| Age | Commit message (Collapse) | Author |
|---|
|
vpp: T9161: Fix smoketests failing on NICs capped at 1500 MTU
|
|
pseudo-ethernet: T9253: fix anycast-gateway with shared MAC on bridge VLANs
|
|
container: T9401: add chown option to tmpfs mounts
|
|
firewall: T9332: fix GeoIP source/destination nftables set name colli…
|
|
ospf: T9448: do not render metric-type when it is the default
|
|
With metric-type 2 (the CLI default), every FRR reload deletes and
re-adds "default-information originate" and every "redistribute" line
under "router ospf". ospfd flushes the Type-5 LSAs on the delete and
re-originates them right after, so neighbours can briefly lose the
external routes on commits that do not touch OSPF.
ospfd and ospf6d (for redistribute) write "metric-type 1" back to the
running config and print nothing for type 2, their default. The
templates render "metric-type 2", so frr-reload sees a different line
on every reload.
frrender now adds the XML default of metric-type to the OSPF and OSPFv3
dicts as xml_default_metric_type, for the default and every VRF
instance. The templates render metric-type only when it differs from
that default, so the generated config matches what FRR prints back.
OSPFv3 default-information keeps rendering metric-type, as ospf6d
prints it for both types.
Add smoketests that read the generated config and vtysh for types 2,
1 and back to 2. Rename the "ptotocol" loop variable in
test_protocols_ospf.py to "protocol", which the typos check flags on
any change to this file.
|
|
Static key mode only supports CBC, so OpenVPN refuses to start with an
AEAD "data-ciphers-fallback" just like with an AEAD "encryption cipher".
Reject it at commit time.
|
|
config-management: T6304: Rewrite commit-archive location into a structured CLI
|
|
VPP now rejects an MTU above the NIC limit, but the CI NICs are capped
at 1500, so tests using MTU 2500 on eth1 failed. The rejected commit
also left a queued initial VPP dependency in the commit daemon, which
the next commit ran with the old config, so every following test failed
too. Pending initial dependents are now cleared before each script run
in vyos-configd and vyos-commitd, and the tests use MTUs that fit any
NIC.
|
|
interfaces: T9152: Refactor source-validation to use vmaps
|
|
Several anycast-gateway pseudo-ethernets with the same MAC on different
VLANs of one bridge (the usual EVPN layout) failed to commit with
"bridge fdb add ... File exists". The local FDB entry was always installed
without a VLAN, so every interface competed for the same entry. A failing
commit at boot left only one interface configured and dropped the rest of
the config.
The local FDB entry is now bound to the VLAN of the bridge sub-interface
when the bridge is VLAN aware, and it is installed with replace so a
re-commit over an existing entry no longer fails. Two anycast-gateways
with the same MAC on the same source-interface are rejected.
|
|
On a VPP-bound interface the MTU limit is the NIC's, which only VPP knows
(the kernel side is an LCP tap reporting a meaningless larger max). Reject at
commit an MTU larger than that limit, read from VPP's 'show hardware-interfaces'
(max mtu + driver frame overhead), so the kernel and dataplane cannot silently
end up with different MTUs.
Also apply a VLAN sub-interface's MTU to its VPP dataplane sub-interface and its
linux-cp tap (created with MTU 0), not just the parent; a sub-interface without
its own MTU inherits the parent's. Covers ethernet (vif/vif-s) and VPP
bond/loopback (vif).
|
|
configd: T9368: reconcile FRR after a DHCP lease without the commit socket
|
|
bgp: T9410: add route-map vrf import under ipv6-unicast
|
|
router-advert: T9413: add no-remove-on-exit and no-flush-* options
|
|
On shutdown radvd sends a final RA with router lifetime 0 and announces
its RDNSS and DNSSL entries with lifetime 0. On a VRRP pair that sends
RAs from a shared source address (source-address fe80::1), hosts read
the zero router lifetime as the shared router going away and remove
their default route until the backup's next RA. On my routers that was
1.6 s of IPv6 loss when the master rebooted.
radvd controls this with RemoveAdvOnExit, FlushRDNSS and FlushDNSSL,
all defaulting to on. Expose them per interface:
set service router-advert interface <if> no-remove-on-exit
set service router-advert interface <if> no-flush-name-server
set service router-advert interface <if> no-flush-dnssl
The directives are only rendered when the options are set, so the
generated radvd.conf is unchanged for existing configurations.
|
|
The ipv4-unicast address family has 'route-map vrf import' to filter the
VRF route leak; ipv6-unicast did not, so an IPv6 leak could not be
filtered. The template is already AFI-generic: only the CLI node was
missing.
|
|
openvpn: T9370: add chacha20poly1305 data cipher
|
|
Two IPv6 tests waited for a global address as their synchronisation point,
although neither of them is about one. A global address only shows up once the
peer answers a router solicitation, which is best effort, so both tests failed
intermittently whenever a run was slow.
