| Age | Commit message (Collapse) | Author |
|---|
|
The vyos.xml functionality is replaced with vyos.xml_ref.
(cherry picked from commit 28a7195d8e200418d2fdc3b8839f14f514d788e7)
|
|
|
|
Allowed using ipoe interface client-subnet without client pools
configuration.
(cherry picked from commit 49d4df5926637ec3dfd33a1dfcaab364adc28c4c)
|
|
found using "git ls-files *.py | xargs pylint | grep W0611"
(cherry picked from commit 274b2da242acd1f1f64ff1dee471e34295137c5f)
|
|
* Use interface_exists() outside of verify()
* Use verify_interface_exists() in verify() to drop common error message
(cherry picked from commit 4c7c168fe970b807750a05ceb66b70c0d8652535)
|
|
T6192: allow binding SSH to multiple VRF instances (backport #3229)
|
|
The next evolutional step after adding get_config_dict(..., with_pki=True) is
to add a common verification function for the recurring task of validating SSL
certificate existance in e.g. EAPoL, OpenConnect, SSTP or HTTPS.
(cherry picked from commit 3b758d870449e92fece9e29c791b950b332e6e65)
|
|
Currently VyOS only supports binding a service to one individual VRF. It might
become handy to have the services (initially it will be VRF, NTP and SNMP) be
bound to multiple VRFs.
Changed VRF from leafNode to multi leafNode with defaultValue: default - which
is the name of the default VRF.
(cherry picked from commit e5af1f0905991103b12302892e6f0070bbb7b770)
|
|
(cherry picked from commit 5bb27f0c6220fd940b63cdd37a60c312c0ac3efd)
|
|
(cherry picked from commit 09ac2851f89f2b7d94a21c3506e46f380e961fba)
|
|
(cherry picked from commit 6e0fdbcbba39691461f791c7a68a2c6c5091d2c1)
|
|
After migrating from ISC DHCLIENT for IPv6 to wide-dhcp-client the logic which
was present to update /etc/resolv.conf with the DHCP specified nameservers and
also the search domain list was no longer present.
This commit adds a per interface rendered script to inform vyos-hostsd about
the received IPv6 nameservers and search domains.
(cherry picked from commit ece425f0191762638b7c967097accd8739e9103d)
|
|
(cherry picked from commit 6927c0b622c8feaece907944bae3d4724f1e55a0)
|
|
dhcp-server: T4718: Listen-address is not commited if the IP address is on the interface with a VRF
|
|
(cherry picked from commit 74e502c16109b8d6d197751fc63ac5a32ff44404)
|
|
The current op-mode script simply calls sudo systemctl restart "dhclient@$4.service"
with no additional information about a client interface at all.
This results in useless dhclient processes
root 47812 4.7 0.0 5848 3584 ? Ss 00:30 0:00 /sbin/dhclient -4 -d
root 48121 0.0 0.0 4188 3072 ? S 00:30 0:00 \_ /bin/sh /sbin/dhclient-script
root 48148 50.0 0.2 18776 11264 ? R 00:30 0:00 \_ python3 -
Which also assign client leases to all local interfaces, if we receive one
valid DHCPOFFER
vyos@vyos:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ----------------- ----------------- ------- ----- ----- -------------
eth0 - 00:50:56:bf:c5:6d default 1500 u/u
eth0.10 172.16.33.102/24 00:50:56:bf:c5:6d default 1500 u/u
eth1 172.16.33.131/24 00:50:56:b3:38:c5 default 1500 u/u
172.16.33.102/24 and 172.16.33.131/24 are stray DHCP addresses.
This commit moved the renew command to the DHCP op-mode script to properly
validate if the interface we request a renew for, has actually a dhcp address
configured. In additional this exposes the renew feature to the API.
(cherry picked from commit 7dbaa25a199a781aaa9f269741547e576410cb11)
|
|
interface with vrf
|
|
bgp: T6106: Show complete FRR output on internal errors (backport #3151)
|
|
vti: T6085: bring VTI interfaces up only when the IPsec tunnel is up (backport #3157)
|
|
This reverts commit ab30509b25d54dac99294b76ba03fd49c3d2c946.
