summaryrefslogtreecommitdiff
path: root/src/conf_mode
AgeCommit message (Collapse)Author
2023-04-20ocserv: T3896: refactor: change ocserv config-per-x node nameJamie Austin
Changes the node name from config-per-x to identity-based-config, as a result the j2 templates and vpn_openeconnect.py has been refactored to update the node name when accessing it's child nodes.
2023-01-26ocserv: T3896: add CLI options to configure ocserv config-per-user/groupJamie Austin
Adds CLI configurations under VPN - OpenConnect to facilitate per user/group vpn session configurations. Validation has been added to restrict config-per-group to be exclusive to OpenConnect RADIUS authentication as the config file is looked up based on a RADIUS response attribute - as well as sanity check that the necessary configs are configured when not disabled.
2023-01-25T1297: VRRP: add garp options to vrrpNicolas Fort
2023-01-22pppoe: T4948: add CLI option to allow definition of host-uniq flagChristian Breunig
Some ISPs seem to use the host-uniq flag to authenticate client equipment. Add CLI option in VyOS to allow specification of the host-uniq flag. set interfaces pppoe pppoeN host-uniq <value>
2023-01-21container: T4947: support mounting container volumes as ro or rwChristian Breunig
Whenever a container is used and a folder is mounted, this happenes as read-write which is the default in Docker/Podman - so is the default in VyOS. A new option is added "set container name foo volume mode <ro|rw>" to specify explicitly if rw (default) or ro should be used for this mounted folder.
2023-01-20Merge pull request #1767 from jestabro/config-mgmtJohn Estabrook
config-mgmt: T4942: rewrite vyatta-config-mgmt to Python/XML
2023-01-20config-mgmt: T4942: add conf_mode scriptJohn Estabrook
2023-01-19Merge pull request #1697 from nicolas-fort/snmp_reworkChristian Breunig
T4857: SNMP: Implement FRR SNMP Recomendations
2023-01-18T4857: change description in cli, and change word oid to uppercase OIDs in ↵Nicolas Fort
warning message
2023-01-18T4857: Cleaning prNicolas Fort
2023-01-17ifb: T4938: add Python implementation for input function block interfacesChristian Breunig
2023-01-15Merge pull request #1758 from c-po/t3008-chronyChristian Breunig
ntp: T3008: migrate from ntpd to chrony
2023-01-14systemd: T2185: always place generated override files in /runChristian Breunig
This prevents any stale override files when the system is beeing rebooted, but the actual configuration was not saved. /run is a tmpfs and thus always fresh after boot.
2023-01-14ntp: T3008: migrate from ntpd to chronyChristian Breunig
* Move CLI from "system ntp" -> "service ntp" * Drop NTP server option preempt as not supported by chrony
2023-01-13T4935: ospfv3: bugfix KeyError: 'range'Christian Breunig
Commit 1fc7e30f ('T4935: ospfv3: "not-advertise" and "advertise" conflict') added a check for not-advertive and advertise in the same area but lacked a test if the key really exists in the dict which is to be validated.
2023-01-12Merge pull request #1752 from sever-sever/T4118Christian Breunig
T4118: Add default value any for connection remote-id
2023-01-12T4118: Add default value any for connection remote-idViacheslav Hletenko
If IPsec "peer <tag> authentication remote-id" is not set it should be "%any" by default https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html#_connections_conn_remote Set XML default value in use it in the python vpn_ipsec.py script
2023-01-12T4935: ospfv3: "not-advertise" and "advertise" conflictYuxiang Zhu
They can't be set at the same time.
2023-01-11webproxy: T4927: Changed restart to reload-or-restart in commitaapostoliuk
Changed restart to reload-or-restart in commit. It allows to reload the config and not restart webporxy service during commit.
2023-01-09Revert "strongSwan: upgrade scripts to work with package version 5.9.8"Christian Poessinger
This reverts commit 6857447bf6acba3537d5e5372cd320aef078b81e.
2023-01-07Merge pull request #1728 from aapostoliuk/T4877-sagittaChristian Breunig
T4877: Added more checks if "import vrf" is used in bgp
2023-01-06T4877: Added more checks if "import vrf" is used in bgpaapostoliuk
1. Fixed: If rd and route-target are used in VRF, can not use "import vrf" in the same VRF in the same AFI/SAFI. 2. Fixed: If rd and route-target is used in VRF, this VRF can not be in the list of command "import vrf" in the same AFI/SAFI but in other VRFs. 3. Fixed: Do not allow to delete vrf if it is used in import list of other vrfs. 4. Added smoketests to check "import vrf" issues.
2023-01-06static: T4883: fix KeyError: 'table'Christian Poessinger
Commit dafb0da2 ("static: T4883: add a description field for routing tables") added an iproute2 description table but lacked checking if the key exists. This has been fixed and also converted to Jinja2 to keep the "common" style inside the routing protocols. It might feel overengineered indeed.
2023-01-05qos: T4284: priority-queue and round-robin have no default bandwidthChristian Poessinger
2023-01-05Merge pull request #1710 from dmbaturin/routing-table-descriptionsChristian Breunig
T4883: add a description field for routing tables
2023-01-04ssh: T2651: extend verify() when both source-address and source-interface is ↵Christian Poessinger
used We need to ensure that source-address is assigned on source-interface before applying the configuration, else SSH client will have a hard time talking to someone.
2023-01-04ssh: T2651: add source-interface support ssh-clientChristian Poessinger
2023-01-04ssh: T2651: use Debian style include directve for ssh_config.dChristian Poessinger
Commit 846e306700a ("ssh: T2651: add cli options for source address") added support for a basic SSH client option, but it grabbed the entire /etc/ssh/ssh_config file without the ability to make custom user adjustments via the /etc/ssh/ssh_config.d/ folder. This vommit places the VyOS SSH options under /etc/ssh/ssh_config.d/ leaving the common override system alive.
