| Age | Commit message (Collapse) | Author |
|---|
|
address configured
|
|
Instead of executing the command passed to popen() and waiting for it to
finish before printing its output, add a function argument to disable
buffered mode.
When buffered mode (the default) is turned off, each line emitted by the
process is flushed immediately to the calling TTY.
|
|
vpp: T8202: Remove XDP driver and options from CLI and config
|
|
op-mode: T8154: fix tcpdump KeyboardInterrupt on Ctrl+C
|
|
- Migration script removes 'driver' and 'xdp-options' nodes.
- XDP logic is commented out in config verification and CLI tests, preserving code for future use.
- The rest of XDP-related code remains untouched
|
|
vpp: T8125: Enable ip4-dhcp-client-detect feature if interface address is configured as DHCP
|
|
This adds the capability to make it re-usable in other code paths.
|
|
This change introduces CLI support for configuring network interface
interrupt coalescing parameters via `netlink`.
Note: Not all NIC drivers support interrupt coalescing. On unsupported interfaces,
`netlink` returns an error and the VyOS commit will fail.
|
|
configured as DHCP
DHCP address cannot be assigned on VPP interfaces without enabling the 'ip4-dhcp-client-detect' feature
|
|
|
|
* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
|
|
ssh: T7483: Add fido2 PubkeyAuthOptions
|
|
T7101: Add hardware watchdog support via systemd
|
|
|
|
|
|
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
(used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
|
|
T8046: traffic-engineering: support link-params
|
|
Add 'traffic-engineering' commands under 'protocols'.
set protocols traffic-engineering admin-group ADMINGROUP bit-position 1
set protocols traffic-engineering interface INTERFACE admin-group ADMINGROUP
set protocols traffic-engineering interface INTERFACE max-bandwidth 1280
set protocols traffic-engineering interface INTERFACE max-reservable-bandwidth 1280
Also add
set protocols isis traffic-engineering export
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
config: T8124: make get_config_dict() pki={} node purely optional
|
|
bond: T2416: support hot-add/remove of bond member interfaces
|
|
Automatic parsing and integration of the PKI subsystem into the resulting
config dict is now enabled by passing with_pki=True to get_config_dict().
However, when no PKI configuration is present, the resulting dictionary still
includes an empty PKI key. This is undesirable; we should only include keys in
the dictionary when they contain relevant data.
|
|
Previously, adding or removing a bond member interface would force the entire
bond into an admin-down state, removing and re-adding all member interfaces.
This caused unnecessary link up/down events and excessive log noise on partner
devices.
This change refactors the code to allow hot-adding and removal of bond member
interfaces without disrupting existing members, minimizing link state changes
and log entries.
|
|
|
|
|
|
vpp: T8080: Fix handling of configuration system lock after vpp commit failure
|
|
bond: T8084: disallow bond members that do not support MAC changes
|
|
|
|
Building on commit ba60266ab1896 (“ethernet: T8084: prevent MAC changes on
ENA interfaces (AWS EC2)”), add safeguards to prevent interfaces from being used
as bond members if they:
* do not support MAC address changes, or
* appear on a denylist of interfaces invalid for bonding (currently empty)
|
|
Add a safeguard to block MAC address changes when the underlying driver is ENA
(used on AWS EC2), and display a clear error message instead of raising
"OSError: [Errno 95] Operation not supported."
|
|
Add requests reference_tree_exists, get_path_type, get_completion_env.
|
|
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained
in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid
NSS/TACACS timeouts").
|
|
The previous implementation of "system login" relied on Python's pwd.getpwall()
to enumerate user accounts. This forces a full walk through the NSS stack,
which is acceptable in general but problematic for our use-case. VyOS only
needs information about locally created accounts and not remote accounts
provided via AAA backends such as TACACS or RADIUS.
When TACACS servers are unreachable, NSS lookups become extremely slow due to
repeated timeouts. As a result, any operation triggering pwd.getpwall()
(including configuration commits) can stall for several minutes.
This change introduces a dedicated helper, get_local_passwd_entries(), which
reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are
relevant, this provides all required data with no external dependencies.
Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers:
# set system login tacacs server 192.168.1.50 key test123
# set system login tacacs server 192.168.1.51 key test123
# time commit
Before:
real 3m29.825s
user 0m0.329s
sys 0m0.246s
After:
real 0m1.464s
user 0m0.337s
sys 0m0.195s
This significantly improves commit performance and removes sensitivity to AAA
server outages.
|
|
The upstream VPP code already writes the ena device ID to new_id
So we can remove `ena` from `override_driver()`
The kernel does not provide a reliable way to check whether an ID has already been
registered, so we simply attempt the write and ignore the FileExistsError.
Any other failure is treated as a warning.
Fixes this case:
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 156, in run_script
script.apply(c)
File "/usr/libexec/vyos/conf_mode/vpp.py", line 613, in apply
control_host.override_driver(
File "/usr/lib/python3/dist-packages/vyos/vpp/control_host.py", line 138, in override_driver
Path('/sys/module/vfio_pci/drivers/pci:vfio-pci/new_id').write_text(
File "/usr/lib/python3.11/pathlib.py", line 1079, in write_text
with self.open(mode='w', encoding=encoding, errors=errors, newline=newline) as f:
FileExistsError: [Errno 17] File exists
|
|
ipsec: T8001: Commit fails removing VTI interface in IPsec config
|
|
T8032: add analogue of cli-shell-api sessionUnsaved
|
|
|
|
Fix cases where commit or IPsec up/down hooks fail if the VTI interface
has already been deleted or the `/tmp/ipsec_vti_interfaces` file does not
exist.
Changes:
- Return empty dict from `get_interface_config()` if it returns None to
avoid TypeError when accessing 'operstate' (vti_updown_db.py).
- Use `open_vti_updown_db_for_create_or_update()` in `vti‑up‑down` script so
the temporary interface tracking file is created automatically when
missing.
|
|
|
|
T8009: add vyconf_cli_compat for retained options of cli-shell-api
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
|
|
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
|
|
op-mode: T8000: fix environment when calling my_set
|
|
T7556: VPP add IPFIX collector configuration
|
|
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