As in T6152 there seem to be some NICs that have a non working implementation
of reading the EEE registers. Remove this feature in the meantime until there
is a less exploding solution hindering boards to boot.
Return to Kernel defaults by removing this code path.
(cherry picked from commit 946f93778f15f4af9f31cd5b164efcd931693635)
|
|
peer-group
handle vtysh bgp error
(cherry picked from commit 6fa72591972618f02ac1c66c084a99e006ce18f3)
|
|
Extend the way how we determine if interfaces exist in VyOS. In the past we
only validated if the interface in question really exists at the OS level.
This has some drawbacks as services (like OSPF or OSPFv3) can also handle
interfaces dynamically which appear or leaf the OS.
This commit not only checks for OS interfaces but also if the interface in
question was configured at the CLI level, this is proof enough to pass the
check. If it does not exist at the CLI level, we continue searching it it's
maybe a Kernel interface - useful for container networks.
In addition we can now not only raise() an error but simply show a warning if
an interface does not exist.
(cherry picked from commit f7250ecf1d119f14d72f99ee379deaaae0790f0e)
|
|
When a VTI interface is just created, it is in ADMIN UP state by default, even
if an IPSec peer is not connected. After the peer is disconnected the interface
goes to DOWN state as expected.
This breaks routing logic - for example, static routes through VTI interfaces
will be active even if a peer is not connected.
This changes to logic so ADMIN UP/DOWN state can only be changed by the
vti-up-down helper script.
Error was introduced during the Perl -> Python migration and move to the generic
vyos.ifconfig abstraction during the 1.4 development cycle.
(cherry picked from commit 9eb018c4935235d292d7c693ac15da5761be064a)
|
|
Linux bridge uses EtherType 0x8100 by default. In some scenarios, an EtherType
value of 0x88A8 is required.
Reusing CLI command from VIF-S (QinQ) interfaces:
set interfaces bridge br0 protocol 802.1ad
(cherry picked from commit 9c9b1febff6863ccd3632a04d9e307909b3efe7a)
|
|
add mtu to default and specified class
update smoke test
(cherry picked from commit 84bbcdf5b7980f701aba6e158a2be4a05e7076d9)
|
|
(cherry picked from commit 4291a1a423c3cbbae9e4142575b36d6fbe1c126f)
|
|
To iterate files on ext* file systems GRUB reads their inodes one by one,
ignoring names. This breaks our configuration logic that relies on proper
loading order.
This commit adds a helper `sort_inodes()` that needs to be used whenever GRUB
configuration files are created. It recreates files, changing their inodes in a
way where inodes order matches alphabetical order.
(cherry picked from commit f74923202311e853b677e52cd83bae2be9605c26)
|
|
(cherry picked from commit 73e215dc338c8c3a6c9b3d10c952477ba00b923b)
|
|
(cherry picked from commit 8f2534e9654b61b7db45788bb52ac6cf8017b054)
|
|
(cherry picked from commit 2104424c1a43dc027567e051262e1eed6506491f)
|
|
settings
(cherry picked from commit 5ee89f46096626ca8aac37da9237635e3d17766a)
|
|
Feature detection is used to see if certain offload settings are available on
the given NIC.
(cherry picked from commit 63ccdc5125e19f8737bf1445938998bef803d1bd)
|
|
is a network.
(cherry picked from commit a7a0c90404d03f7deccb74a46d0fe1f99116907a)
|
|
(cherry picked from commit b984cf8d179cf3d4b16e7f3e5cf94f822055cb04)
|
|
(cherry picked from commit c7f5b510cfd117e57f2d22e259c843600ef4cc76)
|
|
EEE enabled status is on the 2nd line of ethtool output and not the 3rd. Subsequently, reading the 3rd line was causing an out-of-bounds access for the bnx2x driver as well.
(cherry picked from commit 775348a4cda34e6be16454d43c77b525e57c4e47)
|
|
required
(cherry picked from commit 6f7d1e15665655e37e8ca830e28d9650445c1217)
|
|
(cherry picked from commit 5949ff72a9f953da9d06d1ad75add0e6023d0dc4)
|
|
Removed dhcp-interface option (l2tp)
Added wins-server (sstp)
Added description (ipoe, pppoe, sstp, pptp)
Added exteded-script (l2tp, sstp, pptp)
Added shaper (ipoe, pptp, sstp, l2tp)
Added limits (ipoe, pptp, sstp, l2tp)
Added snmp ( ipoe, pptp,sstp, l2tp)
Refactoring and reformated code.
