| Age | Commit message (Collapse) | Author |
|---|
|
T7682: incorrect sla-len in DHCPv6 client prefix delegation (DHCPv6-PD)
|
|
vyos.ifconfig: T7814: suppress unnecessary syslog noise from missing nftables rules
|
|
T6211: Fix kea VRF op-mode commands
|
|
container: T7186: Add macvlan network type for containers
|
|
op-mode: T5992: show dhcpv6 leases with (mostly) the same fields as dhcp leases
|
|
|
|
Since Debian Bookworm and higher support this it should probably
be added to VyOS as well.
Author: roedie <github@roedie.nl>
|
|
|
|
- Added 'rpki-extcommunity' match condition
- Added test to test_policy.py smoketest for rpki-extcommunity match
|
|
- Added solo leafNode to peer-group config
- Added solo.xml.i to reduce code duplication
- Added solo option to peer-group smoketests
|
|
Debian: T7817: vyos_net_name exists in debian/tmp but is not installed to anywhere
|
|
Revert "Makefile: T7793: "make clean" should also clean libvyosconfig"
|
|
anywhere
Fix this build warning by placing the vyos_net_name script in it's own udev
folder to not accidently be copied to a wrong location.
|
|
This change introduced an unintended side effect: subsequent package builds
fail. Debian’s build system performs an implicit dh_clean, which removes the
libvyosconfig/_build directory.
However, the current Makefile logic only builds libvyosconfig once (see
Makefile:L18) and does not trigger a rebuild if the library is already marked
as installed.
As a result, after the first successful build, later builds fail with:
cp libvyosconfig/_build/libvyosconfig.so debian/tmp/libvyosconfig/usr/lib/libvyosconfig.so.0
cp: cannot stat 'libvyosconfig/_build/libvyosconfig.so': No such file or directory
|
|
Commit de44c6aef249 ("interface: T7379: do not request SLAAC default route when
only DHCPv6 is set") introduced a behavioral change while addressing an earlier
issue fixed in e9fb2078d5ea ("interface: T7375: SLAAC assigned address is not
cleared when removing SLAAC").
This change caused unintended connectivity loss after upgrading to VyOS 1.4.3.
The underlying reason is that VyOS now requires explicit configuration to
determine how IPv6 addressing and routing should be handled, rather than making
assumptions: Requesting a DHCPv6 address alone will correctly assign an address.
However, since the IPv6 default route is typically advertised via SLAAC (and not
DHCPv6), SLAAC must also be explicitly enabled to receive the default route.
Historically, this distinction was implicit and did not require additional
configuration.
To preserve backward compatibility, a configuration migrator has been added.
It inspects existing configurations that only request a DHCPv6 address and
automatically appends the required CLI node to also enable SLAAC, ensuring that
the default route is restored after upgrade.
|
|
|
|
nftables rules
When tearing down interfaces without VRF bindings, nftables may attempt to
remove non-existent rules. This results in repetitive error messages in syslog,
e.g.:
Sep 13 10:27:59 python3[90301]: DEBUG/IFCONFIG returned (err):
Sep 13 10:27:59 Error[90301]: Could not process rule: No such file or directory
Sep 13 10:27:59 python3[90301]: delete element inet vrf_zones ct_iface_map { "eth1.1337" }
Sep 13 10:27:59 python3[90301]:
Such output is noise and provides no operational value. The rule removal logic
has been adjusted to silently ignore errors when the interface or rule is
already absent, ensuring nftables cleanup proceeds when needed while keeping
syslogs clean and meaningful.
|
|
When an Ethernet interface is deleted from the configuration, its associated
VLAN subinterfaces must be removed first. This ordering allows VLAN interfaces
to gracefully release any active DHCP or DHCPv6 leases before the parent
interface disappears, ensuring proper cleanup and avoiding potential lease
retention issues.
|
|
The current template has an overly optimistic logic for sla-len calculation,
relying on an assumption that a server always provides a prefix with the exact
length requested by the client. This is incorrect. According to RFC8415 and
RFC7084, the prefix length in a request is only a hint for the server, which
may decide to provide a different prefix size.
The big issue here is that wide-dhcpv6-client uses the sla-len value from the
configuration regardless of the received prefix size. This seems to be the
known issue.
The good news is that we have already inherited a patch from Debian to mitigate
the issue [1]. It accomplishes exactly what we are doing in the configuration
template, but with the advantage of using the actual prefix length from the
received prefix, rather than the one configured in the configuration file.
If we simply remove sla-len from the template, everything appears to function
normally.
Before - server sending /56
set interfaces ethernet eth1 address 'dhcpv6'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 address '1'
set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 sla-id '0'
set interfaces ethernet eth1 dhcpv6-options pd 1 length '60'
Resulted in:
vyos@vyos# run show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ------------------- ----------------- ------- ----- ----- -------------
eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u
eth2 fc00:0:2:ff00::1/60 0c:67:94:67:00:02 default 1500 u/u
Whereas IPv6 PD should always use a /64 prefix on the interface we assign a
dynamic DHCPv6 prefix to.