2023-01-04qos: T4284: replace qdisc/class instead of always adding itChristian Poessinger
This makes transitions/updates faster and less error prone
2023-01-04Merge pull request #1735 from sever-sever/T4904Viacheslav Hletenko
T4904: keepalived virtual-server allow multiple ports with fwmark
2023-01-02xml: qos: T4284: fix DSCP CLI valuesChristian Poessinger
2023-01-02T4904: keepalived virtual-server allow multiple ports with fwmarkViacheslav Hletenko
Allow multiple ports for high-availability virtual-server The current implementation allows balance only one "virtual" address and port between between several "real servers" Allow matching "fwmark" to set traffic which should be balanced Allow to set port 0 (all traffic) if we use "fwmark" Add health-check script set high-availability virtual-server 203.0.113.1 fwmark '111' set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check script '/bin/true' set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '0'
2023-01-02Merge pull request #1725 from sever-sever/T4893Christian Poessinger
T4893: Add ppp-options ipv6-interface-id for L2TP
2023-01-01qos: T4284: first implementation introducing a new vyos.qos moduleChristian Poessinger
2022-12-30T4893: Add ppp-options ipv6-interface-id for L2TPViacheslav Hletenko
Add ppp-options IPv6 interface id for vpn L2TP - fixed or random interface identifier for IPv6 - peer interface identifier for IPv6 - whether to accept peer’s interface identifier set vpn l2tp remote-access ppp-options ipv6-accept-peer-intf-id set vpn l2tp remote-access ppp-options ipv6-intf-id 'random' set vpn l2tp remote-access ppp-options ipv6-peer-intf-id 'calling-sid'
2022-12-30T4897: Fix virtual interface rebuild checksYuxiang Zhu
`leaf_node_changed` returns `[]` (empty list) after a leaf node is added. e.g. Setting `source-interface` doesn't work on an existing vxlan interface. Steps to reproduce: - Add a vxlan interface without `source-address` or `source-interface` options set: ``` set interfaces vxlan vxlan999 vni 999 set interfaces vxlan vxlan999 remote 192.168.100.100 commit ``` - Then set `source-address` or `source-interface`: ``` set interfaces vxlan vxlan999 source-interface eth0 commit ``` Actual result: Source address or source-interface are not set: ``` ip -d link show dev vxlan999 76: vxlan999: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/ether 56:08:ba:4d:4e:a8 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 vxlan id 999 remote 192.168.100.100 srcport 0 0 dstport 8472 tos inherit ttl 16 ageing 300 udpcsum noudp6zerocsumtx noudp6zerocsumrx addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 ``` Expected result: ``` 77: vxlan999: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/ether 9e:05:d9:58:1a:af brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 vxlan id 999 remote 192.168.100.100 dev eth0 srcport 0 0 dstport 8472 tos inherit ttl 16 ageing 300 udpcsum noudp6zerocsumtx noudp6zerocsumrx addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 ``` All invocations of leaf_node_changed() should be migrated to is_node_changes() if you are only interested in if something changed and don‘t care what exactly changed (content).
2022-12-30pseudo-ethernet: T4391: use is_node_changed() over error prone ↵Christian Poessinger
leaf_node_changed() We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-30tunnel: T4391: use is_node_changed() over error prone leaf_node_changed()Christian Poessinger
We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-30geneve: T4366: use is_node_changed() over error prone leaf_node_changed()Christian Poessinger
We only need to use leaf_node_changed() if we are interested in the detailed change to a CLI node (what was the previous content). If we are only interested in if a node changed "at all" is_node_changed() should be used.
2022-12-27strongSwan: upgrade scripts to work with package version 5.9.8Christian Poessinger
2022-12-26static: T4883: add a description field for routing tablesDaniil Baturin
2022-12-25container: T2216: use defaultValue XML definition to define port protocolChristian Poessinger
Instead of hardcoding the default protocol as TCP in the Python script we shall use the XML based defaultValue approach instead. This also automatically exports the default to the CLI completion helper.
2022-12-25container: T2216: add verify() for port definitionChristian Poessinger
If port is specified on the CLI so must be source and destination under the port node.
2022-12-23pki: T4847: extend dependency on sstpc client interfaceChristian Poessinger
2022-12-17sstp: T4384: remote server is mandatory in client modeChristian Poessinger
2022-12-17bonding: T4878: use more is_node_changed() over leaf_node_changed()Christian Poessinger
The implementation of is_node_changed() is less error prone and should always be favoured.
2022-12-17Merge pull request #1626 from nicolas-fort/fwall_group_interfaceChristian Poessinger
T4780: Firewall: add firewall groups in firewall. Extend matching cri…
2022-12-17webproxy: T3810: multiple squidGuard fixesaapostoliuk
1. Added in script update webproxy blacklists generation of all DBs 2. Fixed: if the blacklist category does not have generated db, the template generates an empty dest category in squidGuard.conf and a Warning message. 3. Added template generation for local's categories in the rule section. 4. Changed syntax in the generation dest section for blacklist's categories 4. Fixed generation dest local sections in squidGuard.conf 5. Fixed bug in syntax. The word 'allow' changed to the word 'any' in acl squidGuard.conf
2022-12-17Merge pull request #1358 from sever-sever/T1237Christian Poessinger
routing: T1237: Add new feature failover route
2022-12-15bonding: T4878: Fixed unnecessary bonding flapping during commitzsdc
There was a mistake in a config level that caused triggering the `shutdown_required` flag, even if there were no new interfaces added to a bonding. This commit sets the proper config level to avoid the problem.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-20 15:54:15 +0000