summaryrefslogtreecommitdiff
path: root/smoketest/scripts/cli
AgeCommit message (Collapse)Author
2025-10-01Merge pull request #4734 from alexandr-san4ez/T4251-currentJohn Estabrook
syslog: T4251: Add TLS support to syslog
2025-09-30Merge pull request #4760 from c-po/pppoe-client-smoketestsChristian Breunig
smoketest: T7858: add PPPoE client tests with IPv4, IPv6 and DHCPv6-PD
2025-09-30smoketest: T7858: use pylint for our testcasesChristian Breunig
2025-09-30smoketest: T7858: add PPPoE client tests with IPv4, IPv6 and DHCPv6-PDChristian Breunig
VyOS includes a full-featured PPPoE server (BRAS), but it was previously not exercised during embedded platform smoketests. This commit extends the smoketest suite to include a basic PPPoE server configuration. The test starts a local PPPoE server instance that provides both IPv4 and IPv6 addresses, including DHCPv6-PD for prefix delegation. The client side attempts to establish a PPPoE session and verifies that the assigned addresses and prefixes are within the expected configured pools. Connection is established through virtual-ethernet interface pairs. This helps ensure that core PPPoE functionality works correctly in the base system image and catches regressions early.
2025-09-30smoketest: T7858: make failfast main argument dynamicChristian Breunig
When smoketest debugging is enabled (by creating the file /tmp/vyos.smoketest.debug), all available smoketests will fail fast instead of running to completion. This helps reduce test time when something is broken or undergoing refactoring, as it avoids waiting for the full test suite to finish.
2025-09-30syslog: T4251: Add TLS support to syslogOleksandr Kuchmystyi
Add TLS support for remote syslog by extending the CLI and backend to support configuration of CA certificates, client certificates, keys, and authentication modes. This update integrates with the PKI subsystem for certificate management, ensures proper validation of protocol settings when TLS is enabled, and generates secure rsyslog configuration for forwarding logs over TLS.
2025-09-29Merge pull request #4754 from natali-rs1985/T7815Viacheslav Hletenko
T7815: VPP: NAT44 rules with port requires protocol specification and vice versa
2025-09-25T7815: VPP: NAT44 rules with port requires protocol specification and vice versaNataliia Solomko
2025-09-24T7709: add smoketest for config saveJohn Estabrook
Check that write_file_sync reaches disk, by using util vmtouch to evict cache.
2025-09-23Merge pull request #4684 from c-po/bgp-vrf-system-asDaniil Baturin
bgp: T7760: remove per vrf instance system-as node
2025-09-23kea: T7821: Update paths for Kea v2.7.9 security changessarthurdev
2025-09-22Merge pull request #4698 from l0crian1/fw-disable-conntrackDaniil Baturin
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
2025-09-18Merge pull request #4723 from sarthurdev/kea3.0Viacheslav Hletenko
kea: T7821: Update Kea to 3.0
2025-09-18Merge pull request #4724 from l0crian1/fix-container-branchChristian Breunig
container: T7681: fix multiple name servers
2025-09-18T7805: VPP remove unused 'default-hugepage-size' from memory section and ↵Nataliia Solomko
restrict page sizes in xml
2025-09-18Merge pull request #4722 from natali-rs1985/T7796Daniil Baturin
T7796: PPPoE-server add mapping in vpp if vpp-cp is enabled
2025-09-18Merge pull request #4708 from sarthurdev/T114Daniil Baturin
wlb: T114: Add firewall group support for WAN load balancer
2025-09-17T7796: PPPoE-server add mapping in vpp if vpp-cp is enabledNataliia Solomko
2025-09-16container: T7681: fix multiple name serversl0crian1
- Fixed error with multiple name servers missing space between --dns options
2025-09-16Merge pull request #4688 from hedrok/T75-migration-to-ipt-netflowDaniil Baturin
T75: migrate from pmacct to ipt_NETFLOW
2025-09-16Merge pull request #4506 from davi2367/zbf-vrfDaniil Baturin
firewall: T7452: update rule generation for Zone-based firewall
2025-09-16T75: migrate from pmacct to ipt_NETFLOWKyrylo Yatsenko
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'
2025-09-15Merge pull request #4714 from c-po/dhcpv6-incorrect-sla-lenDaniil Baturin
T7682: incorrect sla-len in DHCPv6 client prefix delegation (DHCPv6-PD)
2025-09-15Merge pull request #4686 from l0crian1/container-macvlanDaniil Baturin
container: T7186: Add macvlan network type for containers
2025-09-14kea: T7821: Update Kea to 3.0sarthurdev
2025-09-14route-map: T1124: Allow matching RPKI OVS extended community (#4699)l0crian1
- Added 'rpki-extcommunity' match condition - Added test to test_policy.py smoketest for rpki-extcommunity match
2025-09-14bgp: T6438: add solo option to peer-group config (#4706)l0crian1
- Added solo leafNode to peer-group config - Added solo.xml.i to reduce code duplication - Added solo option to peer-group smoketests
2025-09-13T7682: incorrect sla-len in DHCPv6 client prefix delegation (DHCPv6-PD)Christian Breunig
