| Age | Commit message (Collapse) | Author |
|---|
|
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
|
|
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
|
|
T9338: add bgp mpls l3vpn-multi-domain-switching
|
|
ntp: T8882: add ntp polling options
|
|
Poll intervals were left entirely to the NTP daemon's built-in defaults, so an
operator could not widen or narrow the polling range for an individual server,
warm up authenticated associations before a poll, or ask a peer for the higher
resolution timestamps it may be able to provide.
Each configured server and pool now accepts a minimum and maximum poll
exponent, defaulting to the values the daemon already used, plus an optional
presend exponent and a switch for the F323 extension field. Existing
configurations render the same associations as before.
Co-authored-by: Christian Breunig <christian@vyos.io>
|
|
T9337: openvpn: stop rendering "ping 0" in site-to-site
|
|
"keep-alive interval 0" turns the keepalive off, but site-to-site
renders "ping" and "ping-restart" unguarded. A zero interval leaves
"ping 0" with the restart timer still armed, so an idle tunnel tears
itself down instead of running without keepalive.
Leave both directives out when the interval is zero, as T9334 does for
the server-mode "keepalive".
|
|
dns: T9175: make PowerDNS security status poll opt-in
|
|
When both the ORF send and receive capability were enabled for a BGP
neighbor address-family, the FRR template emitted two individual
statements:
neighbor 192.0.2.1 capability orf prefix-list send
neighbor 192.0.2.1 capability orf prefix-list receive
FRR stores this combination as a single "both" directive, so its running
configuration never matched what VyOS generated. As a result every subsequent
commit, even one entirely unrelated to BGP, removed and re-added the ORF
capability.
Each of those cycles resets the established BGP session for about two seconds.
Cover all three combinations for both a plain neighbor and a peer-group:
* send only -> neighbor <peer> capability orf prefix-list send
* receive only -> neighbor <peer> capability orf prefix-list receive
* send + receive -> neighbor <peer> capability orf prefix-list both
The "both" case additionally verifies that the individual send and receive
statements are no longer rendered, as those are exactly what made FRR and
VyOS disagree about the running configuration.
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
vpp: T9146: Enable DPDK no-multi-seg when a full frame fits the buffer
|
|
T9274: Add more telegraf configuration
|
|
Added the ability to make several agent values configurable instead of hardcoded.
|
|
dhcp6c was unconditionally started with -D (debug level 2). In daemon mode
setloglevel() only calls setlogmask() for levels 0 and 1 - level 2 falls
through and leaves the log mask wide open, so every LOG_DEBUG message ends
up in syslog:
dhcp6c[3935]: copy_option: set client ID (len 18)
dhcp6c[3935]: copyout_option: set identity association
dhcp6c[3935]: copy_option: set elapsed time (len 2)
dhcp6c[3935]: copy_option: set option request (len 4)
dhcp6c[3935]: client6_send: send solicit to ff02::1:2%wwan0
dhcp6c[3935]: dhcp6_reset_timer: reset a timer on wwan0, state=SOLICIT, ...
On a link where no DHCPv6 server answers this repeats for every SOLICIT
retransmission, forever. Drop the flag - errors and the parser diagnostics
used by the T7058 smoketest are logged at LOG_ERR and remain visible.
|
|
Add command
set protocols bgp interface <interface> mpls l3vpn-multi-domain-switching
that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under
interface node.
|
|
An interval of 0 is how the CLI turns keepalive off, and it rendered
"keepalive 0 0" because OpenVPN skipped its own sanity checks on that
pair. OpenVPN 2.7.6 dropped the exception and now refuses to start:
"keepalive ping: Must be an integer between 1 and 86400, not 0".
Leave the directive out of the file instead. Nothing then sets ping or
ping-restart, which is the keepalive-off the interval asked for, and a
saved configuration still commits untouched.
|
|
T9014: bugfixes for arm64 platform
|
|
The LCDd driver modules are shipped in the architecture dependent
multiarch library directory, but the template hardcoded the x86_64
path. On arm64 this pointed LCDd at a directory that does not exist,
so no driver could be loaded.
Derive the multiarch triplet at runtime and render it into LCDd.conf
instead of assuming x86_64.
|
|
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
|
|
ipsec: T9254: do not emit ESN transforms in IKE proposals
|
|
get_ike_cipher()
get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA
semantics), and every IKE_SA call site had to remember to pass
esn=False. Nothing enforced that, so a future call site could reintroduce
the ESN-in-IKE bug this task fixed.
Following review feedback from hedrok, split it into two public filters:
get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True
get_ike_cipher(group_config) IKE_SA, esn=False always
The shared implementation moves to _get_esp_ike_cipher() (no
register_filter), so a template can no longer call it directly and
skip picking one of the two entry points.
Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2
(proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and
test_template.py.
|
|
The CLI already defaults to "subnet", so this only adds the directive for
bridged servers, which are tap only and where OpenVPN ignores it. Keeps
the daemon on the CLI value rather than an upstream default.
|
|
2.7 refuses --secret unless --allow-deprecated-insecure-static-crypto is
given. Without this every shared-secret-key site-to-site tunnel fails to
start after the upgrade.
|
|
http-api: T8989: fix X-Client-Verify header passthrough auth bypass
|
|
Always set proxy_set_header X-Client-Verify unconditionally so a
client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS
authentication when mTLS is not configured.
When mTLS is disabled, nginx sets X-Client-Verify to empty string
which correctly fails the == 'SUCCESS' check in auth_required.
Fixes: GHSA-4w7q-wwx4-6973
|
|
FRR routing state was only available through the Prometheus frr-exporter,
a pull target. Operators who push everything else out via Telegraf had to
run an external Prometheus server and open inbound access to the router
just to scrape routing state.
