> + <format>permit-reflect</format> + <description>Permit the matching outbound traffic and allow the reverse traffic</description> + </valueHelp> + <constraint> + <regex>(permit|deny|permit-reflect)</regex> + </constraint> + </properties> + </leafNode> + <node name="source"> + <properties> + <help>Source parameters</help> + </properties> + <children> + #include <include/vpp/acl_prefix.xml.i> + #include <include/vpp/acl_port_range.xml.i> + </children> + </node> + <node name="destination"> + <properties> + <help>Destination parameters</help> + </properties> + <children> + #include <include/vpp/acl_prefix.xml.i> + #include <include/vpp/acl_port_range.xml.i> + </children> + </node> + <leafNode name="protocol"> + <properties> + <help>Protocol</help> + <completionHelp> + <script>${vyos_completion_dir}/list_protocols.sh</script> + <list>all</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All IP protocols</description> + </valueHelp> + <valueHelp> + <format><protocol></format> + <description>IP protocol name</description> + </valueHelp> + <constraint> + <validator name="ip-protocol"/> + </constraint> + </properties> + <defaultValue>all</defaultValue> + </leafNode> + <node name="tcp-flags"> + <properties> + <help>Match TCP packet flags</help> + </properties> + <children> + <leafNode name="is-set"> + <properties> + <help>Match TCP flags that are set</help> + #include <include/vpp/acl_tcp_flags.xml.i> + </properties> + </leafNode> + <leafNode name="is-not-set"> + <properties> + <help>Match TCP flags that are not set</help> + #include <include/vpp/acl_tcp_flags.xml.i> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Apply an ACL to an interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + <children> + <node name="input"> + <properties> + <help>Input direction</help> + </properties> + <children> + #include <include/vpp/acl_common_interface_ip_rule.xml.i> + </children> + </node> + <node name="output"> + <properties> + <help>Output direction</help> + </properties> + <children> + #include <include/vpp/acl_common_interface_ip_rule.xml.i> + </children> + </node> + </children> + </tagNode> + </children> + </node> + <node name="mac"> + <properties> + <help>Access Control List by mac address</help> + </properties> + <children> + <tagNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <valueHelp> + <format>txt</format> + <description>ACL name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <tagNode name="rule"> + <properties> + <help>Rule number for Access control element (ACE)</help> + <valueHelp> + <format>u32</format> + <description>Number of ACE</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967295"/> + </constraint> + <constraintErrorMessage>Rule number must be between 1 and 4294967295</constraintErrorMessage> + </properties> + <children> + #include <include/generic-description.xml.i> + <leafNode name="action"> + <properties> + <help>Rule action</help> + <completionHelp> + <list>permit deny</list> + </completionHelp> + <valueHelp> + <format>permit</format> + <description>Permit matching traffic</description> + </valueHelp> + <valueHelp> + <format>deny</format> + <description>Deny matching traffic</description> + </valueHelp> + <constraint> + <regex>(permit|deny)</regex> + </constraint> + </properties> + </leafNode> + #include <include/vpp/acl_prefix.xml.i> + <leafNode name="prefix"> + <properties> + <help>Source IP prefix</help> + </properties> + </leafNode> + <leafNode name="mac-address"> + <properties> + <help>Source MAC address</help> + <valueHelp> + <format>macaddr</format> + <description>MAC address</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="mac-mask"> + <properties> + <help>Source MAC mask (default ff:ff:ff:ff:ff:ff)</help> + <valueHelp> + <format>macaddr</format> + <description>MAC mask</description> + </valueHelp> + <constraint> + <validator name="mac-address"/> + </constraint> + </properties> + <defaultValue>ff:ff:ff:ff:ff:ff</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </tagNode> + <tagNode name="interface"> + <properties> + <help>Apply an ACL to an input interface</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces</script> + </completionHelp> + </properties> + <children> + <leafNode name="tag-name"> + <properties> + <help>ACL tag name</help> + <completionHelp> + <path>vpp acl mac