| Age | Commit message (Collapse) | Author |
|---|
|
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
|
|
T9338: add bgp mpls l3vpn-multi-domain-switching
|
|
Poll intervals were left entirely to the NTP daemon's built-in defaults, so an
operator could not widen or narrow the polling range for an individual server,
warm up authenticated associations before a poll, or ask a peer for the higher
resolution timestamps it may be able to provide.
Each configured server and pool now accepts a minimum and maximum poll
exponent, defaulting to the values the daemon already used, plus an optional
presend exponent and a switch for the F323 extension field. Existing
configurations render the same associations as before.
Co-authored-by: Christian Breunig <christian@vyos.io>
|
|
dns: T9175: make PowerDNS security status poll opt-in
|
|
T9274: Add more telegraf configuration
|
|
vxlan: T9319: add VXLAN-GBP support
|
|
Added the ability to make several agent values configurable instead of hardcoded.
|
|
Add command
set protocols bgp interface <interface> mpls l3vpn-multi-domain-switching
that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under
interface node.
|
|
Expose the Group Policy extension as a valueless gbp CLI node and pass
it to iproute2 when creating VXLAN links. Recreate links when GBP
changes and reject configurations combining GBP with GPE.
Reject conflicting GBP settings on a shared UDP port, accounting for
address families and underlay VRF socket bindings. Warn that external
mode carries GBP in tunnel metadata instead of the packet mark.
Add smoketest coverage for GBP creation, removal and re-enabling,
retained interface settings, rejection without changing the running
tunnel, shared ports, separate address families, and external mode.
|
|
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
|
|
Not every option that turns the offload off can be recognised, so say so
where the option is entered.
|
|
"offload dco" was accepted next to tap, static keys, compression, CBC
ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the
module altogether. Those combinations now fail verify(), which would break
config load on upgrade, so drop the request instead.
The migration has to mirror verify_dco() exactly: anything it keeps that
verify() turns away leaves a router unable to commit its own configuration.
|
|
monitoring: T9260: relay local frr_exporter metrics via Telegraf
|
|
firewall: T9157: add fib-type match for destination/source
|
|
FRR routing state was only available through the Prometheus frr-exporter,
a pull target. Operators who push everything else out via Telegraf had to
run an external Prometheus server and open inbound access to the router
just to scrape routing state.
Add a dedicated "service monitoring telegraf frr-metrics" node. When set,
Telegraf uses inputs.prometheus to scrape the already-running local
frr-exporter and re-emits the metrics through whatever Telegraf outputs
are already configured (InfluxDB, ADX, Loki, Splunk, etc.).
|
|
Some NICs allow to configure more ring descriptors that we
allow in our CLI, extend it to 32768
```
sudo vppctl show hardware-interfaces detail eth2
Mellanox ConnectX-4/5/6 Family
carrier up full duplex max-frame-size 1522 promisc
flags: admin-up promisc maybe-multiseg tx-offload intel-phdr-cksum rx-ip4-cksum
Devargs:
rx: queues 6 (max 1024), desc 16384 (min 0 max 32768 align 1)
tx: queues 6 (max 1024), desc 8192 (min 0 max 32768 align 1)
```
|
|
T9273: Add Telegraf global_tags option configurable
|
|
http-api: T8989: add REST Bearer token authentication
|
|
Adds Telegraf global_tags support - static tags stamped onto every metric.
```
set service monitoring telegraf global-tag <tag-name> value <tag-value>
```
Rendered as a [global_tags] block in telegraf.conf, applied ahead of all outputs.
|
|
- Use OpenID Connect discovery (/.well-known/openid-configuration) to
resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
|
|
Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.
Configuration:
set service https api rest authentication oidc issuer <url>
set service https api rest authentication oidc jwks-url <url>
If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.
Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
|
|
Per dmbaturin's review: the value is a full FQDN, not a suffix, and the
help text should clarify that the poll checks for known vulnerabilities
in the running PowerDNS recursor version.
|
|
The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.
Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
|
|
dns: T8045: expose PowerDNS dont-query list as recursion-exclude-address
|
|
podman: T9129: Use systemd quadlet for containers and networks
|
|
This drastically reduces the wait time from podman killing containers during smoketest
|
|
ha: T9166: add IPv6 support for HA peer links
|
|
T9240: container: Allow sharing host's cgroup namespace with container
|
|
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
|
|
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
|
|
The `+=` append syntax is used for appending.
To remove from the defaults, users can use negation.
|
|
Accept IPv6 source and remote addresses for Kea high availability and
bracket IPv6 endpoints in generated peer URLs.
|
|
Accept IPv6 peer, listen, and multicast addresses. Render the selected
address family and validate it against the synchronization interface and
listen addresses.
|
|
- Add mac-address-mask support to firewall rules
- Add smoketest for mac-address-mask
|
|
|
|
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
Add new CLI subtree 'system option kdump' with memory reservation and
local dump path configuration. Also add 'show system kdump' and
'show system kdump dumps' operation mode commands to get
status of the configuration and list of dumps.
Extend 'show tech-support report' and 'generate tech-support archive' with
kdump service status, active config files and the recently kernel dump file.
|
|
|
|
interfaces: T9158: add option to enable/disable rx offload
|
|
Tab completion for source-interface and other interface leafNodes already
excludes VRF names, but the shared interface-name constraint accepted them
anyway: an existing VRF is a real net device, so it passed the file-path
existence check even though it failed the interface-name regex.
Replace the file-path validator with a new interface-exists validator that
requires the value to both exist under /sys/class/net and not be a VRF.
The regex-match fallback is unchanged, so dynamic interfaces (e.g. pppoe)
referenced before they exist still validate correctly.
|
|
ntp: T9159: add source-address option for client requests
|
|
ddclient: T6981: Upgrade ddclient to v4.0.0
|
|
IID secret enforcement across PPPoE, L2TP, PPTP, and SSTP (BP 2188)
(cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed)
|
|
calling-station-id, to generate Peer Interface Identifier (IID) (BP 2188)
(cherry picked from commit 5354959b60c97df699ad14ef561ab9aa92b37922)
|
|
Add support for receive checksum offload on ethernet interfaces.
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
|
|
Complements source-address (bindacqaddress) with a device-based bind
(chrony's bindacqdevice) for outgoing NTP client requests. Addresses
feedback on T9159 that a source IP alone cannot unambiguously select
the egress path in multi-VRF setups with overlapping address ranges.
Both options bind different socket properties and can be combined.
If "vrf" is set, source-interface must belong to that VRF, mirroring
the existing check for "interface".
|
|
Cosmetic bug
|
|
|