After the fix:
vyos@vyos:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ------------------- ----------------- ------- ----- ----- -------------
eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u
eth2 fc00:0:2:ff00::1/64 0c:67:94:67:00:02 default 1500 u/u
If a DHCPv6 server (e.g. VyOS itself) even provides multiple PD prefixes, the
right one is choosen. Assume the following server configuration:
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 address-range start fc00:0:0:1::100 stop 'fc00:0:0:1::200'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 lease-time default '120'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: prefix-length '56'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: stop 'fc00:0:2:ff00::'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: prefix-length '60'
set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: stop 'fc00:0:3:ff00::'
If a /56 is requested ("dhcpv6-options pd 1 length 56") - we will get a per
interface /64 from the original /56 prefix-delegation from the DHCPv6 server.
If the user suddently requests a /60 ("dhcpv6-options pd 1 length 60") the
delegated prefix will be from the above fc00:0:3:: pool.
1: https://salsa.debian.org/debian/wide-dhcpv6/-/blob/debian/20080615-23/debian/patches/0021-Make-sla-len-config-optional.patch
|
|
op-mode: T7516: expand 'reset bgp all' elements with in/out/soft options
|
|
Debian: T7762: re-apply extend package version with a number always counting up
|
|
Commit content of 562c21cb8 was lost in translation while integrating
the libvyosconfig code as mono repo. This restores the behavior.
|
|
conntrack: T7700: Prevent empty policy generation
|
|
Makefile: T7793: "make clean" should also clean libvyosconfig
|
|
|
|
ospf: T7297: fix redistribute-table
|
|
nat: T7696: Fix NAT op-mode output for protocol and interface groups
|
|
|
|
Only print policy in nftables-ct.conf if protocol config is defined
|
|
- Added 'in', 'out', and 'soft' options to all 'reset bgp all' elements
- Replaced calls to vtysh_wrapper.sh with new bgp.py reset function
- Replaced direct 'vtysh -c' calls with new bgp.py reset function
|
|
T7793: Integrate libvyosconfig repository into vyos-1x
|
|
|
|
|
|
T7757: VPP Verify buffers for rx/tx queues
|
|
|
|
VyOS 1.5 and onwards will no longer have the following CLI node available:
set vrf name <name> protocols bgp system-as <asn>
|
|
Originating from the bug in T7665. To avoid potential issues down the line - and
given that there's no compelling technical reason to retain the system-as CLI
node under per-VRF BGP configuration, which cannot be achieved through
alternative means - the maintainers have collectively decided to deprecate the
following command:
set vrf name <name> protocols bgp system-as <asn>
Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While
it will still be accepted, it will no longer have any operational effect. A
deprecation warning will be displayed at commit time, indicating that the BGP
ASN from the global BGP configuration is now used instead.
A migration script will handle the transition and perform the following actions:
* Ensure a global BGP configuration exists; if not, initialize one.
* Iterate over all configured VRFs to determine whether a BGP instance exists
* For any insance, update the configuration to use the global system-as
and apply the local-as ASN no-prepend replace-as option on all affected
neighbors to preserve existing behavior.
* If a neighbor is already configured with a local-as directive, that neighbor
will be excluded from the migration process, as it already follows a custom
configuration.
* Add allowas-in per neighbor option. Required to not deny prefix received
updates due to as-path contains our own global ASN.
|
|
isis: T7722: Added interface fast-reroute configuration commands
|
|
op-mode: T7764: Add 'vlan-to-vni statistics' op-mode command
|
|
|
|
ratatoskr-org/T7794-fix-prometheus-exporters-invalid-ipv6-listen-address
Monitoring: T7794: Fixed blackbox_exporter, frr_exporter, node_exporter IPv6 listen-address invalid format
|
|
* https://github.com/vyos/libvyosconfig: (107 commits)
T7728: T7734: update commit hash for dynamically generate proposed config
T7728: add package build target for convenience
T7718: update commit hashes for validate_tree_filter
T7718: add binding for validate_tree_filter
T7688: update commit hash for correct management of delete paths
T7644: mirror workflow refactoring rollout
T7637: T7605: update commit hashes for typo and escape backslash
T7579: fix of the run trigger for CLA
T7499: update hashes for add destructive merge
T7499: set permissions on session directory
T7499: bindings for (non-)destructive configtree merge
T7579: added workflow for CLA
T7374: bump vyconf commit id for build.sh
T7374: install vyconf_cli and add links for associated vy_* commands
T7445: added open prs conflict check caller workflow
T7450: fix dependency for use of PCRE2 instead of PCRE
T7363: update hash for vyconf aware initialization of Config
T7450: update commit hashes for Use PCRE2 instead of PCRE
T7334: pr mirror trigger workflow added with label creation permission for default github token
T7321: update commit hashes for replace configsession legacy operations
...
|
|
|
|
listen-address invalid format
|
|
- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest
|
|
T7366: Firewall rules allow empty nodes
|
|
|
|
Requires FRR to support `redistribute table-direct` for ospf
|
|
T7787: Makefile check for unused-imports should be mandatory
|
|
|