tag-name</path> + </completionHelp> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> + </children> +</node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_bonding.xml.in b/interface-definitions/vpp_interface_bonding.xml.in new file mode 100644 index 000000000..78166e306 --- /dev/null +++ b/interface-definitions/vpp_interface_bonding.xml.in @@ -0,0 +1,121 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <properties> + <help>Network interfaces</help> + <priority>300</priority> + </properties> + <children> + <tagNode name="bonding" owner="${vyos_conf_scripts_dir}/vpp_interfaces_bonding.py"> + <properties> + <priority>324</priority> + <help>Bonding Interface/Link Aggregation</help> + <constraint> + <regex>vppbond[0-9]+</regex> + </constraint> + <constraintErrorMessage>Bonding interface must be named vppbondN</constraintErrorMessage> + <valueHelp> + <format>vppbondN</format> + <description>Bonding interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <leafNode name="hash-policy"> + <properties> + <help>Bonding transmit hash policy</help> + <completionHelp> + <list>layer2 layer2+3 layer3+4</list> + </completionHelp> + <valueHelp> + <format>layer2</format> + <description>use MAC addresses to generate the hash</description> + </valueHelp> + <valueHelp> + <format>layer2+3</format> + <description>combine MAC address and IP address to make hash</description> + </valueHelp> + <valueHelp> + <format>layer3+4</format> + <description>combine IP address and port to make hash</description> + </valueHelp> + <constraint> + <regex>(layer2\+3|layer3\+4|layer2)</regex> + </constraint> + <constraintErrorMessage>hash-policy must be layer2 layer2+3 layer3+4</constraintErrorMessage> + </properties> + <defaultValue>layer2</defaultValue> + </leafNode> + #include <include/interface/mac.xml.i> + <leafNode name="mode"> + <properties> + <help>Bonding mode</help> + <completionHelp> + <list>802.3ad active-backup broadcast round-robin xor-hash</list> + </completionHelp> + <valueHelp> + <format>802.3ad</format> + <description>IEEE 802.3ad Dynamic link aggregation</description> + </valueHelp> + <valueHelp> + <format>active-backup</format> + <description>Fault tolerant: only one slave in the bond is active</description> + </valueHelp> + <valueHelp> + <format>broadcast</format> + <description>Fault tolerant: transmits everything on all slave interfaces</description> + </valueHelp> + <valueHelp> + <format>round-robin</format> + <description>Load balance: transmit packets in sequential order</description> + </valueHelp> + <valueHelp> + <format>xor-hash</format> + <description>Distribute based on MAC address</description> + </valueHelp> + <constraint> + <regex>(802.3ad|active-backup|broadcast|round-robin|xor-hash)</regex> + </constraint> + <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, or xor-hash</constraintErrorMessage> + </properties> + <defaultValue>802.3ad</defaultValue> + </leafNode> + <node name="member"> + <properties> + <help>Bonding member interfaces</help> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bondable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <constraint> + #include <include/constraint/interface-name.xml.i> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1500</defaultValue> + </leafNode> + #include <include/vpp/vif.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_bridge.xml.in b/interface-definitions/vpp_interface_bridge.xml.in new file mode 100644 index 000000000..a918ec99b --- /dev/null +++ b/interface-definitions/vpp_interface_bridge.xml.in @@ -0,0 +1,56 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/vpp_interfaces_bridge.py"> + <properties> + <priority>327</priority> + <help>Bridge domain</help> + <constraint> + <!