| Age | Commit message (Collapse) | Author |
|---|
|
|
|
In FRR 10.5 ip protocols
* connected
* kernel
* local
* table
* table-direct
are removed. First three in fb8e399e4f66d09780f176fbecb99168089e64eb,
table* in 7fd030504be060387694e8a2af7f19ddd7dee39d.
In `ip protocols`, `ipv6 protocols` and `vrf` VyOS supports
* connected
* kernel
* table
Remove these from CLI, add migration scripts, update tests.
|
|
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
(used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
|
|
Check if the VRF which is about to be removed is referenced in any PBR rule,
where any is one or more of route, route6, local-route or local-route6.
|
|
T8046: traffic-engineering: support link-params
|
|
Add 'traffic-engineering' commands under 'protocols'.
set protocols traffic-engineering admin-group ADMINGROUP bit-position 1
set protocols traffic-engineering interface INTERFACE admin-group ADMINGROUP
set protocols traffic-engineering interface INTERFACE max-bandwidth 1280
set protocols traffic-engineering interface INTERFACE max-reservable-bandwidth 1280
Also add
set protocols isis traffic-engineering export
|
|
ipsec: T8022: Fix invalid automatic `dynamic` prefix assignment for transport mode tunnels
|
|
T7098: Fix VPP MTU misconfiguration
|
|
ethernet: T8142: do not raise ValueError for non-existing interfaces
|
|
|
|
router-advert: T8140: add captive portal support (RFC 8910)
|
|
nat66: T8139: add support for NAT66 source groups
|
|
transport mode tunnels
When ESP was configured in transport mode for GRE-based site-to-site tunnels,
the default value `dynamic` was automatically injected into the configuration,
even though prefixes must not be set in transport mode. This led to error
"Local/remote prefix cannot be used with ESP transport mode" and commit failures.
This fix updates configuration logic to skip default prefix assignment
for site-to-site peers using ESP transport mode tunnels.
|
|
Call verify_interface_exists() with state_required=True to ensure the interface
exists physically and is recognized by the kernel, rather than relying on its
presence in the CLI configuration. Unlike bridge or bond interfaces, Ethernet
interfaces are not virtual and must be physically present.
Ethtool() instance can only be created when the physical interface exists,
otherwise a ValueError is raised.
|
|
Add support for captive portal identification in IPv6 router adverts as
defined in RFC 8910. The value is a quoted URL pointing to an RFC
8908-compliant API endpoint.
|
|
Copy the support for NAT66 destination groups (commit f96733dd and
commit 43554efc) over to NAT66 source groups as well.
Change the existing smoketest for NAT66 groups to also cover a source
group use-case example.
|
|
Add nat66 as a dependency of firewall groups, because nat66 may
reference firewall groups via source-destination-group-ipv6.xml.i. The
dependency is necessary to ensure a fresh nft ruleset is built when
dependent groups are updated, so that the changes actually take effect
in nat66 on commit.
Add a smoketest to cover nft rulesets failing to update as a result of
changes to dependent firewall groups.
Original commit adding support for groups in nat66 is commit f96733dd.
|
|
|
|
In FRR 10.5 block-len, node-len and func-bits are not
shown if they have default values.
Fix test smoketest/scripts/cli/test_protocols_segment-routing.py
accordingly (update expected + change func-bits 16 -> 12 so that they are shown).
Relevant commits in FRR:
44e67d2d3dabdc1492448e6a3c7024bd0309c244
84c807a3b300f4c9fcda55bccd93dcb64716f5d7
|
|
In FRR 10.5 'bgp reject-as-sets' became default
(https://frrouting.org/release/10.5.0/):
> BGP rejects AS_SET by default
> Until 10.5.0, it was disabled by default, and since RFC 9774 was
> published, we switched this on by default (to reject).
Add 'no bgp reject-as-sets' when VyOS option reject_as_sets is not set.
|
|
Previously, adding or removing a bond member interface would force the entire
bond into an admin-down state, removing and re-adding all member interfaces.
This caused unnecessary link up/down events and excessive log noise on partner
devices.
