| Age | Commit message (Collapse) | Author |
|---|
|
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
|
|
|
|
T8147: Update Linux Kernel to 6.18
|
|
|
|
option
|
|
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As
this was not available in the previous used LTS 6.6 Kernel it now is available
while we upgrade to Linux 6.18.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP: T8495: fix issue with assigning acl on sub interfaces
|
|
T8534: refactor sysctl_(read|write) to accept key parts
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
firewall: T8446: Prevent chain with offload rule on local zone
|
|
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which
conflicts with sysctl's dot-separated key syntax.
Change sysctl_read() and sysctl_write() to take key components as a list and
normalize each component by replacing . with / before invoking sysctl. This
fixes sysctl lookups/updates for VLAN subinterfaces.
Extend the SR-TE smoketest to cover a VLAN subinterface.
Previous error raising this issue:
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
|
|
|
|
|
|
serial: T8375: call update_serial_console() only once for default tty
|
|
|
|
When there are multiple serial consoles defined; but either none or the
last used the 'kernel' CLI option to disply Kernel messages, the GRUB
code was called multiple times.
By moving the call to the GRUB helpers outside the for loop we gain a single
execution of the code path, not that it matters performance wise - but messing
with the bootloader should be reduced to a minimum.
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
|
T8448: add an option to enable SNMP traps in VRRP
|
|
Allow to configure Keepalived VRRP traps
- set high-availability vrrp snmp trap
|
|
remote: T4732: add VRF option for commit-archive
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
Required during first-boot of a system. We have images form amd64 and arm64
CPUs which also tend to have different serial interfaces (ttyS vs. ttyAMA).
The images which are installed have the correct serial setting for GRUB (ttyS0
or ttyAMA0) and the activation script will probe the Kernel command-line. If a
serial interface is defined, we will include it in the VyOS CLI configuration.
|
|
T8292: Fix ndp-proxy verify key mismatch for prefix rules
|
|
Rename `id_from_persisten_conf` to `id_from_persistent_conf`.
|
|
Add new CLI option to make transfers to the commit-archive working using a
dedicated (e.g. management) VRF.
set system config-management commit-archive vrf MGMT
All transfers using vyos.remote module will now run through the VRF defined on
the CLI.
|
|
vpp: T8438: Add bidirectional interface-in-use validation
|
|
NAT64 requires dedicated transport address space for translation, similar to
exclusive port ownership during socket binding. If a local process and Jool
translation both use the same transport tuple (for example, 192.0.2.1:5000),
traffic conflicts can occur.
Jool does not prevent pool4 from overlapping with other port allocations, so
avoiding conflicts is an operator responsibility.
In addition to service ports already in use, account for Linux ephemeral
range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This
default is why, when pool4 is empty, Jool uses 61001-65535 on the node's
primary global addresses.
One can adjust the ephemeral range via sysctl, and Jools translation range via
pool4 add/remove.
vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768 60999
VyOS now uses verify() in NAT64 to check that the supplied tranlation port
range does not overlap with the Kernels ephemeral port range.
|
|
|
|
|
|
Add bidirectional VPP interface reference validation: prevent assigning an interface used by a VPP feature (NAT/ACL/IPFIX/sFlow, etc.)
as a VPP member (bond/bridge/xconnect) and prevent using a VPP member interface in VPP features.
Block interface deletion when it is still referenced by any VPP feature/member.
Fix VLAN subinterface removal checks broken by the recent VPP config tree restructuring.
|
|
* Add warning when defining `offload-target` without setting action to `offload`
|
|
vpp: T8419: Disallow cross-membership between VPP and kernel bonding/bridge interfaces
|
|
interfaces
|
|
|
|
vpp: T8416: Prevent interfaces from being assigned to xconnect and bridge/bonding at the same time
|
|
bridge/bonding at the same time
|
|
Fix AttributeError in `_is_device_allowed` by using
iface parameter for `persist_config` lookup.
|
|
T8379: PBR commit fail with traceback if non-existing VRF added
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
configuration option
Prevents attachments of unsupported NICs when the allow-unsupported-nics option is removed.
|
|
T8405: fix noipv6 emitted when dhcpv6-options configured without ipv6 node
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
vpp: T8355: Set MTU for vpp interfaces
|
|
login: T8415: show Warning() if default password is used when adding user
|
|
T8399: dhcpv6-server: move connectivity/overlap checks inside subnet loop
|
|
|
|
|
