| Age | Commit message (Collapse) | Author |
|---|
|
After deleting a user account and working with a newly added account, we see
that after rebooting in the previously saved configuration, the user is
re-added but it's home directory might have an old UID set on the filesystem.
This is due to the fact that vyos config does not store UIDs. When adding a
user account to the system we now check if the home directory already exists
and adjust the ownership to the new UID.
(cherry picked from commit 3c990f49e2bf9347bd2cc478995baa995ee822fd)
|
|
nat: T5681: relax wording on non existing interface Warning message (backport #2709)
|
|
Remove the word "error" from a Warning only message to not irritate the user.
(cherry picked from commit 9f863a50f1ac6c81782df6c43f7df816d9e11b16)
|
|
smoketest: T5867: extend container tests for IPv4 and IPv6 networks (backport #2710)
|
|
(cherry picked from commit 503e0d1836aa99e34542031fb6c401eb6877eff7)
|
|
ddclient: T5852: add missing priority (backport #2703)
|
|
Running ddclient on a VLAN interface will fail during reboot as there is no
discrete priority to tell that the dynamic DNS service needs to be started
after the interfaces.
(cherry picked from commit ef237a7555843226e9bf48e552ed5feb5df581f4)
|
|
container: T5829: verify container network used supports the given AFI (backport)
|
|
accel-ppp: T5688: Standardized pool configuration in accel-ppp (backport #2501)
|
|
container: T5867: disable healthchecks due to upstream issue (backport #2699)
|
|
op-mode: T5866: Add command to restart IPv6 RA daemon (backport #2698)
|
|
conmon 402de34b31388b5a2e1c <error>: Unable to send container stderr message to parent Broken pipe
https://github.com/containers/conmon/issues/438
(cherry picked from commit 6c84ff41b92d7c2e0b239dca59955e8a247fecdb)
|
|
vyos@vyos:~$ restart router-advert
(cherry picked from commit 9d15c7d3fb21648a52b9c06bdc0a5055f8099119)
|
|
Fixed format of ipv4 pool range from 'x.x.x.x-x.x.x.y'
to 'x.x.x.x-y'
(cherry picked from commit 714a6b1dd5e4de6c85911fa64f4b5f37b44979cf)
|
|
Fixed migration script for pppoe-server
(cherry picked from commit 17722f3ee1151d2e4ccf23655f7079615bf61e24)
|
|
Standardized pool configuration for all accel-ppp services.
1. Only named pools are used now.
2. Allows all services to use range in x.x.x.x/mask
and x.x.x.x-x.x.x.y format
3. next-pool can be used in all services
2. Allows to use in ipoe gw-ip-address without pool configuration
which allows to use Fraimed-IP-Address attribute by radius.
3. Default pool name should be explicidly configured
with default-pool.
4. In ipoe netmask and range subnet can be different.
(cherry picked from commit 422eb463d413da812eabc28706e507a9910d7b53)
|
|
(cherry picked from commit 405cc66041d8035500f7b7116301983c48464a9b)
|
|
(cherry picked from commit e70ca62c474b4e2cc135851a6e5cceee037bf378)
|
|
ddclient: T5144,T5791: Consolidated backport for dynamic dns updates and fixes
|
|
We always enable HTTPS in ddclient configuration, however
`http://checkip.dyndns.org` is HTTP only and does not support HTTPS.
Warn the user if they are using this service.
Also, make `url` in `web-options` mandatory.
|
|
Legacy ddclient allowed arbitrary URLs in web-options, but the new
has stricter validations. Apply migration to the old URLs.
Also migrate checkip.dyndns.org to https://domains.google.com/checkip
for better TLS support.
|
|
When migrating from `service dns dynamic interface <interface> ...` to
`service dns dynamic address <address> ...`, the config name can
potentially have a conflict when `address == 'web'`.
Although the `/run/ddclient/ddclient.conf` that was generated earlier
was incorrect, one could still potentially have misconfigured VyOS
config without realizing it.
We now append the old <interface> name to the config name to avoid
conflict.
|
|
Since `service dns dynamic address <address> service <service> ...`
changed to `service dns dynamic name <service> address <address> ...`,
the resulting service and address config flip can result in conflicting
`service` name.
Additionally, since dynamic DNS service name now have name constraint,
we need to normalize the service name to conform with the constraint.
We now migrate the service name to (service|rfc2136)-<service>-<address>
to avoid the conflict and optionally append an index if there is still a
name conflict after normalization.
|
|
Enforce constraint on Dynamic DNS service name to be alphanumeric
(including hyphens and underscores).
|
|
|
|
|
|
ethernet: T5566: disable energy efficient ethernet (EEE) for interfaces (backport #2689)
|
|
VyOS is a routing (packet pushing) platform, thus supporting EEE which
potentially causes issues is not a good idea. Some recent Intel drivers enable
EEE by default, thus we will disable this for every NIC supporting EEE.
