| Age | Commit message (Collapse) | Author |
|---|
|
T8046: traffic-engineering: support link-params
|
|
Add 'traffic-engineering' commands under 'protocols'.
set protocols traffic-engineering admin-group ADMINGROUP bit-position 1
set protocols traffic-engineering interface INTERFACE admin-group ADMINGROUP
set protocols traffic-engineering interface INTERFACE max-bandwidth 1280
set protocols traffic-engineering interface INTERFACE max-reservable-bandwidth 1280
Also add
set protocols isis traffic-engineering export
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
config: T8124: make get_config_dict() pki={} node purely optional
|
|
bond: T2416: support hot-add/remove of bond member interfaces
|
|
Automatic parsing and integration of the PKI subsystem into the resulting
config dict is now enabled by passing with_pki=True to get_config_dict().
However, when no PKI configuration is present, the resulting dictionary still
includes an empty PKI key. This is undesirable; we should only include keys in
the dictionary when they contain relevant data.
|
|
Previously, adding or removing a bond member interface would force the entire
bond into an admin-down state, removing and re-adding all member interfaces.
This caused unnecessary link up/down events and excessive log noise on partner
devices.
This change refactors the code to allow hot-adding and removal of bond member
interfaces without disrupting existing members, minimizing link state changes
and log entries.
|
|
|
|
|
|
vpp: T8080: Fix handling of configuration system lock after vpp commit failure
|
|
bond: T8084: disallow bond members that do not support MAC changes
|
|
|
|
Building on commit ba60266ab1896 (“ethernet: T8084: prevent MAC changes on
ENA interfaces (AWS EC2)”), add safeguards to prevent interfaces from being used
as bond members if they:
* do not support MAC address changes, or
* appear on a denylist of interfaces invalid for bonding (currently empty)
|
|
Add a safeguard to block MAC address changes when the underlying driver is ENA
(used on AWS EC2), and display a clear error message instead of raising
"OSError: [Errno 95] Operation not supported."
|
|
Add requests reference_tree_exists, get_path_type, get_completion_env.
|
|
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained
in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid
NSS/TACACS timeouts").
|
|
The previous implementation of "system login" relied on Python's pwd.getpwall()
to enumerate user accounts. This forces a full walk through the NSS stack,
which is acceptable in general but problematic for our use-case. VyOS only
needs information about locally created accounts and not remote accounts
provided via AAA backends such as TACACS or RADIUS.
When TACACS servers are unreachable, NSS lookups become extremely slow due to
repeated timeouts. As a result, any operation triggering pwd.getpwall()
(including configuration commits) can stall for several minutes.
This change introduces a dedicated helper, get_local_passwd_entries(), which
reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are
relevant, this provides all required data with no external dependencies.
Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers:
# set system login tacacs server 192.168.1.50 key test123
# set system login tacacs server 192.168.1.51 key test123
# time commit
Before:
real 3m29.825s
user 0m0.329s
sys 0m0.246s
After:
real 0m1.464s
user 0m0.337s
sys 0m0.195s
This significantly improves commit performance and removes sensitivity to AAA
server outages.
|
|
The upstream VPP code already writes the ena device ID to new_id
So we can remove `ena` from `override_driver()`
The kernel does not provide a reliable way to check whether an ID has already been
registered, so we simply attempt the write and ignore the FileExistsError.
Any other failure is treated as a warning.
Fixes this case:
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 156, in run_script
script.apply(c)
File "/usr/libexec/vyos/conf_mode/vpp.py", line 613, in apply
control_host.override_driver(
File "/usr/lib/python3/dist-packages/vyos/vpp/control_host.py", line 138, in override_driver
Path('/sys/module/vfio_pci/drivers/pci:vfio-pci/new_id').write_text(
File "/usr/lib/python3.11/pathlib.py", line 1079, in write_text
with self.open(mode='w', encoding=encoding, errors=errors, newline=newline) as f:
FileExistsError: [Errno 17] File exists
|
|
ipsec: T8001: Commit fails removing VTI interface in IPsec config
|
|
T8032: add analogue of cli-shell-api sessionUnsaved
|
|
|
|
Fix cases where commit or IPsec up/down hooks fail if the VTI interface
has already been deleted or the `/tmp/ipsec_vti_interfaces` file does not
exist.
Changes:
- Return empty dict from `get_interface_config()` if it returns None to
avoid TypeError when accessing 'operstate' (vti_updown_db.py).
- Use `open_vti_updown_db_for_create_or_update()` in `vti‑up‑down` script so
the temporary interface tracking file is created automatically when
missing.
|
|
|
|
T8009: add vyconf_cli_compat for retained options of cli-shell-api
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
|
|
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
|
|
op-mode: T8000: fix environment when calling my_set
|
|
T7556: VPP add IPFIX collector configuration
|
|
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
VRF: T7255: Impossible to delete protocols under VRF
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
When deleting the 'protocols' node under a VRF, a `KeyError` was raised in
`frrender.py` because the 'protocols' dictionary key was missing when
attempting to update protocol states. This prevented configuration
commits from completing successfully.
|
|
|
|
wlb: T7977: Fix weight calculation for multiple interfaces
|
|
T7915: minor fixes for consistent exception handling and error messages
|
|
veth: T7990: fix stale DHCP clients when removing virtual Ethernet pairs
|
|
show_sessions returns a list of dicts of the internal session record
structure for each live session. As this call is itself mediated by a
session one can specify exclude_self=True, resp., exclude_other=True.
|
|
|
|
pid is the more commonly passed argument, and this maintains consistency
with configsession arg use.
|
|
The standalone script teardown-config-session.py is called on CLI
config-mode exit, to close the persistent vyconf config session. Instead
of injecting the config-mode env var into the external script to
indicate a non-ephemeral session, add keyword 'extant' to find existing
session.
|
|
|
|
|
|
|
|
The addition of alert exn to vyos1x-config allows an audit of all raised
exceptions, providing fixes for consistent handling and error reporting.
|
|
|
