summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-08-02pbr: T3702: Add rules match fwmarkViacheslav
2021-07-25tunnel: T3366: re-order migration scriptsChristian Poessinger
The migrator from 20-to-21 is required as 19-to-20 on VyOS 1.3 - thus simply rename/reorder the two migrators to not break things the hard way when upgrading from 1.3 -> 1.4.
2021-07-25ifconfig: T2653: obey conding styleChristian Poessinger
2021-07-25xml: tunnel: use source-interface building blockChristian Poessinger
2021-07-25ipsec: T1210: add RADIUS authentication for remote-access IKEv2 VPNChristian Poessinger
set vpn ipsec remote-access connection rw authentication client-mode 'eap-radius' set vpn ipsec remote-access connection rw authentication id '192.0.2.1' set vpn ipsec remote-access connection rw authentication server-mode 'x509' set vpn ipsec remote-access connection rw authentication x509 ca-certificate 'CAcert_Class_3_Root' set vpn ipsec remote-access connection rw authentication x509 certificate 'vyos' set vpn ipsec remote-access connection rw esp-group 'ESP-RW' set vpn ipsec remote-access connection rw ike-group 'IKE-RW' set vpn ipsec remote-access connection rw local-address '192.0.2.1' set vpn ipsec remote-access connection rw pool 'ra-rw-ipv4' set vpn ipsec remote-access connection rw unique 'never' set vpn ipsec remote-access pool ra-rw-ipv4 name-server '192.0.2.2' set vpn ipsec remote-access pool ra-rw-ipv4 prefix '192.168.22.0/24' set vpn ipsec remote-access radius nas-identifier 'fooo' set vpn ipsec remote-access radius server 172.16.100.10 key 'secret'
2021-07-25xml: add building block for RADIUS nas-identifierChristian Poessinger
2021-07-25ipsec: T1210: move DHCP server configuration unter remote-access nodeChristian Poessinger
As this is only related to remote-access, keeping it under "options" simply feels wrong.
2021-07-23Merge pull request #939 from sarthurdev/pki_fileChristian Poessinger
pki: T3642: Add ability to write generated certificates/keys to files
2021-07-23frr: T2175: remove no longer required loop when removing routing protocolsChristian Poessinger
2021-07-23login: T3699: verify system username does not conflict with Linux base usersChristian Poessinger
(cherry picked from commit 7292631373ea50f9908796ef2eda32e672d1df2e)
2021-07-23pki: T3642: Add ability to write generated certificates/keys to specified ↵sarthurdev
filenames
2021-07-22op-mode: xml: rename definition file for "generate wireguard" commandChristian Poessinger
2021-07-22pki: wireguard: T3642: remove obsolete op-mode scriptChristian Poessinger
As the keys are now stored inside the CLI configuration and no longer in a file on the filesystem, this command is no longer required. Also there are dedicated CLI commands available to display the additional Wireguard information. - show interfaces wireguard wg10 - show interfaces wireguard wg10 summary
2021-07-22pki: wireguard: T3642: remove obsolete "show wireguard keypairs" commandChristian Poessinger
As the keys are now stored inside the CLI configuration and no longer in a file on the filesystem, this command is no longer required.
2021-07-22pki: wireguard: T3642: remove obsolete "delete wireguard keypair" commandChristian Poessinger
As the keys are now stored inside the CLI configuration and no longer in a file on the filesystem, this command is no longer required.
2021-07-22Merge pull request #937 from jack9603301/T3698Christian Poessinger
bridge: op-mode: T3698: Support bridge monitoring
2021-07-22pki: wireguard: T3642: add new op-mode command for public-keyChristian Poessinger
Per interface public-key can now be retrieved via: vyos@vyos:~$ show interfaces wireguard wg10 public-key +XZr0oUjYRQuB/kcO1f+puOjKkiOWBG8eZX1Jpyq2n0=
2021-07-22xml: op-mode: move "show interfaces wireguard" to dedicated fileChristian Poessinger
2021-07-23bridge: op-mode: T3698: Support bridge monitoringjack9603301
2021-07-22ipsec: T2816: remove "auto-update" CLI optionChristian Poessinger
Update/refresh of DNS records is now handled internally by Strongswan.
