| Age | Commit message (Collapse) | Author |
|---|
|
flowtable: T7350: Prevent interface deletion if referenced on flowtable
|
|
QoS: T7415: Fix tcp flags matching
|
|
Bridge: T7430: Add BPDU Guard and Root Guard support
|
|
|
|
Empty leaf nodes are cleaned, causing the tcp
ack and syn flags to not match. These values are exempted from being cleaned.
|
|
|
|
|
|
pppoe: T7463: Added restart if CoA is changed
|
|
Added a restart if CoA is changed
Added a restart if the authentication mode is changed
|
|
prometheus: T7435: Ensure only configured exporters are started
|
|
wireguard: T7387: Optimise wireguard peer handling
|
|
policy: T5069: large-community-list regex validator disallows whitespace
|
|
openconnect: T7287: VPN Openconnect does not check dictionary key se…
|
|
with authentication mode RADIUS
|
|
VPN IPsec unexpected passthrough logic bug was introduced in this
commit https://github.com/vyos/vyos-1x/commit/f480346bb8e934b1ce2e0fc3be23f7168273bba1
The correct behaviour of the `cidr_fit` was replaced with the
incorrect `overlap`
This way, the passthrough option is used every time when networks overlap.
```
>>> from ipaddress import ip_network
>>>
>>> a = ip_network('192.0.2.0/24')
>>> b = ip_network('192.0.2.100/30')
>>>
>>> a.overlaps(b)
True
>>>
>>> b.overlaps(a)
True
>>>
```
But there should be `subnet_of`:
```
>>> a.subnet_of(b)
False
>>>
>>> b.subnet_of(a)
True
>>>
```
In configuration it looks like
```
set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '192.0.2.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '192.0.2.100/30'
```
The StrongSwan unexpected configuration:
```
RIGHT-tunnel-0-passthrough {
local_ts = 192.0.2.0/24
remote_ts = 192.0.2.0/24
start_action = trap
mode = pass
}
```
So all outcoming traffic to the 192.0.2.0/24 pass through the main routing
table instead of out SA
Use `subnet_of` to fix this
|
|
CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>
set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>
set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface
show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
|
|
Added verification of the route-map existence in the vrf
route-leaking.
|
|
T7423: Add kernel boot options isolcpus, hugepages, numa_balancing
|
|
* Re-introduce the whitespace/pattern matches ' ' and '_' as allowed
* Perform a general Python regex validity check (not 100% 1003.2, but in combination
with allowedChars, pretty close)
* Introduce a warning against potentially malformed or over-complex patterns,
but leave it up to the user to resolve - there are plenty of useful
expressions we cannot validate easily
|
|
Add kernel options which apply during the boot:
- isolcpus
- nohz_full
- rcu_nocbs
- default_hugepagesz
- hugepages
- hugepagesz
- numa_balancing
- hpet
- mce
- nosoftlockup
- nmi_watchdog
CLI:
```
set system option kernel cpu disable-nmi-watchdog
set system option kernel cpu isolate-cpus '1,2,4-5'
set system option kernel cpu nohz-full '1,2,4-5'
set system option kernel cpu rcu-no-cbs '1,2,4-5'
set system option kernel disable-hpet
set system option kernel disable-mce
set system option kernel disable-softlockup
set system option kernel memory default-hugepage-size '2M'
set system option kernel memory disable-numa-balancing
set system option kernel memory hugepage-size 1G hugepage-count '2'
set system option kernel memory hugepage-size 2M hugepage-count '512'
```
|
|
nat66: T7051: snat group as destination
|
|
|
|
T7122: pki: unable to switch from custom cert to ACME when HAProxy service is running with 'redirect-http-to-https' option
|
|
This will add support for BPDU Guard and Root Guard to the bridge interface.
Verification will come from:
show log spanning-tree
|
|
When instructing certbot to listen on a given address, check if the address is
free to use. Also take this into account when spawning certbot behind HAProxy.
If the address is not (yet) bound - the request must be done in standalone mode
and not via the reverse-proxy.
|
|
When both the CLI PKI node for an ACME-issued certificate and HAProxy are
configured during initial setup, the certbot challenge cannot be served via the
reverse proxy because HAProxy has not yet been configured at all.
This commit introduces a special case to handle this bootstrap scenario,
ensuring that the certbot challenge can still be served correctly in standalone
mode on port 80 despite initial config dependencies/priorities between PKI
and HAProxy.
|
|
Some VyOS CLI nodes support defining multiple certificates. The previous check
when removing a certificate from the CLI only performed a string comparison,
which failed in cases where the underlying data was a list (CLI <multi/> node).
This update extends the check to handle both cases:
- If the datum is a string, perform a string comparison.
