summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-01-02T4904: keepalived virtual-server allow multiple ports with fwmarkViacheslav Hletenko
Allow multiple ports for high-availability virtual-server The current implementation allows balance only one "virtual" address and port between between several "real servers" Allow matching "fwmark" to set traffic which should be balanced Allow to set port 0 (all traffic) if we use "fwmark" Add health-check script set high-availability virtual-server 203.0.113.1 fwmark '111' set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check script '/bin/true' set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '0'
2023-01-02Merge pull request #1725 from sever-sever/T4893Christian Poessinger
T4893: Add ppp-options ipv6-interface-id for L2TP
2023-01-02smoketest: T4284: remove qos from dialup-router-medium-vpnChristian Poessinger
qos config migration is tested using qos-basic example config file.
2023-01-01qos: T4284: migrate percentaged bandwidth to absolute value in bit/sChristian Poessinger
2023-01-01Merge pull request #1663 from c-po/t4284-qosChristian Poessinger
QoS: T4284: re-implementation using XML and Python
2023-01-01qos: T2721: set fq-codel as default leaf qdisc for shaperChristian Poessinger
Set fq-codel as the default queuing discipline for the shaper traffic-policy if queue-type has not been configured. fq-codel has been the default qdisc for OpenWRT as well as systemd (and thus various linux distributions) for a decent while now. It has proven itself to be a highly effective qdisc for fighting bufferbloat whilst maintaining high link utilization. The combination of HTB + fq-codel has also seen wide deployment in cases when additional traffic classification and/or rate/burst management is required. This change will allow the configuration of a shaper traffic-policy with suitable defaults, saving the pain of having to specify fq-codel as a queue-type for every class.
2023-01-01qos: T4284: first implementation introducing a new vyos.qos moduleChristian Poessinger
2023-01-01qos: T4284: xml: fix path for completion helperChristian Poessinger
2023-01-01qos: T4284: activate new Python backendChristian Poessinger
2022-12-30ci: T4748: add a small delay to the PR title check to ensure that it gets a ↵Daniil Baturin
complete, finalized PR object from GitHub
2022-12-30dummy: T4898: add missing IPv6 options for smoketestsChristian Poessinger
2022-12-30smoketest: dummy: T4898: enable MTU testcaseChristian Poessinger
2022-12-30T4748: Clarify the invalid PR object messageDaniil Baturin
2022-12-30T4893: Add ppp-options ipv6-interface-id for L2TPViacheslav Hletenko
Add ppp-options IPv6 interface id for vpn L2TP - fixed or random interface identifier for IPv6 - peer interface identifier for IPv6 - whether to accept peer’s interface identifier set vpn l2tp remote-access ppp-options ipv6-accept-peer-intf-id set vpn l2tp remote-access ppp-options ipv6-intf-id 'random' set vpn l2tp remote-access ppp-options ipv6-peer-intf-id 'calling-sid'
2022-12-30Merge pull request #1726 from vfreex/vxlan-fix-rebuildChristian Poessinger
T4897: vxlan: Fix setting `source-address` and `source-interface`
2022-12-30T4897: Fix virtual interface rebuild checksYuxiang Zhu
`leaf_node_changed` returns `[]` (empty list) after a leaf node is added. e.g. Setting `source-interface` doesn't work on an existing vxlan interface. Steps to reproduce: - Add a vxlan interface without `source-address` or `source-interface` options set: ``` set interfaces vxlan vxlan999 vni 999 set interfaces vxlan vxlan999 remote 192.168.100.100 commit ``` - Then set `source-address` or `source-interface`: ``` set interfaces vxlan vxlan999 source-interface eth0 commit ``` Actual result: Source address or source-interface are not set: ``` ip -d link show dev vxlan999 76: vxlan999: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/ether 56:08:ba:4d:4e:a8 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 vxlan id 999 remote 192.168.100.100 srcport 0 0 dstport 8472 tos inherit ttl 16 ageing 300 udpcsum noudp6zerocsumtx noudp6zerocsumrx addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 ``` Expected result: ``` 77: vxlan999: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/ether 9e:05:d9:58:1a:af brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 vxlan id 999 remote 192.168.100.100 dev eth0 srcport 0 0 dstport 8472 tos inherit ttl 16 ageing 300 udpcsum noudp6zerocsumtx noudp6zerocsumrx addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 ``` All invocations of leaf_node_changed() should be migrated to is_node_changes() if you are only interested in if something changed and don‘t care what exactly changed (content).
2022-12-30pseudo-ethernet: T4391: use is_node_changed() over error prone ↵Christian Poessinger
leaf_node_changed() We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-30tunnel: T4391: use is_node_changed() over error prone leaf_node_changed()Christian Poessinger
We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-30geneve: T4366: use is_node_changed() over error prone leaf_node_changed()Christian Poessinger
We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-30Merge pull request #1727 from vfreex/dummy-mtuChristian Poessinger
T4898: Add mtu config option for dummy interfaces
2022-12-29T4898: Add mtu config option for dummy interfacesYuxiang Zhu
I use dummy interfaces in a VRF as source-interfaces for VXLAN in order to force VXLAN send underlay UDP traffic through the VRF where the dummy interface resides. However dummy interface has no mtu option so it always gets an MTU of 1500. This will cause an error when the mtu of dummy is not large enough for the VXLAN traffic. Adding this option in the config template will solve this.
