summaryrefslogtreecommitdiff
path: root/data/templates
AgeCommit message (Collapse)Author
2020-06-19console-server: T2490: server must listen only on localhostChristian Poessinger
2020-06-18console-server: T2490: rename CLI to console-serverChristian Poessinger
2020-06-18console-server: T2490: log to journaldChristian Poessinger
2020-06-18console-server: T2490: move CLI parsing to get_config_dict()Christian Poessinger
For more examples on the new get_config_dict() approach migrate this implementation as it is not yet in production use. Also this serves as proof of concept code for further migrations.
2020-06-18console-server: T2490: rename CLI to "serial-proxy"Christian Poessinger
2020-06-18console-server: T2490: initial supportChristian Poessinger
2020-06-17router-advert: T2609: add missing verify() for prefix lifetimeChristian Poessinger
radvd[31898]: AdvValidLifeTime must be greater than AdvPreferredLifetime in radvd.conf, line 19 This happens with the following configuration: vyos@vyos# show service router-advert interface eth0.20 { name-server 2001:4860:4860::8888 prefix ::/64 { valid-lifetime 7200 } } A validator is added to solve this issue and radvd will run again.
2020-06-17login: radius: T2299: Implement RADIUS servers priorityDmitriyEshenko
2020-06-16pppoe-server: T2601: Add default CCP values if not defined via CLIDmitriyEshenko
2020-06-15login: radius: T2600: fix wrongly redered pam_radius_auth.confChristian Poessinger
When multiple RADIUS servers have been configured, they have been all rendered onto a single line in the config. This lead to errors in syslog and not all servers beeing reachable.
2020-06-14nat: T2593: fix for SNAT translation port when using masqueradeChristian Poessinger
The "to" qualifier did not get rendered when using source ports in masquerade targets. This case was totally missed out when porting.
2020-06-13snmp: T2321: add VRF supportChristian Poessinger
2020-06-13ntp: T2321: add VRF supportChristian Poessinger
2020-06-12nat: T2571: add special handling for negated source/destination port(s)Christian Poessinger
We specify NFT source/destination ports within a { } group, but if the port range in question is negated, we need to move the != fraction out of { } and infront of that group, else NFT loading will fail big time.
2020-06-12Revert "nat: T2571: fix negated port definitions"Christian Poessinger
This reverts commit 927c054d9236c2c34ca43c1cbfff10fcfd7f5077.
2020-06-12wwan: T2586: fix installing VRF default routeChristian Poessinger
After commit 1c7d7cb ("wwan: T2529: migrate device from ttyUSB to usbXbY.YpZ.Z") the up/down scripts did not properly parse the passed tty for setting up default routes.
2020-06-11nat: T2571: fix negated port definitionsChristian Poessinger
2020-06-11ssh: T2321: add VRF supportChristian Poessinger
2020-06-11Merge branch 'serial-console' of github.com:c-po/vyos-1x into currentChristian Poessinger
* 'serial-console' of github.com:c-po/vyos-1x: console: T2569: run VGA console powersave on tty1 console: T2569: replicate console settings to grub.cfg Debian: fix warning about undefined substitution variables console: T2569: only start serial console if device exists console: T2529: migrate from ttyUSB device to new device in /dev/serial/by-bus console: T2570: remove support for Hayes Modems netconsole: T2561: use migrator to delete config nodes console: T2569: initial implementation with XML and Python
2020-06-09pppoe-server: T2575: Add missing gw-ip-addressDmitriyEshenko
2020-06-09sstp: T2575: Add missing gw-ip-addressDmitriyEshenko
2020-06-09console: T2529: migrate from ttyUSB device to new device in /dev/serial/by-busChristian Poessinger
During testing it was discovered that there is a well known problem (we had for ethernet interfaces) also in the serial port world. They will be enumerated and mapped to /dev/ttyUSBxxx differently from boot to boot. This is especially painful on my development APU4 board which also has a Sierra Wireless MC7710 LTE module installed. The serial port will toggle between ttyUSB2 and ttyUSB5 depending on the amount of serial port extenders attached (FT4232H). The shipped udev rule (/usr/lib/udev/rules.d/60-serial.rules) partly solves this by enumerating the devices into /dev/serial/by-id folder with their name and serial number - it's a very good idea but I've found that not all of the FT4232H dongles have a serial number programmed - this leads to the situation that when you plug in two cables with both having serial number 0 - only one device symlink will appear - the previous one is always overwritten by the latter one. Derive /usr/lib/udev/rules.d/60-serial.rules and create a /dev/serial/by-bus directory and group devices by attached USB root port.
