| Age | Commit message (Collapse) | Author |
|---|
|
|
|
container: T7305: fix VRF loss when restarting pods
|
|
T7849: ZBF allow to use wildcard interfaces as member
|
|
When removing a veth interface, the kernel automatically deletes its peer
interface, since veth devices always exist in pairs. However, this automatic
removal does not trigger the remove() helper in vyos.ifconfig.interfaces, which
can leave associated DHCP(v6) clients running indefinitely.
For example:
ip link add veth0 type veth peer name veth1
ip link del dev veth1
Removing veth1 will also delete veth0 in the kernel, but the VyOS cleanup
routines are never called for veth0. This patch ensures that peer removal
correctly purges both interfaces and their associated state.
This drops the workarounds in veth smoketest and falls back to the common
interface smoketests from the inherited base class.
|
|
Container networks are only started when there is at least one active consumer.
If a network is created without any attached containers, it does not need to be
assigned to a VRF yet.
When the last container in a pod is stopped, its associated container network
is removed. Upon container restart, the kernel recreates the network, but the
VRF assignment may be lost in the process.
This change ensures that all container networks are correctly reattached to
their designated VRFs when a pod restarts.
|
|
smoketests: T7971: Add docstrings to nftables verification helpers
|
|
- Fixed issue in T7977
- Added smoketest for 3 or more interfaces in rule
- Added wait_for function to utils/misc.py
|
|
Allow to use wildcard interfaces for zone-based firewall
It should allow interfaces like ipoe*/pppoe*/l2tp*
|
|
checks
- Renamed `permitted-peers` to `permitted-peer` across templates, schema, and tests.
- Added support for multiple `permitted-peer` entries and trimmed empty values.
- Replaced TLS/UDP warning with ConfigError for strict validation.
- Updated tests to use TCP for TLS and verified new validation logic.
|
|
T6686: adds container health checks
|
|
|
|
T7896: Add frr profile selection
|
|
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
* dhcp-server: T3936: Added support for DHCP Option 82
This commit adds support in both the CLI and the underlying code for
DHCP Option 82 to be used to filter/route DHCP address assignments.
The primary use case for this is to support enterprise switches which
can "tag" DHCP requests with physical real world informaiton such as
which switch first saw the request and which port it originated from
(known in this context as remote-id and circuit-id). Once
client-classes have been defined they can be assigned to subnets or
ranges so that only certain addresses get assigned to specific
requests.
There is also a corresponding documentation update which pairs with
this code change.
(cherry picked from commit 326b5e713cb363a2b9f69e2204c4ee2ccd9939bb)
* Update src/conf_mode/service_dhcp-server.py
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
* Update src/conf_mode/service_dhcp-server.py
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
* Update interface-definitions/include/dhcp/dhcp-server-common-config.xml.i
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
|
|
T7938: VPP: Rewrite sFlow implementation
|
|
haproxy: T7906: Probing of a port other than the one to which normal traffic is sent
|
|
is sent
Add support for specifying a custom health check port for HAProxy backend servers.
This allows health probes to target a dedicated endpoint - such as port 8080 - separate
from normal traffic ports (e.g., 80 or 443).
|
|
|
|
|
|
T3680: protocols: add dhclient hooks for dhcp-interface static routes
|
|
In large networks with many zones where simple allow/deny rules are not sufficient,
zones become tedious to manage. Many use cases can be simplified by providing an
ability to define a default ruleset for traffic from other zones. This change proposes
adding the follwing syntax:
set firewall zone <name> default_firewall name <name>
set firewall zone <name> default_firewall ipv6_name <name>
The proposed behavior is the following:
local in:
The default firewall ruleset for the local zone will be appended after all
from configurations.
local out:
If a non-local zone does not have a from local ruleset but does have a
default_firewall ruleset, the default_firewall ruleset will be appended using
oifname
forward:
The default firewall ruleset for the zone will be appended after all from
configurations
To keep the behavior consistent with from ruleset configurations, a return is appended
after the default_firewall ruleset.