The current template has an overly optimistic logic for sla-len calculation, relying on an assumption that a server always provides a prefix with the exact length requested by the client. This is incorrect. According to RFC8415 and RFC7084, the prefix length in a request is only a hint for the server, which may decide to provide a different prefix size. The big issue here is that wide-dhcpv6-client uses the sla-len value from the configuration regardless of the received prefix size. This seems to be the known issue. The good news is that we have already inherited a patch from Debian to mitigate the issue [1]. It accomplishes exactly what we are doing in the configuration template, but with the advantage of using the actual prefix length from the received prefix, rather than the one configured in the configuration file. If we simply remove sla-len from the template, everything appears to function normally. Before - server sending /56 set interfaces ethernet eth1 address 'dhcpv6' set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 address '1' set interfaces ethernet eth1 dhcpv6-options pd 1 interface eth2 sla-id '0' set interfaces ethernet eth1 dhcpv6-options pd 1 length '60' Resulted in: vyos@vyos# run show interfaces Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address MAC VRF MTU S/L Description ----------- ------------------- ----------------- ------- ----- ----- ------------- eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u eth2 fc00:0:2:ff00::1/60 0c:67:94:67:00:02 default 1500 u/u Whereas IPv6 PD should always use a /64 prefix on the interface we assign a dynamic DHCPv6 prefix to. After the fix: vyos@vyos:~$ show interfaces Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address MAC VRF MTU S/L Description ----------- ------------------- ----------------- ------- ----- ----- ------------- eth1 fc00:0:0:1::200/128 0c:67:94:67:00:01 default 1500 u/u eth2 fc00:0:2:ff00::1/64 0c:67:94:67:00:02 default 1500 u/u If a DHCPv6 server (e.g. VyOS itself) even provides multiple PD prefixes, the right one is choosen. Assume the following server configuration: set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 address-range start fc00:0:0:1::100 stop 'fc00:0:0:1::200' set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 lease-time default '120' set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: prefix-length '56' set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:2:: stop 'fc00:0:2:ff00::' set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: prefix-length '60' set service dhcpv6-server shared-network-name dhcpv6-1 subnet fc00:0:0:1::/64 prefix-delegation start fc00:0:3:: stop 'fc00:0:3:ff00::' If a /56 is requested ("dhcpv6-options pd 1 length 56") - we will get a per interface /64 from the original /56 prefix-delegation from the DHCPv6 server. If the user suddently requests a /60 ("dhcpv6-options pd 1 length 60") the delegated prefix will be from the above fc00:0:3:: pool. 1: https://salsa.debian.org/debian/wide-dhcpv6/-/blob/debian/20080615-23/debian/patches/0021-Make-sla-len-config-optional.patch
2025-09-11Merge pull request #4704 from hedrok/T7297-fix-ospf-redistribute-tableJohn Estabrook
ospf: T7297: fix redistribute-table
2025-09-10wlb: T114: Add firewall group support for WAN load balancersarthurdev
2025-09-10ospf: T7297: Add smoketest for redistribute tableKyrylo Yatsenko
2025-09-09bgp: T7760: deprecate per bgp vrf instance system-as nodeChristian Breunig
Originating from the bug in T7665. To avoid potential issues down the line - and given that there's no compelling technical reason to retain the system-as CLI node under per-VRF BGP configuration, which cannot be achieved through alternative means - the maintainers have collectively decided to deprecate the following command: set vrf name <name> protocols bgp system-as <asn> Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While it will still be accepted, it will no longer have any operational effect. A deprecation warning will be displayed at commit time, indicating that the BGP ASN from the global BGP configuration is now used instead. A migration script will handle the transition and perform the following actions: * Ensure a global BGP configuration exists; if not, initialize one. * Iterate over all configured VRFs to determine whether a BGP instance exists * For any insance, update the configuration to use the global system-as and apply the local-as ASN no-prepend replace-as option on all affected neighbors to preserve existing behavior. * If a neighbor is already configured with a local-as directive, that neighbor will be excluded from the migration process, as it already follows a custom configuration. * Add allowas-in per neighbor option. Required to not deny prefix received updates due to as-path contains our own global ASN.