-- Bridge domain 0 is reserved to vpp default --> + <regex>vppbr(?!0$)[0-9]+</regex> + </constraint> + <constraintErrorMessage>Bridge domain must be named vppbrN and vppbr0 is reserved</constraintErrorMessage> + <valueHelp> + <format>vppbrN</format> + <description>Bridge interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + <node name="member"> + <properties> + <help>Bridge member interfaces</help> + </properties> + <children> + <tagNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bridgeable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + </properties> + <children> + <leafNode name="bvi"> + <properties> + <help>Bridge Virtual Interface (BVI)</help> + <valueless/> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_gre.xml.in b/interface-definitions/vpp_interface_gre.xml.in new file mode 100644 index 000000000..a0228420a --- /dev/null +++ b/interface-definitions/vpp_interface_gre.xml.in @@ -0,0 +1,88 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="gre" owner="${vyos_conf_scripts_dir}/vpp_interfaces_gre.py"> + <properties> + <priority>325</priority> + <help>Generic Network Encapsulation (GRE) Interface</help> + <constraint> + <regex>vppgre[0-9]+</regex> + </constraint> + <constraintErrorMessage>GRE interface must be named vppgreN</constraintErrorMessage> + <valueHelp> + <format>vppgreN</format> + <description>GRE interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <!-- Disable as point-to-multipoint mode does not work without 'teib' feature that is not implemented yet --> + <!-- <leafNode name="mode"> + <leafNode name="mode"> + <properties> + <help>GRE tunnel mode</help> + <completionHelp> + <list>point-to-point point-to-multipoint</list> + </completionHelp> + <valueHelp> + <format>point-to-point</format> + <description>Point to point mode</description> + </valueHelp> + <valueHelp> + <format>point-to-multipoint</format> + <description>Point to multipoint mode</description> + </valueHelp> + <constraint> + <regex>(point-to-point|point-to-multipoint)</regex> + </constraint> + <constraintErrorMessage>Invalid mode, must be one of: point-to-point or point-to-multipoint</constraintErrorMessage> + </properties> + <defaultValue>point-to-point</defaultValue> + </leafNode> --> + #include <include/interface/parameters-key.xml.i> + <leafNode name="key"> + <defaultValue>0</defaultValue> + </leafNode> + <leafNode name="tunnel-type"> + <properties> + <help>GRE tunnel type</help> + <completionHelp> + <list>erspan l3 teb</list> + </completionHelp> + <valueHelp> + <format>erspan</format> + <description>Encapsulated Remote Switched Port Analyzer</description> + </valueHelp> + <valueHelp> + <format>l3</format> + <description>Generic Routing Encapsulation (network layer)</description> + </valueHelp> + <valueHelp> + <format>teb</format> + <description>L2 Transparent Ethernet Bridge</description> + </valueHelp> + <constraint> + <regex>(erspan|l3|teb)</regex> + </constraint> + <constraintErrorMessage>Invalid encapsulation, must be one of: l3, teb or erspan</constraintErrorMessage> + </properties> + <defaultValue>l3</defaultValue> + </leafNode> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1476</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_ipip.xml.in b/interface-definitions/vpp_interface_ipip.xml.in new file mode 100644 index 000000000..a214f728e --- /dev/null +++ b/interface-definitions/vpp_interface_ipip.xml.in @@ -0,0 +1,36 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="ipip" owner="${vyos_conf_scripts_dir}/vpp_interfaces_ipip.py"> + <properties> + <priority>325</priority> + <help>IP encapsulation tunnel interface</help> + <constraint> + <regex>vppipip[0-9]+</regex> + </constraint> + <constraintErrorMessage>IPIP tunnel interface must be named vppipipN</constraintErrorMessage> + <valueHelp> + <format>vppipipN</format> + <description>IPIP tunnel interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1476</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_loopback.xml.in b/interface-definitions/vpp_interface_loopback.xml.in new file mode 100644 index 000000000..9998c34d2 --- /dev/null +++ b/interface-definitions/vpp_interface_loopback.xml.in @@ -0,0 +1,32 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="loopback" owner="${vyos_conf_scripts_dir}/vpp_interfaces_loopback.py"> + <properties> + <priority>325</priority> + <help>Loopback Interface</help> + <constraint> + <regex>vpplo[0-9]+</regex> + </constraint> + <constraintErrorMessage>Loopback interface must be named vpploN</constraintErrorMessage> + <valueHelp> + <format>vpploN</format> + <description>Loopback interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + #include <include/vpp/vif.xml.i> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_vxlan.xml.in b/interface-definitions/vpp_interface_vxlan.xml.in new file mode 100644 index 000000000..1de141b1e --- /dev/null +++ b/interface-definitions/vpp_interface_vxlan.xml.in @@ -0,0 +1,37 