summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-10-20T5541: firewall: re-add zone-based firewall.Nicolas Fort
2023-10-19Merge pull request #2383 from vyos/mergify/bp/sagitta/pr-2378Christian Breunig
bridge: T5670: add missing constraint on "member interface" node (backport #2378)
2023-10-19vyos.configdict: T5670: move from str to list when calling conf.exists()Christian Breunig
We have had a mix of both string and list arguments to conf.exists(), stremaline this to only make use of list calls. (cherry picked from commit 3f17de7c32621353b51f782ca889a83cad7a6cfd)
2023-10-19bridge: T5670: add missing constraint on "member interface" nodeChristian Breunig
One could specify a bridge member of VXLAN1 interface, but it is not possible to create a VXLAN interface with the name of VXLAN1 - prohibited by VXLAN interface name validator. Add missing interface-name validator code (cherry picked from commit 45dc149e4e3c0c294deac6fd541bb027d2280ea1)
2023-10-19Merge pull request #2380 from vyos/mergify/bp/sagitta/pr-2377Christian Breunig
cluster: T2897: add a migration script for converting cluster to VRRP (backport #2377)
2023-10-19cluster: T2897: add a migration script for converting cluster to VRRPDaniil Baturin
(cherry picked from commit 4c4c2b1f8a58398798f20c252bde80461320d330)
2023-10-18Merge pull request #2375 from vyos/mergify/bp/sagitta/pr-2374Viacheslav Hletenko
pmacct: T5232: Fixed socket parameters for trigger-packets (backport #2374)
2023-10-18pmacct: T5232: Fixed socket parameters for trigger-packetszsdc
This fixes sending packets to uacctd using a socket. (cherry picked from commit 7a0af0d00bae9179c89155e4b2e6ce94abb29c05)
2023-10-17Merge pull request #2372 from vyos/mergify/bp/sagitta/pr-2371Christian Breunig
configdep: T5662: fix incorrect inspect.stack index of calling script (backport #2371)
2023-10-17configdep: T5662: fix incorrect inspect.stack index of calling scriptJohn Estabrook
(cherry picked from commit eff58d8b8842e0bac9fe123cebf93801a92f05d3)
2023-10-16Merge pull request #2368 from vyos/mergify/bp/sagitta/pr-2367Christian Breunig
op-mode: T5642: 'generate tech-support archive' moved to vyos-1x (backport #2367)
2023-10-16op-mode: T5642: 'generate tech-support archive' moved to vyos-1xaapostoliuk
'generate tech-support archive' moved to vyos-1x. Output of 'show tech-support report' command is added to archive. The default location of the archive is moved to '/tmp'. The script is rewritten to Python. (cherry picked from commit 65911b17340a7894aba973113d83ab43964bbf99)
2023-10-15Merge pull request #2356 from vyos/mergify/bp/sagitta/pr-2342Viacheslav Hletenko
T5165: Implement policy local-route source and destination port (backport #2342)
2023-10-14Merge pull request #2365 from vyos/mergify/bp/sagitta/pr-2359Daniil Baturin
remote: T5650: Resize-aware progressbar implementation (backport #2359)
2023-10-14remote: T5650: Resize-aware progressbar implementationerkin
(cherry picked from commit 799d24eba18d6710219b7380cbafb954b9eec5ce)
2023-10-14Merge pull request #2364 from vyos/mergify/bp/sagitta/pr-2361Christian Breunig
pmacct: T5232: Fixed pmacct service control via systemctl (backport #2361)
2023-10-14pmacct: T5232: Fixed pmacct service control via systemctlzsdc
pmacct daemons have one very important specific - they handle control signals in the same loop as packets. And packets waiting is blocking operation. Because of this, when systemctl sends SIGTERM to uacctd, this signal has no effect until uacct receives at least one packet via nflog. In some cases, this leads to a 90-second timeout, sending SIGKILL, and improperly finished tasks. As a result, a working folder is not cleaned properly. This commit contains several changes to fix service issues: - add a new nftables table for pmacct with a single rule to get the ability to send a packet to nflog and unlock uacctd - remove PID file options from the uacctd and a systemd service file. Systemd can detect proper PID, and PIDfile is created by uacctd too late, which leads to extra errors in systemd logs - KillMode changed to mixed. Without this, SIGTERM is sent to all plugins and the core process exits with status 1 because it loses connection to plugins too early. As a result, we have errors in logs, and the systemd service is in a failed state. - added logging to uacctd - systemctl service modified to send packets to specific address during a service stop which unlocks uacctd and allows systemctl to finish its work properly (cherry picked from commit e364e9813b6833f6b108e7177ef7ea2d9e7bac33)
2023-10-13Merge pull request #2350 from vyos/mergify/bp/sagitta/pr-2349Christian Breunig
