| Age | Commit message (Collapse) | Author |
|---|
|
Fixed error with the unknown key in the verification
|
|
Return the old script to 'generate tech-support archive' command.
The machine-readable format is good, but useless for analysis.
There are no logs and other necessary information.
Add op-mode command for machine-readable format:
```
generate tech-support machine-readable-archive
```
|
|
collectors.textfile
|
|
|
|
The apply stage calls systemctl reload-or-restart on the https server,
however, some settings require a restart or will silently fail, since
nginx drops privileges after start up.
Add flag when restart may be needed and check in apply stage.
|
|
Add CLI config node for "group" when configuring NAT66 source
Ensure there is only one group in NAT66 source rule config
Add smoketest to cover new group usage in source NAT66 rules
|
|
T7382: adds podman log driver configuration option
|
|
tech-support: T7410: handle possible errors when executing lsusb
|
|
Commiting suggestions from dmbaturin
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
T7397: add "system kernel option quiet" to suppress boot messages
|
|
|
|
Automatically render HaProxy rules to reverse-proxy ACME challanges when the
requested certificate was issued using ACME.
|
|
|
|
If we detect that an ACME issued certificate is consumed by haproxy service,
we will move the certbot webserver to localhost and a highport, to proxy the
request via haproxy which is already using port 80.
|
|
changed_keys had the same content as the values inside the sync_translate
dictionary. Infact they were both used together do defined changed CLI keys.
The list for changed_keys is a list of all unique values inside the
sync_translate dict.
|
|
|
|
If redirect-http-to-https is set we will render a discrete onfiguration in
HAproxy to properly claim port 80 in the system to detect if a service is
alreadey using the port or not.
|
|
Commit 4523e9c897b3 ("wireguard: T3763: Added check for listening port
availability") added a function to check if a port is free to use or already
occupied by a different running service. This has been done by trying to bind a
socket to said given port.
Unfortunately there is no support for IPv6 address-fdamily in both
socketserver.TCPServer or socketserver.UDPServer. This must be done manually by
deriving TCPServer and setting self.address_family for IPv6.
The new implementation gets rid of both TCPServer and UDPServer and replaces it
with a simple socket binding to a given IPv4/IPv6 address or any interface/
address if unspecified.
In addition build time tests are added for the function to check for proper
behavior during build time of vyos-1x.
|
|
because it exits with a non-zero code on machines
without USB controllers
|
|
VyOS-1x requires mokutil always for `show version`
Debian provides mokutil for amd64, arm64, armhf
Signed-off-by: Date Huang <tjjh89017@hotmail.com>
|
|
Add option to limit the number of messages that are displayed on the console
during the boot process and to persist this setting with image upgrades.
set system option kernel quiet
|
|
There is "set system option kernel amd-pstate-driver" which requires a Kernel
driver to operate. This adds a smoketest validating the Kernel configuration.
|
|
Rename config node from clear-session to reset-session
|
|
smoketest: T7400: fix unbound variable when checking VXLAN remote and group settings
|
|
'NoneType' is not iterable" (#4471)
Co-authored-by: canoziia <canoziia@qq.com>
|
|
settings
FAIL: test_vxlan_group_remote_error (__main__.VXLANInterfaceTest.test_vxlan_group_remote_error)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/libexec/vyos/tests/smoke/cli/test_interfaces_vxlan.py", line 139, in test_vxlan_group_remote_error
self.assertIn('Both group and remote cannot be specified', str(exception))
AssertionError: 'Both group and remote cannot be specified' not found in '[[interfaces vxlan vxlan60]] failed\nCommit failed\n'
This happens because cm variable is accessed when no longer valid. Change
behavior to match common smoketest style, check ConfigError exception - but do
not check exception message. Fix the error and commit again.
|
|
|
|
|
|
firewall: T7358: add offload option to global state policy
|
|
T7181: VPP Static and dynamic NAT
|
|
New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface> # multi
set vpp nat44 interface inside <interface> # multi
set vpp nat44 address-pool translation interface <interface> # multi
set vpp nat44 address-pool translation address <address> # multi
set vpp nat44 address-pool twice-nat interface <interface> # multi
set vpp nat44 address-pool twice-nat address <address> # multi
set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>
set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit> # default 64512
set vpp settings nat44 timeout udp <sec> # default 300
set vpp settings nat44 timeout tcp-established <sec> # default 7440
set vpp settings nat44 timeout tcp-transitory <sec> # default 240
set vpp settings nat44 timeout icmp <sec> # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```
|
|
Change autoignoreprefixes config template and add smoketests
|
|
'NoneType' is not iterable"
|
|
bgp: T7220: Add the option to disable enforce-first-as at peer level
|
|
T7282: op-mode: show firewall group filtering and tab completion update
|
|
T7316: Add MTU validation for interfaces with MTU less then 1200
|
|
|
|
advertisements (#4463)
|
|
dhclient: T6253: Respect `no-default-route`
|
|
interface: T4627: not every interface type supports IPv6 interface-identifiers
|
|
Turns out commit b124f0b3b ("interface: T4627: support IPv6 Interface
Identifier (token) for SLAAC") uncovered a wrong assumption in VyOS that every
interface type in use always supports SLAAC and IPv6-ND (neighbor discovery).
This is not true for WireGuard, Tunnel and VTI interfaces, thus do not provide
that CLI option. In addition SLAAC support should be removed for those interface
types in a future PR.
|
|
syslog: T7367: ensure rsyslog is registered as default systemd syslog service
|
|
interface: T7375: cleanup SLAAC assigned address and default route after removing SLAAC CLI configuration
|
|
geoip: T5636: Add geoip for policy route/route6
|
|
interface: T4627: support setting of IPv6 Interface Identifier(Token)
|
|
bridge: T7322: fix slow performance of allowed vlan
|
|
ospf: T7383: Fixed unconfigured redistribution of nhrp into ospf
|
|
|
|
When an interface runs in DHCPv6 only mode, there is no reason to have a
default installed that was received via SLAAC. If SLAAC is needed, it should
be turned on explicitly.
This bug was only triggered during system boot where a DHCPv6 client address
and a default route to a link-local address was shown in the system. If DHCPv6
was enabled only on an interface while VyOS was already running - no default
route got installed.
|
|
|
