summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-04-28haproxy: T7122: render explicit http configuration to properly bind port 80Christian Breunig
If redirect-http-to-https is set we will render a discrete onfiguration in HAproxy to properly claim port 80 in the system to detect if a service is alreadey using the port or not.
2025-04-28vyos.utils: T7122: fix IPv6 support in check_port_availability()Christian Breunig
Commit 4523e9c897b3 ("wireguard: T3763: Added check for listening port availability") added a function to check if a port is free to use or already occupied by a different running service. This has been done by trying to bind a socket to said given port. Unfortunately there is no support for IPv6 address-fdamily in both socketserver.TCPServer or socketserver.UDPServer. This must be done manually by deriving TCPServer and setting self.address_family for IPv6. The new implementation gets rid of both TCPServer and UDPServer and replaces it with a simple socket binding to a given IPv4/IPv6 address or any interface/ address if unspecified. In addition build time tests are added for the function to check for proper behavior during build time of vyos-1x.
2025-04-25Merge pull request #4475 from c-po/vxlan-T7400Christian Breunig
smoketest: T7400: fix unbound variable when checking VXLAN remote and group settings
2025-04-25image_installer: T7394: add system image raise "Error: argument of type ↵Christian Breunig
'NoneType' is not iterable" (#4471) Co-authored-by: canoziia <canoziia@qq.com>
2025-04-25smoketest: T7400: fix unbound variable when checking VXLAN remote and group ↵Christian Breunig
settings FAIL: test_vxlan_group_remote_error (__main__.VXLANInterfaceTest.test_vxlan_group_remote_error) ---------------------------------------------------------------------- Traceback (most recent call last): File "/usr/libexec/vyos/tests/smoke/cli/test_interfaces_vxlan.py", line 139, in test_vxlan_group_remote_error self.assertIn('Both group and remote cannot be specified', str(exception)) AssertionError: 'Both group and remote cannot be specified' not found in '[[interfaces vxlan vxlan60]] failed\nCommit failed\n' This happens because cm variable is accessed when no longer valid. Change behavior to match common smoketest style, check ConfigError exception - but do not check exception message. Fix the error and commit again.
2025-04-25Merge pull request #4457 from l0crian1/t7358-add-offload-to-global-stateViacheslav Hletenko
firewall: T7358: add offload option to global state policy
2025-04-25image_installer: T7394: add system image raise "Error: argument of type ↵canoziia
'NoneType' is not iterable"
2025-04-24Merge pull request #4469 from KawaiiNetworks/currentDaniil Baturin
bgp: T7220: Add the option to disable enforce-first-as at peer level
2025-04-24Merge pull request #4414 from markh0338/op-fw-dyn-grpsDaniil Baturin
T7282: op-mode: show firewall group filtering and tab completion update
2025-04-24Merge pull request #4442 from srividya0208/T7316Daniil Baturin
T7316: Add MTU validation for interfaces with MTU less then 1200
2025-04-24T7220: Add the option to disable enforce-first-as at peer levelcanoziia
2025-04-23router-advert: T7380: Implement auto-ignore-prefix syntax for router ↵Ryan Zuwala
advertisements (#4463)
2025-04-23Merge pull request #4465 from MattKobayashi/T6253Christian Breunig
dhclient: T6253: Respect `no-default-route`
2025-04-23Merge pull request #4467 from c-po/ipv6-nd-fixesChristian Breunig
interface: T4627: not every interface type supports IPv6 interface-identifiers
2025-04-23interface: T4627: not every interface type supports IPv6 interface-identifiersChristian Breunig
Turns out commit b124f0b3b ("interface: T4627: support IPv6 Interface Identifier (token) for SLAAC") uncovered a wrong assumption in VyOS that every interface type in use always supports SLAAC and IPv6-ND (neighbor discovery). This is not true for WireGuard, Tunnel and VTI interfaces, thus do not provide that CLI option. In addition SLAAC support should be removed for those interface types in a future PR.
2025-04-23Merge pull request #4460 from c-po/systemd-syslogViacheslav Hletenko
syslog: T7367: ensure rsyslog is registered as default systemd syslog service
2025-04-23Merge pull request #4461 from c-po/slaac-removalViacheslav Hletenko
interface: T7375: cleanup SLAAC assigned address and default route after removing SLAAC CLI configuration
2025-04-22Merge pull request #4419 from sskaje/T5636Daniil Baturin
geoip: T5636: Add geoip for policy route/route6
2025-04-22Merge pull request #4392 from symysak/T4627Daniil Baturin
interface: T4627: support setting of IPv6 Interface Identifier(Token)
2025-04-22Merge pull request #4444 from l0crian1/T7322-fix-allowed-vlanDaniil Baturin
bridge: T7322: fix slow performance of allowed vlan
2025-04-22Merge pull request #4466 from aapostoliuk/T7383-rollingDaniil Baturin
ospf: T7383: Fixed unconfigured redistribution of nhrp into ospf
2025-04-22T6773: RFC-2136 support for Kea DHCP4 server (#4153)Alex Bukharov
2025-04-22interface: T7379: do not request SLAAC default route when only DHCPv6 is setChristian Breunig
When an interface runs in DHCPv6 only mode, there is no reason to have a default installed that was received via SLAAC. If SLAAC is needed, it should be turned on explicitly. This bug was only triggered during system boot where a DHCPv6 client address and a default route to a link-local address was shown in the system. If DHCPv6 was enabled only on an interface while VyOS was already running - no default route got installed.