(cherry picked from commit ab30509b25d54dac99294b76ba03fd49c3d2c946)
|
|
snmp: T5855: migrate "set service lldp snmp enable" to "set service lldp snmp" (backport #2687)
|
|
(cherry picked from commit a9201e77110ce0695e2ba879304aef41b7ac9a0c)
|
|
(cherry picked from commit 2490f22408ad811ff9f63ec970d0167ecbf4ab59)
|
|
configdict: T5837: add support to return added nodes when calling node_changed() (backport #2682)
|
|
In the past, node_changed() suggested it would also return nodes that got added
(function comment) but in reality only deleted keys got accounted for.
This commit changes the signature and adds an argument expand_nodes to specify
the users interest of a node was deleted (default), added (expand_nodes=Diff.ADD)
or even both (expand_nodes=Diff.ADD|Diff.DELETE).
(cherry picked from commit 4ee4064705ebd1e1a6a59be0c6df3b96755a067e)
|
|
node_changed() will return a list of changed keys under "path". We are not
always interested what changed, sometimes we are only interested if something
changed at all, that what vyos.configdict.is_node_changed() is for.
(cherry picked from commit 5e7a8288d06a6d6beee5e1abd2e06698ab778650)
|
|
snmp: 5856: fix service removal error (backport #2683)
|
|
When deleting SNMP from CLI the 'delete' key was not honored in the config
dictionary, leading to a false process startup causing the following error:
Job for snmpd.service failed because the control process exited with error code.
See "systemctl status snmpd.service" and "journalctl -xeu snmpd.service" for details.
(cherry picked from commit 20b98e780fda4131eb242921884d4955147ce51a)
|
|
T160: NAT64 add match firewall mark feature (backport #2677)
|
|
Match mark allows to use firewall marks of packet to use
a specific pool
Example of instance config /run/jool/instance-100.json
```
...
"pool4": [
{
"protocol": "TCP",
"prefix": "192.0.2.10",
"port range": "1-65535",
"mark": 23
},
...
```
(cherry picked from commit 8e1e79cfa24c155c8d504822fbbd3c20f890fb70)
|
|
xml: T5854: clear empty paths left by embedded override of defaultValue (backport #2679)
|
|
(cherry picked from commit 89cd75b8dbe5cc145a4423bf10faa76fd6bdcdbf)
|
|
(cherry picked from commit c4f9c936c9fdd32e7f6258c0dfa8c8cf6057998d)
|
|
nat66: T2898: build fix after ndp-proxy backport
|
|
|
|
T2898: add ndp-proxy service (backport #2665)
|
|
VyOS CLI command
set service ndp-proxy interface eth0 prefix 2001:db8::/64 mode 'static'
Will generate the following NDP proxy configuration
$ cat /run/ndppd/ndppd.conf
# autogenerated by service_ndp-proxy.py
# This tells 'ndppd' how often to reload the route file /proc/net/ipv6_route
route-ttl 30000
# This sets up a listener, that will listen for any Neighbor Solicitation
# messages, and respond to them according to a set of rules
proxy eth0 {
# Turn on or off the router flag for Neighbor Advertisements
router no
# Control how long to wait for a Neighbor Advertisment message before invalidating the entry (milliseconds)
timeout 500
# Control how long a valid or invalid entry remains in the cache (milliseconds)
ttl 30000
# This is a rule that the target address is to match against. If no netmask
# is provided, /128 is assumed. You may have several rule sections, and the
# addresses may or may not overlap.
rule 2001:db8::/64 {
static
}
}
(cherry picked from commit 4d721a58020971d00ab854c37b68e88359999f9c)
|
|
srv6: T591: enable SR enabled packet processing on defined interfaces (backport #2663)
|
|
The Linux Kernel needs to be told if IPv6 SR enabled packets whether should be
processed or not. This is done using
/proc/sys/net/conf/<iface>/seg6_* variables:
seg6_enabled - BOOL
Accept or drop SR-enabled IPv6 packets on this interface.
Relevant packets are those with SRH present and DA = local.
0 - disabled (default)
not 0 - enabled
Or the VyOS CLI command:
* set protocols segment-routing interface eth0 srv6
(cherry picked from commit 774cc97eda61eb0b91df820797fb3c705d0073d5)
|
|
Enable/Disable VRF strict mode, when net.vrf.strict_mode=0 (default) it is
possible to associate multiple VRF devices to the same table. Conversely, when
net.vrf.strict_mode=1 a table can be associated to a single VRF device.
A VRF table can be used by the VyOS CLI only once (ensured by verify()), this
simply adds an additional Kernel safety net, but a requirement for IPv6 segment
routing headers.
(cherry picked from commit 10701108fecb36f7be7eb7ef5f1e54e63da5fb4e)
|
|
T5804: nat: remove inbound|outbound interface from old configuration when it was set to <any>. (backport #2611)
|
|
dhcp: T5846: Ensure DUID regex range is bound (backport #2670)
|
