| Age | Commit message (Collapse) | Author |
|---|
|
- Added solo leafNode to peer-group config
- Added solo.xml.i to reduce code duplication
- Added solo option to peer-group smoketests
|
|
isis: T7722: Added interface fast-reroute configuration commands
|
|
Added checks in the verify_rule() function of firewall.py for empty nodes.
Added migration script 19-to-20 to remove empty nodes from the config.
|
|
Added interface fast-reroute configuration commands
|
|
T7678: Move "vpp settings host-resources" to "system option resource-limits"
|
|
kea: T6211: add VRF support for KEA dhcp server
|
|
|
|
|
|
|
|
It will be configured in section "system option host-resources"
|
|
|
|
Multiple styles were used - streamline this to make it look more professional.
|
|
|
|
* T7658: Increase max-map-count interval and default value to linux default
Also input a warning instead of ConfigError in case of "host-resources max-map-count" didn't pass the verification
* T7656: Clarify warning message for max-map-count option verification
|
|
|
|
|
|
* T7424: Refactor and extend resource usage verification on commit for VPP CLI
T7424: Fix ruff errors
* T7424: Implement check for smoke tests runtime; reduce resource requirements for test environments
T7424: Fix errors in calculating the skipped and reserved CPU cores; Adjust default main heap size value.
* T7424: Refactor the CPU checks logic; Add total CPU usage check
T7424: Fix CPU reserve and skip cores calculations; Add total CPU usage check
T7424: Refactor smoketests to reflect new logic
* T7424: Refactor the CPU and memory checks logic
---------
Co-authored-by: oniko94 <onikolaiev94@outlook.com>
|
|
|
|
firewall: T6951: Add a configuration command for ethertypes that bridge firewalls should always accept
|
|
firewalls should always accept
|
|
journald
|
|
T7432: RPKI VRF Support
|
|
conntrack: T7208: nf_conntrack_buckets defaults and behavior
|
|
Previously, we used a lower limit of 1 and a default value of 32768 for the
nf_conntrack_buckets (conntrack hash-size) sysctl option. However, the Linux
kernel enforces an internal minimum of 1024. A configuration migrator will now
adjust the lower limit to 1024 if necessary.
The former default value of 32768 was passed as a kernel module option, which
only took effect after the second system reboot. This was due to the option being
rendered but not applied during the first boot. This behavior has been changed so
that the value is now configurable at runtime and takes effect immediately.
Additionally, since VyOS 1.4 increased the hardware requirements to 4GB of RAM,
we now align the default value of nf_conntrack_buckets with the kernel's
default for systems with more than 1GB of RAM to 65536 entries. Previously, we
only supported half that amount.
|
|
|
|
Allow accepting invalid packets for ethernet types `8021q` and `8021ad`
in addition to ARP and UDP types so that stateful bridge firewall works
for VLAN-aware bridges in addition to regular bridges.
|
|
|
|
Changed CoA port completion help to standard template.
|
|
T7348: Add config CPU thread-count for accel-ppp services
|
|
T7335: Fix typo for HAproxy help redirect-location path
|
|
since the validation utility adds them implicitly
|
|
Accel-ppp services should not use all CPU cores to process requests.
At the moment accel-ppp services use all available CPU cores
to process requests from the subscribers (establish/update session/etc).
During mass connection of sessions, this can lead to the fact that it
utilizes all CPU, and for other services like FRR, there is not enough
CPU time to process their own stable work.
services:
- L2TP
- SSTP
- PPPoE
- IPoE
- PPtP
Add this option configurable and use all cores if not set:
```
set service pppoe-server thread-count < all | half | x >
```
The defaultValue `all`
|
|
|
|
CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>
set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>
set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface
show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
|
|
T7386: firewall: Allow IPv6 member in firewall remote-groups
|
|
VyOS 1.4.1 implemented support for logging facilities for HAProxy. The
facilities got included from the syslog XML definition, which also added
"virtual" or non existing facilities in HAProxy, namely: all, authpriv and mark.
If any of the above facilities is set, HAProxy will not start.
The XML definition for syslog also came with an arbitrary log-level "all" that
is also unsupported in HAProxy.
This commit adds a migration script removing the illegal CLI nodes.
|
|
remote groups
|
|
firewall: T7358: add offload option to global state policy
|
|
New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface> # multi
set vpp nat44 interface inside <interface> # multi
set vpp nat44 address-pool translation interface <interface> # multi
set vpp nat44 address-pool translation address <address> # multi
set vpp nat44 address-pool twice-nat interface <interface> # multi
set vpp nat44 address-pool twice-nat address <address> # multi
set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>
set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit> # default 64512
set vpp settings nat44 timeout udp <sec> # default 300
set vpp settings nat44 timeout tcp-established <sec> # default 7440
set vpp settings nat44 timeout tcp-transitory <sec> # default 240
set vpp settings nat44 timeout icmp <sec> # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```
|
|
Turns out commit b124f0b3b ("interface: T4627: support IPv6 Interface
Identifier (token) for SLAAC") uncovered a wrong assumption in VyOS that every
interface type in use always supports SLAAC and IPv6-ND (neighbor discovery).
This is not true for WireGuard, Tunnel and VTI interfaces, thus do not provide
that CLI option. In addition SLAAC support should be removed for those interface
types in a future PR.
|
|
interface: T4627: support setting of IPv6 Interface Identifier(Token)
|
|
|
|
Add common IPv6 CLI option (use ethernet as example):
set interfaces ethernet eth0 ipv6 address interface-identifier
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Since the jump to the global state chain is inserted before all rules,
it wasn't possible to use offload with the global state policies
This commit adds a new chain for offloaded traffic in the forward
chain and jumps to that chain. Please enter the commit message for your changes. Lines starting
|
|
kea: T7281: Add ping-check, use built-in option for classless static routes
|
|
ids: T7241: remove Fastnetmon from the base system
|
|
* dhcp-server: T7310: add support for option 138 CAPWAP AC to KEA
* kea: T7310: Update data/templates/dhcp-server/kea-dhcp4.conf.j2
Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com>
* kea: T7310: Update python/vyos/kea.py
Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com>
* kea: T7310: add smoketest for capwap-ac-v4
* kea: T7310: Update python/vyos/kea.py
Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com>
---------
Co-authored-by: David Vølker <davvol@davvol.dk>
Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com>
|
|
It will eventually be moved to an addon
|
|
|
|
firewall: T5493: Implement remote-group
|
