| Age | Commit message (Collapse) | Author |
|---|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
This duplication did not cause any harm, but was found in the general
clean up related to element 'properties' collisions.
|
|
The include is unnecessary, as the element is fully defined in the
subsequent lines. As node.def files are only populated on the first
instance, this leads to loss of the proper value help entries hence
completions.
Without these changes, for example:
vyos@vyos# set system conntrack ignore ipv4 rule 137 protocol
will not list 'all', 'tcp_udp', etc. as intended.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
T8587: fix XML data type from u32 to u64 where range exceeds uint32 max
|
|
bgp: T8589: Add ead, es and [1-5] to route-map match evpn route-type
|
|
T8293: Add ability to set timeout for high-availability health-check
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
|
|
The following nodes specified u32 but their range values exceed the
uint32 maximum (4,294,967,295):
- service lldp interface location coordinate-based elin:
u32:0-9999999999 -> u64:0-9999999999
- vpn ipsec esp-group life-bytes:
u32:1024-26843545600000 -> u64:1024-26843545600000
- vpn ipsec esp-group life-packets:
u32:1000-26843545600000 -> u64:1000-26843545600000
|
|
BGP link-state doesn't support next-hop-self, so remove it.
|
|
|
|
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
|
T8448: add an option to enable SNMP traps in VRRP
|
|
Allow to configure Keepalived VRRP traps
- set high-availability vrrp snmp trap
|
|
remote: T4732: add VRF option for commit-archive
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
|
|
|
|
Add new CLI option to make transfers to the commit-archive working using a
dedicated (e.g. management) VRF.
set system config-management commit-archive vrf MGMT
All transfers using vyos.remote module will now run through the VRF defined on
the CLI.
|
|
bgp: T7338: Add support for "parameters as-notation <asdot|asdot+>"
|
|
T8222: Set the default VXLAN interface TTL to 64
|
|
We explicitly omit the "plain" option, as it is the implicit default in FRR
We also do not want to add "plain" as VyOS default value and emit it by default
as this makes the config a bit ugly (frr puts it in the router line so you get
"router bgp <AS> as-notation plain").
Additionally, setting plain as default value and emitting it by default would
break pretty much all BGP tests, as they commonly do
self.getFRRconfig(f'router bgp {ASN}', stop_section='^exit')
and getFRRConfig does a "^<content>$" match, which breaks when you add the
"as-notation plain"
|
|
Fix typos and mistakes
No functional changes
|
|
Default TTL of 16 is insufficient in many deployments, especially
in multi-hop or routed underlay networks. Increase it to 64
to provide better compatibility and avoid packet drop in real-world
topologies.
|
|
We can create pseudo-ethernet (peth, macvlan) interfaces from bond or bridge
interfaces as the unddelraying parent, so the completion helper should honor it.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
vpp: T8355: Set MTU for vpp interfaces
|
|
|
|
|
|
vpp: T8315: Add support for configuring unsupported NICs and update compatible list
|
|
compatible list
Introduce `set vpp settings unsupported nics <pci-id>` and
`set vpp settings unsupported drivers <driver>` to permit VPP activation
on hardware not present in the validated NIC list. Update current compatible list.
|
|
T8269: add option to silence individual validator output
|
|
|
|
|
|
section
|
|
vpp: T8339: Cleanup vpp interfaces and kernel-interfaces after migration
|
|
isis: T6978: add IS-IS SRv6 node-msd configuration
|
|
vpp: T8340: Remove vif option from vxlan interface
|
|
T7513: vyos-1x: CGNAT Exclude Rule CLI support
|
|
Co-Authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
|
|
vpp: T8328: Migrate xconnect interface to 'interfaces vpp xconnect'
|
|
|
|
ipsec: T8136: IPSEC PPK support
|
|
|