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="vxlan" owner="${vyos_conf_scripts_dir}/vpp_interfaces_vxlan.py"> + <properties> + <priority>325</priority> + <help>Virtual Extensible LAN (VXLAN) Interface</help> + <constraint> + <regex>vppvxlan[0-9]+</regex> + </constraint> + <constraintErrorMessage>VXLAN interface must be named vppvxlanN</constraintErrorMessage> + <valueHelp> + <format>vppvxlanN</format> + <description>VXLAN interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + #include <include/source-address-ipv4-ipv6.xml.i> + #include <include/interface/tunnel-remote.xml.i> + #include <include/vni.xml.i> + #include <include/interface/address-ipv4-ipv6.xml.i> + #include <include/interface/mtu-68-16000.xml.i> + <leafNode name="mtu"> + <defaultValue>1450</defaultValue> + </leafNode> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vpp_interface_xconnnect.xml.in b/interface-definitions/vpp_interface_xconnnect.xml.in new file mode 100644 index 000000000..3480a0d41 --- /dev/null +++ b/interface-definitions/vpp_interface_xconnnect.xml.in @@ -0,0 +1,49 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name='interfaces'> + <children> + <node name='vpp'> + <children> + <tagNode name="xconnect" owner="${vyos_conf_scripts_dir}/vpp_interfaces_xconnect.py"> + <properties> + <help>Layer 2 cross-connect</help> + <priority>325</priority> + <constraint> + <regex>vppxcon[0-9]+</regex> + </constraint> + <constraintErrorMessage>Cross-connect interface must be named vppxconN</constraintErrorMessage> + <valueHelp> + <format>vppxconN</format> + <description>Cross-connect interface name</description> + </valueHelp> + </properties> + <children> + #include <include/generic-description.xml.i> + #include <include/interface/disable.xml.i> + <node name="member"> + <properties> + <help>Cross-connect pair member interfaces</help> + </properties> + <children> + <leafNode name="interface"> + <properties> + <help>Member interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces --bridgeable</script> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>Interface name</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> + </children> + </tagNode> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/vrf.xml.in b/interface-definitions/vrf.xml.in index a20be995a..317707cc5 100644 --- a/interface-definitions/vrf.xml.in +++ b/interface-definitions/vrf.xml.in @@ -3,7 +3,7 @@ <node name="vrf" owner="${vyos_conf_scripts_dir}/vrf.py"> <properties> <help>Virtual Routing and Forwarding</help> - <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl --> + <!-- must be before any interface, check /usr/libexec/vyos/priority.py --> <priority>11</priority> </properties> <children> @@ -95,6 +95,15 @@ #include <include/ospfv3/protocol-common-config.xml.i> </children> </node> + <node name="rpki" owner="${vyos_conf_scripts_dir}/protocols_rpki.py $VAR(../../@)"> + <properties> + <help>Resource Public Key Infrastructure (RPKI)</help> + <priority>820</priority> + </properties> + <children> + #include <include/rpki/protocol-common-config.xml.i> + </children> + </node> <node name="static" owner="${vyos_conf_scripts_dir}/protocols_static.py $VAR(../../@)"> <properties> <help>Static Routing</help> @@ -105,6 +114,40 @@ #include <include/static/static-route6.xml.i> </children> </node> + <node name="failover" owner="${vyos_conf_scripts_dir}/protocols_failover.py $VAR(../../@)"> + <properties> + <help>Failover Routing</help> + <priority>491</priority> + </properties> + <children> + #include <include/failover/protocol-common-config.xml.i> + </children> + </node> + </children> + </node> + <node name="service"> + <properties> + <help>Enable services in the vrf itself</help> + </properties> + <children> + <node name="dhcp-server" owner="${vyos_conf_scripts_dir}/service_dhcp-server.py $VAR(../../@)"> + <properties> + <help>Dynamic Host Configuration Protocol (DHCP) for DHCP server</help> + <priority>912</priority> + </properties> + <children> + #include <include/dhcp/dhcp-server-common-config.xml.i> + </children> + </node> + <node name="dhcpv6-server" owner="${vyos_conf_scripts_dir}/service_dhcpv6-server.py $VAR(../../@)"> + <properties> + <help>DHCP for IPv6 (DHCPv6) server</help> + <priority>901</priority> + </properties> + <children> + #include <include/dhcp/dhcpv6-server-common-config.xml.i> + </children> + </node> </children> </node> <leafNode name="table"> |