| Age | Commit message (Collapse) | Author |
|---|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
|
|
This duplication did not cause any harm, but was found in the general
clean up related to element 'properties' collisions.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
BGP link-state doesn't support next-hop-self, so remove it.
|
|
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
bgp: T7338: Add support for "parameters as-notation <asdot|asdot+>"
|
|
We explicitly omit the "plain" option, as it is the implicit default in FRR
We also do not want to add "plain" as VyOS default value and emit it by default
as this makes the config a bit ugly (frr puts it in the router line so you get
"router bgp <AS> as-notation plain").
Additionally, setting plain as default value and emitting it by default would
break pretty much all BGP tests, as they commonly do
self.getFRRconfig(f'router bgp {ASN}', stop_section='^exit')
and getFRRConfig does a "^<content>$" match, which breaks when you add the
"as-notation plain"
|
|
Fix typos and mistakes
No functional changes
|
|
We can create pseudo-ethernet (peth, macvlan) interfaces from bond or bridge
interfaces as the unddelraying parent, so the completion helper should honor it.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
|
|
|
|
vpp: T8339: Cleanup vpp interfaces and kernel-interfaces after migration
|
|
Co-Authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
|
|
ospf: T7679: fix plaintext authentication on specific interface
|
|
ospf: T8319: virtual-link takes invalid input data <INT>
|
|
vrf: T8320: only allow alpha numerical characters, - and _ as VRF name
|
|
|
|
|
|
vyos@vyos# set protocols ospf area 0 virtual-link
Possible completions:
> <x.x.x.x> OSPF area in dotted decimal notation
>
vyos@vyos# set protocols ospf area 0 virtual-link 0
vyos@vyos# commit
vtysh failed to process new configuration: vtysh (mark file) exited with
status 2: b'line 30: % Unknown command: area 0 virtual-link 0 hello-
interval 10 retransmit-interval 5 transmit-delay 1 dead-interval 40\n\n'
|
|
(target version 6)
|
|
|
|
Grafana Cloud token consist of several components that are put into a json structure, base64 encoded and have also a prefix.
Contents of the Token:
Name of the Token (max 255)
Organization (currently 7 digits)
Secret (fixed 24)
Region (longest currently 20)
That beeing said, the length can easily exceed 255 chars. They dont expect the Password to be longer than 500 chars. I propose to simply set 512.
|
|
commands
Add `set vpp settings interfaces-rx-mode <polling|interrupt|adaptive>`
to configure RX mode for all interfaces. Raise error if any interface
does not support the selected mode.
Also remove per-interface rx-mode commands:
- `set vpp settings interface <name> rx-mode`
- `set vpp kernel-interfaces <name> rx-mode`
|
|
xml: T8271: cleanup duplicate includes and split duplicate code into new building blocks
|
|
bgp: T7984: add CLI support for "neighbor <N> remote-as auto"
|
|
|
|
$ make interface_definitions
$ git add -f templates-cfg
$ ... refactor
$ make interface_definitions
$ git diff templates-cfg
No change in any node.def file detected.
|
|
$ make interface_definitions
$ git add -f templates-cfg
$ ... refactor
$ make interface_definitions
$ git diff templates-cfg
No change in any node.def file detected.
|
|
Verified that the resulting node.def files are still the same by:
$ make interface_definitions
$ git add -f templates-cfg
$ ... refactor
$ make interface_definitions
$ git diff templates-cfg
No change in any node.def file detected.
|
|
FRR implemented a new know to learn the peers remote ASN from the BGP OPEN
message from https://github.com/FRRouting/frr/pull/16345.
|
|
This commit changes logging settings naming:
- before: `set vpp settings logging default-log-level <alert>`
- after: `set vpp settings logging default-level <alert>`
|
|
|
|
|
|
|
|
geoip: T7926: T8049: Refactor geoip code and add MaxMind support
|
|
- Migration script removes 'driver' and 'xdp-options' nodes.
- XDP logic is commented out in config verification and CLI tests, preserving code for future use.
- The rest of XDP-related code remains untouched
|
|
pppoe-server: T8143: Set 'vpp-cp' option automatically if interface is in VPP
|
|
T7664: support FRR 10.5
|
|
|
|
|
|
In FRR 10.5 ip protocols
* connected
* kernel
* local
* table
* table-direct
are removed. First three in fb8e399e4f66d09780f176fbecb99168089e64eb,
table* in 7fd030504be060387694e8a2af7f19ddd7dee39d.
In `ip protocols`, `ipv6 protocols` and `vrf` VyOS supports
* connected
* kernel
* table
Remove these from CLI, add migration scripts, update tests.
|
|
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
(used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
|
|
isis: T8158: fix lsp-timers
|
|
T8046: traffic-engineering: support link-params
|
|
There are three configuration values in VyOS isis XML:
* lsp-gen-interval
* lsp-refresh-interval
* max-lsp-lifetime
In FRR they have the following restrictions in yang model:
* refresh-interval, default 900
* maximum-lifetime >= refresh-interval + 300 (350-65535), default 1200
* generation-interval < refresh-interval (1..120), default 30
When setting these values in separate steps we can get error e.g.:
libyang: Must condition ". >= ../refresh-interval + 300" not satisfied.
even when all restrictions are satisfied.
To fix the issue:
1. Write default values in our XML.
2. Check these restrictions in protocol_isis.py
3. Use FRR command `lsp-timers` that sets all these values in one go
|
