| Age | Commit message (Collapse) | Author |
|---|
|
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which
conflicts with sysctl's dot-separated key syntax.
Change sysctl_read() and sysctl_write() to take key components as a list and
normalize each component by replacing . with / before invoking sysctl. This
fixes sysctl lookups/updates for VLAN subinterfaces.
Extend the SR-TE smoketest to cover a VLAN subinterface.
Previous error raising this issue:
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
|
|
NAT64 requires dedicated transport address space for translation, similar to
exclusive port ownership during socket binding. If a local process and Jool
translation both use the same transport tuple (for example, 192.0.2.1:5000),
traffic conflicts can occur.
Jool does not prevent pool4 from overlapping with other port allocations, so
avoiding conflicts is an operator responsibility.
In addition to service ports already in use, account for Linux ephemeral
range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This
default is why, when pool4 is empty, Jool uses 61001-65535 on the node's
primary global addresses.
One can adjust the ephemeral range via sysctl, and Jools translation range via
pool4 add/remove.
vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768 60999
VyOS now uses verify() in NAT64 to check that the supplied tranlation port
range does not overlap with the Kernels ephemeral port range.
|
|
|
|
|
|
|
|
Fix errors introduced by refactoring for modprobe/rmmod jool module.
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
Functions called from config scripts outside of the standard functions
get_config/verify/generate/apply will not be called when run under
configd. Move as appropriate for the general config script structure and
the specific script requirements.
|
|
Simplest fix is to comply with RFC6052. The code change is just masking
out the relevant bits and ensuring they're zeroed.
|
|
found using "git ls-files *.py | xargs pylint | grep W0611"
|
|
Match mark allows to use firewall marks of packet to use
a specific pool
Example of instance config /run/jool/instance-100.json
```
...
"pool4": [
{
"protocol": "TCP",
"prefix": "192.0.2.10",
"port range": "1-65535",
"mark": 23
},
...
```
|
|
- Update the base (rebase)
- Move include/nat64-protocol.xml.i => include/nat64/protocol.xml.i
- Delete unwanted `write_json`, use `write_file` instead
- Remove unnecessary deleting of default values for tagNodes T2665
- Add smoketest
Example:
```
set interfaces ethernet eth0 address '192.168.122.14/24'
set interfaces ethernet eth0 address '192.168.122.10/24'
set interfaces ethernet eth2 address '2001:db8::1/64'
set nat64 source rule 100 source prefix '64:ff9b::/96'
set nat64 source rule 100 translation pool 10 address '192.168.122.10'
set nat64 source rule 100 translation pool 10 port '1-65535'
```
|
|
Signed-off-by: Joe Groocock <me@frebib.net>
|