T5489: Change default qdisc from 'fq' to 'fq_codel' (backport #2349)
2023-10-12Merge pull request #2360 from vyos/mergify/bp/sagitta/pr-2358John Estabrook
xml: T5649: catch errors from schema validation before generating cache (backport #2358)
2023-10-12xml: T5649: catch errors from schema validation before generating cacheJohn Estabrook
(cherry picked from commit 126a67ade9cd045e0ff60b0b9eb9b5680e8a29d0)
2023-10-11Merge pull request #2354 from vyos/mergify/bp/sagitta/pr-2352John Estabrook
http-api: T2612: correct the response message and add reload for api self-configuration (backport #2352)
2023-10-11T5165: Implement policy local-route source and destination portViacheslav Hletenko
Add `policy local-route` source and destination port set policy local-route rule 23 destination port '222' set policy local-route rule 23 protocol 'tcp' set policy local-route rule 23 set table '123' set policy local-route rule 23 source port '8888' % ip rule show prio 23 23: from all ipproto tcp sport 8888 dport 222 lookup 123 (cherry picked from commit ff43733074675b94ce4ead83fe63870b6cf953c5)
2023-10-10http-api: T2612: reload server within configsession for api self-configJohn Estabrook
(cherry picked from commit 93d2ea7d635c7aa5acf3000654393ea48b7c6405)
2023-10-10http-api: T2612: send response before reconfiguring api serverJohn Estabrook
(cherry picked from commit 7d597a6dca15cb592230b349ef7ef565f258cf43)
2023-10-08Change to BBR as TCP congestion control, or at least make it an config optionApachez
(cherry picked from commit ac1bd7c2f69e058f54084decbfe6b6d329df6462)
2023-10-07Merge pull request #2346 from vyos/mergify/bp/sagitta/pr-2335Christian Breunig
pppoe: T5630: allow to specify MRU in addition to already configurable MTU (backport #2335)
2023-10-07pppoe: T5630: verify MRU is less or equal then MTUChristian Breunig
(cherry picked from commit e357258e645cf85de0035d4ecfbf99db4dd90f7e)
2023-10-07pppoe: T5630: allow to specify MRU in addition to already configurable MTUChristian Breunig
Set the MRU (Maximum Receive Unit) value to n. PPPd will ask the peer to send packets of no more than n bytes. The value of n must be between 128 and 16384, the default was always 1492 to match PPPoE MTU. A value of 296 works well on very slow links (40 bytes for TCP/IP header + 256 bytes of data). Note that for the IPv6 protocol, the MRU must be at least 1280. CLI: set interfaces pppoe pppoe0 mru 1280 (cherry picked from commit e062a8c11856f213983f5b41f50d4f9dbc0dde0f)
2023-10-05Merge pull request #2341 from vyos/mergify/bp/sagitta/pr-2339John Estabrook
config: T5631: save copy of config in JSON format on commit (backport #2339)
2023-10-05config: T5631: save copy of config in JSON format on commitJohn Estabrook
(cherry picked from commit 27605426a4ad613f45d36e7db5b1664dc3192981)
2023-10-05Merge pull request #2340 from vyos/mergify/bp/sagitta/pr-2338John Estabrook
T4320: remove references to obsoleted legacy version files (backport #2338)
2023-10-05T4320: remove references to obsoleted legacy version filesJohn Estabrook
(cherry picked from commit aeb0138c9df73b57489eced152f026c0666d1ee5)
2023-10-05Merge pull request #2337 from vyos/mergify/bp/sagitta/pr-2336Christian Breunig
login: T5521: do not call system-login.py in vyos-router init (backport #2336)
2023-10-04login: T5521: do not call system-login.py in vyos-router initChristian Breunig
Calling system-login.py with no mounted VyOS config has the negative effect that the script will not detect any local useraccounts and thus assumes they all need to be removed from the password backend. As soon as the VyOS configuration is mounted and the CLI content is processed, system-login.py get's invoked and re-creates the before deleted user accounts. As the account names are sorted in alphabetical order, the name <-> UID mapping can get mixed up during system reboot. The intention behind calling system-login.py from vyos-router init was to reset system services (PAM, NSS) back to sane defaults with the defaults provided via system-login.py. As PAM is already reset in vyos-router startup script, /etc/nsswitch.conf was the only candidate left. This is now accomplished by simply creating a standard NSS configuration file tailored for local system accounts. This is the second revision after the first change via commit 64d32329958 ("login: T5521: home directory owner changed during reboot") got reverted. (cherry picked from commit 12069d5653034b46a47430353c3867b3678c196f)
2023-10-04Revert "login: T5521: home directory owner changed during reboot"Christian Breunig
This reverts commit 074870dad33d80e78128736f9e89bdfa1a0e08fd.
