| Age | Commit message (Collapse) | Author |
|---|
|
container: T9401: add chown option to tmpfs mounts
|
|
config-management: T6304: Rewrite commit-archive location into a structured CLI
|
|
bgp: T9410: add route-map vrf import under ipv6-unicast
|
|
router-advert: T9413: add no-remove-on-exit and no-flush-* options
|
|
On shutdown radvd sends a final RA with router lifetime 0 and announces
its RDNSS and DNSSL entries with lifetime 0. On a VRRP pair that sends
RAs from a shared source address (source-address fe80::1), hosts read
the zero router lifetime as the shared router going away and remove
their default route until the backup's next RA. On my routers that was
1.6 s of IPv6 loss when the master rebooted.
radvd controls this with RemoveAdvOnExit, FlushRDNSS and FlushDNSSL,
all defaulting to on. Expose them per interface:
set service router-advert interface <if> no-remove-on-exit
set service router-advert interface <if> no-flush-name-server
set service router-advert interface <if> no-flush-dnssl
The directives are only rendered when the options are set, so the
generated radvd.conf is unchanged for existing configurations.
|
|
The ipv4-unicast address family has 'route-map vrf import' to filter the
VRF route leak; ipv6-unicast did not, so an IPv6 leak could not be
filtered. The template is already AFI-generic: only the CLI node was
missing.
|
|
openvpn: T9370: add chacha20poly1305 data cipher
|
|
bgp: T9404: do not render "bgp default local-preference" when the value is 100
|
|
T9351: Accel-PPP-NG: Add CLI support for Message Authenticator attribute in Access packets (Blast-RADIUS mitigation)
|
|
Replace the free-form 'commit-archive location <url>' leafNode with a
structured, per-destination tagNode:
`set system config-management commit-archive location <name> <protocol> \
authentication { username | password } | server | port | path`
Each location selects exactly one transport protocol (scp, sftp, ssh, ftp,
ftps, http, https, git, tftp). 'git' additionally accepts a 'transport'
(https/http/ssh, default https). 'source-address' and 'vrf' stay under
'commit-archive' and apply to every location, as before.
|
|
FRR does not print "bgp default local-preference 100" in show
running-config because 100 is its default, so frr-reload never finds the
line in the running config and sends it again on every reload. The
command handler calls bgp_clear_star_soft_in() whether or not the value
changed, so every reload ran "clear bgp * soft in" (once in pass 0 and
twice in pass 1), a full inbound re-evaluation of every peer.
Add the default (100) to the XML definition of parameters default
local-pref. Templates cannot query the XML definition while rendering,
so frrender takes the value from the config defaults of "parameters
default" (conf.get_config_defaults) and adds it to the BGP dict as the
key xml_default_local_pref, for the global instance and for every VRF
instance. bgpd.frr.j2 renders the line only when the configured value
differs from xml_default_local_pref, so the value 100 is not hardcoded
in the template. A real value change (100 to 200, or 200 to 100) is
still sent: frr-reload sees the difference between the rendered file and
the running config.
|
|
Since T9024 (Podman 5.8.4, crun replaced by runc 1.1.5), a tmpfs mounted
over a directory that already exists in the image is owned by root:root
0755, whatever the image prepared. A container running as a non-root
user (image USER or uid/gid) can no longer write its pid file or control
socket there and fails to start. With crun 1.8.1 every tmpfs was 1777,
so the same configuration used to work.
runc 1.1.5 ignores tmpfs-mode; the Podman mount option `U` (chown the
mount to the container user) is the only one that works on the runtime
VyOS ships. Expose it as a valueless `chown` node:
set container name <name> tmpfs <tag> chown
Without the option the generated Quadlet line is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Offer chacha20poly1305 in "encryption data-ciphers" and
"encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and
allowed with DCO.
|
|
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
|
|
in Access packets
Add CLI options to control Message-Authenticator handling for Access
packets.
The new options allow including Message-Authenticator in Access-Request
packets and requiring it in Access-Accept, Access-Reject and
Access-Challenge responses. Render the corresponding accel-ppp-ng
configuration options and warn when response validation is configured as
required while Access-Request packets are not configured to include
Message-Authenticator.
|
|
T9338: add bgp mpls l3vpn-multi-domain-switching
|
|
Poll intervals were left entirely to the NTP daemon's built-in defaults, so an
operator could not widen or narrow the polling range for an individual server,
warm up authenticated associations before a poll, or ask a peer for the higher
resolution timestamps it may be able to provide.