The proposed behavior differs slightly from the default_policy configuration for the
local out chains. The default_policy applied in the out templates comes from the local
zone, not the actual outbound zone. The proposed change does not amend this, but does
make default_firewall logically consistent with the intent of the out rules.
|
|
Due to an issue in FRR where dynamic PPPoE interfaces sometimes receive an
ifIndex of 0 (which is invalid), disable the testcase and add a marker.
Test was just recently added in commit 75e9fd60c ("smoketest: T7858: add PPPoE
client tests with IPv4, IPv6 and DHCPv6-PD")
|
|
This extends commit 2c521f135 ("smoketest: T7858: make failfast main argument
dynamic").
|
|
Upgrades to FRR 10.4 have shown that there are cases where FRRs mgmtd will
SIGSEGV - to cover for this case and fail the smoketests we will monitor the
PID of the mgmtd process.
|
|
This extends commit 2c521f135 ("smoketest: T7858: make failfast main argument
dynamic").
|
|
|
|
While working on task T7664 (FRR 10.4 upgrade), I identified the need for
additional validation and safeguards around the FRR management daemon. The
most appropriate place for this logic is in the setUp() and tearDown() methods
of the smoketest base class, VyOSUnitTestSHIM.
However, during implementation, it became apparent that test cases do not
consistently invoke the base class's setup and teardown methods. This
inconsistency complicates the process of capturing the FRR mgmtd PID at the
start of a test and verifying that it remains unchanged by the end - a key step
in detecting crashes or unexpected terminations (e.g., SIGSEGV) of the FRR
management daemon during tests.
|
|
kea: T7925: Improve error handling, validate IPv6 PD prefix length
|
|
|
|
Execute commands for vpp sflow with API calls. Use values for polling interval and sampling rate from 'system sflow'. Add op-mode command
|
|
T5942: Make failover support dhcp-interface
|
|
This complements commit cf4666257 ("frrender: T7927: de-nest DHCP and PPPoE
interface section for VRFs") by validating the new DHCP behavior.
When a VRF bound interface obtains an IP via DHCP, the default route received
must be reflected in FRR's routing table (vtysh). Ensure the dynamic DHCP
learned route is retained even when unrelated sections of the FRR configuration
are modified.
|
|
|
|
|
|
Rathern then re-inventing the wheel by outself we import the frr-reload.py
script and their read-in function of the current vtysh configuration.
|
|
|
|
T7897: VPP: fix rx-mode interrupt for XDP driver with workers
|
|
T7750: VPP: CGNAT commit failure with vpptunX interface
|
|
Allow using bond interfaces in CGNAT. Improve interface cleanup to rely
on VPP API queries, as VPP config changes may modify interface indexes
|
|
* Refactor XML a little: move common dhcp-interface properties to
separate include file
* Add failover support for dhcp-interface
* Add test for DHCP in failover protocol
|
|
Remove no-syscall-lock from CLI and enable this option if interrupt/adaptive mode is enabled and workers are configured.
Also forbid interrupt mode for ixgbevf driver
|
|
|
|
T7887: system_option: Add validation for memory hugepage-count
|
|
Recursion error was fixed, enable the bonding test for VPP
|
|
* Added 'protocol failover' to 'set vrf name':
set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2
* Added vrf and interface to target:
set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue
set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1
Last two are needed when check VRF is not same as route VRF.
In this case icmp can use any/both options, tcp requires `vrf` and
arp requires `interface`
|
|
This reverts commit d871fe9c4c65de87232802ed54b263c9b2824391.
|
|
Move smoke test for hugepages to test_vpp.py
|
|
|
|
* kea: T7823: DHCP-server lease cannot be cleared
* Update smoketest/scripts/cli/test_service_dhcp-server.py
Co-authored-by: Christian Breunig <christian@breunig.cc>
---------
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