2022-12-27strongSwan: T4593: add charon-systemd runtime dependencyChristian Poessinger
2022-12-27strongSwan: upgrade scripts to work with package version 5.9.8Christian Poessinger
2022-12-25container: T2216: use defaultValue XML definition to define port protocolChristian Poessinger
Instead of hardcoding the default protocol as TCP in the Python script we shall use the XML based defaultValue approach instead. This also automatically exports the default to the CLI completion helper.
2022-12-25container: T2216: add verify() for port definitionChristian Poessinger
If port is specified on the CLI so must be source and destination under the port node.
2022-12-24container: T4870: remove manual user interaction during storage migrationChristian Poessinger
Commit 60c80df4 ("container: T4870: bump package version 0 -> 1 for filesystem change") introduced a fundamental change in the container storage driver that required a manual migration step from the user to not loose any data. This commit removes the manual user interaction and temporary exports the container images and re-imports them after the filesystem got changed. The only things that get lost are orphaned container images no longer referenced by the CLI - thats an adequate trade-off as those images can always be re-added to the system.
2022-12-24T4893: Move ppp-opt ipv6-intf-id to include section accel-pppViacheslav Hletenko
Move PPPoE-server ppp-options XML ipv6-intf-id to 'include' section accel-ppp It allows to use the same code for different accel-ppp services
2022-12-24container: T4870: update to overlay2 driverChristian Poessinger
overlay2 is the preferred storage driver for all currently supported Linux distributions, and requires no extra configuration.
2022-12-23Merge pull request #1724 from sarthurdev/fw_macChristian Poessinger
firewall: T2199: Add mac-address match to destination side
2022-12-23firewall: T2199: Fix typo in `rule-log-level.xml.i` headersarthurdev
2022-12-23firewall: T2199: Add mac-address match to `destination` sidesarthurdev
2022-12-23container: T4870: bump package version 0 -> 1 for filesystem changeChristian Poessinger
move from vfs to overlay driver The following pre iage upgrade script must be executed to have containers after the reboot: for pod in $(cli-shell-api listActiveNodes container name); do systemctl stop vyos-container-${pod//\'}.service done sed -i 's/vfs/overlay/g' /etc/containers/storage.conf /usr/share/vyos/templates/container/storage.conf.j2 rm -rf /usr/lib/live/mount/persistence/container/storage/libpod for pod in $(cli-shell-api listActiveNodes container name); do image=$(cli-shell-api returnActiveValue container name ${pod//\'} image) podman image pull $image systemctl start vyos-container-${pod//\'}.service done for dir in vfs vfs-containers vfs-images vfs-layers; do rm -rf /usr/lib/live/mount/persistence/container/storage/$dir done
2022-12-23Merge pull request #1702 from TGNThump/patch-1Christian Poessinger
container: T4870: Update podman to use overlay storage driver
2022-12-23ipsec: T4594: drop old show_ipsec_sa.py in favor of new implementation in ↵Christian Poessinger
ipsec.py
2022-12-23containers: T4585: remove redundant sudo calls in op-mode scriptChristian Poessinger
2022-12-23ipsec: T2816: do not explicitly call intepreter for python scriptChristian Poessinger
Our python scripts use the shebang logic to set an intepreter - we should rely on this and not use an external interpreter in front of the helper.
2022-12-23wireguard: T3642: drop deprecated CLI commandsChristian Poessinger
2022-12-23pki: T4847: extend dependency on sstpc client interfaceChristian Poessinger
2022-12-23dhcp: T4758: implement missing functionality from old script to new op-mode ↵Christian Poessinger
script Sorting DHCP pools and filtering for state can now be done using the new op-mode mode scripts in DHCP. This allows us to drop the old helpers show_dhcp.py and show_dhcpv6.py.
2022-12-23nat: T4545: implement missing functionality from old script to new op-mode ↵Christian Poessinger
script Remaining functionality to filter NAT translations for a given address got implemented to nat.py - with this cahnge we can drop the old files show_nat*.py
2022-12-23Merge pull request #1723 from aapostoliuk/T4890-sagittaChristian Poessinger
T4890: Fixed op_mode show conntrack table ipv4
2022-12-23T4890: Fixed op_mode show conntrack table ipv4aapostoliuk
Fixed op_mode show conntrack table ipv4 Created check on empty column "mark"
2022-12-22Merge pull request #1720 from jestabro/op-mode-interfacesJohn Estabrook
T4866: rewrite show_interfaces.py show* functions to standardized op-mode
2022-12-21interfaces: T4866: add interfaces.py to op-mode-standardized listJohn Estabrook
2022-12-21interfaces: T4866: call interfaces.py in op-mode-definitionsJohn Estabrook
2022-12-21interfaces: T4866: add standardized op-mode interfaces.pyJohn Estabrook
2022-12-20smoketest: radvd: T4809: add test case for RA source addressChristian Poessinger
2022-12-20op-mode: radvd: T4809: add CLI commands for log displayChristian Poessinger
- show log router-advert - monitor log router-advert
2022-12-20radvd: T4809: fix AdvRASrcAddress missing semicolonChristian Poessinger
Commit 13071a4a ("T4809: radvd: Allow the use of AdvRASrcAddress") added a new feature to set the RA source-address. Unfortunately it missed a semicolon.
2022-12-19graphql: T4887: interpret all boolean options as nullableJohn Estabrook
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-21 04:29:22 +0000