2025-09-09Merge pull request #4682 from aapostoliuk/T7722-currentJohn Estabrook
isis: T7722: Added interface fast-reroute configuration commands
2025-09-05Firewall: T7475: Disable conntrack per firewall chainl0crian1
- Added command to disable conntrack per firewall chain - Added test_disable_conntrack_per_chain function to smoketest
2025-08-28container: T7186: Add macvlan network type for containersl0crian1
Modified: - interface-definitions/container.xml.in: - Add macvlan network type - Add gateway option - python/vyos/utils/network.py: - Add gen_mac function to generate mac address - smoketest/scripts/cli/test_container.py: - Add test for container network types - src/conf_mode/container.py: - Add support for macvlan network type - Add gateway option
2025-08-28Merge pull request #4663 from KawaiiNetworks/currentDaniil Baturin
bgp: T7708: correct logic for route-reflector-client peer_as check
2025-08-28isis: T7722: Added interface fast-reroute configuration commandsaapostoliuk
Added interface fast-reroute configuration commands
2025-08-26Merge pull request #4676 from sever-sever/T7743Daniil Baturin
T7743: PPPoE-server add option for VPP control plane
2025-08-26Merge pull request #4628 from ryanzuwala/ryanzuwala/T7482Daniil Baturin
conntrack: T7482: Fix custom timeouts
2025-08-23T7743: PPPoE-server add option for VPP control planeViacheslav
Enable PPPoE control-plane integration with VPP, add configurable option: - set service pppoe-server interface eth1 vpp-cp ``` interface=eth1,vpp-cp=true ```
2025-08-19Merge pull request #4647 from natali-rs1985/T7678Daniil Baturin
T7678: Move "vpp settings host-resources" to "system option resource-limits"
2025-08-19T7678: Change node name to resource-limitsNataliia Solomko
2025-08-19Merge pull request #4508 from davi2367/vrf-dhcpDaniil Baturin
kea: T6211: add VRF support for KEA dhcp server
2025-08-17bgp: T7708: correct logic for route-reflector-client peer_as checkcanoziia
2025-08-15kea: T6211: add VRF support for KEA dhcp serverDavid Vølker
2025-08-13haproxy: T7715: Add rule matching on subdomainssarthurdev
2025-08-13T7678: Add smoketest for host-resourcesNataliia Solomko
2025-08-12Merge pull request #4637 from alexandr-san4ez/T7562-currentDaniil Baturin
ipsec: T7562: Add support for `disable-uniqreqids` option in IPsec configs
2025-08-12Merge pull request #4650 from sever-sever/T7697Daniil Baturin
T7697: Merge vyos-vpp repo into vyos-1x
2025-08-12ipsec: T7562: Add support for `disable-uniqreqids` option in IPsec configsOleksandr Kuchmystyi
This commit makes `set vpn ipsec disable-uniqreqids` work with the modern StrongSwan backend by setting `unique=never` in swanctl.conf for connections. This restores legacy behavior about multiple connections with the same identity.
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-19 05:13:19 +0000