Each configured server and pool now accepts a minimum and maximum poll
exponent, defaulting to the values the daemon already used, plus an optional
presend exponent and a switch for the F323 extension field. Existing
configurations render the same associations as before.
Co-authored-by: Christian Breunig <christian@vyos.io>
|
|
dns: T9175: make PowerDNS security status poll opt-in
|
|
T9274: Add more telegraf configuration
|
|
vxlan: T9319: add VXLAN-GBP support
|
|
Added the ability to make several agent values configurable instead of hardcoded.
|
|
Add command
set protocols bgp interface <interface> mpls l3vpn-multi-domain-switching
that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under
interface node.
|
|
Expose the Group Policy extension as a valueless gbp CLI node and pass
it to iproute2 when creating VXLAN links. Recreate links when GBP
changes and reject configurations combining GBP with GPE.
Reject conflicting GBP settings on a shared UDP port, accounting for
address families and underlay VRF socket bindings. Warn that external
mode carries GBP in tunnel metadata instead of the packet mark.
Add smoketest coverage for GBP creation, removal and re-enabling,
retained interface settings, rejection without changing the running
tunnel, shared ports, separate address families, and external mode.
|
|
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
|
|
Not every option that turns the offload off can be recognised, so say so
where the option is entered.
|
|
"offload dco" was accepted next to tap, static keys, compression, CBC
ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the
module altogether. Those combinations now fail verify(), which would break
config load on upgrade, so drop the request instead.
The migration has to mirror verify_dco() exactly: anything it keeps that
verify() turns away leaves a router unable to commit its own configuration.
|
|
monitoring: T9260: relay local frr_exporter metrics via Telegraf
|
|
firewall: T9157: add fib-type match for destination/source
|
|
FRR routing state was only available through the Prometheus frr-exporter,
a pull target. Operators who push everything else out via Telegraf had to
run an external Prometheus server and open inbound access to the router
just to scrape routing state.
Add a dedicated "service monitoring telegraf frr-metrics" node. When set,
Telegraf uses inputs.prometheus to scrape the already-running local
frr-exporter and re-emits the metrics through whatever Telegraf outputs
are already configured (InfluxDB, ADX, Loki, Splunk, etc.).
|
|
Some NICs allow to configure more ring descriptors that we
allow in our CLI, extend it to 32768
```
sudo vppctl show hardware-interfaces detail eth2
Mellanox ConnectX-4/5/6 Family
carrier up full duplex max-frame-size 1522 promisc
flags: admin-up promisc maybe-multiseg tx-offload intel-phdr-cksum rx-ip4-cksum
Devargs:
rx: queues 6 (max 1024), desc 16384 (min 0 max 32768 align 1)
tx: queues 6 (max 1024), desc 8192 (min 0 max 32768 align 1)
```
|
|
T9273: Add Telegraf global_tags option configurable
|
|
http-api: T8989: add REST Bearer token authentication
|
|
Adds Telegraf global_tags support - static tags stamped onto every metric.
```
set service monitoring telegraf global-tag <tag-name> value <tag-value>
```
Rendered as a [global_tags] block in telegraf.conf, applied ahead of all outputs.
|
|
- Use OpenID Connect discovery (/.well-known/openid-configuration) to
resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
|
|
Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.
Configuration:
set service https api rest authentication oidc issuer <url>
set service https api rest authentication oidc jwks-url <url>
If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.
Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
|
|
Per dmbaturin's review: the value is a full FQDN, not a suffix, and the
help text should clarify that the poll checks for known vulnerabilities
in the running PowerDNS recursor version.
|
|
The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.
Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
|
|
dns: T8045: expose PowerDNS dont-query list as recursion-exclude-address
|
|
podman: T9129: Use systemd quadlet for containers and networks
|
|
This drastically reduces the wait time from podman killing containers during smoketest
|
|
ha: T9166: add IPv6 support for HA peer links
|
|
T9240: container: Allow sharing host's cgroup namespace with container
|
|
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
|
|
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
|
|
The `+=` append syntax is used for appending.
To remove from the defaults, users can use negation.
|
|
Accept IPv6 source and remote addresses for Kea high availability and
bracket IPv6 endpoints in generated peer URLs.
|
|
Accept IPv6 peer, listen, and multicast addresses. Render the selected
address family and validate it against the synchronization interface and
listen addresses.
|
|
- Add mac-address-mask support to firewall rules
- Add smoketest for mac-address-mask
|
|
|
|
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
