| Age | Commit message (Collapse) | Author |
|---|
|
T8502: Add exclusion mask to config-sync
|
|
|
|
snmp: T8538: Persist engineBoots counter across reboots
|
|
When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.
The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.
Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.
This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.
|
|
ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers
|
|
T8910: ipoe-server: expose accel-ppp idle-timeout option
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
Add a CLI knob to terminate idle IPoE sessions after a configurable
timeout:
set service ipoe-server idle-timeout <0-86400>
Today there is no way to age out stale IPoE sessions: clients that go
silent (powered off, link down) leave a session record on the router
indefinitely. accel-ppp natively supports idle-timeout in its [ipoe]
section but VyOS did not expose it.
The option is added as a shared accel-ppp include so it can be reused
by other accel-ppp services in follow-up PRs.
|
|
|
|
|
|
T8822: Add BFD strict mode for BGP
|
|
|
|
firewall (#5206)
sysctl values written by firewall global-options are overwritten when using
"system option performance" configuration on VyOS CLI. This is caused by a
missing dependency fall from system_option.py to the firewall CLI helper script.
|
|
IKEv2 reauthentication was configurable via CLI but never translated
into `swanctl.conf`. Add `reauth_time` to the peer connection template,
driven by the `ikev2-reauth` flag on the ike-group and the per-peer
override (yes/no/inherit).
|
|
virtual-server (#5205)
|
|
|
|
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
Changes:
1. Change option space from 'ubnt' to 'vendor-encapsulated-options-space'.
2. Change option name from 'unifi-controller' to 'ubnt'.
3. Add 'vendor-encapsulated-options' option (in addition to adding unifi
controller IP address under the option name 'ubnt') if unifi-controller
is configured.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
|
T8478: Fix typo in the firewall template bridge chain name
|
|
config-sync: T7784: Add command to diff configuration with secondary node
|
|
Internal typo/cosmitic bug, no functional changes
|
|
T8448: add an option to enable SNMP traps in VRRP
|
|
Allow to configure Keepalived VRRP traps
- set high-availability vrrp snmp trap
|
|
Required during first-boot of a system. We have images form amd64 and arm64
CPUs which also tend to have different serial interfaces (ttyS vs. ttyAMA).
The images which are installed have the correct serial setting for GRUB (ttyS0
or ttyAMA0) and the activation script will probe the Kernel command-line. If a
serial interface is defined, we will include it in the VyOS CLI configuration.
|
|
|
|
Add a new operational command to compare configuration between
nodes participating in config synchronization.
New command:
- `show configuration secondary sync [commands] [running|candidate|saved] [config-node-path]`.
This allows operators to view configuration differences across secondary peer
before applying or syncing changes.
Supports:
- displaying using raw diff and 'commands' format;
- optional section filtering (subtree comparison);
- selectable config source (running, candidate, saved).
|
|
T8229: Fix handling of endpoint in Telegraf Loki template
|
|
bgp: T7338: Add support for "parameters as-notation <asdot|asdot+>"
|
|
|
|
We explicitly omit the "plain" option, as it is the implicit default in FRR
We also do not want to add "plain" as VyOS default value and emit it by default
as this makes the config a bit ugly (frr puts it in the router line so you get
"router bgp <AS> as-notation plain").
Additionally, setting plain as default value and emitting it by default would
break pretty much all BGP tests, as they commonly do
self.getFRRconfig(f'router bgp {ASN}', stop_section='^exit')
and getFRRConfig does a "^<content>$" match, which breaks when you add the
"as-notation plain"
|
|
Fix typos and mistakes
No functional changes
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
Commit 5c800be95 ("T8405: fix noipv6 emitted when dhcpv6-options configured
without ipv6 node") added a superfluous +, most likely due to a rebase or
merge error.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
When a PPPoE interface has dhcpv6-options (e.g. prefix delegation)
configured but no explicit ipv6 node, the Jinja template writes
noipv6 into the PPP peer configuration. This prevents IPv6CP
negotiation, causing the ISP to silently ignore all DHCPv6 traffic.
Fix the peer template to also check for dhcpv6_options before emitting
noipv6, and add dhcpv6-options and ipv6 to the list of config nodes
that trigger a PPPoE session restart so the change takes effect
without manual disconnect/reconnect.
|
|
T8386: fix locat_ts rendering in remote_access.j2
|
|
vpp: T8230: Add support for PPPoE on bonding interfaces
|
|
|
|
|
|
|
|
|
|
|
