summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-10-08firewall: T4612: Support arbitrary netmasksRain
Add support for arbitrary netmasks on source/destination addresses in firewall rules. This is particularly useful with DHCPv6-PD when the delegated prefix changes periodically.
2022-10-01Merge pull request #1568 from dmbaturin/abbr-consistencyChristian Poessinger
T4722: consistent use of the official spelling for RADIUS and IPsec
2022-10-01T4722: consistently use the "RADIUS" spelling for the RADIUS protocolDaniil Baturin
2022-10-01T4722: consistently use the "IPsec" spelling for IPsecDaniil Baturin
2022-09-30bgp: evpn: T1315: add route-target CLI node <multi/> propertyChristian Poessinger
FRR supports multiple route-targets to be used for import/export: address-family l2vpn evpn route-target import 20:10 route-target import 20:11 route-target import 20:12 route-target import 40:40 route-target export 1:2 route-target export 1:3 route-target export 40:40 exit-address-family Thus the <multi/> property is added to the relevant CLI nodes.
2022-09-29Merge pull request #1566 from sarthurdev/firewall_opChristian Poessinger
firewall: T2199: Fix op-mode script for interface migration and vyos_filter table name
2022-09-29firewall: T2199: Fix op-mode script for interface migration and vyos_filter ↵sarthurdev
table name
2022-09-28Merge pull request #1561 from sever-sever/T4715Christian Poessinger
login: T4715: Auto logout user after inactivity
2022-09-28op-mode: ipsec: T4719: bugfix IKEv2 road-warrior profile generatorChristian Poessinger
Commit bd4588827b ("ipsec: T4118: Change vpn ipsec syntax for IKE ESP and peer") changed the CLI syntax of ipsec. This resulted in a node not renamed in the op-mode generator when generating IKEv2 IPSec iOS configuration profiles.
2022-09-28Merge pull request #1565 from sever-sever/T4557Christian Poessinger
ids: T4557: Update xml-component-version
2022-09-28Merge pull request #1564 from sarthurdev/T4713Christian Poessinger
nat: T4713: Fix op-mode nat translation output
2022-09-28ids: T4557: Update xml-component-versionViacheslav Hletenko
2022-09-28login: T4715: Auto logout user after inactivityViacheslav Hletenko
Ability to terminate interactive sessions (TTY/PTS) after a period of inactivity. set system login timeout '300'
2022-09-28nat: T4713: Fix op-mode nat translation outputsarthurdev
2022-09-28op-mode: T3589: streamline console-server journalctl cmdlineChristian Poessinger
2022-09-28op-mode: T3589: streamline pppoe interface journalctl cmdlineChristian Poessinger
2022-09-28Merge pull request #1559 from insertjokehere/console-server-namesChristian Poessinger
conserver: T4717: Support for setting a name for console-server devices
2022-09-28conserver: T4717: Support for setting a name for console-server devicesWilliam Hughes
This adds a new 'alias' property to the console-server device definition to allow users to connect to a console using a human-readable name rather than just the device name. For a configuration like: service { console-server { device ttyUSB0 { speed 115200 alias my-server } } } Users can connect either by doing `connect console ttyUSB0`, or `connect console my-server`. Names: * Must be unique * Are limited to 128 characters * Are optional - if not specified, only the `connect console ttyX` form can be used
2022-09-27Merge pull request #1562 from sever-sever/T4711Christian Poessinger
login: T4711: Terminate user TTY and PTS sessions
2022-09-27Merge pull request #1560 from nicolas-fort/T4700Christian Poessinger
T4700: Firewall: add interface matching criteria
2022-09-27login: T4711: Terminate user TTY and PTS sessionsViacheslav Hletenko
Ability to terminate user TTY and PTS sessions clear session pts/1
2022-09-26ethernet: T4689: support asymetric RFS configuration on multiple interfacesChristian Poessinger
The initial implementation from commit ac4e07f9 ("rfs: T4689: Support RFS (Receive Flow Steering)") always adjusted the global rps_sock_flow_entries configuration. So if RFS was enabled for one NIC but not the other - it did not work. According to the documentation: RFS is only available if the kconfig symbol CONFIG_RPS is enabled (on by default for SMP). The functionality remains disabled until explicitly configured. The number of entries in the global flow table is set through: /proc/sys/net/core/rps_sock_flow_entries The number of entries in the per-queue flow table are set through: /sys/class/net/<dev>/queues/rx-<n>/rps_flow_cnt Both of these need to be set before RFS is enabled for a receive queue. Values for both are rounded up to the nearest power of two. The suggested flow count depends on the expected number of active connections at any given time, which may be significantly less than the number of open connections. We have found that a value of 32768 for rps_sock_flow_entries works fairly well on a moderately loaded server. This commit sets rps_sock_flow_entries via sysctl on bootup leafing the RFS configuration to the interface level.