2021-07-22xml: add building block for "local-users"Christian Poessinger
2021-07-22Merge pull request #936 from jack9603301/T3667Christian Poessinger
bridge: op-mode: T3667: Fix displaying members of a specific bridge interface
2021-07-22Merge pull request #935 from sarthurdev/pki_httpsChristian Poessinger
pki: https: T3642: Migrate HTTPS to use PKI configuration
2021-07-23bridge: op-mode: T3667: Fix displaying members of a specific bridge interfacejack9603301
2021-07-22pki: https: T3642: Migrate HTTPS to use PKI configurationsarthurdev
2021-07-22Merge pull request #934 from sarthurdev/pki_openvpnChristian Poessinger
pki: openvpn: T3642: Migrate OpenVPN to PKI and refactor
2021-07-21pki: openvpn: T3642: Migrate OpenVPN to PKI and refactorsarthurdev
2021-07-20ipsec: T1210: create uuid from empty string in ios profileChristian Poessinger
2021-07-20ipsec: T1210: add op-mode command for macOS and iOS profile generationChristian Poessinger
generate ipsec mac-ios-profile <connection> remote <ip|fqdn> will generate a matching IPSec profile which can be loaded on an iOS device.
2021-07-20Merge pull request #931 from sarthurdev/pki_eapolChristian Poessinger
pki: eapol: T3642: Migrate EAPoL to use PKI configuration
2021-07-20pki: eapol: T3642: Migrate EAPoL to use PKI configurationsarthurdev
2021-07-20pki: T3642: Fix Wireguard migration commentsarthurdev
2021-07-20Merge pull request #930 from sarthurdev/pki_migrationChristian Poessinger
pki: openconnect: sstp: T3642: Migrate OpenConnect and SSTP to PKI configuration
2021-07-20pki: sstp: T3642: Migrate SSTP to PKI configurationsarthurdev
2021-07-20pki: openconnect: T3642: Migrate OpenConnect SSL to PKI configurationsarthurdev
2021-07-19vrf: T3655: fix potential error when removing VRF connection tracking tableChristian Poessinger
This extends commit 22791e26 ("VRF: T3655: proper connection tracking for VRFs") so that when the netfilter table is removed, we first check if it exists at all, and if it does not exist we do not remove it. This fixes the smoketest error: PermissionError: [Errno 1] failed to run command: nft delete table inet vrf_zones
2021-07-19Merge pull request #929 from sarthurdev/pki_wgChristian Poessinger
pki: wireguard: T3642: Migrate Wireguard private key directly into CLI
2021-07-19pki: wireguard: T3642: Replace/remove old Wireguard op-mode commandssarthurdev
2021-07-19pki: wireguard: T3642: Migrate Wireguard private key directly into CLIsarthurdev
Also renames peer pubkey to public-key for consistency
2021-07-19ipsec: T1210: add "unique" option to specify how to handle multiple connectionsChristian Poessinger
Connection uniqueness policy to enforce. To avoid multiple connections from the same user, a uniqueness policy can be enforced. * never: never enforce such a policy, even if a peer included INITIAL_CONTACT notification * keep: reject new connection attempts if the same user already has an active connection * replace: delete any existing connection if a new one for the same user gets established To compare connections for uniqueness, the remote IKE identity is used. If EAP or XAuth authentication is involved, the EAP-Identity or XAuth username is used to enforce the uniqueness policy instead.
2021-07-19ipsec: T1210: split out pool from remote-access configurationChristian Poessinger
Remote access IP pools can now be defined at a global level and referenced in IPSec remote-access connections. To defined a pool use: set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1' set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24' set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1' set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64' A connection can then reference the pool: set vpn ipsec remote-access connection foo pool 'global-ipv4' set vpn ipsec remote-access connection foo pool 'global-ipv6'
2021-07-18ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixesChristian Poessinger
... this enables a dual-stack IKEv2 VPN deployment.
2021-07-18ipsec: T2816: limit remote-access nameservers to two IPv4 and two for IPv6Christian Poessinger
2021-07-18ipsec: l2tp: T2816: use common if 'key' in dict patternChristian Poessinger
2021-07-18Revert "T3641: fastnetmon package is not available for Debian Bullseye"Christian Poessinger
This reverts commit 70f7f06e778efa4bd3c2ad127d66c080e1db80c5.
2021-07-18smoketest: ospf: extend passive-interface debugging with kernel logChristian Poessinger
2021-07-18bridge: remove obsolete helper scriptChristian Poessinger
2021-07-17ipsec: T2816: add missing +x permission on Python helperChristian Poessinger
2021-07-17Merge pull request #927 from zdc/T3655-sagittaChristian Poessinger
VRF: T3655: proper connection tracking for VRFs
2021-07-17VRF: T3655: proper connection tracking for VRFszsdc
Currently, all VRFs share the same connection tracking table, which can lead to problems: - traffic leaks to a wrong VRF - improper NAT rules handling when multiple VRFs contain the same IP networks - stateful firewall rules issues The commit implements connection tracking zones support. Each VRF utilizes its own zone, so connections will never mix up. It also adds some restrictions to VRF names and assigned table numbers, because of nftables and conntrack requirements: - VRF name should always start from a letter (interfaces that start from numbers are not supported in nftables rules) - table number must be in the 100-65535 range because conntrack supports only 65535 zones
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-15 07:46:13 +0000