| Age | Commit message (Collapse) | Author |
|---|
|
With metric-type 2 (the CLI default), every FRR reload deletes and
re-adds "default-information originate" and every "redistribute" line
under "router ospf". ospfd flushes the Type-5 LSAs on the delete and
re-originates them right after, so neighbours can briefly lose the
external routes on commits that do not touch OSPF.
ospfd and ospf6d (for redistribute) write "metric-type 1" back to the
running config and print nothing for type 2, their default. The
templates render "metric-type 2", so frr-reload sees a different line
on every reload.
frrender now adds the XML default of metric-type to the OSPF and OSPFv3
dicts as xml_default_metric_type, for the default and every VRF
instance. The templates render metric-type only when it differs from
that default, so the generated config matches what FRR prints back.
OSPFv3 default-information keeps rendering metric-type, as ospf6d
prints it for both types.
Add smoketests that read the generated config and vtysh for types 2,
1 and back to 2. Rename the "ptotocol" loop variable in
test_protocols_ospf.py to "protocol", which the typos check flags on
any change to this file.
|
|
interfaces: T9152: Refactor source-validation to use vmaps
|
|
router-advert: T9413: add no-remove-on-exit and no-flush-* options
|
|
On shutdown radvd sends a final RA with router lifetime 0 and announces
its RDNSS and DNSSL entries with lifetime 0. On a VRRP pair that sends
RAs from a shared source address (source-address fe80::1), hosts read
the zero router lifetime as the shared router going away and remove
their default route until the backup's next RA. On my routers that was
1.6 s of IPv6 loss when the master rebooted.
radvd controls this with RemoveAdvOnExit, FlushRDNSS and FlushDNSSL,
all defaulting to on. Expose them per interface:
set service router-advert interface <if> no-remove-on-exit
set service router-advert interface <if> no-flush-name-server
set service router-advert interface <if> no-flush-dnssl
The directives are only rendered when the options are set, so the
generated radvd.conf is unchanged for existing configurations.
|
|
Since FRR 10.5 "bgp reject-as-sets" is the default. FRR does not print
the default in show running-config, so frr-reload never finds the line in
the running config and sends it again on every reload. The command
handler resets every BGP session of the instance (NOTIFICATION Cease,
other configuration change) whether or not the value changed,
so with "protocols bgp parameters reject-as-sets" set, every commit that
reloads FRR reset every established session, not only commits that touch
BGP.
Render only the non-default form: "no bgp reject-as-sets" when the
option is not set, as T7664 added it, and nothing when it is set. The
option is a valueless leaf, so it has no XML default to read; the
rendered "no" form already was the only place that knows what FRR's
default is. Changing the option still reaches FRR: frr-reload sends
"bgp reject-as-sets" when the option is set (the "no" line leaves the
rendered config) and "no bgp reject-as-sets" when it is deleted, and
each change resets the sessions once, as before.
Add a smoketest that reads the rendered /run/frr/config/vyos.frr.conf,
because FRR never prints the default form and vtysh cannot show it.
|
|
bgp: T9404: do not render "bgp default local-preference" when the value is 100
|
|
T9351: Accel-PPP-NG: Add CLI support for Message Authenticator attribute in Access packets (Blast-RADIUS mitigation)
|
|
FRR does not print "bgp default local-preference 100" in show
running-config because 100 is its default, so frr-reload never finds the
line in the running config and sends it again on every reload. The
command handler calls bgp_clear_star_soft_in() whether or not the value
changed, so every reload ran "clear bgp * soft in" (once in pass 0 and
twice in pass 1), a full inbound re-evaluation of every peer.
Add the default (100) to the XML definition of parameters default
local-pref. Templates cannot query the XML definition while rendering,
so frrender takes the value from the config defaults of "parameters
default" (conf.get_config_defaults) and adds it to the BGP dict as the
key xml_default_local_pref, for the global instance and for every VRF
instance. bgpd.frr.j2 renders the line only when the configured value
differs from xml_default_local_pref, so the value 100 is not hardcoded
in the template. A real value change (100 to 200, or 200 to 100) is
still sent: frr-reload sees the difference between the rendered file and
the running config.
|
|
pppoe: T9395: render default routes via FRR only
|
|
Deleting a PPPoE interface shortly after its session came up could fail the
commit with "% could not lock candidate DS". The default routes were installed
via vtysh both from the commit and from the asynchronous ppp ip-up hook, so the
two FRR sessions raced for the mgmtd lock. The IPv6 default route was also
missing from the rendered FRR configuration, so an FRR reload could remove it.
Both default routes are now part of the rendered FRR configuration, which
vyos-configd applies at the end of every commit. PPPoE no longer calls vtysh.
|
|
When local-block-url is the first ACL entry of a rule, the template wrote
"!ocal-block-url-<rule>" into the pass line. SquidGuard does not know
that destination group, so the rule silently blocked nothing, while the
dest block itself was generated correctly.
