| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
The added calculations were just enough to introduce a race between
remote commit completion and show remote config.
|
|
|
|
|
|
|
|
|
|
python: T8857: replace bare except clauses with except Exception in config scripts
|
|
T8782: remove dormant pr-auto-close.yml on current
|
|
This workflow was a newer copy of the per-branch pr-auto-close.yml
files, with a branch filter targeting both sagitta and circinus.
It never actually fired: pull_request_target evaluates the workflow
from the PR's TARGET branch, not the default branch. PRs targeting
sagitta used .github/workflows/pr-auto-close.yml from the sagitta
branch; PRs targeting circinus used circinus's copy. The file on
current matched no events.
Functionality is now centralized in the Mergify config at vyos/mergify
(see PR vyos/mergify#13, merged). vyos/vyos-1x extends that baseline
via .github/mergify.yml on this branch.
Sibling cleanup of vyos/vyos-1x#5228 (sagitta) and the parallel
PR removing circinus's copy.
|
|
When service https is configured with a listen-address on a VRF
interface, adding or changing the vrf option causes the commit to
fail with "TCP port 443 is used by another service!" even though
no conflict exists.
Root cause: check_port_availability() performs a socket.bind() in
the default network namespace. When the listen-address belongs to
a VRF interface the address is unreachable from the default
namespace, so the bind fails with OSError which is misinterpreted
as "port in use". The secondary check via is_listen_port_bind_service()
also fails because psutil cannot see sockets bound inside a VRF.
Fix: add an optional vrf parameter to check_port_availability().
When set, the test socket is bound to the VRF master device via
SO_BINDTODEVICE before the bind() call, so that the address is
resolved in the correct L3 domain. This is done in-process (no
subprocess) and works for both IPv4 and IPv6.
service_https verify() now passes the configured VRF (if any) to
check_port_availability(). Non-VRF configurations are unaffected.
Add smoke test for HTTPS with listen-address inside a VRF.
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
snmp: T8538: Persist engineBoots counter across reboots
|
|
T8929: auto-close pr workflow name updated
|
|
ipsec: T8912: Fix log level not respected in system journal
|
|
|
|
T8929: auto-close pr workflow pullrequest target trigger fixed
|
|
When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.
The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.
Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.
This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.
|
|
|
|
|
|
|
|
|
|
geoip: T8590: fix initialization failure and set clobbering on boot and commit
|
|
Add two enhancements to the `show conntrack table` op-mode command:
- Display per-flow packet and byte counters (original and reply
direction).
- Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`
that maps VRF name to its conntrack table ID and
passes `--orig-zone` to the underlying conntrack call.
|
|
ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers
|
|
openvpn: T6478: Skip restart service when only client config changed
|
|
pki: T8877: Add ability to show private key in pem format
|
|
Policy: T8823: validation of GE and LE according FRR instructions
|
|
wan: T8480: add suppress_prefixlength ip rules for internal routing
|
|
wwan: T8924: add UDEV configuration for USB modeswitch
|
|
conntrack: T8909: Remove connection id column from output table
|
|
wwan: T8412: Fix commit failure when modem is absent or not connected
|
|
This cleanup enhances readability and aligns the output
with the actual data being displayed.
|
|
OpenVPN server reads per-client files from `--client-config-dir` at connect
time. When only `interfaces openvpn vtunN server client <client>`
entries are modified there is no need to send SIGHUP or restart
the service - the new CCD files written by `generate()` will
be picked up automatically on the next client connection.
|
|
When using WWAN interfaces, the Linux kernel selects configuration 2 by
default, but that does not work with ModemManager - configuration 3 (MBIM mode)
is a better choice.
Add UDEV rules for Huawei ME906s-158 and HP LT4132 which is a re-brand of
Huawei ME906s-158 to properly set MBIM mode on system startup.
|
|
T8910: ipoe-server: expose accel-ppp idle-timeout option
|
|
openconnect: T7654: OpenConnect Script Execution
|
|
T8883: Fix restart PPPoE-server service when RADIUS settings change
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
`mmcli --simple-disconnect` can be called when the modem bearer is not active.
This causes cmd() to raise a `PermissionError` and abort the commit.
Handle the case gracefully so the configuration can be committed before the modem
is physically present or fully connected.
|
|
Add a CLI knob to terminate idle IPoE sessions after a configurable
timeout:
set service ipoe-server idle-timeout <0-86400>
Today there is no way to age out stale IPoE sessions: clients that go
silent (powered off, link down) leave a session record on the router
indefinitely. accel-ppp natively supports idle-timeout in its [ipoe]
section but VyOS did not expose it.
The option is added as a shared accel-ppp include so it can be reused
by other accel-ppp services in follow-up PRs.
|
|
dhcpv6: T8862: Allow multiple addresses and prefixes for reservations
|
|
|
|
ntp: T8601: add local stratum option
|
|
|
|
|
|
T8822: Add BFD strict mode for BGP
|
|
wireguard: T8509: Add fwmark ip rules for VRF-bound interfaces
|
|
|
|
Restart the PPPoE server when RADIUS configuration is modified.
Previously, changes to settings such as `priority` and `backup`
were not applied until the service was restarted manually.
|
|
wireless: T8528: Add module config code for mt7916 based cards
|
