| Age | Commit message (Collapse) | Author |
|---|
|
If any dynamic rule is configured forwarding should be disabled because each
packet must be processed through the NAT session table to apply proper
translations
|
|
|
|
|
|
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
|
|
vpp: T8036: Commit fails removing nat44 static rule
|
|
frr: T8034: use dict_search() for routing protocols to check if VRF is used
|
|
dict_search() is save when passing in keys that do not exist in the dict
we are working on.
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
firewall: T7739: Default ruleset for firewall zones
|
|
bond: T8023: validate member interface min/max MTU
|
|
It is impossible to set the bond interface MTU to be larger or lower then the
limits of the underlaying interface MTU. Add proper commit validation and
smoketest.
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
Add a commit-time check and warning to the user if the TACACS source-address is
not configured on the system or the given VRF.
|
|
Add a commit-time check and warning to the user if the RADIUS source-address
(IPv4 or IPv6) is not configured on the system or the given VRF.
|
|
|
|
veth: T8017: bugfix KeyError: 'peer_name'
|
|
T8012: Add user vpp to user groups
|
|
To allow call VPP api without sudo
- Get op-mode commands without sudo
- Use API call in smoke-tests
|
|
T7556: VPP add IPFIX collector configuration
|
|
Use safe dict_search() function to locate veth peer interface name. If no peer
is defined an error will be displayed.
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
removed from vif
Do not allow to delete subinterface if it is in use in VPP features
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
|
|
|
|
|
|
Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.
|
|
container: T7305: fix VRF loss when restarting pods
|
|
pki: T7976: calls to node_changed_presence() must use unmangled config paths
|
|
T7789: T7661: VPP prevent failing to load XDP in clouds (ena/gve drivers)
|
|
Container networks are only started when there is at least one active consumer.
If a network is created without any attached containers, it does not need to be
assigned to a VRF yet.
When the last container in a pod is stopped, its associated container network
is removed. Upon container restart, the kernel recreates the network, but the
VRF assignment may be lost in the process.
This change ensures that all container networks are correctly reattached to
their designated VRFs when a pod restarts.
|
|
T7949: VPP add the ability to configure bond subinterfaces for NAT
|
|
We do use mangled config paths where
pki = conf.get_config_dict(base, key_mangling=('-', '_'), ...
returns a config dict where "-" is replaced by "_" when assembling the config
dict keys.
This does not work when we throw the retrieved path into
ConfigDiff().node_changed_presence()
https://github.com/vyos/vyos-1x/blob/07936657062c/src/conf_mode/pki.py#L259-L265
Add orig_path key which is preferred over path.
|
|
pki: T7953: implement certbot_renew() function to have everything at one place
|
|
Some cloud NICs (ena, gve) fail to load XDP if all RX queues are configured. To
avoid this, we limit the number of queues to half of the maximum supported by the driver.
|
|
checks
- Renamed `permitted-peers` to `permitted-peer` across templates, schema, and tests.
- Added support for multiple `permitted-peer` entries and trimmed empty values.
- Replaced TLS/UDP warning with ConfigError for strict validation.
- Updated tests to use TCP for TLS and verified new validation logic.
|
|
T7797: VPP: switching from XDP to DPDK driver fails in cloud vm (hv_netvsc)
|
|
T6686: adds container health checks
|
|
|
|
pki: T7953: refactor internal dependency generation
|
|
T7896: Add frr profile selection
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
* dhcp-server: T3936: Added support for DHCP Option 82
This commit adds support in both the CLI and the underlying code for
DHCP Option 82 to be used to filter/route DHCP address assignments.
The primary use case for this is to support enterprise switches which
can "tag" DHCP requests with physical real world informaiton such as
which switch first saw the request and which port it originated from
(known in this context as remote-id and circuit-id). Once
client-classes have been defined they can be assigned to subnets or
ranges so that only certain addresses get assigned to specific
requests.
There is also a corresponding documentation update which pairs with
this code change.
(cherry picked from commit 326b5e713cb363a2b9f69e2204c4ee2ccd9939bb)
* Update src/conf_mode/service_dhcp-server.py
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
* Update src/conf_mode/service_dhcp-server.py
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
* Update interface-definitions/include/dhcp/dhcp-server-common-config.xml.i
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
|
|
T7938: VPP: Rewrite sFlow implementation
|
|
|
|
|
|
|
|
|