- If the datum is a list, check whether the target certificate is part of the
list.
This ensures proper removal behavior regardless of the data type used in the
CLI node.
|
|
This will wrap the messages at 72 characters in the same way as Warning() and
DeprecationWarning() would do. We now have simple wrappers for it!
Example:
vyos@vyos# commit
[ pki ]
Updating configuration: "load-balancing haproxy service frontend ssl
certificate LE_cloud"
Add/replace automatically imported CA certificate for "LE_cloud"
|
|
bgp: T7157: Fixed error with the unknown key in the verification
|
|
Always enable the ACL entry to reverse-proxy requests to the path
"/.well-known/acme-challenge/" when "redirect-http-to-https" is configured for
a given HAProxy frontend service.
This is an intentional design decision to simplify the implementation and reduce
overall code complexity. It poses no risk: a missing path returns a 404, and an
unavailable backend yields an error 503.
This approach avoids a chicken-and-egg problem where certbot might try to
request a certificate via reverse-proxy before the proxy config is actually
generated and active.
By always routing through HAProxy, we also eliminate downtime as port 80 does
not need to be freed for certbot's standalone mode.
|
|
T7412: Allow privileged containers
|
|
CLI:
```
set vpp nat cgnat interface outside <interface> # multi
set vpp nat cgnat interface inside <interface> # multi
set vpp nat cgnat rule <rule> outside-prefix <prefix>
set vpp nat cgnat rule <rule> inside-prefix <prefix>
set vpp nat cgnat timeout udp <sec> # default 300
set vpp nat cgnat timeout tcp-established <sec> # default 7440
set vpp nat cgnat timeout tcp-transitory <sec> # default 240
set vpp nat cgnat timeout icmp <sec> # default 60
```
OP mode:
```
show vpp nat cgnat interfaces
show vpp nat cgnat mappings
show vpp nat cgnat sessions
clear vpp cgnat inside-address <address> port <port> external-address <address> port <port>
```
|
|
T7364: Fixing Route reflector client check not working for peer-group
|
|
Fixed error with the unknown key in the verification
|
|
The apply stage calls systemctl reload-or-restart on the https server,
however, some settings require a restart or will silently fail, since
nginx drops privileges after start up.
Add flag when restart may be needed and check in apply stage.
|
|
Add CLI config node for "group" when configuring NAT66 source
Ensure there is only one group in NAT66 source rule config
Add smoketest to cover new group usage in source NAT66 rules
|
|
|
|
Automatically render HaProxy rules to reverse-proxy ACME challanges when the
requested certificate was issued using ACME.
|
|
|
|
If we detect that an ACME issued certificate is consumed by haproxy service,
we will move the certbot webserver to localhost and a highport, to proxy the
request via haproxy which is already using port 80.
|
|
changed_keys had the same content as the values inside the sync_translate
dictionary. Infact they were both used together do defined changed CLI keys.
The list for changed_keys is a list of all unique values inside the
sync_translate dict.
|
|
Commit 4523e9c897b3 ("wireguard: T3763: Added check for listening port
availability") added a function to check if a port is free to use or already
occupied by a different running service. This has been done by trying to bind a
socket to said given port.
Unfortunately there is no support for IPv6 address-fdamily in both
socketserver.TCPServer or socketserver.UDPServer. This must be done manually by
deriving TCPServer and setting self.address_family for IPv6.
The new implementation gets rid of both TCPServer and UDPServer and replaces it
with a simple socket binding to a given IPv4/IPv6 address or any interface/
address if unspecified.
In addition build time tests are added for the function to check for proper
behavior during build time of vyos-1x.
|
|
Add option to limit the number of messages that are displayed on the console
during the boot process and to persist this setting with image upgrades.
set system option kernel quiet
|
|
|
|
|
|
firewall: T7358: add offload option to global state policy
|
|
New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface> # multi
set vpp nat44 interface inside <interface> # multi
set vpp nat44 address-pool translation interface <interface> # multi
set vpp nat44 address-pool translation address <address> # multi
set vpp nat44 address-pool twice-nat interface <interface> # multi
set vpp nat44 address-pool twice-nat address <address> # multi
set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>
set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit> # default 64512
set vpp settings nat44 timeout udp <sec> # default 300
set vpp settings nat44 timeout tcp-established <sec> # default 7440
set vpp settings nat44 timeout tcp-transitory <sec> # default 240
set vpp settings nat44 timeout icmp <sec> # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```
|
|
T7316: Add MTU validation for interfaces with MTU less then 1200
|
|
syslog: T7367: ensure rsyslog is registered as default systemd syslog service
|
|
geoip: T5636: Add geoip for policy route/route6
|