2025-04-22sysctl: T7379: always disable IPv6 autoconf and accept_ra during startupChristian Breunig
2025-04-22interface: T7375: routes received via SLAAC are not cleared on exitChristian Breunig
When using SLAAC for IPv6 addresses we will also receive a default route via a RA (Router Advertisement). When we disable SLAAC on a interface the Linux Kernel does not automatically flush all addresses nor the routes received. The Kernel wait's until the addresses/prefixes/routes expire using their lifestime setting. When removing SLAAC from an interface, also remove the auto generated IPv6 address and both the default router received and the connected IP prefix of the SLAAC advertisement.
2025-04-22interface: T7375: remove superfluous "ifname = self.ifname" assignmentChristian Breunig
We can reference "self.ifname" in any Python f-ormatted string directly. No need for an interim temporary variable.
2025-04-22interface: T7375: SLAAC assigned address is not cleared when removing SLAACChristian Breunig
2025-04-22T7282: op-mode: update op-mode template build script to concatenate with ; ↵Mark Hayes
instead of &&
2025-04-22T7282: op-mode: update firewall completion paths to include all group typesMark Hayes
2025-04-22T7282: op-mode: update firewall.py for proper group filteringMark Hayes
2025-04-22ospf: T7383: Fixed unconfigured redistribution of nhrp into ospfaapostoliuk
Fixed unconfigured redistribution of nhrp into ospf.
2025-04-22dhclient: T6253: Respect `no-default-route`Matthew Kobayashi
2025-04-20Merge pull request #4462 from kumvijaya/currentChristian Breunig
T7334: pr mirror trigger workflow added with label creation permission for default github token
2025-04-20T7334: pr mirror trigger workflow added with label creation permission for ↵kumvijaya
default github token
2025-04-19T7358: add offload option to global state policyl0crian1
- Added smoketest for offload in global state policy
2025-04-18interface: T4627: support IPv6 Interface Identifier (token) for SLAACYoshiaki Suyama
Add common IPv6 CLI option (use ethernet as example): set interfaces ethernet eth0 ipv6 address interface-identifier Co-authored-by: Christian Breunig <christian@breunig.cc>
2025-04-18syslog: T7367: use generic systemd syslog.service over rsyslog.serviceChristian Breunig
2025-04-18syslog: T7367: ensure rsyslog is registered as default systemd syslog serviceChristian Breunig
Systemd states: The default syslog implementation should make syslog.service a symlink to itself, so that this socket activates the right actual syslog service.
2025-04-18firewall: T7358: add offload option to global state policyl0crian1
- fixed CI smoketest failures (again)
2025-04-18firewall: T7358: add offload option to global state policyl0crian1
- Fixed CI smoketest failures
2025-04-18firewall: T7370: Add conntrack log commands (#4459)l0crian1
* firewall: T7370: Add conntrack log commands Added the following commands: show log conntrack show log conntrack event new show log conntrack event update show log conntrack event destroy * firewall: T7370: Add conntrack log commands Added the following commands: show log conntrack show log conntrack event new show log conntrack event update show log conntrack event destroy * firewall: T7370: Add conntrack log commands Added the following commands: show log conntrack show log conntrack event new show log conntrack event update show log conntrack event destroy * Fix capitalization --------- Co-authored-by: l0crian1 <ryan.claridge13@gmail.com> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2025-04-18Merge pull request #4458 from l0crian1/t7369-allow-state-policy-log-opDaniil Baturin
firewall: T7369: Match global state policies in show firewall
2025-04-17Merge pull request #4453 from c-po/kernel-cmdline-T7327Christian Breunig
grub: T7327: honor "system option kernel" settings during image upgrade
2025-04-17Merge pull request #4446 from sever-sever/T7343Daniil Baturin
T7343: IPsec add traffic-selector handling for VTI interfaces
2025-04-17Merge pull request #4454 from c-po/dhcp6c-orderDaniil Baturin
dhcpv6-client: T6113: add proper startup/shutdown order for systemd units
2025-04-17T7343: IPsec add traffic-selector handling for VTI interfacesViacheslav Hletenko
Allow to set traffic-selector for VTI interfaces We can set several local and remote IPv4 and IPv6 prefixes ``` set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix 0.0.0.0/0 set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix :/0 set vpn ipsec site-to-site peer P1 vti traffic-selector remote prefix 192.0.2.0/24 ```
2025-04-17firewall: T7369: Match global state policies in show firewalll0crian1
Global state policies were not matched when typing "show firewall"
2025-04-16firewall: T7369: Match global state policies in show firewalll0crian1
Global state policies were not matched when typing "show firewall"
2025-04-16firewall: T7358: add offload option to global state policyl0crian1
Since the jump to the global state chain is inserted before all rules, it wasn't possible to use offload with the global state policies This commit adds a new chain for offloaded traffic in the forward chain and jumps to that chain. Please enter the commit message for your changes. Lines starting
2025-04-15dhcpv6-client: T6113: add proper startup/shutdown order for systemd unitsChristian Breunig
When running dhcp6c on top of a PPPoE interface, properly honor the dependency chain with systemd. On shutdown we need to stop the wide-dhcpv6-client prior to shutting down the ppp portion of the interface.
generated by cgit v1.2.3 (git 2.39.1) at 2026-01-20 10:08:17 +0000