| Age | Commit message (Collapse) | Author |
|---|
|
T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured
|
|
The blackbox-exporter runs as node_exporter user which cannot create
ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW
capability to the systemd service when ICMP modules are configured.
In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet.
In VRF mode, replace runuser with setpriv to preserve the capability
across the UID change.
|
|
This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.
Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
Add input-queue-limit and output-queue-limit CLI nodes to expose global FRR
"bgp input-queue-limit" and "bgp output-queue-limit" commands via our CLI.
Parameters control the maximum number of queued messages for all BGP peers
during message parsing. FRR default is 10000 which we honor.
Note that this is a global option and can only be set for the global/default
BGP instance.
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
|
|
openvpn: T8998: fix ccd-exclusive without client-config-dir
|
|
haproxy: T8931: Improve WebSocket support for HAProxy
|
|
VRF route leaking via VPNv4/VPNv6 caused all imported (leaked) routes to
be withdrawn and reinstalled on every commit - even commits unrelated to
BGP, VRF or routing - briefly blackholing traffic that depends on them.
Root cause: the BGP address-family template rendered the route-target
using the "route-target vpn ..." alias. FRR accepts that alias on input
but its config writer only ever emits the canonical "rt vpn ..." form.
frr-reload.py diffs the generated config against FRR's running config
line by line and has no normalisation for this, so the route-target lines
never matched and were deleted and re-added on every reload. Re-applying
the route-target runs FRR's vpn_leak_prechange()/postchange(), a
non-atomic withdraw-all then reinstall-all of every leaked route.
Emit the canonical "rt vpn" keyword so the rendered config round-trips
through frr-reload unchanged. FRR also folds an identical import+export
route-target into "both" (an order-sensitive, byte-identical match), so
do the same to stay idempotent; reordered or differing lists stay split
on both sides.
Add test_bgp_33_vpn_route_target_idempotency covering both / identical
export+import / asymmetric route-target, reading the generated FRR config
(getFRRconfig/vtysh returns FRR's already-canonical form and cannot catch
the alias).
|
|
Emit `client-config-dir` when `reject-unconfigured-clients` is set,
even without server client entries, so OpenVPN does not crash-loop.
|
|
|
|
|
|
Add refresh-on-ttl-perc, nothing-below-nxdomain, and minimum-ttl-override
under service dns forwarding with recursor template and smoketest coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
Replace two-word "can not" / "Can not" with "cannot" across comments,
ConfigError messages, CLI help text, and op-mode output.
Standard SNMP MIB files under mibs/ are left unchanged.
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
snmp: T8538: Persist engineBoots counter across reboots
|
|
When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.
The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.
Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.
This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.
|
|
ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers
|
|
T8910: ipoe-server: expose accel-ppp idle-timeout option
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
Add a CLI knob to terminate idle IPoE sessions after a configurable
timeout:
set service ipoe-server idle-timeout <0-86400>
Today there is no way to age out stale IPoE sessions: clients that go
silent (powered off, link down) leave a session record on the router
indefinitely. accel-ppp natively supports idle-timeout in its [ipoe]
section but VyOS did not expose it.
The option is added as a shared accel-ppp include so it can be reused
by other accel-ppp services in follow-up PRs.
|
|
|
|
|
|
|
|
IKEv2 reauthentication was configurable via CLI but never translated
into `swanctl.conf`. Add `reauth_time` to the peer connection template,
driven by the `ikev2-reauth` flag on the ike-group and the per-peer
override (yes/no/inherit).
|
|
virtual-server (#5205)
|
|
|
|
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
Changes:
1. Change option space from 'ubnt' to 'vendor-encapsulated-options-space'.
2. Change option name from 'unifi-controller' to 'ubnt'.
3. Add 'vendor-encapsulated-options' option (in addition to adding unifi
controller IP address under the option name 'ubnt') if unifi-controller
is configured.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
|
|
Internal typo/cosmitic bug, no functional changes
|
|
T8448: add an option to enable SNMP traps in VRRP
|
|
Allow to configure Keepalived VRRP traps
- set high-availability vrrp snmp trap
|
|
|
|
T8229: Fix handling of endpoint in Telegraf Loki template
|
|
bgp: T7338: Add support for "parameters as-notation <asdot|asdot+>"
|
|
|
|
We explicitly omit the "plain" option, as it is the implicit default in FRR
We also do not want to add "plain" as VyOS default value and emit it by default
as this makes the config a bit ugly (frr puts it in the router line so you get
"router bgp <AS> as-notation plain").
Additionally, setting plain as default value and emitting it by default would
break pretty much all BGP tests, as they commonly do
self.getFRRconfig(f'router bgp {ASN}', stop_section='^exit')
and getFRRConfig does a "^<content>$" match, which breaks when you add the
"as-notation plain"
|
|
Fix typos and mistakes
No functional changes
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
Commit 5c800be95 ("T8405: fix noipv6 emitted when dhcpv6-options configured
without ipv6 node") added a superfluous +, most likely due to a rebase or
merge error.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
When a PPPoE interface has dhcpv6-options (e.g. prefix delegation)
configured but no explicit ipv6 node, the Jinja template writes
noipv6 into the PPP peer configuration. This prevents IPv6CP
negotiation, causing the ISP to silently ignore all DHCPv6 traffic.
Fix the peer template to also check for dhcpv6_options before emitting
noipv6, and add dhcpv6-options and ipv6 to the list of config nodes
that trigger a PPPoE session restart so the change takes effect
without manual disconnect/reconnect.
|
