| Age | Commit message (Collapse) | Author |
|---|
|
snmp: T8538: Persist engineBoots counter across reboots
|
|
When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.
The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.
Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.
This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.
|
|
ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers
|
|
T8910: ipoe-server: expose accel-ppp idle-timeout option
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
Add a CLI knob to terminate idle IPoE sessions after a configurable
timeout:
set service ipoe-server idle-timeout <0-86400>
Today there is no way to age out stale IPoE sessions: clients that go
silent (powered off, link down) leave a session record on the router
indefinitely. accel-ppp natively supports idle-timeout in its [ipoe]
section but VyOS did not expose it.
The option is added as a shared accel-ppp include so it can be reused
by other accel-ppp services in follow-up PRs.
|
|
|
|
|
|
|
|
IKEv2 reauthentication was configurable via CLI but never translated
into `swanctl.conf`. Add `reauth_time` to the peer connection template,
driven by the `ikev2-reauth` flag on the ike-group and the per-peer
override (yes/no/inherit).
|
|
virtual-server (#5205)
|
|
|
|
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
Changes:
1. Change option space from 'ubnt' to 'vendor-encapsulated-options-space'.
2. Change option name from 'unifi-controller' to 'ubnt'.
3. Add 'vendor-encapsulated-options' option (in addition to adding unifi
controller IP address under the option name 'ubnt') if unifi-controller
is configured.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
|
|
Internal typo/cosmitic bug, no functional changes
|
|
T8448: add an option to enable SNMP traps in VRRP
|
|
Allow to configure Keepalived VRRP traps
- set high-availability vrrp snmp trap
|
|
|
|
T8229: Fix handling of endpoint in Telegraf Loki template
|
|
bgp: T7338: Add support for "parameters as-notation <asdot|asdot+>"
|
|
|
|
We explicitly omit the "plain" option, as it is the implicit default in FRR
We also do not want to add "plain" as VyOS default value and emit it by default
as this makes the config a bit ugly (frr puts it in the router line so you get
"router bgp <AS> as-notation plain").
Additionally, setting plain as default value and emitting it by default would
break pretty much all BGP tests, as they commonly do
self.getFRRconfig(f'router bgp {ASN}', stop_section='^exit')
and getFRRConfig does a "^<content>$" match, which breaks when you add the
"as-notation plain"
|
|
Fix typos and mistakes
No functional changes
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
Commit 5c800be95 ("T8405: fix noipv6 emitted when dhcpv6-options configured
without ipv6 node") added a superfluous +, most likely due to a rebase or
merge error.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
When a PPPoE interface has dhcpv6-options (e.g. prefix delegation)
configured but no explicit ipv6 node, the Jinja template writes
noipv6 into the PPP peer configuration. This prevents IPv6CP
negotiation, causing the ISP to silently ignore all DHCPv6 traffic.
Fix the peer template to also check for dhcpv6_options before emitting
noipv6, and add dhcpv6-options and ipv6 to the list of config nodes
that trigger a PPPoE session restart so the change takes effect
without manual disconnect/reconnect.
|
|
T8386: fix locat_ts rendering in remote_access.j2
|
|
|
|
|
|
|
|
|
|
section
|
|
Co-Authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
ospf: T7679: fix plaintext authentication on specific interface
|
|
|
|
|
|
Replace single '=' with '==' in GRUB shell conditionals for
string comparisons
|
|
T8120: Add support AMA console for ARM devices
|
|
IPv6 wildcard prefix derivation and includes validation and smoketests.
Included changes:
- Add `base-interface` under:
- `service router-advert interface <lan-if> prefix ::/64 base-interface <wan-if>`
- Render `Base6Interface <wan-if>;` in `radvd.conf` when configured.
- Add validation guard:
- `base-interface` is only allowed with wildcard prefix `::/64`.
- Extend smoketests:
- Positive case: `::/64` + `base-interface` commits and renders correctly.
- Negative case: non-`::/64` prefix with `base-interface` fails commit.
|
|
|
|
srv6: T6977: add srv6 encapsulation source-address
|