2022-09-26Merge pull request #1545 from sever-sever/T4557Christian Poessinger
ids: T4557: Migrate threshold and add new threshold types
2022-09-26ids: T4557: Migrate threshold and add new threshold typesViacheslav Hletenko
Migrate "service ids ddos-protection threshold xxx" to "service ids ddos-protection general threshold xxx" Add new threshold types: set service ids ddos-protection threshold tcp xxx set service ids ddos-protection threshold udp xxx set service ids ddos-protection threshold icmp xxx
2022-09-26T4700: Firewall: add interface matching criteriaNicolas Fort
2022-09-25wireguard: ifconfig: T2653: move Config() import to be local to consumerChristian Poessinger
2022-09-25wireguard: ifconfig: T2653: use NamedTemporaryFile() when dealing with ↵Christian Poessinger
private key This prevents habing any leftover private-key files in /tmp directory.
2022-09-24Merge pull request #1558 from initramfs/current-fix-tcp-mssChristian Poessinger
interfaces: T4709: raise minimum TCP MSS clamping value
2022-09-25interfaces: T4709: raise minimum TCP MSS clamping valueinitramfs
This commit raises the minimum TCP MSS clamping range to the MSS value corresponding to the minimum packet size that must be accepted for IPv4.
2022-09-24ethernet: T3171: enable RPS (Receive Packet Steering) for all RX queuesChristian Poessinger
The initial implementation in commit 9fb9e5cade ("ethernet: T3171: add CLI option to enable RPS (Receive Packet Steering)" only changed the CPU affinity for RX queue 0. This commit takes all RX queues into account.
2022-09-22ipoe: T4703: fix migration of vlan node for loca authenticated usersChristian Poessinger
2022-09-22xml: T4698: validating a range must be explicitly enabled in the validatorChristian Poessinger
This extends commit 28573ffe4f ("xml: T4698: drop validator name="range" and replace it with numeric"). The first version allowed both a range and discrete numbers to be validated by the numeric validator. This had a flaw as both 22 and 22-30 were valid at the same time. The generic "port-number.xml.i" building block only allows a discrete number. Now if a user set port 22-30 for e.g. SSH the daemon did no longer start. This is why range validation must be explicitly enabled.
2022-09-22Merge pull request #1541 from goodNETnick/ggl_authChristian Poessinger
system login: T874: add libpam-google-authenticator package
2022-09-22Merge pull request #1554 from sarthurdev/nat_refactorChristian Poessinger
nat: T4605: Fix op-mode NAT table name
2022-09-22nat: T4605: Fix op-mode NAT table namesarthurdev
2022-09-22Merge pull request #1521 from sever-sever/T3476Christian Poessinger
update-check: T3476: Allow update-check for VyOS images
2022-09-22Merge pull request #1552 from sarthurdev/nat_refactorChristian Poessinger
nat: nat66: T4605: T4706: Refactor NAT/NAT66 and use new table name
2022-09-22telegraf: T4680: fix prometheus client listen-address invalid formatKyleM
2022-09-21nat: T4605: Refactor static NAT to use python module for parsing rulessarthurdev
* Rename table to vyos_nat * Add static NAT smoketest
2022-09-21nat66: T4605: Refactor NAT66 to use python module for parsing rulessarthurdev
* Rename table to vyos_nat * Refactor tests to use `verify_nftables` format
2022-09-21nat: T4605: Refactor NAT to use python module for parsing rulessarthurdev
* Rename table to vyos_nat * Refactor tests to use `verify_nftables` format
2022-09-21Merge pull request #1553 from nicolas-fort/return-actionChristian Poessinger
T4699: Firewall: Add return action
2022-09-21T4699: Firewall: Add return action, since jump action was added recentlyNicolas Fort
2022-09-21dhcpv6-pd: T2821: bugfix Jinja2 template - missing conditional ifChristian Poessinger
Specifying "dhcpv6-options pd 0" for any interface without an interface where we delegate an address to resulted in a commit error: {% for interface, interface_config in pd_config.interface.items() if pd_config.interface is vyos_defined %} jinja2.exceptions.UndefinedError: 'dict object' has no attribute 'interface'
2022-09-21ipoe: T4678: T4703: rewrite to get_config_dict()Christian Poessinger
In addition to the rewrite to make use of get_config_dict() the CLI is slightly adjusted as specified in T4703. * Rename vlan-id and vlan-range to simply vlan * Rename network-mode to simply mode * Re-use existing common Jinja2 template for Accel-PPP which are shared with PPPoE and SSTP server. * Retrieve default values via defaultValue XML node
2022-09-20xml: firewall: T2199: improve interface help stringChristian Poessinger
2022-09-20xml: ipsec: T1210: add valueHelp and constraint for remote-access connection ↵Christian Poessinger
name
2022-09-20xml: ipsec: T3093: add valueHelp and constraint for profile nameChristian Poessinger
2022-09-20ipsec: T4118: bugfix migration of IKEv2 road-warrior "id" CLI optionChristian Poessinger
The "authentication id" option for road-warriors did not get migrated to the new local-id CLI node. This has been fixed.
2022-09-19ipsec: T4118: bugfix config migrator 9-to-10Christian Poessinger
When a CLI node is set with a migrator and is not a valueLess node, we need to specify the "value" using the value= operation in config.set(). This fixes the config load error: vyos.configsession.ConfigSessionError: Invalid config file (syntax error): error at line 353
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-15 22:28:50 +0000