2023-10-03Merge pull request #2334 from vyos/mergify/bp/sagitta/pr-2331Christian Breunig
login: T5521: home directory owner changed during reboot (backport #2331)
2023-10-03login: T5521: home directory owner changed during rebootChristian Breunig
During system startup the system-login.py script is invoked by vyos-router systemd service. As there is no complete configuration available at this point in time - and the sole purpose of this call is to reset/re-render the system NSS/PAM configs back to default - it accidently also deleted the local useraccounts. Once the VyOS configuration got mounted, users got recreated in alphabetical order and thus UIDs flipped and the /home suddenely belonged to a different account. This commit prevents any mangling with the local userdatabase during VyOS bootup phase. (cherry picked from commit 64d323299586da646ca847e78255ff2cd8464578)
2023-10-03Merge pull request #2332 from vyos/mergify/bp/sagitta/pr-2326Daniil Baturin
T5436: Add missing preconfig-script (backport #2326)
2023-10-03T5436: Add missing preconfig-scriptApachez
(cherry picked from commit 646f08fc5a302e08aad90af3fa0ee32e138ee585)
2023-10-03Merge pull request #2329 from vyos/mergify/bp/sagitta/pr-2328Christian Breunig
login: T5628: fix spwd deprecation warning (backport #2328)
2023-10-03login: T5628: fix spwd deprecation warningChristian Breunig
vyos@vyos:~$ show system login users Username Type Locked Tty From Last login ---------- ------ -------- ----- ------------- ------------------------ vyos vyos False pts/0 172.16.33.139 Mon Oct 2 20:42:24 2023 (cherry picked from commit 80f08af76db0ccee4d6dc1a99b6d8d90884fa33f)
2023-10-02Merge pull request #2327 from vyos/mergify/bp/sagitta/pr-2325Christian Breunig
T5165: Migrate policy local-route rule x destination to address (backport #2325)
2023-10-02T5165: Migrate policy local-route rule x destination to addressViacheslav Hletenko
Migrate policy local-route <destination|source> to node address replace 'policy local-route{v6} rule <tag> destination|source <x.x.x.x>' => 'policy local-route{v6} rule <tag> destination|source address <x.x.x.x>' (cherry picked from commit 9f7a5f79200782f7849cab72f55a39dedf45f214)
2023-09-28Merge pull request #2321 from vyos/mergify/bp/sagitta/pr-2307vyos/1.4dev1Christian Breunig
mdns: T5615: Allow controlling IP version to use for mDNS repeater (backport #2307)
2023-09-28mdns: T5615: Rename avahi-daemon config fileIndrajit Raychaudhuri
Rename avahi-daemon config file to avahi-daemon.conf.j2 to match the convention used by other config files. (cherry picked from commit 3a3123485f2ea7b253caa1c49f19c82a0eaa0b37)
2023-09-28mdns: T5615: Allow controlling IP version to use for mDNS repeaterIndrajit Raychaudhuri
This commit adds a new configuration option to the mDNS repeater service to allow controlling which IP version to use for mDNS repeater. Additionally, publishing AAAA record over IPv4 and A record over IPv6 is disabled as suggested. See: - https://github.com/lathiat/avahi/issues/117#issuecomment-1651475104 - https://bugzilla.redhat.com/show_bug.cgi?id=669627#c2 (cherry picked from commit e66f7075ee12ae3107d29efaf683442c3535e8b9)
2023-09-28Merge pull request #2319 from vyos/mergify/bp/sagitta/pr-2313Christian Breunig
T5165: Add option protocol for policy local-route (backport #2313)
2023-09-28Merge pull request #2320 from vyos/mergify/bp/sagitta/pr-2306Christian Breunig
firewall: T5614: Add support for matching on conntrack helper (backport #2306)
2023-09-28firewall: T5614: Add support for matching on conntrack helpersarthurdev
(cherry picked from commit 81dee963a9ca3224ddbd54767a36efae5851a001)
2023-09-28T5165: Add option protocol for policy local-routeViacheslav Hletenko
Add option `protocol` for policy local-route set policy local-route rule 100 destination '192.0.2.12' set policy local-route rule 100 protocol 'tcp' set policy local-route rule 100 set table '100' (cherry picked from commit 96b8b38a3c17aa08fa964eef9141cf89f1c1d442)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-29 17:32:33 +0000