Add a dedicated "service monitoring telegraf frr-metrics" node. When set,
Telegraf uses inputs.prometheus to scrape the already-running local
frr-exporter and re-emits the metrics through whatever Telegraf outputs
are already configured (InfluxDB, ADX, Loki, Splunk, etc.).
|
|
dhcp6c-script.j2 calls logmsg() six times but runs standalone under dhcp6c. It
never sources dhclient-enter-hooks.d/01-vyos-logging, which is only pulled into
the dhclient-script shell, and defines no logmsg() itself, so every call failed
with "logmsg: not found" while adding shell errors to the journal.
Carry a POSIX sh copy using the same tag, priorities and /tmp/vyos.dhclient.debug
gate as the DHCPv4 hooks. The two messages announcing an internal step log at
debug; the nameserver and search domain updates stay at info.
|
|
T9273: Add Telegraf global_tags option configurable
|
|
http-api: T8989: add REST Bearer token authentication
|
|
Adds Telegraf global_tags support - static tags stamped onto every metric.
```
set service monitoring telegraf global-tag <tag-name> value <tag-value>
```
Rendered as a [global_tags] block in telegraf.conf, applied ahead of all outputs.
|
|
|
|
Per dmbaturin's review: the value is a full FQDN, not a suffix, and the
help text should clarify that the poll checks for known vulnerabilities
in the running PowerDNS recursor version.
|
|
The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.
Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
|
|
dns: T8045: expose PowerDNS dont-query list as recursion-exclude-address
|
|
get_esp_ike_cipher() renders both IKE_SA proposals and CHILD_SA
proposals. It unconditionally appended the -esn / -noesn variants,
which are only meaningful for ESP: ESN is Transform Type 5 per
RFC 7296 section 3.3.2 and is defined for CHILD_SAs only.
Emitting ESN in an IKE_SA proposal breaks interoperability with
implementations that reject the malformed payload without replying
at all. Observed against a Cisco FTD: the IKE_SA_INIT is silently
discarded, no NO_PROPOSAL_CHOSEN and no INVALID_KE_PAYLOAD, so the
tunnel never comes up and nothing on the initiator side explains it.
Add an explicit esn parameter defaulting to True so ESP behaviour is
unchanged, and pass esn=False at the four IKE call sites: peer.j2,
profile.j2, remote_access.j2 and l2tp.j2. The five esp_proposals call
sites keep ESN.
ike_group could have served as the discriminator, since IKE call sites
do not pass it, but that coupling is incidental: the argument only
exists to resolve PFS.
Smoke test assertions on the proposals lines are updated accordingly;
the esp_proposals assertions are left untouched.
|
|
Disabling DPDK multi-segment buffers (no-multi-seg) lets VPP receive each
frame into a single buffer, increasing forwarding throughput. The frame
must then fit the buffer 'data-size', so 'no-multi-seg' is computed: it is
enabled only while the largest MTU across all VPP-bound interfaces, plus
its L2 framing overhead (26 bytes), fits 'data-size'. Otherwise VPP keeps
multi-seg and Jumbo frames still work without a larger buffer.
Changing the MTU of a VPP-bound interface can flip the flag, so
interfaces_ethernet reconfigures VPP when it changes, via an initial
dependency (set_dependents_initial) to avoid a cycle with the existing
vpp -> ethernet dependency.
|
|
vrf: T6097: add the nat anchor conntrack zoning needs
|
|
podman: T9129: Use systemd quadlet for containers and networks
|
|
VRF conntrack zoning assigns a zone to the original direction only, which
leaves every reply tuple in the default zone 0. That is deliberate and is
required by T3655: the reply of a flow that was leaked out of a VRF and
NATed in the default VRF arrives on an interface carrying no zone at all,
so it can only be matched when the reply tuple lives in zone 0 as well.
The side effect is that two flows differing only by their VRF end up with
identical reply tuples. The second conntrack entry can then not be
inserted and its packet is dropped, visible as insert_failed and drop in
"conntrack -S".
The kernel already resolves this, but only once nf_nat is registered for
the address family: a null binding is applied to every new conntrack entry
and get_unique_tuple() reallocates the clashing reply tuple. nf_nat is
registered as soon as any "type nat" chain exists in that family.
IPv4 always had one, because the startup ruleset created "table ip nat"
unconditionally. IPv6 never had an equivalent, so IPv6 was dropped while
IPv4 kept working by accident. That is the asymmetry reported here.
Create the chain from the VRF code instead, in the inet family so one
table covers both, and only while conntrack zoning is installed. A
registered nf_nat costs about 200ns per new connection, measured at +19%
for IPv4 and +11% for IPv6 in a connection setup benchmark, and is not
worth paying on systems without a VRF.
|
|
|
|
- Scope mTLS CA chain to selected CA only (not all configured CAs)
- Pass verify-client value to nginx template instead of hardcoding optional
- Allow mTLS-only REST configuration without API keys
- Add mTLS warning when no API keys are configured
|
|
|
|
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
|
|
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
|
|
The `+=` append syntax is used for appending.
To remove from the defaults, users can use negation.
|
|
Accept IPv6 peer, listen, and multicast addresses. Render the selected
address family and validate it against the synchronization interface and
listen addresses.
|
|
http-api: T9224: add ping endpoint to REST API
|
|
Add new CLI subtree 'system option kdump' with memory reservation and
local dump path configuration. Also add 'show system kdump' and
'show system kdump dumps' operation mode commands to get
status of the configuration and list of dumps.
Extend 'show tech-support report' and 'generate tech-support archive' with
kdump service status, active config files and the recently kernel dump file.
|
|
|
|
ntp: T9159: add source-address option for client requests
|
|
ddclient: T6981: Upgrade ddclient to v4.0.0
|
