| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
T3680: protocols: add dhclient hooks for dhcp-interface static routes
|
|
In large networks with many zones where simple allow/deny rules are not sufficient,
zones become tedious to manage. Many use cases can be simplified by providing an
ability to define a default ruleset for traffic from other zones. This change proposes
adding the follwing syntax:
set firewall zone <name> default_firewall name <name>
set firewall zone <name> default_firewall ipv6_name <name>
The proposed behavior is the following:
local in:
The default firewall ruleset for the local zone will be appended after all
from configurations.
local out:
If a non-local zone does not have a from local ruleset but does have a
default_firewall ruleset, the default_firewall ruleset will be appended using
oifname
forward:
The default firewall ruleset for the zone will be appended after all from
configurations
To keep the behavior consistent with from ruleset configurations, a return is appended
after the default_firewall ruleset.
The proposed behavior differs slightly from the default_policy configuration for the
local out chains. The default_policy applied in the out templates comes from the local
zone, not the actual outbound zone. The proposed change does not amend this, but does
make default_firewall logically consistent with the intent of the out rules.
|
|
kea: T7925: Improve error handling, validate IPv6 PD prefix length
|
|
Solves the problem that vyos-configs in FRRender caches configuation and
DHCP changes are ignored.
* Add src/helpers/vyos-request-configd-update.py that requests vyos-configd
to update FRR configuration.
* Make dhclient hooks use it instead of calling protocols_static.py
* Make FRRender cache not only configuration but also DHCP gateways so
that is any of them changes, FRR configuration is updated
|
|
|
|
Execute commands for vpp sflow with API calls. Use values for polling interval and sampling rate from 'system sflow'. Add op-mode command
|
|
T5942: Make failover support dhcp-interface
|
|
T7930: VPP: Changing NAT44 settings resets `forwarding_enabled` to False
|
|
translation pool
|
|
Enable/disable NAT forwarding in vpp_nat.py script to prevent it's reset
|
|
|
|
T7897: VPP: fix rx-mode interrupt for XDP driver with workers
|
|
T7890: VPP fix verify_dev_driver
|
|
The verify_dev_driver must return bool value, but it a device
does not have PCI address (for example veth interface)
it returns Traceback
Fix this
|
|
T7750: VPP: CGNAT commit failure with vpptunX interface
|
|
Allow using bond interfaces in CGNAT. Improve interface cleanup to rely
on VPP API queries, as VPP config changes may modify interface indexes
|
|
* Refactor XML a little: move common dhcp-interface properties to
separate include file
* Add failover support for dhcp-interface
* Add test for DHCP in failover protocol
|
|
Remove no-syscall-lock from CLI and enable this option if interrupt/adaptive mode is enabled and workers are configured.
Also forbid interrupt mode for ixgbevf driver
|
|
T7887: system_option: Add validation for memory hugepage-count
|
|
image: T5455: Add migration of SSH `known_hosts` files during upgrade
|
|
T7803: Make failover route vrf-aware
|
|
* Added 'protocol failover' to 'set vrf name':
set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2
* Added vrf and interface to target:
set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue
set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1
Last two are needed when check VRF is not same as route VRF.
In this case icmp can use any/both options, tcp requires `vrf` and
arp requires `interface`
|
|
|
|
This reverts commit d871fe9c4c65de87232802ed54b263c9b2824391.
|
|
This reverts commit 85fe32f0e1a91a47fe4a6d4a5cdd6ac516dcc3b9.
|
|
This reverts commit 7da3fcc9b7306f2e241716aa26b518540f3e3471.
|
|
wlb: T7902: remove explicit calls to sudo
|
|
Move smoke test for hugepages to test_vpp.py
|
|
pki: T7885: check_port_availability() can't be used during system boot
|
|
Configuration mode scripts are executed under the context of vyos-configd or
vyos-commitd and thus do not need an explicit call to sudo. Permission handling
is done outside.
|
|
|
|
|
|
A call to check_port_availability() will always fail during system boot when
listen_address is set and the address is not yet assigned to an interface.
This happens b/c PKI subsystem is called prior to any inteface - e.g. ethernet -
and thus the OS will always be unable to bind() a socket() to a non existing IP
address.
|
|
T7884: VPP: dependency issue when set interface address and NAT44 address translation interface in one commit
|
|
translation interface in one commit
Moved dependencies for NAT to be executed after interfaces_ethernet, and
all settings for the interface (including interface address) have
already been applied
|
|
Add TLS support for remote syslog by extending the CLI and backend to support configuration of CA certificates, client certificates, keys, and authentication modes.
This update integrates with the PKI subsystem for certificate management, ensures proper validation of protocol settings when TLS is enabled, and generates secure rsyslog configuration for forwarding logs over TLS.
|
|
T7815: VPP: NAT44 rules with port requires protocol specification and vice versa
|
|
After commit 85fe32f0e ("bgp: T7760: remove per vrf instance system-as node")
BGP isntances running in a VRF will no longer have a system-as node set. This
results in "set vrf name <name> protocols bgp" becomeing a valid CLI path.
When reading in the config dict - we now might see {'protocols': {'bgp': {}}
as a valid entry. We do need to account for this empty dictionary.
|
|
During upgrade, the script now checks if any `known_hosts` files exist.
If so, it prompts the user to save these SSH fingerprints, and upon
confirmation, copies the files to the new image persistence directory.
|
|
|
|
T7862: VPP: Enable support of ixgbevf driver for DPDK
|
|
|
|
Some platforms do not have `vendor_id` for the CPU information
This causes of `KeyError: 'vendor_id'` errors while commiting
system option kernel memory settings.
Fix this.
|
|
bgp: T7760: remove per vrf instance system-as node
|
|
|
|
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
|
