| Age | Commit message (Collapse) | Author |
|---|
|
In the absence of Cstore, the env var remains as the sole indication of
config mode for the legacy CLI, and its emulation here.
|
|
The environment variable _OFR_CONFIGURE is used by bash completion to
setup the config mode environment. We check this setting to coordinate
vyconf config mode and CLI config mode, independent of the legacy
backend Cstore check.
|
|
Despite the counterintuitive numbering, this is correct.
|
|
Empty leaf nodes are cleaned, causing the tcp
ack and syn flags to not match. These values are exempted from being cleaned.
|
|
ipoe_server: T7472: Add validation for giaddr if dhcp-relay is defined
|
|
|
|
Changed CoA port completion help to standard template.
|
|
ipoe_server: T6997: Do not require to create client ip pool when dhcp-relay is used
|
|
|
|
is used
|
|
T1771: automatic reboot of system into previous image
|
|
T7445: added open prs conflict checker caller workflow
|
|
|
|
T7363: update hash for vyconf aware initialization of Config
|
|
pppoe: T7463: Added restart if CoA is changed
|
|
Added a restart if CoA is changed
Added a restart if the authentication mode is changed
|
|
prometheus: T7435: Ensure only configured exporters are started
|
|
opennhrp: T7462: Removed unused opennhrp files and configurations
|
|
T7348: Add config CPU thread-count for accel-ppp services
|
|
T7335: Fix typo for HAproxy help redirect-location path
|
|
|
|
wireguard: T7387: Optimise wireguard peer handling
|
|
xml: T7467: remove ^/$ wrapping from validation regexes
|
|
policy: T5069: large-community-list regex validator disallows whitespace
|
|
openconnect: T7287: VPN Openconnect does not check dictionary key se…
|
|
since the validation utility adds them implicitly
|
|
Removed unused opennhrp files and configurations
|
|
snmp: T7464: fix the community string validation regex for compatibility with PCRE2
|
|
bonding: T7466: fix the 802.3ad regex
|
|
|
|
for compatibility with PCRE2
|
|
T7458: Fix VPN IPsec unexpected passthrough logic bug
|
|
T7414: Fix conntrack ignore rules for using several ports
|
|
with authentication mode RADIUS
|
|
|
|
If any part of the system boot fails, we set overall_status=1 in the vyos-router
startup script. When an error during the image upgrade is detected, the system
will automatically revert the default boot image to the previously used version,
if the CLI option "system option reboot-on-upgrade-failure" is set.
The user is informed via console messages:
Booting failed, reverting to previous image
Automatic reboot in 5 minutes
Use "reboot cancel" to cancel
The user has time to log in and run reboot cancel to remain in the faulty image
for troubleshooting. Reboot timeout is defined by CLI: "system option
reboot-on-upgrade-failure"
Once the system boots into the previous image, the MOTD will display a
persistent warning message - cleared during next reboot.
WARNING: Image update to "VyOS 1.5.xxxx" failed
Please check the logs:
/usr/lib/live/mount/persistence/boot/NAME/rw/var/log
Message is cleared on next reboot!
Upgrade failure can be synthetically injected by booting with Kernel command
line option: vyos-fail-migration
|
|
When performing an image upgrade we will create a file named /config/first_boot
with JSON data inside the new images persistent storage. The content of the file
will look like: {"previous_image": "1.5-stream-2025-Q3"}
The previous image name can be easily queried using "jq -r '.previous_image'".
This is the base work required for an adjusted version of the vyos-router init
script to support an automatic rollback to a previous image if things go
sideways.
|
|
If we use several port for the `conntrack ignore` there
have to be used curly braces for nftables
Incorrect format: dport 500,4500
Correct format: dport { 500, 4500 }
|
|
Accel-ppp services should not use all CPU cores to process requests.
At the moment accel-ppp services use all available CPU cores
to process requests from the subscribers (establish/update session/etc).
During mass connection of sessions, this can lead to the fact that it
utilizes all CPU, and for other services like FRR, there is not enough
CPU time to process their own stable work.
services:
- L2TP
- SSTP
- PPPoE
- IPoE
- PPtP
Add this option configurable and use all cores if not set:
```
set service pppoe-server thread-count < all | half | x >
```
The defaultValue `all`
|
|
|
|
|
|
VPN IPsec unexpected passthrough logic bug was introduced in this
commit https://github.com/vyos/vyos-1x/commit/f480346bb8e934b1ce2e0fc3be23f7168273bba1
The correct behaviour of the `cidr_fit` was replaced with the
incorrect `overlap`
This way, the passthrough option is used every time when networks overlap.
```
>>> from ipaddress import ip_network
>>>
>>> a = ip_network('192.0.2.0/24')
>>> b = ip_network('192.0.2.100/30')
>>>
>>> a.overlaps(b)
True
>>>
>>> b.overlaps(a)
True
>>>
```
But there should be `subnet_of`:
```
>>> a.subnet_of(b)
False
>>>
>>> b.subnet_of(a)
True
>>>
```
In configuration it looks like
```
set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '192.0.2.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '192.0.2.100/30'
```
The StrongSwan unexpected configuration:
```
RIGHT-tunnel-0-passthrough {
local_ts = 192.0.2.0/24
remote_ts = 192.0.2.0/24
start_action = trap
mode = pass
}
```
So all outcoming traffic to the 192.0.2.0/24 pass through the main routing
table instead of out SA
Use `subnet_of` to fix this
|
|
validators: T7450: remove debug line from use PCRE2 commit
|
|
|
|
T7450: update commit hash for Use PCRE2 instead of PCRE
|
|
|
|
T7450: update commit hashes for Use PCRE2 instead of PCRE
|
|
|
|
validators: T7450: use PCRE2 instead of the outdated original PCRE
|
|
CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>
set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>
set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface
show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
|