Add a smoketest that checks the rule ACL.
|
|
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
|
|
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
|
|
in Access packets
Add CLI options to control Message-Authenticator handling for Access
packets.
The new options allow including Message-Authenticator in Access-Request
packets and requiring it in Access-Accept, Access-Reject and
Access-Challenge responses. Render the corresponding accel-ppp-ng
configuration options and warn when response validation is configured as
required while Access-Request packets are not configured to include
Message-Authenticator.
|
|
T9338: add bgp mpls l3vpn-multi-domain-switching
|
|
ntp: T8882: add ntp polling options
|
|
Poll intervals were left entirely to the NTP daemon's built-in defaults, so an
operator could not widen or narrow the polling range for an individual server,
warm up authenticated associations before a poll, or ask a peer for the higher
resolution timestamps it may be able to provide.
Each configured server and pool now accepts a minimum and maximum poll
exponent, defaulting to the values the daemon already used, plus an optional
presend exponent and a switch for the F323 extension field. Existing
configurations render the same associations as before.
Co-authored-by: Christian Breunig <christian@vyos.io>
|
|
T9337: openvpn: stop rendering "ping 0" in site-to-site
|
|
"keep-alive interval 0" turns the keepalive off, but site-to-site
renders "ping" and "ping-restart" unguarded. A zero interval leaves
"ping 0" with the restart timer still armed, so an idle tunnel tears
itself down instead of running without keepalive.
Leave both directives out when the interval is zero, as T9334 does for
the server-mode "keepalive".
|
|
dns: T9175: make PowerDNS security status poll opt-in
|
|
When both the ORF send and receive capability were enabled for a BGP
neighbor address-family, the FRR template emitted two individual
statements:
neighbor 192.0.2.1 capability orf prefix-list send
neighbor 192.0.2.1 capability orf prefix-list receive
FRR stores this combination as a single "both" directive, so its running
configuration never matched what VyOS generated. As a result every subsequent
commit, even one entirely unrelated to BGP, removed and re-added the ORF
capability.
Each of those cycles resets the established BGP session for about two seconds.
Cover all three combinations for both a plain neighbor and a peer-group:
* send only -> neighbor <peer> capability orf prefix-list send
* receive only -> neighbor <peer> capability orf prefix-list receive
* send + receive -> neighbor <peer> capability orf prefix-list both
The "both" case additionally verifies that the individual send and receive
statements are no longer rendered, as those are exactly what made FRR and
VyOS disagree about the running configuration.
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
vpp: T9146: Enable DPDK no-multi-seg when a full frame fits the buffer
|
|
T9274: Add more telegraf configuration
|
|
Added the ability to make several agent values configurable instead of hardcoded.
|
|
- Reduced rule processing of source-validation rules through hashable objects
|
|
- Refactor source-validation to use vmaps
- Update broken source-validation tests
- Fix source-validation failing to remove rules when interface is removed (T9153)
|
|
dhcp6c was unconditionally started with -D (debug level 2). In daemon mode
setloglevel() only calls setlogmask() for levels 0 and 1 - level 2 falls
through and leaves the log mask wide open, so every LOG_DEBUG message ends
up in syslog:
dhcp6c[3935]: copy_option: set client ID (len 18)
dhcp6c[3935]: copyout_option: set identity association
dhcp6c[3935]: copy_option: set elapsed time (len 2)
dhcp6c[3935]: copy_option: set option request (len 4)
dhcp6c[3935]: client6_send: send solicit to ff02::1:2%wwan0
dhcp6c[3935]: dhcp6_reset_timer: reset a timer on wwan0, state=SOLICIT, ...
On a link where no DHCPv6 server answers this repeats for every SOLICIT
retransmission, forever. Drop the flag - errors and the parser diagnostics
used by the T7058 smoketest are logged at LOG_ERR and remain visible.
|
|
Add command
set protocols bgp interface <interface> mpls l3vpn-multi-domain-switching
that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under
interface node.
|
|
An interval of 0 is how the CLI turns keepalive off, and it rendered
"keepalive 0 0" because OpenVPN skipped its own sanity checks on that
pair. OpenVPN 2.7.6 dropped the exception and now refuses to start:
"keepalive ping: Must be an integer between 1 and 86400, not 0".
Leave the directive out of the file instead. Nothing then sets ping or
ping-restart, which is the keepalive-off the interval asked for, and a
saved configuration still commits untouched.
|
|
T9014: bugfixes for arm64 platform
|
|
The LCDd driver modules are shipped in the architecture dependent
multiarch library directory, but the template hardcoded the x86_64
path. On arm64 this pointed LCDd at a directory that does not exist,
so no driver could be loaded.