2020-06-08l2tp: T2565: Add missing gw-ip-addressDmitriyEshenko
2020-06-07wwan: T2488: remove generation of dedicated logfileChristian Poessinger
... all information are present in journald.
2020-06-07wwan: T2529: migrate device from ttyUSB to usbXbY.YpZ.ZChristian Poessinger
During testing it was discovered that there is a well known problem (we had for ethernet interfaces) also in the serial port world. They will be enumerated and mapped to /dev/ttyUSBxxx differently from boot to boot. This is especially painful on my development APU4 board which also has a Sierra Wireless MC7710 LTE module installed. The serial port will toggle between ttyUSB2 and ttyUSB5 depending on the amount of serial port extenders attached (FT4232H). The shipped udev rule (/usr/lib/udev/rules.d/60-serial.rules) partly solves this by enumerating the devices into /dev/serial/by-id folder with their name and serial number - it's a very good idea but I've found that not all of the FT4232H dongles have a serial number programmed - this leads to the situation that when you plug in two cables with both having serial number 0 - only one device symlink will appear - the previous one is always overwritten by the latter one. Derive /usr/lib/udev/rules.d/60-serial.rules and create a /dev/serial/by-bus directory and group devices by attached USB root port. vyos@vyos:~$ find /dev/serial/by-bus/ -name usb* -exec basename {} \; | sort usb0b1.3p1.0 usb0b1.3p1.2 usb0b1.3p1.3 usb0b2.4p1.0 usb0b2.4p1.1 usb0b2.4p1.2 usb0b2.4p1.3 So we have USB root 0 with bus 1.3 and port 1.0. The enumeration is constant accross reboots.
2020-06-01bgp: T2387: proof-of-concept using get_config_dict()Christian Poessinger
2020-05-29ssh: T2230: remove duplicated HostKey lineChristian Poessinger
2020-05-26pppoe: T2502: configure IPv6 default routes if requiredChristian Poessinger
2020-05-26pppoe: T2502: always delete default route once interface goes downChristian Poessinger
2020-05-26pppoe: T2219: fix proper RA autoconf file nameChristian Poessinger
Commit 8dcf042a7f5 ("pppoe: T2219: move adding of default route to ip-(up|down) script") wrongly tried to open a file called autoconfigure which infact should be autoconf
2020-05-26pppoe: T2502: fix Jinja2 template indentionChristian Poessinger
2020-05-26dhcpv6-pd: T2506: add option to request specific prefix lengthChristian Poessinger
Some ISPs (e.g. Comcast) only delegate a /64 by default. You have to explicitly "ask" for a bigger (e.g. /60) prefix. This commit adds a CLI node to request a specific prefix length in the range 32 - 64. dhcpv6-options { prefix-delegation { length 60 } }
2020-05-26dhcpv6-pd: pppoe: T2506: restructure CLIChristian Poessinger
Rename the CLI nodes for prefix delegation from "dhcpv6-options delegate <interface>" to "dhcpv6-options prefix-delegation interface <interface>". The change is required to add the possibility to request for specific prefix sized via the CLI. That option was not possible with the old configuration tree.
2020-05-26pppoe: T2502: "default-route none" option had no effectChristian Poessinger
2020-05-24fromdos: fix wrong line encodingChristian Poessinger
2020-05-22macsec: T2491: add replay window protectionChristian Poessinger
2020-05-22macsec: T2023: only render mka in template if encrypt enabledChristian Poessinger
2020-05-21pppoe: T2488: remove logfile generationChristian Poessinger
2020-05-21macsec: T2023: support MACsec Key Agreement protocol actor priorityChristian Poessinger
2020-05-21macsec: T2023: rename "security key" node to "security mka"Christian Poessinger
MACsec always talks about MKA (MACsec Key Agreement protocol) thus the node should reflect that.