This change refactors the code to allow hot-adding and removal of bond member
interfaces without disrupting existing members, minimizing link state changes
and log entries.
|
|
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained
in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid
NSS/TACACS timeouts").
|
|
Follow VyOS CLI best practices for using singular whenever possible to build a
CLI node. As we introduce a new migration 2 -> 3 for SSH we can correct this
minor detail.
|
|
vpp: T7972: Make `nat44 no-forwarding` feature automatically configurable
|
|
If any dynamic rule is configured forwarding should be disabled because each
packet must be processed through the NAT session table to apply proper
translations
|
|
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
|
|
The generated Net-SNMP configuration for SNMPv3 trap-targets was fundamentally
broken. Not only was the auth/priv type not written in uppercase letters, but
also the ordering of transport protocol, IP(v6) address and port was wrong.
To complete the issues above - IPv6 addresses did not get wrapped into
mandatory [] brackets.
|
|
T8027: vpn: adding config for swanctl "send-cert always"
|
|
firewall: T7739: Default ruleset for firewall zones
|
|
This setting seems to be required for various Apple clients to
connect to the IKEv2 IPSec VPN.
|
|
Some drivers are limited to an MTU of 1500 byte - e.g. when VyOS runs on
PROXMOX with default bridge settings. We use lower values for the testcase
test_vif_8021q_mtu_limits which will fit for almost every NIC, but keep the
testcase logic intact.
|
|
It is impossible to set the bond interface MTU to be larger or lower then the
limits of the underlaying interface MTU. Add proper commit validation and
smoketest.
|
|
veth: T8017: bugfix KeyError: 'peer_name'
|
|
T7556: VPP add IPFIX collector configuration
|
|
Use safe dict_search() function to locate veth peer interface name. If no peer
is defined an error will be displayed.
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
VRF: T7255: Impossible to delete protocols under VRF
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
When deleting the 'protocols' node under a VRF, a `KeyError` was raised in
`frrender.py` because the 'protocols' dictionary key was missing when
attempting to update protocol states. This prevented configuration
commits from completing successfully.
|
|
|
|
Commit fb9f2f3e950 ("pppoe: T7485: allow explicit request for CPE IPv6 address
via IA_NA") introduced the CLI node definition for address dhcpv6, which at the
time had only a single available option. Because of that, the node wasn't
defined as <multi/> in the XML schema.
However, the generic interface code expects address to be a <multi/> XML node,
which is translated into a list in Python. This mismatch caused an error
referencing the letter d, corresponding to the first character of dhcpv6.
|
|
Commit 9775bb49e ("frr: T7664: drop BASH/SED implementation in smoketest
getFRRconfig()") dropped a custom BASH/SED based implementation of how we
interacted with FRR to make use of the utility helpers from FRR team.
This changed added some arbitray warnings when executing about unclosed
files handles. ResourceWarning: unclosed file <_io.BufferedReader name=5>
Instead of importing the frr-reload Python module, we simply call popen() by
ourself.
|
|
Commit 9775bb49e ("frr: T7664: drop BASH/SED implementation in smoketest
getFRRconfig()") changed how we searched strings using a regex. In the
past we searched at the beginning of a line ^ till the end $. THis logic
was dropped in commit 9775bb49e marking some tests failing as they matched,
when they should not match.
Example: getFRRconfig('vrf red') showed output for both VRF red and red15 as
both started with "red". This has been fixed.
|
|
The original VRF DHCP test case, introduced in commit 186900f7165b2
("smoketest: T7927: test DHCP route preservation"), used a fixed delay of
8 seconds to wait for the DHCP server and client to initialize. This approach
was unreliable and could cause unnecessary test delays.
Since commit 354517677f ("wlb: T7977: Updated smoketest to validate nft vmap
weight buckets"), the "vyos.utils.misc.wait_for()" helper provides a more
efficient busy-wait loop with an early-exit condition. This test case now uses
wait_for() to detect when the DHCP-assigned default route becomes available,
eliminating the fixed sleep and reducing test runtime.
|
|
Commit 186900f7165b2 ("smoketest: T7927: test DHCP route preservation") which
was added to validate a bugfix for DHCP default routes added it's own
little regression. Tests defined a VRF named red15, but when reading in the FRR
configuration we have had a hardcoded search for "vrf red" instead.
This has been fixed to re-use the defined VRF variable name we perform our test
on.
|
|
|
|
wlb: T7977: Fix weight calculation for multiple interfaces
|
|
firewall: T7112: Default action drop fails
|
|
veth: T7990: fix stale DHCP clients when removing virtual Ethernet pairs
|
|
Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.
|
