vyos-1x.git - VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)

Age	Commit message (Collapse)	Author
2024-01-01	T5474: establish common file name pattern for XML conf mode commands	Christian Breunig
	We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in (cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)
2023-12-30	T5870: ipsec remote access VPN: add x509 ("pubkey") authentication.	Lucas Christian
	(cherry picked from commit 656934e85cee799dba5b495d143f6be445ac22d5)
2023-04-03	T5139: IPSec add IKE lifetime 0 for no rekeying	Viacheslav Hletenko
	IKE lifetime should starting from 0 for disabling rekeying
2023-02-15	ipsec: T4593: Migrate and remove legacy `include-ipsec` nodes	sarthurdev
	Not supported with swanctl
2023-02-13	ipsec: T4968: Added default values to dpd and close action	aapostoliuk
	Based on https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html Added default value to dpd_action - clear Added default value to close_action - none
2023-01-30	Merge pull request #1761 from sever-sever/T4916-curr	Viacheslav Hletenko
	T4916: Rewrite IPsec peer authentication and psk migration
2023-01-28	T4958: ocserv: openconnect: adds support for configuring RADIUS accounting	Jamie Austin
	Adds CLI configuration options to configure RADIUS accounting for OpenConnect VPN sessions. This functionality cannot be used outside of the RADIUS OpenConnect VPN authentication mode
2023-01-26	T4916: Rewrite IPsec peer authentication and psk migration	Viacheslav Hletenko
	Rewrite strongswan IPsec authentication to reflect structure from swanctl.conf The most important change is that more than one local/remote ID in the same auth entry should be allowed replace: 'ipsec site-to-site peer <tag> authentication pre-shared-secret xxx' => 'ipsec authentication psk <tag> secret xxx' set vpn ipsec authentication psk <tag> id '192.0.2.1' set vpn ipsec authentication psk <tag> id '192.0.2.2' set vpn ipsec authentication psk <tag> secret 'xxx' set vpn ipsec site-to-site peer <tag> authentication local-id '192.0.2.1' set vpn ipsec site-to-site peer <tag> authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer <tag> authentication remote-id '192.0.2.2' Add template filter for Jinja2 'generate_uuid4'
2023-01-18	ipsec: T4925: Added PRF into IKE group	aapostoliuk
	Added the possibility to configure Pseudo-Random Functions (PRF) in IKE group set vpn ipsec ike-group <Ike-grp> proposal <number> prf <PRF>
2023-01-12	T4118: Add default value any for connection remote-id	Viacheslav Hletenko
	If IPsec "peer <tag> authentication remote-id" is not set it should be "%any" by default https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html#_connections_conn_remote Set XML default value in use it in the python vpn_ipsec.py script
2022-10-31	ipsec: T4787: add support for road-warrior/remote-access RADIUS timeout	Christian Poessinger
	This enabled users to also use 2FA/MFA authentication with a radius backend as there is enough time to enter the second factor.
2022-09-20	xml: ipsec: T1210: add valueHelp and constraint for remote-access connection ↵	Christian Poessinger
	name
2022-09-20	xml: ipsec: T3093: add valueHelp and constraint for profile name	Christian Poessinger

2022-09-16	ipsec: T4118: Change vpn ipsec syntax for IKE ESP and peer	Viacheslav Hletenko
	Migration and Change boolean nodes "enable/disable" to disable-xxxx, enable-xxxx and just xxx for VPN IPsec configurations - IKE changes: - replace 'ipsec ike-group <tag> mobike disable' => 'ipsec ike-group <tag> disable-mobike' - replace 'ipsec ike-group <tag> ikev2-reauth yes\|no' => 'ipsec ike-group <tag> ikev2-reauth' - ESP changes: - replace 'ipsec esp-group <tag> compression enable' => 'ipsec esp-group <tag> compression' - PEER changes: - replace: 'peer <tag> id xxx' => 'peer <tag> local-id xxx' - replace: 'peer <tag> force-encapsulation enable' => 'peer <tag> force-udp-encapsulation' - add option: 'peer <tag> remote-address x.x.x.x' Add 'peer <name> remote-address <name>' via migration script
2022-06-29	xml: streamline interface definition filenames, drop _	Christian Poessinger
	Some files that described the CLI used underscores to split CLI levels, some others did not. This commit removes all underscores from the filename and only makes use of a hyphen.