2020-05-21macsec: T2023: use wpa_supplicant for key managementChristian Poessinger
2020-05-19dhcpv6-server: T815: support delegating IPv6 prefixesChristian Poessinger
2020-05-17pppoe: dhcpv6-pd: T421: start/stop delegation with interface statusChristian Poessinger
2020-05-17pppoe: dhcpv6-pd: T421: initial supportChristian Poessinger
The following configuration will assign a /64 prefix out of a /56 delegation to eth0. The IPv6 address assigned to eth0 will be <prefix>::ffff/64. If you do not know the prefix size delegated to you, start with sla-len 0. pppoe pppoe0 { authentication { password vyos user vyos } description sadfas dhcpv6-options { delegate eth0 { interface-id 65535 sla-id 0 sla-len 8 } } ipv6 { address { autoconf } enable } source-interface eth1 } vyos@vyos:~$ show interfaces Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address S/L Description --------- ---------- --- ----------- eth0 2001:db8:8003:400::ffff/64 u/u
2020-05-17dhcpv6-pd: T421: migrate from ISC dhclient to wide-dhcpv6-clientChristian Poessinger
ISC does not support running the client on PPP(oE) interfaces which makes it unusable for DHCPv6 Prefix Delegation tasks. Internet Systems Consortium DHCP Client 4.4.1 Copyright 2004-2018 Internet Systems Consortium. All rights reserved. For info, please visit https://www.isc.org/software/dhcp/ Unsupported device type 512 for "pppoe0"
2020-05-17pppoe-server: T2471: add SLAAC supportChristian Poessinger
... by setting AdvAutonomousFlag=1 when an IPv6 client pool is defined.
2020-05-17frr: combine all templates in frr directoryChristian Poessinger
2020-05-16nat: T2198: use Jinja2 macro for common ruleset for SNAT and DNATChristian Poessinger
By using a Jinja2 macro the same template code can be used to create both source and destination NAT rules with only minor changes introduced by e.g. the used chain (POSTROUTING vs PREROUTING). Used the following configuration for testing on two systems with VyOS 1.2 and the old implementation vs the new one here. set nat destination rule 15 description 'foo-10' set nat destination rule 15 destination address '1.1.1.1' set nat destination rule 15 inbound-interface 'eth0.202' set nat destination rule 15 protocol 'tcp_udp' set nat destination rule 15 translation address '192.0.2.10' set nat destination rule 15 translation port '3389' set nat destination rule 20 description 'foo-20' set nat destination rule 20 destination address '2.2.2.2' set nat destination rule 20 destination port '22' set nat destination rule 20 inbound-interface 'eth0.201' set nat destination rule 20 protocol 'tcp' set nat destination rule 20 translation address '192.0.2.10' set nat source rule 100 outbound-interface 'eth0.202' set nat source rule 100 protocol 'all' set nat source rule 100 source address '192.0.2.0/26' set nat source rule 100 translation address 'masquerade' set nat source rule 110 outbound-interface 'eth0.202' set nat source rule 110 protocol 'tcp' set nat source rule 110 source address '192.0.2.0/26' set nat source rule 110 source port '5556' set nat source rule 110 translation address 'masquerade' set nat source rule 120 outbound-interface 'eth0.202' set nat source rule 120 protocol 'tcp_udp' set nat source rule 120 source address '192.0.3.0/26' set nat source rule 120 translation address '2.2.2.2'
2020-05-16nat: T2198: restructure DNAT template part for less duplicated codeChristian Poessinger
Build up only one output rule string by appending the configuration part by part.
2020-05-16nat: T2198: add support for SNAT based on source addressesChristian Poessinger
CLI commands used for ruleset generation: set nat source rule 100 outbound-interface 'eth0.202' set nat source rule 100 protocol 'all' set nat source rule 100 source address '192.0.2.0/26' set nat source rule 100 translation address 'masquerade' set nat source rule 110 outbound-interface 'eth0.202' set nat source rule 110 protocol 'tcp' set nat source rule 110 source address '192.0.2.0/26' set nat source rule 110 source port '5556' set nat source rule 110 translation address 'masquerade'