Derive the multiarch triplet at runtime and render it into LCDd.conf
instead of assuming x86_64.
|
|
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
|
|
ipsec: T9254: do not emit ESN transforms in IKE proposals
|
|
get_ike_cipher()
get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA
semantics), and every IKE_SA call site had to remember to pass
esn=False. Nothing enforced that, so a future call site could reintroduce
the ESN-in-IKE bug this task fixed.
Following review feedback from hedrok, split it into two public filters:
get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True
get_ike_cipher(group_config) IKE_SA, esn=False always
The shared implementation moves to _get_esp_ike_cipher() (no
register_filter), so a template can no longer call it directly and
skip picking one of the two entry points.
Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2
(proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and
test_template.py.
|
|
The CLI already defaults to "subnet", so this only adds the directive for
bridged servers, which are tap only and where OpenVPN ignores it. Keeps
the daemon on the CLI value rather than an upstream default.
|
|
2.7 refuses --secret unless --allow-deprecated-insecure-static-crypto is
given. Without this every shared-secret-key site-to-site tunnel fails to
start after the upgrade.
|
|
http-api: T8989: fix X-Client-Verify header passthrough auth bypass
|
|
Always set proxy_set_header X-Client-Verify unconditionally so a
client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS
authentication when mTLS is not configured.
When mTLS is disabled, nginx sets X-Client-Verify to empty string
which correctly fails the == 'SUCCESS' check in auth_required.
Fixes: GHSA-4w7q-wwx4-6973
|
|
FRR routing state was only available through the Prometheus frr-exporter,
a pull target. Operators who push everything else out via Telegraf had to
run an external Prometheus server and open inbound access to the router
just to scrape routing state.
Add a dedicated "service monitoring telegraf frr-metrics" node. When set,
Telegraf uses inputs.prometheus to scrape the already-running local
frr-exporter and re-emits the metrics through whatever Telegraf outputs
are already configured (InfluxDB, ADX, Loki, Splunk, etc.).
|
|
dhcp6c-script.j2 calls logmsg() six times but runs standalone under dhcp6c. It
never sources dhclient-enter-hooks.d/01-vyos-logging, which is only pulled into
the dhclient-script shell, and defines no logmsg() itself, so every call failed
with "logmsg: not found" while adding shell errors to the journal.
Carry a POSIX sh copy using the same tag, priorities and /tmp/vyos.dhclient.debug
gate as the DHCPv4 hooks. The two messages announcing an internal step log at
debug; the nameserver and search domain updates stay at info.
|
|
T9273: Add Telegraf global_tags option configurable
|
|
http-api: T8989: add REST Bearer token authentication
|
|
Adds Telegraf global_tags support - static tags stamped onto every metric.
```
set service monitoring telegraf global-tag <tag-name> value <tag-value>
```
Rendered as a [global_tags] block in telegraf.conf, applied ahead of all outputs.
|
|
|
|
Per dmbaturin's review: the value is a full FQDN, not a suffix, and the
help text should clarify that the poll checks for known vulnerabilities
in the running PowerDNS recursor version.
|
|
The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.
Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
|
|
dns: T8045: expose PowerDNS dont-query list as recursion-exclude-address
|
|
get_esp_ike_cipher() renders both IKE_SA proposals and CHILD_SA
proposals. It unconditionally appended the -esn / -noesn variants,
which are only meaningful for ESP: ESN is Transform Type 5 per
RFC 7296 section 3.3.2 and is defined for CHILD_SAs only.
Emitting ESN in an IKE_SA proposal breaks interoperability with
implementations that reject the malformed payload without replying
at all. Observed against a Cisco FTD: the IKE_SA_INIT is silently
discarded, no NO_PROPOSAL_CHOSEN and no INVALID_KE_PAYLOAD, so the
tunnel never comes up and nothing on the initiator side explains it.
Add an explicit esn parameter defaulting to True so ESP behaviour is
unchanged, and pass esn=False at the four IKE call sites: peer.j2,
profile.j2, remote_access.j2 and l2tp.j2. The five esp_proposals call
sites keep ESN.
ike_group could have served as the discriminator, since IKE call sites
do not pass it, but that coupling is incidental: the argument only
exists to resolve PFS.
Smoke test assertions on the proposals lines are updated accordingly;
the esp_proposals assertions are left untouched.
|
|
Disabling DPDK multi-segment buffers (no-multi-seg) lets VPP receive each
frame into a single buffer, increasing forwarding throughput. The frame
must then fit the buffer 'data-size', so 'no-multi-seg' is computed: it is
enabled only while the largest MTU across all VPP-bound interfaces, plus
its L2 framing overhead (26 bytes), fits 'data-size'. Otherwise VPP keeps
multi-seg and Jumbo frames still work without a larger buffer.
Changing the MTU of a VPP-bound interface can flip the flag, so
interfaces_ethernet reconfigures VPP when it changes, via an initial
dependency (set_dependents_initial) to avoid a cycle with the existing
vpp -> ethernet dependency.
|
|
vrf: T6097: add the nat anchor conntrack zoning needs
|