The link-local test now waits for the address it actually asserts on, and
forces the established session to be reconfigured within a commit before it
looks. Waiting for the link-local alone would race the code it guards, as the
peer assigns that address before VyOS configures the link. The autoconf test
proves the session negotiated IPv6 before asserting that no global address
exists.
Autoconfiguration itself is covered by a test of its own, with a timeout of its
own, so a slow peer no longer fails tests which do not depend on it.
|
|
Since FRR 10.5 "bgp reject-as-sets" is the default. FRR does not print
the default in show running-config, so frr-reload never finds the line in
the running config and sends it again on every reload. The command
handler resets every BGP session of the instance (NOTIFICATION Cease,
other configuration change) whether or not the value changed,
so with "protocols bgp parameters reject-as-sets" set, every commit that
reloads FRR reset every established session, not only commits that touch
BGP.
Render only the non-default form: "no bgp reject-as-sets" when the
option is not set, as T7664 added it, and nothing when it is set. The
option is a valueless leaf, so it has no XML default to read; the
rendered "no" form already was the only place that knows what FRR's
default is. Changing the option still reaches FRR: frr-reload sends
"bgp reject-as-sets" when the option is set (the "no" line leaves the
rendered config) and "no bgp reject-as-sets" when it is deleted, and
each change resets the sessions once, as before.
Add a smoketest that reads the rendered /run/frr/config/vyos.frr.conf,
because FRR never prints the default form and vtysh cannot show it.
|
|
bgp: T9404: do not render "bgp default local-preference" when the value is 100
|
|
T9351: Accel-PPP-NG: Add CLI support for Message Authenticator attribute in Access packets (Blast-RADIUS mitigation)
|
|
Replace the free-form 'commit-archive location <url>' leafNode with a
structured, per-destination tagNode:
`set system config-management commit-archive location <name> <protocol> \
authentication { username | password } | server | port | path`
Each location selects exactly one transport protocol (scp, sftp, ssh, ftp,
ftps, http, https, git, tftp). 'git' additionally accepts a 'transport'
(https/http/ssh, default https). 'source-address' and 'vrf' stay under
'commit-archive' and apply to every location, as before.
|
|
FRR does not print "bgp default local-preference 100" in show
running-config because 100 is its default, so frr-reload never finds the
line in the running config and sends it again on every reload. The
command handler calls bgp_clear_star_soft_in() whether or not the value
changed, so every reload ran "clear bgp * soft in" (once in pass 0 and
twice in pass 1), a full inbound re-evaluation of every peer.
Add the default (100) to the XML definition of parameters default
local-pref. Templates cannot query the XML definition while rendering,
so frrender takes the value from the config defaults of "parameters
default" (conf.get_config_defaults) and adds it to the BGP dict as the
key xml_default_local_pref, for the global instance and for every VRF
instance. bgpd.frr.j2 renders the line only when the configured value
differs from xml_default_local_pref, so the value 100 is not hardcoded
in the template. A real value change (100 to 200, or 200 to 100) is
still sent: frr-reload sees the difference between the rendered file and
the running config.
|
|
Since T9024 (Podman 5.8.4, crun replaced by runc 1.1.5), a tmpfs mounted
over a directory that already exists in the image is owned by root:root
0755, whatever the image prepared. A container running as a non-root
user (image USER or uid/gid) can no longer write its pid file or control
socket there and fails to start. With crun 1.8.1 every tmpfs was 1777,
so the same configuration used to work.
runc 1.1.5 ignores tmpfs-mode; the Podman mount option `U` (chown the
mount to the container user) is the only one that works on the runtime
VyOS ships. Expose it as a valueless `chown` node:
set container name <name> tmpfs <tag> chown
Without the option the generated Quadlet line is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
pppoe: T9395: render default routes via FRR only
|
|
The IPv6 autoconf test failed intermittently. It rejected the link-local
address IPV6CP still negotiates without a BRAS IPv6 pool, and on failure left
the pool deleted, breaking the next test. It now only checks for global
addresses and always restores the pool.
|
|
Deleting a PPPoE interface shortly after its session came up could fail the
commit with "% could not lock candidate DS". The default routes were installed
via vtysh both from the commit and from the asynchronous ppp ip-up hook, so the
two FRR sessions raced for the mgmtd lock. The IPv6 default route was also
missing from the rendered FRR configuration, so an FRR reload could remove it.