(cherry picked from commit ac6a16f6c5ad7700789759e1ec093236c2e182a2)
|
|
set pki openssh rpki private key ...
set pki openssh rpki public key ...
set pki openssh rpki public type 'ssh-rsa'
(cherry picked from commit 8c78ef0879f22ffd4a5f7fdb175e9109b46e9d7b)
|
|
The `class_id_max` is wrong due to `tmp.sort` of Strings
If we have class 5 and class 10 we get sorted max value 5, expected 10
```
>>> tmp = ['5', '10']
>>> tmp.sort()
>>> tmp
['10', '5']
>>>
>>> hex(5+1)
'0x6'
>>>
>>> hex(10+1)
'0xb'
>>>
```
This way we get wrong default maximum class value:
```
tc qdisc replace dev eth1 root handle 1: htb r2q 444 default 6
```
Expect:
```
tc qdisc replace dev eth1 root handle 1: htb r2q 444 default b
```
Fix this converting Strings to Integers and get max value.
(cherry picked from commit 2e8fa45c7f0663549edd118622b3381e7c428b2e)
|
|
T5828: fix grub installation on arm64-efi machines (backport #2643)
|
|
Since the migration of GRUB handling to vyos-1x, the grub install
sequence has hardcoded references to x86.
Change the GRUB sequence so it can work on arm64 as well.
(cherry picked from commit 37bd574c4e1f49b03f985c4293513ff7107ae82f)
|
|
Rewritten authentication node in accel-ppp services
to a single view. In particular - PPTP authentication.
(cherry picked from commit 018110200c9a82815dd5d0510f0732d7159c0d59)
|
|
This extends commit 9199c87cf ("init: T2044: always start/stop rpki during
system boot") to check the bootup configuration if an RPKI cache is defined.
Only start RPKI if this is the case.
(cherry picked from commit 9b8e11e078c42e3ae86ebfa45fec57336f25a0af)
|
|
The current calculation `r2q` is wrong as it uses `Floor division`
but expecting `division`
This way `math.ceil` calculate wrong value as we expect
round a number upward to its nearest integer
For example for speed 710 mbits expected value `444` but we get `443`
```
from math import ceil
MAXQUANTUM = 200000
speed = 710000000
speed_bps = int(speed) // 8
>>> speed_bps // MAXQUANTUM
443
>>> speed_bps / MAXQUANTUM
443.75
>>>
>>>
>>> ceil(speed_bps // MAXQUANTUM)
443
>>> ceil(speed_bps / MAXQUANTUM)
444
>>>
```
(cherry picked from commit ce1035e1e8642bf740e2a21693a72fe2127b8f72)
|
|
(cherry picked from commit d80530c48a78dfeb55293494a257f6234b0ef76d)
|
|
Commit b152b5202 ("configdict: T5894: add get_config_dict() flag with_pki")
added the generic PKI flag but if there was no PKI subsystem available
in the configuration, no pki dict key ever manifested in the resulting
dictionary requested by the caller.
This is different to the old behavior (which each caller implementing the call
itself) where there always was a pki key present - even if it was empty.
This triggered a bug in the IPSec script
Traceback (most recent call last):
File "/usr/libexec/vyos/conf_mode/vpn_ipsec.py", line 600, in <module>
verify(ipsec)
File "/usr/libexec/vyos/conf_mode/vpn_ipsec.py", line 372, in verify
verify_pki_rsa(ipsec['pki'], rsa)
~~~~~^^^^^^^
KeyError: 'pki'
As it wanted to verify keys, but there was no pki dictionary key available.
This commit restores the previous behavior.
(cherry picked from commit 9b56a86def674886721a367c02371f9da65c3fd3)
|
|
(cherry picked from commit 61342083d7db8c30d015474fae5cb71f480487d8)
|
|
T5971: Rewritten ppp options in accel-ppp services (backport #2891)
|