Both default routes are now part of the rendered FRR configuration, which
vyos-configd applies at the end of every commit. PPPoE no longer calls vtysh.
|
|
Offer chacha20poly1305 in "encryption data-ciphers" and
"encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and
allowed with DCO.
|
|
When local-block-url is the first ACL entry of a rule, the template wrote
"!ocal-block-url-<rule>" into the pass line. SquidGuard does not know
that destination group, so the rule silently blocked nothing, while the
dest block itself was generated correctly.
Add a smoketest that checks the rule ACL.
|
|
T9364: openvpn: default the MTU to 1420 when DCO is enabled
|
|
smoketest: T9367: only assert on the leaked flows in the VRF conntrack zone
|
|
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
|
|
http-api: T8989: Hotfix to enforce audience validation if OIDC is configured
|
|
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
|
|
openvpn: T8999: improve shared-secret reference errors
|
|
test_vrf_conntrack_route_leak asserted that no conntrack entry carrying the
VRF zone is [UNREPLIED]. The zone is assigned by oifname as well, so it also
covers traffic the box originates itself. An IGMPv3 membership report to
224.0.0.22, say, which is [UNREPLIED] by nature and lives for the 600s
generic protocol timeout:
unknown 2 584 src=192.0.2.1 dst=224.0.0.22 zone-orig=6099 [UNREPLIED] ...
Whether such an entry exists when the assertion runs depends on when some
process joins a multicast group on the VRF interface, so the test fails at
random.
Restrict assertion to the flows towards the far end, which are the only ones
the test controls, and count them so the added filter cannot silently make
the assertion vacuous.
|
|
not related to T9351)
|
|
in Access packets
Add CLI options to control Message-Authenticator handling for Access
packets.
The new options allow including Message-Authenticator in Access-Request
packets and requiring it in Access-Accept, Access-Reject and
Access-Challenge responses. Render the corresponding accel-ppp-ng
configuration options and warn when response validation is configured as
required while Access-Request packets are not configured to include
Message-Authenticator.
|
|
T9338: add bgp mpls l3vpn-multi-domain-switching
|
|
|
|
ntp: T8882: add ntp polling options
|
|
Poll intervals were left entirely to the NTP daemon's built-in defaults, so an
operator could not widen or narrow the polling range for an individual server,
warm up authenticated associations before a poll, or ask a peer for the higher
resolution timestamps it may be able to provide.
Each configured server and pool now accepts a minimum and maximum poll
exponent, defaulting to the values the daemon already used, plus an optional
presend exponent and a switch for the F323 extension field. Existing
configurations render the same associations as before.
Co-authored-by: Christian Breunig <christian@vyos.io>
|
|
T9337: openvpn: stop rendering "ping 0" in site-to-site
|
|
|
|
"keep-alive interval 0" turns the keepalive off, but site-to-site
renders "ping" and "ping-restart" unguarded. A zero interval leaves
"ping 0" with the restart timer still armed, so an idle tunnel tears
itself down instead of running without keepalive.
Leave both directives out when the interval is zero, as T9334 does for
the server-mode "keepalive".
|
|
dns: T9175: make PowerDNS security status poll opt-in
|
|
T8977: Fix regression with is_addr_assigned and is_listen_port_bind_service
|
|
(#5504)
The Router Solicitation kicked off when an IPv6 autoconf PPPoE link comes up
is best effort - the peer may answer late or not at all. rdisc6(8) then blocks
for the duration of all retries and exits non-zero, which aborted the commit:
FileNotFoundError: [Errno 2] failed to run command: rdisc6 --single --retry 3 pppoe1000
returned: Soliciting ff02::2 (ff02::2) on pppoe1000...
Timed out.
No response.
exit code: 2
Run rdisc6(8) detached in a transient systemd unit, so neither the delay nor
the exit code reaches the commit. The outcome is logged to the journal.
|
|
accel-ppp: T9357: do not require local users when any-login is configured
|
